NetScreeny a Fortinet (diskuse)

chassis a backup router: set system backup-router [address-of-nexthop-on-fxp0] destination [network-that-ntp-and-mgmt-is-in]
KB 13428: Difference in chassis cluster support between JUNOS-ES and SRX
KB 15356: How are interfaces assigned on J-Series and SRX platforms when Chassis Cluster is enabled?
KB 15504: SRX Getting Started - Configure Chassis Cluster (High Availability) on a SRX240 device
KB 15439: How do I verify chassis cluster nodes are configured and up on J-Series and SRX?
KB 16141: What are the minimum hardware and software requirements for a Chassis Cluster (JSRP) on SRX?
KB 17161: Cannot manage SRX via fpx0 in chassis cluster
KB 17410: Copy a file from one node to the other node in a JSRP Chassis Cluster
KB 18181: How to add SRX Chassis Cluster into NSM
KB 19938: How to schedule upgrade reboot with SRX Chassis Cluster
KB 20554: Copy OS from primary partition to secondary partition in Chassis Cluster
KB 20641: Troubleshooting steps when the Chassis Cluster does not come up
KB 20672: Troubleshooting steps if the Chassis Cluster is in Primary/Lost State
KB 20673: How to verify that Chassis Cluster in Primary/Secondary State has proper priority
KB 20687: Troubleshooting steps to correct a Fabric Link that is down in a Chassis Cluster
KB 20697: Troubleshooting steps if the Chassis Cluster is in Primary/Disabled State
KB 20795: How-to's and troubleshooting articles for managing a Chassis Cluster
KB 20861: How can I automatically trigger failover of redundancy-group 0 and redundancy-group 1 at the same time on a Chassis Cluster?
KB 20987: Troubleshooting Chassis Cluster Redundancy Group not failing over
KB 21050: Unable to get logs to NSM from Chassis Cluster in stream mode logging
KB 21113: Can't manage Chassis Cluster (High Availability)
KB 21145: After setting up SRX650 Chassis Cluster, how can the last remaining onboard port ge-0/0/3 be used for both LAN and WAN links?
KB 21647: Unable to Process More Than 4 Queues per RETH Interface on SRX High End Devices in a Chassis Cluster
KB 22431: How to use the local interface in a chassis cluster
KB 22679: How to prepare a standalone SRX system to join another SRX system configured for chassis cluster (using USB snapshot)
KB 23862: How to enable/disable Fabric Monitoring

TN 81: Junos NAT Configuration Examples Refer to the following Application Note for several configuration examples of how to configure NAT (Source NAT, Destination NAT, Double NAT, and Static NAT)
TN 25: Configuring (NAT) on SRX and J Series devices for ScreenOS Users
KB 10139: How to determine if the Source and Destination Address Translation is correct on a J Series or SRX Series device
KB 13427: What is the total number of sessions supported for source nat pool with PAT on SRX?
KB 14194: What are the NAT rule limits in on SRX and J-series routers?
KB 15694: SRX Getting Started - Configuration Examples & Troubleshooting (JumpStation) - *obecné rozcestí*
kB 15758: SRX Getting Started - Configure NAT
KB 16252: Troubleshooting NAT in SRX series
KB 16710: How to define packet filters for NAT traffic?
KB 17448: Accessing a Static NAT from inside your network
KB 17525: Can you configure NAT rules on traffic for policy-based VPNs on SRX or J-Series gateways?
KB 17855: SRX: In "cluster" (HA) environment, the "nat source" with "port no-translation" works differently
KB 19400: SRX: Configuration Example: How to access Internal Resources using the external Static NAT address
KB 19459: SRX: DNS queries will not resolve names when Persistent NAT is enabled
KB 20711: SRX: Scenarios to clarify definition of address-persistent vs persistent-nat
KB 21296: SRX: Configuration Example -- Persistent NAT (Formerly Cone NAT)
KB 21547: SRX: Does NAT provide support for traffic processed by 'Selective stateless packet-based services'?
KB 21611: Resolution Guide - SRX - Troubleshoot Source NAT
KB 21697: SRX: NAT is not working for device in Junos Packet Mode
KB 21709: SRX: Verify Source NAT Rules are in order and working correctly
KB 21719: How to check and interpret the Flow Sessions installed in the SRX when troubleshooting NAT
KB 21757: SRX: How to interpret Flow TraceOptions output for NAT troubleshooting
KB 21783: SRX: Example - Checking and reordering NAT rules
KB 21785: SRX: When and how to configure Proxy ARP
KB 21839: Resolution Guide – SRX - Troubleshoot Destination NAT
KB 21872: SRX: Example Firewall Filter used to count the number of incoming packets
KB 21886: SRX: Verify Destination NAT Rules are in order and working correctly
KB 21892: Resolution Guide – SRX - Troubleshoot Static NAT
KB 21918: SRX: Verify Static NAT Rules are being used
KB 21922: Resolution Guides and Articles - SRX - NAT ... This article provides links to the Resolution Guides and articles for troubleshooting NAT on a SRX device
KB 22059: SRX: Anti-virus is not working when persistent NAT is enabled
KB 22178: SRX: The ALG for IKE and ESP is not applied to the traffic
KB 24709: SRX: Ping to proxy ARP address does not work after 11.2R1

