Juniper SRX采用Junos操作系统，简单介绍Junos的基础操作命令：

set: 建立一个配置（set system hostname srx-test）；delete:删除一个配置（delete system hostname srx-test）；commit: 建立，删除，修改配置都需要保存配置，使生效；commit check: 检测候选配置的合法性；show | compare: 查看当前配置与激活配置的区别；

system层级，用于配置防火墙系统配置，在系统配置中涉及用户，远程接入方式，日志等信息的配置：

一、创建用户（修改root用户密码，创建普通用户）

1. 修改root用户的密码
   admin@SRX# set system root-authentication plain-text-password
   New password:
   Retype new password:

[edit]

admin@SRX#

2. 创建普通用户
   admin@SRX# set system login user admin class super-user authentication plain-text-password
   New password:
   Retype new password:

[edit]

admin@SRX#

3. Junos默认的用户权限

   [edit]
   admin@SRX# set system login user admin class ?
   Possible completions:
   <class> Login class
   operator permissions [ clear network reset trace view ]
   read-only permissions [ view ]
   super-user permissions [ all ]
   unauthorized permissions [ none ]
   [edit]
   admin@SRX# set system login user admin class

4. 查看用户权限

   show cli authorization

5. 手工配置class分类，并在用户中调试新权限
   set system login class class-test permissions all
   set system login class class-test deny-configuration "shell|configuration|request"

set system login user admin class class-test

set system login user admin authentication encrypted-password "$1$u83mA/sa$aeMk9kBBqyOLRQepJkA2.1"

admin@SRX> show cli authorization

Current user: 'admin ' class 'class-test'Permissions:admin -- Can view user accounts.........all-control -- Can modify any configurationIndividual command authorization:Allow configuration regular expression: noneDeny configuration regular expression: shell|configuration|request

admin@SRX>

6. 默认junos远程用户登录网络不会超时，设置10分钟超时
   set system login class super-all idle-timeout 10
   set system login user admin class super-all .....

二、SRX防火墙创建radius认证

1. SRX防火墙指定radius服务器

   set system radius-server 10.250.0.254 secret "$9$5znCO1hKMXtuMX7-2gTz3"
   set system radius-server 10.250.0.254 source-address 10.10.1.1

2. SRX防火墙指定认证顺序，默认为本地认证
   set system authentication-order radius
   set system authentication-order password

三、SRX防火墙配置NTP时间同步

1. 配置防火墙的所在地的时区
   set system time-zone Asia/Shanghai
2. 配置NTP服务器
   set system ntp boot-server 100.100.100.1
   set system ntp server 100.100.100.1 prefer
   set system ntp source-address 10.10.1.1

注：当有多个NTP Server存在是，使用prefer优先选择

admin@SRX> set date ntp 100.100.100.1 强制NTP同步

3. 配置NTP认证

   set system ntp authentication-key 1 type md5
   set system ntp authentication-key 1 value "$9$g8aGiP5FApBk.pBIEeK4aZ"
   set system ntp server 100.100.100.1 key 1 /单个server指定认证
   set system ntp trusted-key 1 /所有Server指定认证

4. 查看NTP同步状态
   show ntp associations
   show ntp status

四、防火墙开启远程访问服务

1. 开启防火墙服务

   set system services ftp
   set system services ssh
   set system services telnet
   set system services web-management http
   set system services web-management https system-generated-certificate

2. 对服务进行优化

   （1）FTP、Telent、SSH
   set system services ftp connection-limit 10
   set system services ftp rate-limit 10
   set system services ssh root-login deny
   set system services telnet connection-limit 10
   set system services telnet rate-limit 10

   （2）WEB

   set system services web-management management-url admin
   set system services web-management http
   set system services web-management https port 8443
   set system services web-management https system-generated-certificate
   set system services web-management https interface ge-0/0/0.0

3. 在防火墙zone下开启所有服务的，否则不能访问防火墙，包括（radius和ntp协议等）
   host-inbound-traffic：允许管理流量到达防火墙自身
   [edit security zones security-zone trust]
   admin@SRX# set host-inbound-traffic system-services ?
   Possible completions:
   all All system services
   bootp Bootp and dhcp relay-agent service
   dhcp Dynamic Host Configuration Protocol
   dhcpv6 Enable Dynamic Host Configuration Protocol for IPv6
   dns DNS service
   ftp FTP
   http Web management service using HTTP
   https Web management service using HTTP secured by SSL
   ike Internet Key Exchange
   ntp Network Time Protocol service
   ping Internet Control Message Protocol echo requests
   snmp Simple Network Management Protocol service
   snmp-trap Simple Network Management Protocol traps
   ssh SSH service
   telnet Telnet service
   tftp TFTP

[edit security zones security-zone trust]

admin@SRX# set host-inbound-traffic protocols ? Possible completions:all All protocolsbfd Bidirectional Forwarding Detectionbgp Border Gateway Protocoldvmrp Distance Vector Multicast Routing Protocoligmp Internet Group Management Protocolmsdp Multicast Source Discovery Protocolnhrp Next Hop Resolution Protocolospf Open Shortest Path Firstospf3 Open Shortest Path First version 3pgm Pragmatic General Multicastpim Protocol Independent Multicastrip Routing Information Protocolripng Routing Information Protocol next generationsap Session Announcement Protocolvrrp Virtual Router Redundancy Protocol或者还有防火墙策略中放行

五、SNMP简单管理协议（v2c）

1. snmp基础配置：

   set snmp community public authorization read-only

2. snmp trap配置：
   set snmp trap-group test categories chassis
   set snmp trap-group test categories chassis-cluster
   set snmp trap-group test categories configuration
   set snmp trap-group test categories link
   set snmp trap-group test categories routing
   set snmp trap-group test categories service
   set snmp trap-group test categories startup
   set snmp trap-group test targets 100.100.100.1

六、系统日志配置

Junos的控制日志，可以给日志服务器、写在日志文件中、或者直接输出在CLI中set system syslog archive size 1mset system syslog archive world-readableset system syslog user * any emergencyset system syslog host 10.10.1.100 any noticeset system syslog host 10.10.1.100 authorization infoset system syslog file messages any noticeset system syslog file messages authorization infoset system syslog file interactive-commands interactive-commands anyset system syslog console any warningset system syslog time-format yearset system syslog source-address 10.10.1.1

set system syslog file messages match "!(kernel time sync enabled)" /*过滤日志

Junos数据平面日志，将生成的session状态信息发送给日志服务器

set security log mode streamset security log mode streamset security log source-address 10.10.1.1set security log stream log severity noticeset security log stream log host 10.10.1.10

七、设置console的参数

set system ports console log-out-on-disconnectset system ports console disable以上为Junos防火墙的基础配置，请参考！