JUNIPER SSG5 初始化設定
JUNIPER SSG5 初始化設定
關於如何恢復闖廠配置，請自行參考以下之連結：
我們這次利用序號登入來恢復出廠設定：
login: 016xxxxxxxxxxx18
password:
!!! Lost Password
Reset !!! You have initiated a command to reset the device to
factory defaults,
clearing all current configuration and settings. Would you lik
e to continue? y/[n] y
!! Reconfirm Lost
Password Reset !! If you continue, the entire configuration of
the device will be erased. In addition, a
permanent counter will be incremented
to signify that this device has been reset.
This is your last chance to cancel
this command. If you
proceed, the device will return to factory default configur
ation, which is:
System IP: 192.168.1.1; username: netscreen, password: netscree
n. Would you like to
continue? y/[n] y
In reset ...
重開機中
...
開機完成後，我們可以利用get config all命令來查看設備恢復出廠配置後的設定情形。
我們可以修改出廠設定來將Juniper
SSG5設備初始化，這樣可以讓我們節省不少的時間。
恢復出廠設定之後，我們只要直接進行下列命令，就可達到利用0/2--0/6端口來上網並進行設定管理的目的。
如果您的WAN介面是DHCP用戶端，請您執行下列命令：
set
interface ethernet0/0 dhcp client
set interface ethernet0/0 route
set route 0.0.0 .0/0 interface ethernet0/0
save
如果您的WAN介面採用固定IP，則請您執行下列命令：
set
interface ethernet0/0 ip 192.168.188.11
set interface ethernet0/0 route
set route 0.0.0 .0/0 interface ethernet0/0
save
下列命令是將ethernet0/1綁定在bgroup0介面之下，並將ethernet0/0 WAN介面設定成DHCP用戶端，以順利取得上網IP資訊。
ethernet0/1在SSG5/20系列產品預設為DMZ區域專屬介面，而在JUNIPER SRX系列產品則無此設定，若您不需要DMZ介面，我們可以先解除ethernet0/1介面的安全區綁定，再將ethernet0/1綁定在bgroup0介面之下，即可達成除了ethernet0/0為WAN介面之外，其他的介面皆是LAN介面的需求。
unset interface ethernet0/1 zone
set interface bgroup0 port ethernet0/1
如果您的設備型號為SSG5SH-W，具有WIFI的功能，則要另外加入下列之命令，為其做安全性初始化動作：
建立"WIFI"
安全區，並將wireless0/0介面設為不可管理，最後設定策略讓WIFI能夠上網。
由於wifi網路並不安全，任何人都可以監聽您的WIFI網路，並透過適當的工具及設備，就能破解您的WIFI網路之安全設定，進而入侵您的設備，所以我們在一開始就要將無線網路進行安全性初始化動作，就算有人在此時入侵您的無線網路，也只是能上網而已，並無法因此來取得網路設備的管理權限。
set zone
id 100 "WIFI"
set
interface "wireless0/0" zone "WIFI"
unset
interface wireless0/0 ip manageable
set
policy id 2 name "WIFI-2-Internet" from "WIFI" to
"Untrust" "Any"
"Any" "ANY" permit
set
policy id 2
exit
save
設定時區，取消日光節約，以及啟用網路對時(NTP)服務。
set clock dst-off
set clock ntp
set clock timezone 8
set clock dst recurring start-weekday 2 0 3 02:00
end-weekday 1 0 11 02:00
set ntp server "118.163.81.61"
set ntp server backup1 "118.163.81.62"
set ntp server backup2 "118.163.81.63"
設定系統管理者的帳號及密碼，預設為"netscreen"，必須更改成其他名稱以及複雜的密碼，以免被人取得管理權限。
set admin name "administrators"
set admin password "netscreen123456"
為了避免測試時閒置太久，console或web自動斷線，然後要您再重key帳號密碼，將console設定成永久連線，WebUI則閒置60後自動斷線，若是已經上線使用的設備，為了安全起見，請勿延長閒置斷線時間，預設為10分鐘。
set console timeout 0
set admin auth web timeout 60
save
設定轉發syslog，將系統日誌訊息轉發到訊息接收伺服器192.168.1.11，訊息接收伺服器必須開放port
516，且運行訊息接收軟體，例如tftpd64。
set syslog config 192.168.1.11
set syslog enable
save
我們還有以下的安全性初始化設定：
set admin http redirect
將沒有加密的HTTP網頁管理重新導向至加密的SSL網頁(port 443)
unset admin http redirect 取消將HTTP登入管理網頁重新導向到HTTPS的設定
變更ssh port從port 22到其他prot number，以免駭客破解ssh密碼。
set admin ssh port <number> scs port
number (1024-32767)
變更telnet port從port 21到其他prot number，以免駭客破解telnet密碼。
set admin telnet port <number> telnet
port number (1024-32767)
set admin hw-reset 設置設置按Reset鍵就會恢復出廠預設配置(預設值)
unset admin hw-reset 設置為禁用按Reset鍵就會恢復出廠預設配置
set admin device-reset 設置用序號登入帳號及密碼就會恢復出廠預設配置(預設值)
unset admin device-reset 設置為禁用帶有序號的初始化
set admin root access console allows
access via console
set admin access attempts <number> 預設情況下，在關閉 Telnet 會話之前，裝置最多允許三次不成功的登入嘗試。
set admin ssh password <enable|disable> 設置啟用或關閉ssh登入密碼功能
利用序號登入恢復出廠設定之後，配置檔的內容如下：
unset key protection
enable
set clock timezone 0
set vrouter trust-vr
sharable
set vrouter
