Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Device Login and Initial Configuration

Learn how to perform the initial software configuration for SRX1600, SRX4120, and SRX4300 Firewalls.

Physical Setup Before Initial Configuration

To prepare an SRX1600, SRX4120, or SRX4300 Firewall for initial configuration, complete the physical installation before accessing the device through the Junos OS CLI.

Before performing initial software configuration:

  1. Unpack and rack-mount the devices using the provided brackets and rails.

  2. Ground the chassis with an AWG grounding cable to an earth ground point. For more information, refer to Hardware Compatibility Tool.

  3. Connect power supplies (AC or DC) and cables to external devices, ensuring proper routing to avoid hazards.

  4. Power on the device and verify startup.

Perform Initial Software Configuration

After you've physically installed the devices, use HPE Networking Security Director Cloud (if licensed), J-Web, or the Junos CLI to perform the initial software configuration.

  • HPE Networking Security Director Cloud: Claim and onboard a device using HPE Networking Security Director Cloud portal for automated setup. Ensure you have a valid HPE Networking Security Director Cloud license. For license information, see Software Licenses for Security Director.

  • J-Web GUI: J-Web GUI on firewalls uses the default fxp0 management interface IP (typically 192.168.1.1) for initial access. Use the Setup Wizard in standalone mode (SA mode) to configure the key settings like root password, hostname, management interface, zones, DNS, and gateways. Follow the instructions in Access the J-Web User Interface to start and access the J-Web UI for device configuration.

  • Junos OS CLI: Connect to the device through the console port and log in as the root user. On factory-default devices, the root account has no password. Start the Junos OS CLI by entering the cli command.

    For example:

    Exit shell mode: If you are in the shell environment (bash or Unix shell), enter exit or cli to return to operational CLI mode (prompt: root@SRX1600, SRX4120, and SRX4300>).

    Enter configuration mode:

Initial Software Configuration Using Junos OS CLI

To perform initial software configuration on your firewall:

  1. Connect a management device to the console port CON on your firewall chassis using an RJ-45 connector.

    The console port (CON) provides an RS-232 serial interface through an RJ-45 connector, and the default baud rate is 9600 bit/s (baud). For more information, see Interface Types and Configurations.

    You might need an adapter depending on your management console type:

    • RJ-45 to USB-A adapter (JNP-CBL-RJ45-USBA)

    • RJ-45 to USB-C adapter (JNP-CBL-RJ45-USBC)

    Tip: If your laptop or desktop PC doesn't have a serial port, use a serial-to-USB adapter (not provided). If you are using USB adapters, install the X64 (64-Bit) virtual COM port (VCP) driver on your PC. See https://ftdichip.com/drivers/vcp-drivers/ to download the driver.

  2. Power on the device and wait for it to boot. The software boots automatically. When the boot process is complete, you'll see the login: prompt on the console.

  3. Log in as the root user and start the CLI.

    The root user account password is not preconfigured and must be set during the initial setup and commit. The device prompt root@% indicates that you are the root user.

  4. Revert the device to its original factory‑default state.

  5. Set root password and management interface and commit from the CLI. This secures the root account and enables remote access.

    Note:

    The SRX1600, SRX4120, and SRX4300 Firewalls support cleartext password, encrypted password, SSH public key (DSA, RSA, ECDSA, or ED25519), and Quantum Buffer for SSH.

    Learn how to Protect Network Security by Configuring the Root Password.

  6. Configure remote access.

    Remote management access to the device and all management access protocols such as Telnet and FTP are disabled by default.

  7. Enable SSH service.

    • Configure root authentication and optionally enable SSH root login during initial setup.

      Note: Factory-default setup allows initial root login through console (no password required)

    • Create a new user (for example, admin user with superuser privileges).

      In Junos OS, the root user cannot log in through SSH by default. To explicitly allow it, you must enable root login over SSH using the set system services ssh root-login allow command.

      After a separate user account has been created, this setting can be safely removed.

    • Disable root login through SSH. After you confirm, the new admin user can login through SSH:

  8. Configure the IP address and prefix length for the management interface (fxp0).

    After assigning the address, configure a default route for out‑of‑band management (OOBM):

SZTP Onboarding Using HPE Mist

The SRX1600, SRX4120, and SRX4300 Firewalls support cloud-based onboarding through HPE Mist using Secure Zero-Touch Provisioning (SZTP). SZTP enables rapid initial setup by claiming the device with a QR code, typically through the Mist AI mobile app or the HPE Mist web portal, with no preconfiguration required on the device.

Prerequisites

  • Your firewall must be unpacked, installed in a rack, properly grounded, and powered on (connect the DC or AC power feeds to the PSUs using correct polarity and circuit protection).

  • An HPE Mist account with an organization created. For instructions on creating an HPE Mist account and organization, see Create Your Account.

  • Access to the QR code and alphanumeric claim code printed on your firewall chassis (used for single-device onboarding).

SZTP Onboarding Using the Mist AI Mobile App (Recommended For Single-Device Deployments)

  1. Download the Mist AI mobile app from Google Play or the Apple App Store, and sign in to your Mist organization.

  2. Tap Claim Devices to Org, and then scan the QR code on the firewall chassis.

    The device is automatically claimed into your inventory.

  3. Navigate to Organization > Inventory > WAN Edges > Unassigned.
  4. Select the firewall and assign it to the Primary Site.

SZTP Onboarding Using the HPE Mist Web Portal (Recommended For Single Or Bulk Device Onboarding)

  1. Log in to https://manage.mist.com/and go to Organization > Inventory > WAN Edges > Claim WAN Edges.

  2. Enter the claim code from the QR label (single device) or an activation code (multiple devices from a purchase order).
  3. Enable Assign claimed WAN Edges to site, select the Primary Site, and enable Manage configuration with HPE Mist.
  4. Set a root password, then click Claim.

  5. Verify that the device appears in the inventory.

    The status initially shows Disconnected until the device completes its cloud connection.

Post‑Onboarding Configuration

  • Use HPE Networking Security Director Cloud (if licensed) for centralized policy and security configuration.
  • Use J-Web for basic or custom configuration, such as management interface setup and authentication.
  • Alternatively, perform additional configuration through the Junos OS CLI, including root authentication and management access.
  • Activate required feature licenses by following the Juniper Licensing Guide.

Related Documentation