当前位置：文档之家 › NSM升级手册

NSM升级手册

  • 格式：docx
  • 大小：5.53 MB
  • 文档页数：74

NSM升级手册目录NSM升级手册 (1)一、NSM恢复出厂设置及版本升级 (1)二、NSM攻击特征库更新 (18)三、添加MIP地址 (23)四、SNMP 配置 (25)五、IDP-Policy添加 (31)六、防火墙及IDP设备添加 (45)七、NSM主备切换及恢复 (68)八、删除设备 (71)一、NSM恢复出厂设置及版本升级1、恢复出厂设置（1）将主备两台NSM恢复出厂设置的U盘插在NSM的USB口上，并重启设备重启设备命令：reboot（2）等设备重启后进入到安装界面，输入erase-re install，开始恢复出厂设置（3）恢复完后输入用户名和密码进入命令行界面用户名：admin密码：abc123（4）检查当前NSM版本，确认是否完成恢复出厂设置2、Master NSM版本升级（1）在本地用3CD软件搭建FTP服务器，利用FTP将升级所需文件导入到NSM中升级所需文件：nsm2012.2R8-systemupdate-linux.zipnsm2012.2R8_servers_linux_x86.zip（2）解压系统更新文件（3）解压Linux文件（4）设置参数（按照如下配置设置参数）参数设置如下：########## GATHERING INFORMATION ##########1) Install Device Server only2) Install GUI Server only3) Install both Device Server and GUI ServerEnter selection (1-3) []> 3Do you want to do NSM installation with base license? (y/n) [y]> Enter base directory location for management servers [/usr/netscreen]> ==> Set to /usr/netscreenEnable FIPS Support? (y/n) [n]>Select Device Schema to be loaded in NSM1) Load all Device Family Schemas2) Load Screen OS Device Schema only (Screen OS)3) Load Screen OS and J/SRX Devices Schema only (Screen OS + J/SRX Series)Enter selection (1-3)[1]> 1########## GENERAL SERVER SETUP DETAILS ##########Will this machine participate in an HA cluster? (y/n) [n]> yIs this machine the primary server for the HA cluster? (y/n) [y]> WARNING: The servers need to be stopped on the secondary server during the installation of this software to avoid data corruption.########## DEVICE SERVER SETUP DETAILS ##########Will the Device Server data directory be located on a shared disk partition? (y/n) [n]>The Device Server stores all of the user data under a single directory.By default, this directory is /var/netscreen/DevSvr. Becausethe user data (including logs and policies) can grow to be quitelarge, it is sometimes desirable to place this data in another partition.Please enter an alternative location for this data ifso desired, or press ENTER for the location specified in the brackets.==> Set to /var/netscreen/DevSvr########## GUI SERVER SETUP DETAILS ##########Will the GUI Server data directory be located on a shared disk partition? (y/n) [n]>The GUI Server stores all of the user data under a single directory.By default, this directory is /var/netscreen/GuiSvr. Becausethe user data (including database data and policies) can grow to be quite large, it is sometimes desirable to place this data in another partition.Please enter an alternative location for this data ifso desired, or press ENTER for the location specified in the brackets.==> Set to /var/netscreen/GuiSvrThe GUI Server stores all of the database logs under a single directory. By default, this directory is /var/netscreen/GuiSvr/xdb/log. Becausethe database log can grow to be quitelarge, it is sometimes desirable to place this log in another partition.Please enter an alternative location for this log ifso desired, or press ENTER for the location specified in the brackets.Enter database log directory location [/var/netscreen/GuiSvr/xdb/log]> Enter the management IP address of this server [172.17.245.44]> Enter the https port for NBI service [8443]>Setting GUI Server address and port to 172.17.245.44:7801 for Device ServerPlease enter a password for the 'super' userEnter password (password will not display as you type)>Please enter again for verificationEnter password (password will not display as you type)>Enter the one-time password for this Gui ServerEnter password (password will not display as you type)>Please enter again for verificationEnter password (password will not display as you type)>Will a Statistical Report Server be used with this GUI Server? (y/n) [n]> ==> CFM user is set to 