Security

Hi

Currently i am trying to install 2 nsmxpress boxes in a HA setup.

For now we have just powered the devices up, followed the Quick install guide.

But we are not able to access either of the nsmxpress through the web interface, neither can we find the nsm client gui anywhere.

Are we missing something basic or has someone else encountered the same problem?

Kind regards,
Maarten

Hi Maarten

it should just be https://<your nsm ip>

Kind regards

Colin 

Hi Collin,

Problem is that both the NSM's are responding to pings.

But they are not responding to http or https, not in the browser and when we do a telnet to port 80 or 443 we do not get any reply.

When we get the web interface, can we download the UI software from there?

Kind regards,
Maarten

The NSMXpress webUI url is https://<ip>/admin

If you don't append "/admin" to the URL, you'll only see the NSM client download page.

Thank You for this reply it is exactly what I needed to know to get connected to my NSM. All the documentation that I found online was to use adminstration not admin. Admin worked like a charm

Hi Maarten,

if you need to , you can ftp the installer off the box, its located at /usr/netscreen/GuiSvr/lib/webproxy/webapps/download/installers/windows

or linux depending on your need.

The webproxy config script is located at /usr/netscreen/GuiSvr/lib/webproxy/conf/server.xml

Please see below a sample config from a box on 2007.3r2

<!--  Server Configuration File -->

<Server port="8005" shutdown="SHUTDOWN">
--------snip --------

   
    <Connector port="8443" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               clientAuth="false" sslProtocol="SSL" keystoreFile="/usr/netscreen/GuiSvr/lib/webproxy/conf/.webproxy_keystore"
                           keystoreType="PKCS12" address="127.0.0.1" />

        <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009"
               enableLookups="false" redirectPort="8443" protocol="AJP/1.3" address="127.0.0.1" />
----- snip ------

Please check the ip (127.0.0.1) as well as the ports, you may also wish to double check that the webproxy is indeed running.

Kind regards

Colin 

Hi,

I think i have left out some vital information.

We are running 2007.2R1 so whe have no possibillity to ftp to the box.

We have also found in the release notes that the webgui is only available from 2007.3 ?

Also the mentioned file is not there, it stops at the directory webproxy (probably because of the mentioned fact above?

Kind regards,

Maarten

Hi Maarten,

yes correct webproxy is a new feature in 2007.3rx

you will see when you run /etc/init.d/guiSvr status that there is no webproxy present.

Once you upgrade to 2007.3 you will get the webproxy service as well as the possibility to download the client direct from the box.

Kind regards

Colin 

Hi Collin,

first of all, thank you very much for your help and quick response!

The last 2 questions,

where do i find the client now?

Is it very beneficial to upgrade to 2007.3rx ?

kind regards,
Maarten

Hi Maarten,

yes i would recommend going to 2007.3r2 for sure, there are many fixes and some new features.

If you decide not to upgrade to 2007.3 then at least upgrade to 2007.2r2 as you get real time DB synchronisation on the guiSvr.

The client is available from the customer service site on juniper.net under screenos downloads then down the list , there are links to all the nsm releases.

Kind regards

Colin 

Oh Maarten,

nearly forgot, if you upgrade to 2007.3r2 and apply the schema update. Just a headsup, the schema is not automatically applied to the nsm client available for download so you will need to download the schema update for the client from the website also and apply this tothe downloaded client to allow for a connection.

Kind regards

Colin 

Hey CB, thanks for the post about upgrading the Windows UI.  I simply uploaded all of the files to the NSM and ran the update script, unaware that the Windows UI wasnt upgraded along with the Server portion of the product.

I have an NSMXpress that came with 2007.3 installed.  I upgraded it to 2008.1 with no issues, but after upgrading (i thought) to 2001.1r1 i struggled all day today with a version mismatch between the Windows UI and the server.  every time i connected, it gave me the mismatch error, and prompted me to download the new version from the NSM... me being totally unaware that it was the same version, went through this twice (at T1 speed).  so my question is this:   were in the docs did i miss the part about running the schema update on the windows client?

thanks for your previous note, and any advice you care to give.

stine

Hi Stine,

i'm not sure on the documentation, but just to clarify, the schema updates add files to the existing installation of the dev , gui or client software on windows or linux. If one component is updated , then in order to work the other components must be upgraded also.

In the case of nsmXpress, a schema update will not change the downloadable client (as this is a .zip or .bin for linux). Hence the schema would need to be reapplied once downloaded and installed.

 I'll have a look and see if i can find some documentation that clarifies this and post a link if i can find it.

Hope this clarifies the issue for others running into the same issue.

Kind regards

Colin

thanks, i got everything working at 3 am this morning and decided to call it a night.

stine