最基本的物质需求得到满足之后，唯一能够不断增加个人幸福感的事情就是帮助他人

一、已有条件
SSG 5:
boot loader版本：Boot Loader Version 1.3.3
firmware screenOS版本：6.1.0
下载的新版本固件：ssg5ssg20.6.3.0r4.0
PC机：安装Solarwinds TFTP Server，其默认根目录默认为c:\TFTP-Root，已经将ssg5ssg20.6.3.0r4.0放置到该目录下。PC机ip地址是 192.168.170.210

二、步骤
1、将PC机串口连接SSG 5Console口，将PC机网口连接SSG5 ethernet0/3，PC机ip地址为192.168.170.210。启动TFTP Server。

2、开启终端工具（如windows hyperterminal），启动SSG 5。终端工具中显示

Juniper Networks SSG5 Boot Loader Version 1.3.3 (Checksum: D8BC25A8)
Copyright (c) 1997-2006 Juniper Networks, Inc.


Total physical memory: 256MB
    Test - Pass
    Initialization - Done


Hit any key to run loader
Hit any key to run loader


此时hit any key，

Serial Number [0162042009001887]: READ ONLY
HW Version Number [0710]: READ ONLY
Self MAC Address [0023-9c38-99c0]: READ ONLY
Boot File Name [ssg5ssg20.6.3.0r4.0]:ssg5ssg20.6.3.0r4.0
Self IP Address [192.168.170.91]:192.168.170.91
TFTP IP Address [192.168.170.210]:192.168.170.210

顺利的话

a!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!at
a!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!at
a!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!at
a!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!at
a!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!ata!at
a!ata!ata!ata!ata!ata!ata!ata

Loaded Successfully! (size = 13,280,811 bytes)

Image authenticated!

3、Save to on-board flash disk? (y/[n]/m) Yes!
此步选择yes，才能每次都能启动新固件，不同于升级boot loader，虽然升级入口都一样（Hit any key）
然后，
Saving system image to on-board flash disk...
Done! (size = 13,280,811 bytes)

4、Run downloaded system image? ([y]/n) Yes!


Start loading...
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
.................................................................
......................
Done.



Juniper Networks, Inc
SSG5/SSG20 System Software
Copyright, 1997-2008

Version 6.3.0r4.0
Cksum:d99f6452
Load Manufacture Information ... Done

Initialize FBTL 0........ Done
Load NVRAM Information ... (6.1.0)Done
Install module init vectors
The device is storing the firmware into reserved flash sectors.
Please do not power off the device during this operation. Doing so could result
in loss of firmware.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++
The device successfully completed the operation.
Changed to l3 mode
Install modules (01254800,01fb4000) ...
PPP IP-POOL initiated, 256 pools

Initializing DI 1.1.0-ns

System config (1331 bytes) loaded

Done.
Load System Configuration ...............................
Unsupported command - set zone "VLAN" block
..................................modem is not detected
....................................Disabled licensekey auto update
...........Done
system init done..
login: ethernet0/3 interface change physical state to Up
bgroup0 interface change physical state to Up
System change state to Active(1)

升级成功，此时进入ScreenOS 6.3.0r4

标签： Boot Loader, Firmware upgrade, Juniper SSG 5

一、已有条件
SSG 5:
boot loader版本：Boot Loader Version 1.3.2
下载的新版本boot loader：Loadssg5ssg20v133.d
PC机：安装Solarwinds TFTP Server，其默认根目录默认为c:\TFTP-Root，已经将Loadssg5ssg20v133.d放置到该目录下。PC机ip地址是192.168.170.210

二、步骤
1、将PC机串口连接SSG 5Console口，将PC机网口连接SSG5 ethernet0/3，PC机ip地址为192.168.170.210。启动TFTP Server。

2、开启终端工具（如windows hyperterminal），启动SSG 5。终端工具中显示

Juniper Networks SSG5 Boot Loader Version 1.3.2 (Checksum: A1EAB858)
Copyright (c) 1997-2006 Juniper Networks, Inc.