'cfmuser'CFM password for user 'cfmuser'Enter password (password will not display as you type)>Please enter again for verificationEnter password (password will not display as you type)>Please try again. First entry does not match second entry.CFM password for user 'cfmuser'Enter password (password will not display as you type)>Please enter again for verificationEnter password (password will not display as you type)>Enter the same password again for CFM userChanging password for user cfmuser.New UNIX password:BAD PASSWORD: it is too simplistic/systematicRetype new UNIX password:passwd: all authentication tokens updated successfully.########## HIGH AVAILABILITY (HA) SETUP DETAILS ########## Enter the IP address for the primary HA Server [172.17.245.44]>Enter the IP address for the secondary HA Server []> 172.17.245.43 NOTE: Please make sure the heartbeat PASSWORD is the same for primary andsecondary machines.Please enter shared password that will be used for Heartbeat authenticationEnter password (password will not display as you type)>Please enter again for verificationEnter password (password will not display as you type)>Enter number of Heartbeat links between the primary and secondary machines [1]>NOTE: Heartbeat link(s) are needed between the primary and secondary machines.The IP addresses entered here must be correct and match on both ends ofthe link for automatic failover to function correctly.Enter the IP address for this machine's primary heartbeat link[172.17.245.44]>Enter the IP address for the peer's primary heartbeat link[172.17.245.43]>Enter the port used for heartbeat communication [7802]>Minimum HA failover time is 60 seconds.The heartbeat message interval times the number of missing heartbeatsmust equal at least this value.Using the defaults is recommended.Enter a time interval (seconds) between heartbeat messages [15]> Enter number of missing heartbeat messages before automatic switchover occurs [4]>An IP address outside the HA cluster is needed to monitor this server's network connection.Enter an IP address outside of the cluster []> 172.17.245.249Enter the rsync replication timeout [3600]>Enter HA directory [/var/netscreen/dbbackup]>The HA server(s) requires that you have previously installed the rsync program.Enter the full path to rsync [/usr/bin/rsync]>The HA server(s) requires that you have previously installed the ssh program.Enter the full path for the ssh command [/usr/bin/ssh]>Note: A trust relationship between the primary and thesecondary server, via ssh-keygen, is a requirement for theremote replication to work properly.Please reset the trust relationship with 'nsm' user.Here are sample commands:cd /home/nsmsu nsmssh-keygen -t rsachmod 0700 .ssh-- then copy .ssh/id_rsa.pub to the peer machines' .ssh/authorized_keys ########## BACKUP SETUP DETAILS ##########Will this machine require local database backups? (y/n) [y]>Enter hour of day to start the database backup (00 = midnight, 02 = 2am, 14 = 2pm ...)[02]>Will daily backups need to be sent to a remote machine? (y/n) [n]> Enter number of database backups to keep [7]>Enter the rsync backup timeout [3600]>########## DEVSVR DB SETUP DETAILS ##########Enter Postgres DevSvr Db port [5432]>Enter Postgres DevSvr Db super user [nsm]>Enter Postgres DevSvr Db password for user 'nsm'Enter password (password will not display as you type)>Please enter again for verificationEnter password (password will not display as you type)>########## POST-INSTALLATION OPTIONS ##########Start High Availability daemon processes when finished? (y/n) []> y########## CONFIRMATION ##########About to proceed with the following actions:- Install Device Server- Install GUI Server- Install