How to Set Up Your SRX300 Services Gateway

The SRX300 Services Gateway consolidates security, routing, switching, Front Panel
and WAN interfaces for small retail offices. With advanced threat mitigation
capabilities, the services gateway provides cost-effective and secure Reset Config Serial Console 1G 1G SFP
button port Ethernet ports ports
connectivity.

With a desktop form-factor chassis, the SRX300 Services Gateway has six
1-Gigabit Ethernet ports, two 1-Gigabit Ethernet SFP ports, 1 USB 3.0 port,

g000732
Console port (RJ45 and mini-USB), 4 GB of DRAM memory, and 8 GB of
flash memory.

Power LEDs USB Mini-USB ESD

Package Contents button port Console port point

Verify that you have the following parts available:

•• SRX300 Services Gateway

Back Panel
•• RJ-45 cable with DB-9 adapter

g000733
•• USB cable

•• Power supply adapter

Grounding Lock Cable tie DC input
•• Power cable point holder

•• Warranty and registration information

NOTE: The SRX300 Services Gateway shipment package contains a
•• End User License Agreement
packing list. Check the parts in the shipment against the items on the
•• Quick Start Guide packing list. If anything is missing or damaged, contact your Juniper
Networks customer service representative.

Specification Value
Dimensions (D x W x H) 7.52 in. x 12.63 in. x 1.37 in.
(19.10 cm x 32.08 cm x 3.48 cm)
Chassis weight 4.38 lb (1.99 kg)

Average power consumption 24.9 W

Average heat dissipation 85 BTU/hr

Relative humidity 5% to 90%, noncondensing

1
Factory-Default Settings Initial Configuration Process
Security Policies
Install Device Connect the Power On
Source Zone Destination Zone Policy Action in a Rack Grounding Cable the Device

trust untrust permit

trust trust permit

Verify the Configure Connect to

NAT Rules

g043616
Settings Using ZTP/J-Web Management Device

Source Zone Destination Zone Policy Action

trust untrust Source NAT to untrust zone
interface NOTE: Before you begin the installation, see the Safety Guide at https://
www.juniper.net/documentation/hardware/safety-guide/translated/index.
Interfaces html.

Port Label Interface Security Zone DHCP State IP Address

0/0 and 0/7 ge-0/0/0 and untrust Client Unassigned
Install the Device in a Rack
ge-0/0/7 1. Position a mounting bracket on each side of the chassis. Use a number-1
0/1 to 0/6 VLAN Interface trust Server 192.168.1.1/24 Phillips screwdriver to install the screws that secure the mounting brackets
irb.0 (ge-0/0/1 and power supply adapter tray to the chassis.
to ge-0/0/6)

Services
Services SRX 300

SSH

HTTPS

g005160
NETCONF over SSH

Protocols 2. Place the power supply adapter in the tray.

Protocols
RSTP (all interfaces)

Screens

Screens
Basic set of screens are enabled on the untrust zone SRX 300

Device Startup Mode

g005161
Device Startup Mode
Switching

How to Set Up Your SRX300 Services Gateway 2

3. Have one person grasp the sides of the device, lift it, and position it in the rack. Connect the Grounding Cable (Optional)
Align the bottom hole in each mounting bracket with a hole in each rack rail,
1. Attach an ESD strap to an ESD point and place the other end of the strap
making sure that the chassis is level.
around your bare wrist.
4. Have a second person install a mounting screw into each of the two aligned
2. Connect the grounding cable to a proper earth ground.
holes. Use a number-3 Phillips screwdriver to tighten the mounting screws.
3. Place the grounding cable lug over the grounding point on the rear of the
chassis.

CAUTION: A licensed electrician must attach a cable lug to the

SRX3 00

grounding cable. A cable with an incorrectly attached lug can damage

the device.

4. Secure the grounding cable lug to the grounding point with the screw.

g000735
g005162

5. Install the second screw in each mounting bracket.

6. Verify that the mounting screws on one side of the rack are aligned with the
mounting screws on the opposite side and that the device is level.

The SRX300 Services Gateway can also be mounted on a desk or a wall. For
details, see the SRX300 Services Gateway Hardware Guide.

NOTE: The mounting kits are not shipped with the device and must be
ordered separately.

How to Set Up Your SRX300 Services Gateway 3

Power On the Device LED State

CAUTION: Before connecting the device to the power supply, attach an ALARM •• Solid amber (noncritical alarm).

