Junos® Fundamentals Series DAY ONE: FINISHING Junos DEPLOYments Before your next cutover, ask yourself: Is there anything I neglected to do? Here’s a Day One book that can help you finalize your deployments with a suite of best practices, sample configurations, and a handy checklist. By Martin Brown DAY ONE: FINISHING JUNOS DEPLOYMENTS When you are almost done with a deployment and see the straightaway to the fin- ish dead ahead—when you begin racing towards the cutover – that’s exactly when you need to take a deep breath and concentrate on the finishing touches. Is there anything important I neglected to do? Experience has taught you that while it’s probably a good deployment, you still need to consider whether anything is stopping it from becoming a great deployment. Day One: Finishing Junos Deployments is a twofold book: first, it serves as a reminder for those all-important finishing touches that should be applied to any Junos OS deploy- ment, and second, it describes how to implement those finishing touches on a network device running Junos OS. “Martin Brown takes post-Junos deployments to another level in this excellent Day One book! We sometimes forget about attention to detail in routine configuration deployments and this book goes to great lengths to ensure that no configuration item, big or small, is overlooked. This book is a time saver, headache reliever, and the pre-deployment checklist is a must!” Scott Ware, Network Security Engineer, ITS Security Technologies IT’S DAY ONE AND YOU HAVE A JOB TO DO, SO LEARN HOW TO: n Better understand Network Monitoring n Use special Junos commands to check that your configuration is working as expected n Understand how to control access to devices n Be able to deploy a more secure network device Juniper Networks Books are singularly focused on network productivity and efficiency. Peruse the complete library at www.juniper.net/books. Published by Juniper Networks Books ISBN 978-1941441145 5 1 4 0 0 9 781941 441145 Junos® Fundamentals Series Day One: Finishing Junos® Deployments By Martin Brown Preface ............................................................. vii Chapter 1: The Necessity of NTP ...................................... 11 Chapter 2: SNMP and the Health of Your Network ..................... 21 Chapter 3: The Gold Mine That Is Syslog .............................. 35 Chapter 4: Authentication, Authorization, and Accounting .............. 41 Chapter 5: Securing Device Management .............................. 51 iv © 2015 by Juniper Networks, Inc. All rights reserved. About the Author: Juniper Networks, Junos, Steel-Belted Radius, Martin Brown is a Network Security Engineer for a NetScreen, and ScreenOS are registered trademarks of major telco based in the UK, and a Juniper Ambassador Juniper Networks, Inc. in the United States and other with knowledge that covers a broad range of network countries. The Juniper Networks Logo, the Junos logo, devices. Martin started his career in IT 20 years ago and JunosE are trademarks of Juniper Networks, Inc. All supporting Macintosh computers, became an MCSE in other trademarks, service marks, registered trademarks, 1999, and has since progressed to networking, support- or registered service marks are the property of their ing most of the major manufacturers including Cisco, F5, respective owners. Juniper Networks assumes no Checkpoint, and of course, Juniper. responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, Author’s Acknowledgments: transfer, or otherwise revise this publication without I would like to thank my good friend, Joy Horton, for notice. making me take time out, relax and enjoy my down time once I’m out of the office, and Lee Wild for inspiring me Published by Juniper Networks Books to continue learning and for keeping me on my toes while Author: Martin Brown I’m in the office. I would also like to give a special thank Technical Reviewers: Riley Fitzpatrick, Carl P. Francis, you to Scott Ware for agreeing to be my technical editor Pete Robbins, Scott Ware and checking that what I’ve said is accurate, and of Editor in Chief: Patrick Ames course to Julie Wider for administering the Juniper Copyeditor and Proofer: Nancy Koerbel Ambassadors and for helping us to become more engaged Illustrator: Karen Joice in activities outside of our normal day jobs. J-Net Community Manager: Julie Wider This book is available in a variety of formats at: ISBN: 978-1-936779-14-5 (print) http://www.juniper.net/dayone. Printed in the USA by Vervante Corporation. ISBN: 978-1-936779-15-2 (ebook) Version History: v1, May 2015 2 3 4 5 6 7 8 9 10 v Welcome to Day One This book is part of a growing library of Day One books, produced and published by Juniper Networks Books. Day One books were conceived to help you get just the information that you need on day one. The series covers Junos OS and Juniper Networks networking essentials with straightforward