Total physical memory: 256MB
    Test - Pass
    Initialization - Done

Hit any key to run loader
Hit any key to run loader

可以看出此时boot loader版本为1.3.2，此时hit any key，

Serial Number [0162042009001887]: READ ONLY
HW Version Number [0710]: READ ONLY
Self MAC Address [0023-9c38-99c0]: READ ONLY
Boot File Name [Loadssg5ssg20v133.d]:Loadssg5ssg20v133.d
Self IP Address [192.168.170.91]:192.168.170.91
TFTP IP Address [192.168.170.210]:192.168.170.210

顺利的话

Loading file "Loadssg5ssg20v133.d"...
rtatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatat
atatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatatata

Loaded Successfully! (size = 408,395 bytes)

Image authenticated!

3、Save to on-board flash disk? (y/[n]/m) No!
此时要选no，因为升级boot loader是一次性的行为，不需要存入on-board flash。

4、Run downloaded system image? ([y]/n) Yes!

    ******************************************************************
    *                                                                *
    *               SSG5/SSG20 BOOT LOADER UPDATE UTILITY            *
    *         ==============================================         *
    *               (c)1997-2006 Juniper Networks, Inc.              *
    *                      All Rights Reserved                       *
    *                                                                *
    *         ----------------------------------------------         *
    *         Boot Loader Version: 1.3.3                             *
    *         Date               : 05/26/2006                        *
    *                                                                *
    *         !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!         *
    *         !                                            !         *
    *         ! Please don't power off during update.      !         *
    *         ! Otherwise, the system can not boot again.  !         *
    *         !                                            !         *
    *         !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!         *
    *                                                                *
    *        *** DON'T POWER OFF DURING BOOT LOADER UPDATE ***       *
    *        *** DON'T POWER OFF DURING BOOT LOADER UPDATE ***       *
    *        *** DON'T POWER OFF DURING BOOT LOADER UPDATE ***       *
    *                                                                *
    ******************************************************************


Check on-board Boot Loader... Update needed!

Are you sure you want to update Boot Loader? (y/n)

选择y。

5、Read product information of on-board boot flash device:
    Manufacturer ID      = 1f
    Device ID            = 13
    Additional Device ID = 10

Boot flash device is AT49LV040B

Erase on-board boot flash device.......... Done

Update Boot Loader..............................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................. Done

Verify Boot Loader... Done

Boot Loader has been updated successfully!

Please hit any key to reboot the system...

Juniper Networks SSG5 Boot Loader Version 1.3.3 (Checksum: D8BC25A8)
Copyright (c) 1997-2006 Juniper Networks, Inc.

Total physical memory: 256MB
    Test - Pass
    Initialization - Done

Hit any key to run loader
Hit any key to run loader
可以看到Boot Loader的版本已经升级为1.3.3。

标签： Boot Loader, Juniper SSG 5, Upgrade

方案图：10.10.10.2<——>1.1.1.3


设备：
Firewall A: Juniper SSG 5
Firewall B: Juniper SSG 5
Internet: Cisco 3750，用3750实现互联网拓扑

配置细节：

Firewall A:路由模式

1、端口配置。

ethernet0/0:
zone:untrust
ip: 2.2.2.2/24，manageable
manage options: webui、ssh、telnet、ping

cli下：
set interface "ethernet0/0" zone "Untrust"
set interface ethernet0/0 ip 2.2.2.2/24
set interface ethernet0/0 route      （端口路由模式）
set interface ethernet0/0 ip manageable
set interface ethernet0/0 manage ping
set interface ethernet0/0 manage ssh
set interface ethernet0/0 manage telnet
set interface ethernet0/0 manage web



ethernet0/2:将其从bgroup中解除绑定，在ssg 5中，ethernet0/2-0/6默认属于端口组bgroup，作为整体加入zone trust。
zone: trust
ip: 10.10.10.1/24, manageable
manage options: webui、ssh、telnet、ping

cli下：
set interface "ethernet0/2" zone "Trust"
set interface ethernet0/2 ip 10.10.10.1/24
set interface ethernet0/2 route     （端口路由模式，trust zone的端口默认为nat接口）
set interface ethernet0/2 ip manageable
set interface ethernet0/2 manage ping
set interface ethernet0/2 manage ssh
set interface ethernet0/2 manage telnet
set interface ethernet0/2 manage web