KB 16224: How to forward Syslogs from SRX to STRM
KB 16448: Sending logs to NSM from SRX devices
KB 16502: SRX Getting Started - Configure System Logging
KB 16509: SRX Getting Started - Configure Traffic Logging (Security Policy Logs) for SRX Branch Devices
KB 16643: How to configure High-End SRX devices to send traffic logs to NSM
KB 21450: New knob allow-duplicates added in syslog hierarchy
KB 21501: Security log hostname is not the same as the primary node hostname
KB 22193: Syslog timestamp generated by High-End SRX is wrong
KB 22281: Syslog rotation time has been changed in 10.4R7

KB 12142: SNMP monitoring of CPU utilization not working when in JSRP cluster mode
KB 16545: SRX Getting Started - Configure SNMP Agent
KB 20788: "snmpwalk" of ifDescr is not returning the same values after upgrading from Junos 10.1 to 10.2
KB 22048: How to configure SNMPv3 on SRX

KB 4394: How Do I View the Juniper Networks NSM Error Logs?
KB 4503: NSM Log Management
KB 4514: Transferring an NSM Database From One System to Another
KB 4548: Why Does a Firewall Device Fail to Connect to the NSM Server?
KB 4594: How Do I Run the NSM Processes as a Non-Root User?
KB 4649: Clearing the Email Queue From NSM GUI Server
KB 5096: How To determine NSM software version
KB 7115: How To: Generate a Core Dump on NSM Server When System Problem Occurs
KB 8580: Can NSM send a trap to an SNMP manager when a firewall disconnects from NSM?
KB 9002: Changing the NSM update timeout in High Latency Network
KB 9313: devSvrDbSvr shows as Off when checking the status of the devSvr process
KB 9692: How do I change the IP Address of NSM Server?
KB 9840: How to enable debug mode for NSM processes
KB 9844: NSM directive fails with a Java error message similar to"java null.pointer.exception error"
KB 9851: Where can I find the related error logs when processing directives in NSM?
KB 10375: How to backup a current NSM install
KB 11015: What is the directory /var/netscreen/DevSvr/.latest-db-backup in NSMxpress?
KB 11016: NSM Gui Server does not communicate with Device Server
KB 11257: Obtain logging rate of devices to NSM
KB 11263: Proper order for starting and stopping NSM services
KB 11267: NSM: What is the role of the DevSvr/misc/action/sp directory?
KB 11476: How to backup NSM: Taking a snapshot of NSM
KB 11714: NSM: devSvr will not start. devSvrDbSvr fails to start and no new errorLogs are written in errorLogs
KB 11731: How to Export and Import the NSM database in 2007.1r3 and higher to remove audit logs, old database versions or shrink the database
KB 11829: NSM DevSvr processes names, definitions, and error logs filenames
KB 11830: NSM HaSvr processes names, definitions, and error logs filenames
KB 11598: NSM: how to move an NSM standalone server to a distributed configuration
KB 12173: NSM installation Package does not give you the MENU choice to upgrade DevSvr/GuiSvr or both
KB 12285: Three methods of creating a Database backup from the command line interface for NSM
KB 12367: Can't import device in NSM; stuck in Pending state.
KB 12707: Understanding NSM Log Management
KB 12891: How to clear blocked IP addresses from NSM backend ... tip na spuštění /usr/netscreen/GuiSvr/utils/.xdbViewEdit.sh
KB 13121: NSM: Protocol not enabled 81000102
KB 13523: How to check the upgrade history of an NSM server
KB 14868: Export NSM logs to CSV file from the NSM CLI
KB 14938: NSM - How to adjust retry settings and timeout for JUNOS software upgrade.
KB 15196: NSM Daily backups fail on Secondary Server
KB 15643: NSM: Restoring a Database from a Tech-Support
KB 16166: Where are packet captures stored on the NSM server?
KB 16655: NSM - Meaning of Red Triangle Error - "Could not get day list"
KB 17268: Meaning of deviceDaemon.0: "Error 4477856-nsDdNspServer.c:896 GSP message size 16388 > 16384: IDP -> NSM message"
KB 17358: How to relocate device logs on NSM server to a different directory
KB 21050: Unable to get logs to NSM from Chassis Cluster in stream mode logging
KB 22703: JTAC Recommended NSM (Network & Security Manager) Software Versions