explanations, step-by-step instructions, and practical examples that are easy to follow. The Day One library also includes a slightly larger and longer suite of This Week books, whose concepts and test bed examples are more similar to a weeklong seminar. You can obtain either series, in multiple formats: Download a free PDF edition at http://www.juniper.net/dayone. Get the ebook edition for iPhones and iPads from the iTunes Store. Search for Juniper Networks Books. Get the ebook edition for any device that runs the Kindle app (Android, Kindle, iPad, PC, or Mac) by opening your device’s Kindle app and going to the Kindle Store. Search for Juniper Networks Books. Purchase the paper edition at either Vervante Corporation (www. vervante.com) for between $12-$28, depending on page length. Note that Nook, iPad, and various Android apps can also view PDF files. Audience This book is intended for large office and Enterprise network adminis- trators and provides field-tested device and server configurations for common network deployment scenarios, as well as brief background information needed to understand and deploy these solutions in your own environment. The chapters of this book are numbered in a logical sequence designed to establish a natural progressive flow when finalizing a deployment of a network device. vi What You Need to Know Before Reading This Book Before reading this book, you should be familiar with the basic adminis- trative functions of the Junos operating system, including the ability to work with operational commands and to read, understand, and change Junos configurations. There are several books in the Day One library on learning Junos, at www.juniper.net/dayone. This book makes a few assumptions about you, the reader: You have a basic understanding of the Internet Protocol (IP) Version 4. You have access to a lab with at least the following components: one SRX-Series firewall, one EX-Series switch (with port mirroring capability), one server, and one workstation. By Reading This Book You Will Better understand Network Monitoring Know and use special Junos commands to check your configura- tion is working as expected Understand how to control access to devices Be able to deploy a more secure network device Information Experience This Day One book is singularly focused on one aspect of networking technology that you might be able to do in one day. There are other sources at Juniper Networks, from white papers to webinairs to online forums such as J-Net (forums.juniper.net). Look for the following sidebars for access directly to other superb resources for information. MORE? It’s highly recommended you go through the technical documentation in order to become fully acquainted with the initial configuration process of Junos devices in order to get a better understanding of the configura- tion process flow, before you jump in. The technical documentation can be located at www.juniper.net/documentation. Use the Pathfinder tool on the documentation site to explore and find the right information for your needs. vii Preface As network engineers, our primary focus always tends to be on getting the traffic flowing across a device, or in the case of a firewall, filtering traffic from entering the device. In either case, when we deploy a new network device we like to start assigning IP addresses to interfaces as soon as we can; we want to enable a routing protocol, create VRFs, assign RDs, and set the device as a PE router before finally testing reachability across the LAN. Then, once we know we are able to reach the furthest corners of our WAN, we feel an amazing sense of satisfaction that we have created an integral part of a network that will hopefully remain in place for years to come. In other words, we are almost done with the deployment and we see a straightaway dead ahead and begin racing towards the cutover. However, many a network engineer will attest that now is exactly the time you need to stop and think: Is there anything important I have neglected to do? Experience has taught you that while this is probably a good deployment, you should consider whether anything is stopping it from becoming a great deployment. The purpose of this book is twofold: first, it serves as a reminder for those all-important finishing touches that should be applied to any Junos OS deployment, and second, it describes how to implement those finishing touches on a network device running Junos OS. At the end of this preface there is a checklist that breaks the tasks up into five general categories: NTP, SNMP, system log (syslog), AAA, and Secure Device Management. The remainder of this book then provides a high-level view of the technologies in the checklist, dividing each into its own chapter describing the technology and any pros and cons of particu- lar versions and then detailing how to implement the technology on a device running Junos OS and how to test its functionality.