2、设置到Internet的默认路由
set route 0.0.0.0/0 interface ethernet0/0 gateway 2.2.2.1


3、设置地址
set address "Trust" "FirewallA_Local" 10.10.10.2 255.255.255.255
set address "Untrust" "FirewallB_Remote" 1.1.1.3 255.255.255.255


4、设置vpn

Phase 1:
VPNs->AutoKey Advanced->Gateway->New
Gateway Name: p1-VPN
Security Level: Standard
Remote Gateway Type->Static IP Address: 1.1.1.2
Preshared Key: netscreen
Outgoing Interface: ethernet0/0


Phase 2:
VPNs->AutoKey IKE->New
VPN Name: p2-VPN
Security Level: Standard
Predefined: p1-VPN




cli下：
set ike gateway "p1-VPN" address 1.1.1.2 Main outgoing-interface "ethernet0/0" preshare "netscreen" sec-level standard
set vpn "p2-VPN" gateway "p1-VPN" no-replay tunnel idletime 0 sec-level standard



5、设置policy
Policies->From Trust to Untrust->New
Source Address Book Entry: FirewallA_Local
Destination Address Book Entry: FirewallB_Remote
Service: Any
Action: Tunnel
Tunnel VPN: p2-VPN
Modify matching bidirectional policy: Checked
Logging: Checked


cli下：

set policy id 2 from "Trust" to "Untrust"  "FirewallA_Local" "FirewallB_Remote" "ANY" tunnel vpn "p2-VPN" id 0x1 pair-policy 3 log

set policy id 3 from "Untrust" to "Trust"  "FirewallB_Remote" "FirewallA_Local" "ANY" tunnel vpn "p2-VPN" id 0x1 pair-policy 2 log





Firewall B:透明模式

1、将Firewall B设为透明模式，可通过get sys来确认。

2、端口配置。

vlan1:用于管理.
ip: 1.1.1.2/24，manageable
manage options: webui、ssh、telnet、ping
broadcast: arp，check trace route

cli下：
set interface vlan1 ip 1.1.1.2/24
set interface vlan1 ip manageable


ethernet0/0：
zone：v1-untrust

cli:
set interface "ethernet0/0" zone "V1-Untrust"

ethernet0/1:
zone: v1-dmz

cli:
set interface "ethernet0/1" zone "V1-DMZ"

ethernet0/2:
zone: v1-trust

cli:
set interface "ethernet0/2" zone "V1-Trust"


3、设置 到Internet的默认路由
set route 0.0.0.0/0 interface vlan1 gateway 1.1.1.1


4、设置地址
set address "V1-Trust" "FirewallB_Local" 1.1.1.3 255.255.255.255
set address "V1-Untrust" "FirewallA_Remote" 10.10.10.2 255.255.255.255


5、 设置vpn

Phase 1:

VPNs->AutoKey Advanced->Gateway->New
Gateway Name: p1-VPN
Security Level: Standard
Remote Gateway Type->Static IP Address: 2.2.2.2
Preshared Key: netscreen
outgoing-zone: "V1-Untrust"


Phase 2:
VPNs->AutoKey IKE->New
VPN Name: p2-VPN
Security Level: Standard
Predefined: p1-VPN




cli下：
set ike gateway "p1-VPN" address 2.2.2.2 Main outgoing-zone "V1-Untrust" preshare "netscreen" sec-level standard
set vpn "p2-VPN" gateway "p1-VPN" no-replay tunnel idletime 0 sec-level standard