ESD strap to an ESD point and place the other end of the strap around your •• Solid red (critical alarm).
bare wrist. •• Off (no alarms).

1. Plug the DC connector end of the power cable into the power connector on STAT •• Solid green (operating normally).
the rear of the device. •• Solid red (error detected).

PWR •• Solid green (receiving power).

•• Solid red (power failure).

•• Off (no power).

HA •• Solid green (all HA links are available).

•• Solid amber (some HA links are unavailable).

g000736
•• Solid red (HA links are not functional).

•• Off (HA is disabled).

2. Plug the AC adapter end of the power cable into an AC power outlet.
Connect the Management Device
3. Turn on the power to the AC power receptacle. 1. To configure the device using J-Web (recommended), connect any of the
4. Note the following LED indications. Wait until the STATUS LED is solid green network ports numbered 0/1 through 0/6 to the Ethernet port on the
before proceeding to the next step. management device, using an RJ-45 cable.

Ethernet port
g000734

SRX3 00

g000737
RJ-45 cable
Ethernet port

NOTE: The ge-0/0/0 and ge-0/0/7 interfaces (ports 0/0 and 0/7)
are WAN interfaces. Do not use these ports for the initial configuration
procedure.

How to Set Up Your SRX300 Services Gateway 4

2. The services gateway functions as a DHCP server and automatically assigns To configure the device automatically using ZTP:
an IP address to the management device. Ensure that the management
device acquires an IP address on the 192.168.1.0/24 network from the device. NOTE: To complete the ZTP process, ensure that the services gateway
is connected to the Internet. See the “Connect the Management Device”
If an IP address is not assigned to the management device, manually
section.
configure an IP address in the 192.168.1.0/24 network. Do not assign the
192.168.1.1 IP address to the management device, as this IP address is assigned
•• If you already have the authentication code, enter the code in the webpage
to the services gateway. By default, the DHCP server is enabled on the L3
displayed.
VLAN interface, irb.0 (interface ge-0/0/1 to ge-0/0/6), which is configured
with an IP address of 192.168.1.1/24.

3. Connect port 0/0 or 0/7 to the ISP device to obtain a dynamic IP address.

4. Access the J-Web interface (https://192.168.1.1). The recommended browser

is Internet Explorer version 10 or 11, Mozilla Firefox version 46 (or later), or
Google Chrome 55 (or later).

To configure the device using Zero Touch Provisioning, follow the procedure in
the “Configure the Device Using ZTP with Juniper Networks Network Service
Controller” section.

To configure the device using J-Web, click Skip to J-Web and follow the
procedure in the “Configure the Device Using J-Web” section.

Configure the Device Using ZTP with Juniper Networks

On successful authentication, the initial configuration is applied and
Network Service Controller committed on the services gateway. Optionally, the latest Junos OS image is
Zero Touch Provisioning (ZTP) enables you to complete the initial configuration installed on the device before the initial configuration is applied.
of the SRX300 Services Gateway in your network automatically, with minimum
•• If you do not have the authentication code, you can use the J-Web setup
intervention.
wizard to configure the services gateway. Click Skip to J-Web and follow the
Network Service Controller is a component of the Juniper Networks Contrail procedure in the “Configure the Device Using J-Web” section.
Service Orchestration platform that simplifies and automates the design and
implementation of custom network services that use an open framework.

For more information, refer to the Network Service Controller section

in the datasheet at http://www.juniper.net/assets/us/en/local/pdf/
datasheets/1000559-en.pdf.

How to Set Up Your SRX300 Services Gateway 5

Configure the Device Using J-Web Configure the Device Using the Guided Setup Mode
To configure the device using J-Web, follow the steps in this section. 1. Select the expertise level as Basic or Expert.

1. Enter the root authentication password.

2. Select one of the following setup modes:

The following table compares the Basic and Expert levels:

Options Basic Expert

Number of internal zones 3 ≥3
•• Guided Setup (uses a dynamic IP address)—Allows you to set up the allowed
device in a custom security configuration. You can select either the Basic
Internet zone configuration •• Static IP •• Static IP
or the Expert option. options
•• Dynamic IP •• Static pool
•• Default Setup (uses a dynamic IP address)—Allows you to quickly set up
•• Dynamic IP
the device with the default configuration. Any additional configuration can
be done after the wizard setup is completed. Internal zone service Allowed Allowed
configuration
•• High Availability—Allows you to set up a chassis cluster with a default basic
configuration. Internal destination NAT Not allowed Allowed
configuration

NOTE: The initial configuration requires that you specify the device
name and root password. You can skip all the other steps and go
directly to the Confirm & Apply page to apply the configuration.