"untrust-vr"
exit
set vrouter
"trust-vr"
unset
auto-route-export
exit
set alg appleichat
enable
unset alg appleichat
re-assembly enable
set alg sctp enable
set auth-server
"Local" id 0
set auth-server
"Local" server-name "Local"
set auth default auth
server "Local"
set auth radius
accounting port 1646
set admin name
"netscreen"
set admin password
"nKVUM2rwMUzPcrkG5sWIHdCtqkAibn"
set admin auth web
timeout 10
set admin auth dial-in
timeout 3
set admin auth server
"Local"
set admin format dos
set zone
"Trust" vrouter "trust-vr"
set zone
"Untrust" vrouter "trust-vr"
set zone
"DMZ" vrouter "trust-vr"
set zone
"VLAN" vrouter "trust-vr"
set zone
"Untrust-Tun" vrouter "trust-vr"
set zone
"Trust" tcp-rst
set zone
"Untrust" block
unset zone
"Untrust" tcp-rst
unset zone
"V1-Trust" tcp-rst
unset zone
"V1-Untrust" tcp-rst
set zone
"DMZ" tcp-rst
unset zone
"V1-DMZ" tcp-rst
unset zone
"VLAN" tcp-rst
set zone
"Untrust" screen tear-drop
set zone
"Untrust" screen syn-flood
set zone
"Untrust" screen ping-death
set zone
"Untrust" screen ip-filter-src
set zone
"Untrust" screen land
set zone
"V1-Untrust" screen tear-drop
set zone
"V1-Untrust" screen syn-flood
set zone
"V1-Untrust" screen ping-death
set zone
"V1-Untrust" screen ip-filter-src
set zone
"V1-Untrust" screen land
set interface adsl1/0
phy operating-mode auto
set interface
"ethernet0/0" zone "Untrust"
set interface
"ethernet0/1" zone "DMZ"
set interface
"wireless0/0" zone "Trust"
set interface
"bgroup0" zone "Trust"
set interface
"adsl1/0" pvc 8 35 mux llc protocol bridged qos ubr zone
"Untrust"
set interface bgroup0
port ethernet0/2
set interface bgroup0
port ethernet0/3
set interface bgroup0
port ethernet0/4
unset interface vlan1
ip
set interface
wireless0/0 ip 192.168.2.1/24
set interface
wireless0/0 nat
set interface bgroup0
ip 192.168.1.1/24
set interface bgroup0
nat
unset interface vlan1
bypass-others-ipsec
unset interface vlan1
bypass-non-ip
set interface
wireless0/0 ip manageable
set interface bgroup0
ip manageable
unset interface
ethernet0/0 manage ping
unset interface
ethernet0/0 manage ssh
unset interface
ethernet0/0 manage telnet
unset interface
ethernet0/0 manage snmp
unset interface
ethernet0/0 manage ssl
unset interface
ethernet0/0 manage web
unset interface
ethernet0/0 manage ident-reset
set interface
ethernet0/0 g -arp
set interface
ethernet0/1 manage ping
unset interface
ethernet0/1 manage ssh
unset interface
ethernet0/1 manage telnet
unset interface
ethernet0/1 manage snmp
unset interface
ethernet0/1 manage ssl
unset interface
ethernet0/1 manage web
unset interface
ethernet0/1 manage ident-reset
set interface
ethernet0/1 g -arp
set interface
wireless0/0 manage ping
set interface wireless0/0
manage ssh
set interface
wireless0/0 manage telnet
set interface
wireless0/0 manage snmp
set interface
wireless0/0 manage ssl
set interface
wireless0/0 manage web
unset interface
wireless0/0 manage ident-reset
set interface
wireless0/0 g -arp
set interface bgroup0
manage ping
set interface bgroup0
manage ssh
set interface bgroup0
manage telnet
set interface bgroup0
manage snmp
set interface bgroup0
manage ssl
set interface bgroup0
manage web
unset interface
bgroup0 manage ident-reset
set interface bgroup0 g -arp
unset interface
adsl1/0 manage ping
unset interface
adsl1/0 manage ssh
unset interface
adsl1/0 manage telnet
unset interface
adsl1/0 manage snmp
unset interface
adsl1/0 manage ssl
unset interface
adsl1/0 manage web
unset interface
adsl1/0 manage ident-reset
set interface adsl1/0 g -arp
