Qiita Teams that are logged in
You are not logged in to any team

Log in to Qiita Team
Community
OrganizationEventAdvent CalendarQiitadon (β)
Service
Qiita JobsQiita ZineQiita Blog
24
Help us understand the problem. What is going on with this article?
@tukiyo3

ScreenOS コマンド

Junos OS / ScreenOS の CLI 比較


参考

はじめに

  • NetScreenやSSG製品。
    • NS-5GT,NS-25 : 物理メモリ 128MB
    • SSG-140 : 物理メモリ 512MB
  • 冗長化はNSRP

コマンド

get system
get config      (設定一覧)

get tech-support(全コマンド結果)
get event       (show log)
get arp          (接続PCリスト)
get console (login状態、未保存情報)
get route
get licence-key (制限)
get ntp
get performance cpu(w)
get session     (接続情報一覧)
get socket      (接続情報一覧)
get service user(FW設定)
get policy    (FW設定一覧)
get mip       (IP割り当て一覧)

インターフェース周り

get vip
get mip
get interface
get interface eth0/0 mip

初期化

SSG140-> unset all
Erase all system config, are you sure y/[n] ? y
SSG140-> reset
Configuration modified, save? [y]/n n
System reset, are you sure? y/[n] y
In reset ...

設定

ホスト名

set hostname SSG140_M.mydomain

ファイアウォールの名前をSSG140_M.mydomainに設定

get hostname

zone名

set interface ethernet0/0 zone Untrust
set interface ethernet0/1 zone Trust
set interface ethernet0/2 zone DMZ
  • ethernet0/0 を zone Untrust
  • ethernet0/1 を zone Trust
  • ethernet0/2 を zone DMZ に設定

get zone

IP設定

set interface ethernet0/0 manage-ip 5.6.7.8
set interface ethernet0/1 manage-ip 192.168.10.254
set interface ethernet0/2 manage-ip 192.168.20.254
set interface ethernet0/0 manage ping
set interface ethernet0/1 manage ping
set interface ethernet0/2 manage ping

それぞれのインターフェースにIPの割当てとpingの応答を返す。

get interface

DNS

set dns host dns1 8.8.8.8
set dns host dns2 8.8.4.4

ScreenOSのDNS設定

冗長化(nsrp)用IP設定

master側

set interface ethernet0/8 zone HA
set interface ethernet0/9 zone HA
set interface ethernet0/0 ip 5.6.7.8/28
set interface ethernet0/0 route
set interface ethernet0/1 ip 192.168.10.1/24
set interface ethernet0/1 nat
set interface ethernet0/2 ip 192.168.20.1/24
set interface ethernet0/2 nat
set nsrp cluster id 1
set nsrp rto-mirror sync
set nsrp vsd-group id 0 priority 50
set nsrp vsd-group id 0 preempt
set nsrp monitor interface ethernet0/0
set nsrp monitor interface ethernet0/1
set nsrp monitor interface ethernet0/2
set nsrp monitor track-ip ip 5.6.7.9 interface ethernet0/0
set nsrp monitor track-ip ip 5.6.7.9 weight 255

backup側

master側の設定に以下追加
- set nsrp vsd-group id 0 priority 50
- set nsrp vsd-group id 0 preempt
+ set nsrp vsd-group id 0 priority 100
  • priorityが低いほうがmasterになる。

hostname(I)-> の状態になっている場合

set nsrp monitor interface ethernet0/0
set nsrp monitor interface ethernet0/1
set nsrp monitor interface ethernet0/2

ethernet0/0,0/1,0/2のLANが抜けている場合(I)になる。刺すこと

デフォルトゲートウェイ設定

set route 0.0.0.0/0 interface ethernet0/0 gateway 5.6.7.6

ntp

set clock timezone 9
set clock dst-off
set clock ntp
set ntp server "ntp.ubuntu.com"
set ntp interval 300
  • 手動でntp問い合わせする場合、exec ntp update

nat

set policy id 100 from DMZ to Untrust Any Any Any nat src permit
  • nat src permitがミソ。
    • permitだけだとDMZからUntrustへ通信する場合、DMZ側に5.6.7.0/28 のアドレスが振られている必要がある。
    • つまりDMZからUntrustへ通信ができない。

ファイアウォール

set interface ethernet0/0 vip 5.6.7.10 22 SSH 192.168.20.10
set policy id 22 name VIP(SSH) from Untrust to DMZ Any VIP(5.6.7.10) SSH permit
  • 5.6.7.10:22 -> 192.168.20.10:22 にポートフォワードする
set service ssh_server01 protocol tcp dst-port 10022-10022
set interface ethernet0/0 vip 5.6.7.10 10022 SSH 192.168.20.80
set policy id 80 name server01 from Untrust to DMZ Any VIP(5.6.7.10) ssh_server01 permit

5.6.7.10:10022 -> 192.168.20.80:22 にポートフォワードする。

接続元IPを制限

set address Untrust office 2.2.2.2 255.255.255.255
set policy id 22 name VIP(SSH) from Untrust to DMZ office VIP(5.6.7.10) SSH permit

2.2.2.2からのみ5.6.7.10:22 への接続を許可

telnetの許可

set interface ethernet0/2 manage-ip 192.168.20.254

をした状態で、

set admin manager-ip 192.168.20.0 255.255.255.0
set interface ethernet0/2 manage telnet

ScreenOS

How to upgrade ScreenOS either via the WebUI or CLI
KB7860 Download ScreenOS Updates From the Web
KB4317 [ScreenOS] Accessing your Juniper firewall device using the WebUI
SSG140 - Download Software

  • DL時にはid/passが必要

バックアップ

バックアップ
save software from flash to tftp 192.168.1.50 ssg140.6.3.0r17.0

tftpサーバ(192.168.1.50)の /var/lib/tftproot/ssg140.6.3.0r17.0 に保存される。12MB

更新

更新
save software from tftp 192.168.1.50 ssg140.6.3.0r17.0 to flash
24
Help us understand the problem. What is going on with this article?
Why not register and get more from Qiita?
  1. We will deliver articles that match you
    By following users and tags, you can catch up information on technical fields that you are interested in as a whole
  2. you can read useful information later efficiently
    By "stocking" the articles you like, you can search right away
24
Help us understand the problem. What is going on with this article?