High Availability Server- This machine will have base license with maximum 25 devices- Store base directory for management servers as /usr/netscreen- All Device Families Schemas Load- This machine participates in an HA cluster- This server is the primary: Yes- Store Device Server data in /var/netscreen/DevSvr- Store GUI Server data in /var/netscreen/GuiSvr- Store GUI Server database log in /var/netscreen/GuiSvr/xdb/log- Use IP address 172.17.245.44 for management- Use port 8443 for NBI Service- Connect to GUI Server at 172.17.245.44:7801- Set password for 'super' user- CFM user: cfmuser- CFM Password set for 'cfmuser'- IP address for the primary HA Server: 172.17.245.44- IP address for the secondary HA Server: 172.17.245.43- Set shared password for heartbeat- Number of Heartbeat links: 1- IP address for this machine's primary heartbeat link: 172.17.245.44 - IP address for the peer's primary heartbeat link: 172.17.245.43- IP address for remote HA replications: 172.17.245.43- Port for HA heartbeat communication: 7802- Seconds between heartbeat messages: 15- Missing heartbeat messages: 4- Outside pingable IP address: 172.17.245.249- Become primary in the event of a tie: y- HA rsync command replication timeout: 3600- Create database backup in /var/netscreen/dbbackup- Use rsync program at /usr/bin/rsync- Path for the ssh command: /usr/bin/ssh- Local database backups are enabled- Start backups at 02- Daily backups will not be sent to a remote machine- Number of database backups to keep: 7- HA rsync command backup timeout: 3600- Postgres DevSvr Db Server port: 5432- Postgres DevSvr Db super user: nsm- Postgres DevSvr Db password set for 'nsm'- Start High Availability daemon processes when finished: YesAre the above actions correct? (y/n)> y########## PERFORMING INSTALLATION TASKS ##########----- INSTALLING Device Server -----Looking for existing RPM package............................okRemoving existing Device Server RPM.........................okInstalling Device Server RPM................................okInstalling JRE..............................................okInstalling GCC..............................................okCreating var directory......................................okCreating /var/netscreen/dbbackup............................okPutting NSROOT into start scripts...........................okFilling in Device Server config file(s).....................okSetting permissions for Device Server.......................ok----- Setting up PostgreSQL for DevSvr -----Setting up PostgreSQL for DevSvr............................ok Installation of Device Server complete.----- INSTALLING GUI Server -----Looking for existing RPM package............................ok Removing existing GUI Server RPM............................okInstalling GUI Server RPM...................................okInstalling JRE..............................................okInstalling GCC..............................................okCreating var directory......................................okPutting NSROOT into start scripts...........................okFilling in GUI Server config file(s)........................okSetting permissions for GUI Server..........................okRunning generateMPK utility.................................okRunning fingerprintMPK utility..............................okInstallation of GUI Server complete.----- INSTALLING HA Server -----Looking for existing RPM package............................ok Removing existing HA Server RPM.............................okInstalling HA Server RPM....................................okCreating var directory......................................okPutting NSROOT into start scripts...........................okFilling in HA Server config file(s).........................okSetting permissions for HA Server...........................ok Installation of HA Server complete.