set interface vlan1
manage ping
set interface vlan1
manage ssh
set interface vlan1
manage telnet
set interface vlan1
manage snmp
set interface vlan1
manage ssl
set interface vlan1
manage web
unset interface vlan1
manage ident-reset
unset interface vlan1 g -arp
set zone V1-Trust
manage ping
set zone V1-Trust
manage ssh
set zone V1-Trust
manage telnet
set zone V1-Trust
manage snmp
set zone V1-Trust
manage ssl
set zone V1-Trust
manage web
unset zone V1-Trust
manage ident-reset
set zone V1-Trust
g-arp
unset zone V1-Untrust
manage ping
unset zone V1-Untrust
manage ssh
unset zone V1-Untrust
manage telnet
unset zone V1-Untrust
manage snmp
unset zone V1-Untrust
manage ssl
unset zone V1-Untrust
manage web
unset zone V1-Untrust
manage ident-reset
set zone V1-Untrust
g-arp
set zone V1-DMZ manage
ping
unset zone V1-DMZ
manage ssh
unset zone V1-DMZ
manage telnet
unset zone V1-DMZ
manage snmp
unset zone V1-DMZ
manage ssl
unset zone V1-DMZ
manage web
unset zone V1-DMZ
manage ident-reset
set zone V1-DMZ g-arp
unset zone V1-Null
manage ping
unset zone V1-Null
manage ssh
unset zone V1-Null
manage telnet
unset zone V1-Null
manage snmp
unset zone V1-Null
manage ssl
unset zone V1-Null
manage web
unset zone V1-Null
manage ident-reset
set zone V1-Null g-arp
set interface
wireless0/0 dhcp server service
set interface bgroup0
dhcp server service
set interface
wireless0/0 dhcp server auto
set interface bgroup0
dhcp server auto
set interface
wireless0/0 dhcp server option gateway 192.168.2.1
set interface
wireless0/0 dhcp server option netmask 255.255.255.0
set interface bgroup0
dhcp server option gateway 192.168.1.1
set interface bgroup0
dhcp server option netmask 255.255.255.0
set interface
wireless0/0 dhcp server ip 192.168.2.33 to 192.168.2.126
set interface bgroup0
dhcp server ip 192.168.1.33 to 192.168.1.126
unset interface
wireless0/0 dhcp server config next-server-ip
unset interface
bgroup0 dhcp server config next-server-ip
set interface
"serial0/0" modem settings "USR" init "AT&F"
set interface
"serial0/0" modem settings "USR" active
set interface
"serial0/0" modem speed 115200
set interface
"serial0/0" modem retry 3
set interface
"serial0/0" modem interval 10
set interface
"serial0/0" modem idle-time 10
set flow tcp-mss
unset flow no-tcp-seq-check
set flow tcp-syn-check
unset flow
tcp-syn-bit-check
set flow reverse-route
clear-text prefer
set flow reverse-route
tunnel always
set pki authority
default scep mode "auto"
set pki x509 default
cert-path partial
set crypto-policy
exit
set ike
respond-bad-spi 1
set ike ikev2
ike-sa-soft-lifetime 60
unset ike
ikeid-enumeration
unset ike
dos-protection
unset ipsec
access-session enable
set ipsec
access-session maximum 5000
set ipsec
access-session upper-threshold 0
set ipsec
access-session lower-threshold 0
set ipsec
access-session dead-p2-sa-timeout 0
unset ipsec
access-session log-error
unset ipsec
access-session info-exch-connected
unset ipsec
access-session use-error-log
set url protocol
websense
exit
set policy id 1 from
"Trust" to "Untrust"
"Any" "Any" "ANY" permit
set policy id 1
exit
set nsmgmt bulkcli
reboot-timeout 60
set ssh version v2
set config lock
timeout 5
unset license-key
auto-update
set telnet client
enable
set wlan 0 channel
auto
set wlan 1 channel
auto
set wlan change-channel-timer
0
set snmp port listen
161
set snmp port trap 162
set snmpv3
local-engine id "0164102006002418"
set vrouter
"untrust-vr"
exit
set vrouter
"trust-vr"
unset
add-default-route
exit
set vrouter
"untrust-vr"
exit
set vrouter
"trust-vr"
exit
