Performing Initial Software Configuration on the SRX210 Services Gateway Using the CLI
This procedure connects the device to the network but does not enable it to forward traffic. For complete information about enabling the device to forward traffic, including examples, see the appropriate Junos OS configuration guides.
To configure the software:
- Verify that the device is powered on.
- Log in as the root user. There is no password.
- Start
the CLI.root# cliroot@>
- Enter
configuration mode.configure[edit]root@#
- Set the
root authentication password by entering a cleartext password, an
encrypted password, or an SSH public key string (DSA or RSA).[edit]root@# set system root-authentication plain-text-passwordNew password: passwordRetype new password: password
- Configure
an administrator account on the device.[edit]root@# set system login user admin class super-user authentication plain-text-password
- Commit the
configuration to activate it on the device.[edit]root@# commit
- Log in as the administrative user you configured in Step 6.
- Configure
the name of the device. If the name includes spaces,
enclose the name in quotation marks (“ ”).configure[edit]admin@# set system host-name host-name
- Configure the traffic interface.[edit]admin@# set interfaces ge-0/0/1 unit 0 family inet address address/prefix-length
- Configure
the default route.[edit]admin@# set routing-options static route 0.0.0.0/0 next-hop gateway
- Configure
basic security zones and bind them to traffic interfaces.[edit]admin@# set security zones security-zone untrust interfaces ge-0/0/1
- Configure
basic security policies.[edit]admin@# set security policies from-zone trust to-zone untrust policy policy-name match source-address any destination-address any application anyadmin@# set security policies from-zone trust to-zone untrust policy policy-name then permit
- Create a NAT rule for source translation of all
Internet bound traffic.[edit]admin@# set security nat source rule-set interface-nat from zone trustadmin@# set security nat source rule-set interface-nat to zone untrustadmin@# set security nat source rule-set interface-nat rule rule1 match source-address 0.0.0.0/0 destination-address 0.0.0.0/0admin@# set security nat source rule-set interface-nat rule rule1 then source-nat interface
- Check
the configuration for validity.[edit]admin@# commit checkconfiguration check succeeds
- Commit
the configuration to activate it on the device.[edit]admin@# commitcommit complete
- Optionally, display the configuration to verify that it
is correct.[edit]user@host# showsystem {host-name devicea;domain-name lab.device.net;domain-search [ lab.device.net device.net ];backup-device 192.168.2.44;time-zone America/Los_Angeles;root-authentication {ssh-rsa "ssh-rsa AAAAB3Nza...D9Y2gXF9ac==root@devicea.lab.device.net";}name-server {10.148.2.32;}services {}ntp {server 10.148.2.21;}}interfaces {ge-0/0/0 {unit 0 {family inet {address 192.168.1.1/24;}}}lo0 {unit 0 {family inet {address 172.16.1.24/32;}}}}
- Commit the configuration to activate it on the device.[edit]admin@# commit
- Optionally, configure
additional properties by adding the necessary configuration statements.
Then commit the changes to activate them on the device.[edit]admin@host# commit
- When you have finished configuring the device,
exit configuration mode.[edit]admin@host# exitadmin@host>