----- SETTING START SCRIPTS -----Disabling Device Server start script........................okDisabling GUI Server start script...........................okEnabling HA Server start script.............................ok########## PERFORMING POST-INSTALLATION TASKS ########## Running nacnCertGeneration..................................okRunning idpCertGeneration...................................okConverting GuiSvr SetDB to XDB .............................okLoading GuiSvr XDB data from init files ....................okRunning webproxy Cert Generation............................okRemoving staging directory..................................okStarting HA Server..........................................okNOTES:- Installation log is stored in/usr/netscreen/DevSvr/var/errorLog/netmgtInstallLog.20150512142603 - Please note that TCP port 7808 is being used for server-UI communication- This is the GUI Server fingerprint:A9:4A:60:76:34:F0:9A:E6:2E:0B:98:FF:B6:C0:8B:7E:4C:2D:47:8AYou will need this for verification purposes when logging into the GUI Server. Please make a note of it.（5）检查版本信息（6）检查设备服务状态3、Backup NSM设备升级（1）升级过程参考Master NSM设备升级步骤注意：如下操作与Master NSM不同########## GENERAL SERVER SETUP DETAILS ##########Will this machine participate in an HA cluster? (y/n) [n]> yIs this machine the primary server for the HA cluster? (y/n) [y]> n WARNING: The servers need to be stopped on the secondary server during the installation of this software to avoid data corruption. （2）检查设备服务状态（3）检查HA状态4、两台NSM建立SSH信任关系 Master：Backup：版本升级完成！二、NSM攻击特征库更新1、上传特征库更新文件所需文件为：NSM-SecurityUpdateInfo.dat NSMFP17-DI-IDP.zip2、用NSM客户端登陆3、设置更新文件路径（1）点击导航栏中的Tools，选中Preferences（2）点击左侧Attack Object，在Download URL ScreenOS Device 文本框中输入更新文件路径，点击OK（注意：两个打钩的选项均不要选）文件路径为：file://tmp/NSM-SecurityUpdateInfo.dat4、更新特征库（1）点击导航栏中的Tools，选中View/Update NSM Attack Database（2）点击Next（3）点击Finish（4）等待更新完成特征库更新完成三、添加MIP地址1、添加Master设备的MIP地址（1）在左侧栏Administer中选中Servers，并双击右侧窗口中的条目双击（2）点击“+”图标添加MIP地址（3）填写MIP地址，点击OK2、选中HA栏，添加Backup设备的MIP地址，步骤同上四、SNMP 配置1、在左侧栏Administer中选中Action Manager中的Action Parameters，并双击右侧窗口中的条目双击2、在SNMP栏中点击“+”，添加SNMP地址3、填写SNMP管理名称、管理地址和Community，点击OK4、log Action Criteria配置（1）在左侧栏Administer中选中Action Manager中的Device Log Action Criteria，点击“+”（2）点击Severity栏，勾选Critical（3）点击Actions栏，勾选Send SNMP Traps，并点击勾选栏下方的编辑图标（4）将SNMP管理地址添加到右边的窗口中，点击OK五、IDP-Policy添加1、创建IDP-Policy （1）右击Policy右击这里（2）添加Policy名称为IDP-Policy，点击下一步（3）选择Stand Alone IDP Device，点击下一步（4）选择Empty Policy，点击下一步（5）点击Finish2、添加IDP Policy（1）点击创建好的IDP Policy，右击条目中的，Attacks，打开Select Attacks右击这里（2）点开Attack Group-IDP Objects，选中All Attacks，添加到右侧窗口中，点击OK（3）右击中间窗口上方的“IDP”标题，选择Security Policies中的Add Exempt Rulebase右击“IDP”（4）点击“+”图标，选择Add Rule（5）右击创建好的条目的Source列，选择Select Address（6）点击“+”图标，添加地址（7）在Name文本框中输入policy 的Source地址名称，在IP Address文本框中输入Source地址注：此次测试中所有的地址Name与IP Address相同（8）将建好的地址添加到右侧的窗口中，点击OK（9）右击条目中的Destination列，选择Select Address（10）点击“+”图标，添加地址（11）在Name文本框中输入policy 的Destination地址名称，在IP Address文本框中输入Destination地址（12）将建好的地址添加到右侧的窗口中，点击OK（13）右击条目中的Attacks列，选择Select Attacks（14）在Attack Group-IDP Objects中找到条目想对应的Attack，并添加到右侧窗口中，点击OK（15）再次创建第二条策略，步骤同上（16）如果Source地址或者Destination地址为一个地址组，则先创建一个地址组，再将地址加入到地址组中（17）如果Source地址或者Destination地址是一个地址段，则选择Add Network，添加一个地址段六、防火墙及IDP设备添加1、在NSM上添加直连防火墙设备（无需MIP）（1）在左侧栏Configure中选中Device Manager中的Devices，点击右侧窗口的“+”图标，选中Cluster（2）填写Cluster名称，并且选择设备的型号、OS名称和版本，点击OK（3）选中创建好的Cluster，点击“+”，选中Cluster Member（4）填写防火墙设备名称，点击Next（5）填写防火墙设备的管理IP地址，登陆时的用户名和密码，点击Next（6）在获得SSH Key后点击Next（7）此处防火墙设备是直连设备，无需MIP地址设置，点击Next（8）点击Next和Finish完成添加。

