Screen OS

last person joined: 8 months ago 

This is a legacy community with limited Juniper monitoring.
  • 1.  Configuring SSG-5-SH with Comcast Cable

    Posted 03-04-2010 14:00

    Hi,

     

    I am totally new to firewall and Juniper world. I have got a Juniper SSG from my company to practice and learn about it, Just wonder how to configure it with comcast cable at home so i could get it running. I have been working and googling for past one week but no luck.

     

    Very basic configuration that i could do.

     

    Eth0/0 Untrusted - Comcast modem and DHCP IP.

     

    Eth0/2-6 Trusted to connect it to a switch and get my pc and other devices running.

     

    Policies,

    trusted any any to untrusted

    untrusted any any to trusted ( I know it opens everything but just to get running )

     

    Please as i just want to know the very basic configuration and then i will work the rest out.

     

    Thank you

     

    NetworkGeek



  • 2.  RE: Configuring SSG-5-SH with Comcast Cable

    Posted 03-04-2010 15:59

    Dear Juniper Masters,

     

    Need your help please!

     

    Thank you in advance.



  • 3.  RE: Configuring SSG-5-SH with Comcast Cable
    Best Answer

    Posted 03-06-2010 04:57

    Welcome to Juniper firewalls.  I made the transition from managing Sonicwall networks to Juniper about a year ago now.  I love the platform for the flexibility and managability it is giving the network I manage.  But the price for that was a completely different model of configuration and a level of complexity that allows the flexibility.

     

    In your situation I would start with the basic suggested load outlined in the Getting Started Guide.

     

    Getting Started

     

    This creates a basic DMZ and Trust zone behind the firewall and allows you to experiment with the basic features.

     

    Before you get started, check your software downloads area.  Get in the habit of looking at the JTAC recommended release of ScreenOS version for your model.  And then update the device to this release.   This is on the Configuration--Update--ScreenOS tab in the web interface.

     

    For Comcast you will probably need to call the operations center to change your firewall.  They have an annoying habit in most areas of grabing the MAC address of the first firewall or computer setup on your line then locking access for your physical connection to that MAC address.  If you don't want to deal with the call center you'll have to determine the MAC address on your current gear and configure MAC spoofing on the Untrust interface.

     

    Once this is up and running.  I would setup a computer in DMZ and others in Trust then write the NAT and policy rules that allow access from Trust to DMZ to access services and manage the server.  But leave the reverse traffic blocked.  This is a typical scenario.

     

    From there I would hit the documentation.

     

    ScreenOS Documentation

     

    The feature set is rich.  Skim the table of contents for each volume and determine which features are applicable to your network. Then you can use the sample concepts and examples in these guides to create the configuration on your test unit.  You may need other firewalls to create routing or VPN tunnels with for these exercises.

     

    If you want a more formal organized introduction, the Syngress introduction to SSG firewalls is really well done.  Experienced people can skip the opening chapters that start with even the networking firewall basics but this organizes and introduces the major concepts of ScreenOS configuration and I found it very helpful.

     

    Configuring Juniper Networks NetScreen & SSG Firewalls

     

    There is also the Oreilly "Cookbook" for the ScreenOS.  This is a great reference I use as a first stop for setting up new features.  It is a quick and dirty guide to how to perform specific functions.  There is not really anything here that is not in the concepts and examples documenation, and that is the place to go when you don't understand or need to modify a configuration presented here, but it is a very convenient short cut for me.

     

    Cookbook

     

    If you have budget and perhaps spare equipment, you can purchase a layer 3 switch to setup a test lab.  Netgear has some very inexpensive models now for this type of setup.  We have a layer 3 switch configured with separate VLANs on each port and RIP that allows all our retired and spare firewalls to be used in a test lab.  The switch setup mimics the internet for the group of firewalls and you can setup even the multi-site hub and spoke examples in the concepts and examples guide.



  • 4.  RE: Configuring SSG-5-SH with Comcast Cable

    Posted 03-06-2010 07:53

    Steve - very nice post on getting started!



  • 5.  RE: Configuring SSG-5-SH with Comcast Cable

    Posted 03-08-2010 11:29

    Dear All,

     

    Thank you for replying and i will work and get back to you.

     

    For time being what i did is run the wizard on Juniper SSG5 after reseting and it is routing the packets. i will work on your solutions and will get back you guyz.

     

    Thank you once again.

     

    Cheers

     

    Networkgeek



  • 6.  RE: Configuring SSG-5-SH with Comcast Cable

    Posted 03-16-2010 14:03

    Dear All,

     

    Thank you for the help, it is running and working perfectly.

     

    thank you once again for the help.

     

    cheers

     

    Networkgeek