How to Set Up Your SRX300 Services Gateway 6

2. Configure the basic settings: 6. Review the settings and click Apply Settings.
a. Device name
b. Password for the root account (Use the password that you entered in
Step 1 of the “Configure the Device Using J-Web” section.)
c. Time
3. Configure the security topology:
a. Internet zone (Untrust)
b. Internal zones (Trust)
c. DMZ
4. Configure the security policy:
a. Licenses (Security services)
b. DMZ policy
c. Internet and internal policies
d. Remote VPN
5. Configure Network Address Translation:
NOTE: Check the connectivity from the management device to the
a. Internal Source NAT
SRX Series device. You might lose connectivity to the SRX Series device
b. Internal Destination NAT if you have changed the internal zone IP. Click the URL for reconnection
instructions on the Confirm & Apply page to reconnect, if required.
c. DMZ Destination NAT
7. Click Done to complete the setup.

How to Set Up Your SRX300 Services Gateway 7

Configure the Device Using the Default Setup Mode the problem:

1. Configure the basic settings – device name, root account information, and •• Verify your configuration settings, and ensure that you have applied the
system time. con­figuration.

2. Configure the security policy – licenses. •• Check if the ISP-supplied device connecting your SRX Series device to the
Internet is turned on and working properly. Try turning it off and on again.

After you complete these steps, the SRX Series device can pass traffic from any
trust port to the untrust port.

NOTE: With this step, you have successfully completed the initial
configuration, and your SRX300 Services Gateway is ready for use.

Change the Configuration Settings (Optional)

After you complete the initial setup configuration, you can access the J-Web
setup wizard by clicking Configure > Device Setup > Set Up. You can either
edit the existing settings or create a new configuration. If you choose to create
a new configuration, then all the current configuration in the services gateway
will be deleted.

3. Review the settings and click Apply Settings. Click Done to complete the
setup.

You can also configure the services gateway using the CLI, by connecting to the
Console port. For details, see the SRX300 Services Gateway Hardware Guide.

Verify the Settings

Access http://www.juniper.net to ensure that you are connected to the Internet.
This connectivity ensures that you can pass traffic through the services gateway.

If the page does not load, perform the following checks to see if you can identify

How to Set Up Your SRX300 Services Gateway 8

Power Off the Device Reference
You can power off the device in one of the following ways: Technical Support
http://www.juniper.net/support/requesting-support.html
•• Graceful shutdown—Press and immediately release the Power button.
SRX300 Services Gateway Hardware Guide
•• Forced shutdown—Press the Power button, and hold it for 10 seconds.
http://www.juniper.net/techpubs/en_US/release-independent/junos/
After powering off a power supply, wait at least 60 seconds before turning it information-products/pathway-pages/hardware/srx300/index.html
back on.
Supported Transceivers
https://pathfinder.juniper.net/hct/product/#prd=SRX300
Reset the Configuration
Use the RESET CONFIG button to restore the device to the factory-default
configuration or to a rescue configuration. To press the RESET CONFIG button,
insert a small probe (such as a straightened paper clip) into the pinhole on the
front panel.

Pressing and quickly releasing the RESET CONFIG button loads and commits
the rescue configuration. The rescue configuration is a previously committed,
valid configuration set through J-Web or the CLI. The STATUS LED is solid amber
during this time.

Pressing and holding the RESET CONFIG button for 15 seconds or more,
until the STATUS LED is solid amber, deletes all configurations (backup
configurations and rescue configuration), and loads and commits the factory
configuration.

NOTE: After resetting the device, check the device status by viewing
the LEDs on the front panel. For information on the LED states, see the
“Power On the Device“ section.

Next Steps
For information on configuring features on your services gateway, refer to the
following:

•• Junos OS Documentation/Feature Configuration

http://www.juniper.net/techpubs/en_US/release-independent/junos/
information-products/pathway-pages/srx-series/product/index.html

•• Getting Started Knowledge Base Article

https://kb.juniper.net/InfoCenter/index?page=content&id=KB15694

How to Set Up Your SRX300 Services Gateway 9

Copyright © 2017, Juniper Networks, Inc. All rights reserved.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper
Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks
reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Part Number: 530-081623 Rev. 01, November 2017.