合集下载

华三路由器软件升级指南

华三路由器软件升级指南

8.1 CMW710-R0106P02 版本解决问题列表 ···························································································· 10 8.2 CMW710-R0106 版本解决问题列表··································································································· 11 8.3 CMW710-R0105P12 版本解决问题列表 ···························································································· 12 8.4 CMW710-R0105P06 版本解决问题列表 ···························································································· 13 8.5 CMW710-R0105 版本解决问题列表··································································································· 13 8.6 CMW710-E0104 版本解决问题列表··································································································· 14 8.7 CMW710-E0102 版本解决问题列表··································································································· 14 8.8 CMW710-E0006P02 版本解决问题列表 ···························································································· 14 9 相关资料 ············································································································································· 14 9.1 相关资料清单······································································································································ 14 9.2 资料获取方式······································································································································ 15 10 技术支持 ··········································································································································· 15 附录 A 本版本支持的软、硬件特性列表································································································· 16 A.1 版本硬件特性 ····································································································································· 16 A.2 版本软件特性 ····································································································································· 23
俊弘网络NSMXpress和NSM3000产品说明书

俊弘网络NSMXpress和NSM3000产品说明书

DATASHEETProduct DescriptionJuniper Networks ® NSMXpress and NSM3000 are purpose built security hardenedappliance versions of Juniper Networks Network and Security Manager (NSM) optimized towards providing a single centralized management solution to effectively manage Juniper Networks family of devices including routers, switches, and firewalls.While the NSMXpress is primarily geared towards small to mid market, the NSM3000 scales to the requirements of large enterprise customers with the capability to manage up to 1,500 devices. These appliances, which install in minutes with high availability (HA) support, not only simplify the complexity of device administration by providing a single integrated management interface that controls every device parameter, but also eliminate the need to have dedicated resources for maintaining the management solution. NSM3000 and NSMXpress have the following features:• Provides an appliance version of NSM with a security hardened OS• Offers centralized, end-to-end device life cycle management for granular control of configuration, network settings and security policies • Allows for delegation of administrative roles, which provides relevant access to those who need it • Offers easy installation with operational efficiency that delivers lower total cost of ownership (TCO)• Provides dedicated HA supportProduct OverviewNow more than ever, networkoperators need the ability to easily manage security policies and tohave visibility into potential security concerns in the network. At thesame time, they need to invest their time in monitoring and operating secure networks. Juniper Networks NSM3000 and NSMXpress enable IT departments not only to control the entire device life cycle with a single, centralized solution, but also provides visibility with a complete set of investigative and reporting tools.NSM3000)Features and BenefitsHardened OSJuniper Networks security team monitors and maintains the OS, which is optimized for performance and ers don’t have to worry about security vulnerabilities, support or patch management for the OS.Firewall/VPN (SSG5, SSG20, SRX100,SRX110, SRX210, SRX220, SRX240, SRX550, and SRX650)3001500NSM3000in HA ModeNSM User InterfaceNSM3000SA SeriesFirewall/VPN EX Series NSM3000AdministrationWeb UIFigure 1: Managed Juniper Networks devicesNSMXPRESSNSM3000SpecificationsJuniper Networks Services and Supporthigh-performance network. Our services allow you to maximize operational efficiency while reducing costs and minimizingrisk, achieving a faster time to value for your network. Juniper Networks ensures operational excellence by optimizing the network to maintain required levels of performance, reliability, and availability. For more details, please visit /us/en/products-services.Juniper Networks Device and Software Support• EX Series Ethernet Switches• IC Series Unified Access Control AppliancesIC Series version 2.2 and above• ISG Series Integrated Security Gateways• IDP Series Intrusion Detection and Prevention Appliances IDP Series version 4.0 and above• J Series Services Routers• M Series Multiservice Edge Routers• MX Series 3D Universal Edge Routers• SRX Series Services Gateways• NetScreen Series Security SystemsScreenOS version 5.0.0 and above• SA Series SSL VPN AppliancesSA Series version 6.3 and above• SSG Series Secure Services Gateways• Junos® Operating System SupportJunos OS version 9.0 and above; forward support for Junos OS 9.6 software through schema updateNote: For more information on Network and Security Manager, please refer to the datasheet.About Juniper NetworksJuniper Networks is in the business of network innovation. From devices to data centers, from consumers to cloud providers, Juniper Networks delivers the software, silicon and systems that transform the experience and economics of networking. The company serves customers and partners worldwide. Additional information can be found at .1000204-007-EN Apr 2014Copyright 2014 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Junos and QFabric are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All othertrademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.APAC and EMEA Headquarters Juniper Networks International B.V. Boeing Avenue 240 1119 PZ Schiphol-RijkAmsterdam, The Netherlands Phone: +31.0.207.125.700 Fax: +31.0.207.125.701Corporate and Sales Headquarters Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USAPhone: 888.JUNIPER (888.586.4737) or +1.408.745.2000 Fax: +1.408.745.2100 To purchase Juniper Networks solutions, please contact your Juniper Networks representative at +1-866-298-6428 or authorized reseller.。

