Device Login and Initial Configuration
This topic provides essential information to help you get started with the SRX4700 Firewall. It guides you through the initial setup tasks required to bring the firewall online and ready for configuration using the Junos OS CLI.
Physical Setup Before Initial Configuration
Getting started with SRX4700 Firewall configurations begins with initial setup using Junos OS CLI, after physical installation.
Before performing initial software configuration:
Unpack and rack-mount the SRX4700 Firewall using the provided brackets and rails.
Ground the chassis with a 6 AWG grounding cable to an earth ground point.
Connect power supplies (AC or DC) and cables to external devices, ensuring proper routing to avoid hazards.
Power on the device and verify startup.
Perform Initial Software Configuration
After you've physically installed the SRX4700 Firewall device, use Juniper Security Director Cloud (if licensed), J-Web GUI, or the Junos CLI to perform the initial software configuration.
Perform the initial software configuration using any of these methods:
-
Juniper Security Director Cloud: Claim and onboard a device using Juniper Security Director Cloud (SD Cloud) portal for automated setup (you must have a valid license):
-
J-Web GUI: J-Web GUI on Juniper SRX Series devices uses the default fxp0 management interface IP (typically 192.168.1.1) for initial access. Use the Setup Wizard in standalone mode to configure the key settings like root password, hostname, management interface, zones, DNS, and gateways. Follow the instructions in Access the J-Web User Interface to how to start and access the J-Web user interface to configure your device.
-
Junos OS CLI: Connect through the console. Log in as
root(default has no password on factory-default devices) and start the CLI with theclicommands.For example:
Exit shell mode: If in shell (
bashor Unix shell), typeexitorclito return to operational CLI mode (prompt:root@srx4700>). Enter configuration mode:cli configure #This enters configuration mode (prompt: root@srx4700#) set system root-authentication plain-text-password set interfaces fxp0 unit 0 family inet address <IP>/<prefix> set routing-options static route 0.0.0.0/0 next-hop <gateway> commit
Initial Software Configuration
To perform initial software configuration on the SRX4700 Firewall:
Connect a management device to the console port CON on the SRX4700 Firewall chassis using an RJ-45 connector.
The console port (CON) uses an RS-232 serial interface with an RJ-45 connector, and the default baud rate is 9600 bit/s (baud). For more information, see Interface Types and Configurations
You might need an adapter depending on your management console type:
RJ-45 to USB-A adapter (JNP-CBL-RJ45-USBA)
RJ-45 to USB-C adapter (JNP-CBL-RJ45-USBC)
Note: If your laptop or desktop PC doesn't have a serial port, use a serial-to-USB adapter (not provided). If you are using USB adapters, install the X64 (64-Bit) virtual COM port (VCP) driver on your PC.Log in as the root user and start the CLI.
rootlogin: rootInitially, you won't need a password for the root user account. The device prompt
root@%indicates that you are the root user.root@% cliroot@>configureroot@> configure[edit]root@#Power on the device and wait for it to boot. The software boots automatically. When the boot process is complete, you'll see the login: prompt on the console.
login:Set root password and management interface and commit from the CLI. This secures the root account and enables remote access.
configure set system root-authentication plain-text-password [Enter new password twice] set interfaces fxp0 unit 0 family inet address <management-IP>/<mask> # for example, 192.168.1.10/24 user@host# commit
Note:The SRX4700 Firewall supports cleartext password, encrypted password, and SSH public key (DSA or RSA).
Learn how to Protect Network Security by Configuring the Root Password.
If you need to revert the device to its original factory‑default state:
load factory-defaultcommitConfigure remote access.
Remote management access to the device and all management access protocols such as Telnet and FTP are disabled by default.
Enable SSH service.
Configure root authentication and optionally enable SSH root login during initial setup.
Note: Factory-default setup allows initial root login through console (no password required)set system services ssh
Create new user (for example, admin user with superuser privileges).
In Junos OS, the root user cannot log in through SSH by default. To explicitly allow it, you must enable root login over SSH using the
set system services ssh root-login allowcommand.After a separate user account has been created, this setting can be safely removed.
set system root-authentication plain-text-password set system login user <username> class super-user authentication plain-text-password set system services ssh root-login allow # Optional: Enable SSH for root commit
Disable root login through SSH. After you confirm, the new admin user can SSH in:
delete system services ssh root-login commit [edit] delete system services ssh root-login [edit system services ssh] show # (root-login statement is now gone)
Configure the IP address and prefix length for the management interface (fxp0).
set interfaces fxp0 unit 0 family inet address <address/prefix-length>After assigning the address, configure a default route for out‑of‑band management:
set routing-options static route 0.0.0.0/0 next-hop <gateway>commitSee SRX4700 Firewall Hardware Guide for instructions on how to connect to the management port.
SRX4700 Firewall Initial Configuration Using Secure Zero Touch Provisioning (SZTP)
The SRX4700 Firewall supports cloud-based onboarding through Juniper Mist using SZTP. SZTP enables rapid initial setup by claiming the device with a QR code, typically through the Mist AI mobile app or the Mist web portal, with no preconfiguration required on the device.
- Prerequisites
- SZTP Onboarding Using the Mist AI Mobile App (Recommended For Single-Device Deployments)
- SZTP Onboarding Using the Mist Web Portal (Recommended For Single Or Bulk Device Onboarding)
- Post‑Onboarding Configuration
Prerequisites
- The SRX4700 Firewall must be unpacked, racked, grounded, and powered on (connect DC or AC power feeds to the PSUs using correct polarity and circuit protection).
- A Juniper Mist account with an organization already created.
- Access to the QR code and alphanumeric claim code printed on the SRX4700 Firewall chassis (used for single-device onboarding).
SZTP Onboarding Using the Mist AI Mobile App (Recommended For Single-Device Deployments)
- Download the Mist AI mobile app from Google Play or the Apple App Store and sign in to your Mist organization.
Tap Claim Devices to Org, then scan the QR code on the SRX4700 Firewall chassis.
The device is automatically claimed into your inventory.
- Navigate to Organization > Inventory > WAN Edges > Unassigned.
- Select the SRX4700 Firewall and assign it to the Primary Site.
SZTP Onboarding Using the Mist Web Portal (Recommended For Single Or Bulk Device Onboarding)
Log in to https://manage.mist.com/and go to Organization > Inventory > WAN Edges > Claim WAN Edges.
- Enter the claim code from the QR label (single device) or an activation code (multiple devices from a purchase order).
- Enable Assign claimed WAN Edges to site, select the Primary Site, and enable Manage configuration with Mist.
- Set a root password, then click Claim.
Verify that the device appears in the inventory.
The status initially shows Disconnected until the device completes its cloud connection.
Post‑Onboarding Configuration
- Use Juniper Security Director Cloud (if licensed) for centralized policy and security configuration.
- Use J-Web for basic or custom configuration, such as management interface setup and authentication.
- Alternatively, perform additional configuration through the Junos OS CLI, including root authentication and management access.
- Activate required feature licenses by following the Juniper Licensing Guide.