6、设置policy
Policies->From V1-Trust to V1-Untrust->New
Source Address Book Entry: FirewallB_Local
Destination Address Book Entry: FirewallA_Remote
Service: Any
Action: Tunnel
Tunnel VPN: p2-VPN
Modify matching bidirectional policy: Checked
Logging: Checked


cli下：

set policy id 2 from "V1-Trust" to "V1-Untrust"  "FirewallB_Local" "FirewallA_Remote" "ANY" tunnel vpn "p2-VPN" id 0x1 pair-policy 3 log

set policy id 3 from "V1-Untrust" to "V1-Trust"  "FirewallA_Remote" "FirewallB_Local" "ANY" tunnel vpn "p2-VPN" id 0x1 pair-policy 2 log


不需要在Firewall B上设置从v1-trust any到v1-untrust any的允许any service的policy。

3750设置：
vlan11: 1.1.1.1/24
vlan12: 2.2.2.1/24
gi1/0/1: 加入vlan11
gi1/0/2: 加入vlan12
路由：ip route 10.10.10.0 255.255.255.0 2.2.2.2






客户端设置：
客户a：
ip:10.10.10.2
gateway: 10.10.10.1

客户b：
ip: 1.1.1.3
gateway: 1.1.1.1
这里从1.1.1.3到1.1.1.1是ping不通的，但是1.1.1.3必须以1.1.1.1为网关，才能实现双方的互通。

标签： Juniper SSG 5, Lan 2 Lan VPN

网络拓扑图如上图，ssg5 trust接口采用nat模式，映射关系如图中所指。

1、bgroup属于trust zone，ip地址10.1.1.254/24，端口模式为nat（trust zone的端口默认即为nat模式），manageable，不设另外manage ip，service options作为模板支持web ui，telnet，ssh和ping。

2、eth0/0属于untrust zone，ip地址为220.220.1.1/24，端口模式为route，manageble，不设另外manage ip，service options作为模板支持web ui，telnet，ssh和ping。

3、在端口eth0/0中设置mip。
mapped ip: 220.220.1.100
host ip: 10.1.1.100
netmask: 255.255.255.255
vrouter: trust-vr

4、在端口eth0/0设置vip
先添加virtual ip address:220.220.1.80
分别new vip service:
virtual ip: 220.220.1.80
virtual port: 80
map to service: 80
map to ip: 10.1.1.10
server auto detection: checked

virtual ip: 220.220.1.80
virtual port: 8080
map to service: 80
map to ip: 10.1.1.20
server auto detection: checked

virtual ip: 220.220.1.80
virtual port: 8800
map to service: 80
map to ip: 10.1.1.30
server auto detection: checked

可以看出mip和vip的区别，mip是一对一的ip映射，vip可以进行端口映射，ip地址的映射可以是一对多。

5、添加costom services
set service "TCP-8080" protocol tcp src-port 0-65535 dst-port 8080-8080
set service "TCP-8800" protocol tcp src-port 0-65535 dst-port 8800-8800

6、添加policy
set policy from trust to untrust any any any permit
set policy from untrust to trust "any" "MIP(220.220.1.100)" "POP3" permit log
set policy from untrust to trust "any" "VIP(220.220.1.80)" "HTTP" permit log
set policy from untrust to trust "any" "VIP(220.220.1.80)" "TCP-8080" permit log
set policy from untrust to trust "any" "VIP(220.220.1.80)" "TCP-8800" permit log

OK!

标签： Juniper SSG 5, NAT

通过两次捅小屁屁将Juniper SSG 5恢复出厂设置，console的输出

Configuration Erasure Process aborted.
Configuration Erasure Process has been initiated.
Waiting for 2nd confirmation.
2nd push has been confirmed.

标签： Juniper SSG 5, Reset