国内航行船舶实施公司SMS须知

国内航行船舶实施公司SMS须知

国内航行船舶实施公司SMS须知1．目的根据国际安全管理规则（ISM）实施的要求，我司编制和实施了国际航行船舶（入级船舶）安全管理体系（SMS），由于国内安全管理规则（NSM）将于07年7月1日全面实施.我司又把国内航行船舶也纳入了该体系实施的范畴。

鉴于ISM和NSM实施的对象和要求有所区别，为避免国内航行船舶实施该体系产生要求过高的想法，特别制定本须知，目的是对国内航行船舶实施该体系的一些适用法律、法规及通常的做法进行调整，使该体系更适用于国内航行船舶。

2．ISM和NSM区别2.1 NSM规则1.2.1“水域环境”代替ISMC1.2.1“海域环境”，理解为“需适用航行于内河和湖泊的船舶。

2.2 NSM规则1.4.2“有关规定和标准”代替ISMC1.4.2“有关的国际和船旗国立法”，因为：国内航行船舶不必要符合“国际立法”；“有关规定和标准”比“立法”更具体，更具备可操作性。

2.3 NSM规则1.4.2“工作程序和须知”代替ISMC1.4.2“须知和程序”，表明“程序”和“须知”的关系。

2.4 NSM规则1.4.6“内部评审、有效性评价”代替ISMC1.4.6“内部评审”，分清“内审和有效性评价”两项管理活动。

2.5 NSM规则3.1要求船东和船舶管理人双方都必须“向主管机关报告”（ISMC仅船东有此报告责任），并将“船舶管理协议”及其内容由ISMC的审核规则提升为管理规则。

2.6 NSM规则3.2“执行以及审核监控”代替“从事和审核”，分工更为合理。

2.7 NSM规则3.3明确规定了“提供足够的资源和岸基支持”的途径：公司提供给（“对其”）指定人员—指定人员提供给船舶；ISMC未规定提供途径，只要求“提供足够的资源和岸基支持”，可直接提供给船舶。

2.8 NSM规则4 设置指定人员的目的是“直接同最高管理层联系，提供公司与船舶的联系渠道”，不再包括ISMC“保证各船舶的安全营运”；同时增加了指定人员“对岸上机构安全管理活动的监控”的职责和权利。

ScreenOS升级指导手册

ScreenOS升级指导手册

ScreenOS升级指导手册ScreenOS防火墙升级方案V1.0Juniper Networks.目录1.升级前准备 (3)1.1. 配置备份 (3)1.2. 检查两台防火墙是否同步 (5)2.升级步骤 (5)2.1. 升级备用机器OS (5)2.2. 升级主用机器OS (6)2.3. 测试 (6)6.系统回退 (6)7.TFTP设置 (6)1. 升级前准备（1）对集群里的2台防火墙都分别进行备份，将配置文件、OS 备份。

（2）升级中需要提前准备好console线，并且在白天提前检查配置是否同步。

（3）升级之前需要准备好TFTP软件并且熟悉TFTP软件设置，建议使用cisco tftp。

1.1. 配置备份选择Configuration >Update > Config file > Save TO File选择配置文件保存的目录。

1.2. 检查两台防火墙是否同步防火墙配置同步检查，包括检查两台防火墙配置是否相同和两台防火墙的RTO是否同步。

在防火墙console端口执行命令：exec nsrp sync global check-sum防火墙输出有两种情况：1、Warning: configuration out of sync，说明防火墙配置或RTO不同步，需要检查配置或执行RTO同步。

建议用对比软件（例如UltraEdit）比较两台防火墙的配置文件，找出差异并进行相应的修改。

2、configuration in sync (local checksum XXX == remote checksum XXX)说明防火墙配置同步。

2. 升级步骤(下面举例说明升级SSG520M/550M本SSG500M 6.3.0r17,如是单机升级，请按照步骤2.1进行升级)2.1. 升级备用机器OS（1）将OS文件解压，放到TFTP的根目录，然后运行tftp软件。

（2）利用SSH或者telnet登陆到防火墙上。