KB17292 - Dynamic VPN Check license usage & install license
KB17220 - Dynamic VPN Troubleshoot Dynamic VPN client that is not working (Start here)
KB17232 - Dynamic VPN Access Manager client is 'Disconnected'
KB17335 - Dynamic VPN Access Manager client gets 'Authentication Failure: Incorrect Credentials' error
KB17337 - Dynamic VPN Configuration example using FreeRADIUS
KB17660 - Dynamic VPN Access Manager client is connected, but can't get to protected resources
KB17344 - Dynamic VPN Access Manager client gets 'Authentication Failure: No Configuration Available'
KB17455 - Dynamic VPN Access Manager client gets 'No configuration for user'
KB17453 - Dynamic VPN 'IKE Negotiations Failed' reported on Access Manager client
KB17439 - Dynamic VPN Access Manager client gets no error and the 'Connection result:' field is blank (hangs) when attempting to connect to the SRX

WebUI ukládá konfiguraci automaticky
CLI:
get config - výpis konfigurace
get sys-cfg - another hidden command
save config to tftp - uložení konfigurace na tftp
save software from flash to tftp
secure copy - kopírování skrze scp
set scp enable
get scp
get file
get system
get system > tftp .
exec vfs ls flash:/*
delete file flash:jmeno
clear session
get session
get session | include 192.168.1.1*
reset
get log event
get envar
get vrouter
get admin user
set admin password password priviliege _what_
set admin root access console
set admin access attempts 2
set admin auth banner telnet login "Authorized users only All actions are logged!!!"
get console
set console timeout 5
get user
get auth
set admin auth timeout 5
set/unset admin manager-ip _ipaddress_
exec tftp 123.123.123.100 cert-name newcertifikat.cet
set ssl encrypt 3des sha-1
unset interface untrust manage ping|snmp|telnet
set admin port 32000
set admin ssh port 1024
save config to last-known good
exec config rollback enable
unset/set admin device-reset
unset/set admin hw-reset
get zone
set flow tcp-syn-check
get interface trust port phy
get route
get route v6
get route prefix A.B.C.D/E
get route | exclude /32
get route id X
set vrouter trust-vr route 0.0.0.0/0 vrouter untrust-vr
set address V1-trust my-pc 1.1.1.11/32
set policy from V1-trust do V1-untrust my-pc host-2 any permit
set policy id 5
set src-address negate ...
set policy (from zone to zone sa da service action) auth
set route IP/mask interface ifname gateway gw_
set ntp timezone -5
set clock ntp
exec ntp update
set interface ethernet2 dhcp server auto
set interface untrust phy full
set int tru manage ssh
unset int tru manage telnet
set int phy link-down
set interface ethernet2 dhcp server ip 10.7.0.50 mac 123412341234
set domain moje.domena
set dns host dns1 2.33.2.11
set interface e1 nat
set ike gateway "dallas" address 10.11.12.1 main outgoing-interface eth0/0 preshare juniper123
set ike gateway "dallas" address 10.11.12.1 main outgoing-interface eth0/0 preshare juniper123 sec-level standard
get ike p1-sec-level
set ike p1-proposal custom1 pre group5 esp aes256 sha seconds 12800
set ike p1-proposal custom1 pre group5 esp aes256 sha days 7
set ike gateway "corp" address 10.140.0.3 Aggressive local-id s1 denton@xyzcorp.com" outgoing-interface "ethernet0/0" preshare jun
get sa
get db info
get sys-cfg | inc dbuf
get mem
clear dbuf
get db stream > tftp 10.251.7.113 login_debug.txt
get log event > tftp 10.251.7.113 eventlog.txt
set ffilter dst-ip 10.10.10.1 ip-proto 6 dst-port 23
snoop filter ip src-ip 10.10.10.1 src-port 23
unset all
debug: set ff src-ip X.X.X.X set ff dst-ip X.X.X.X (X is the IP of your server) clear dbuf debug flow basic undebug all get db str

Ty nejhlubší objevy nečekají nutně za příští hvězdou. Jsou uvnitř nás utkány do vláken, která nás spojují, nás všechny.