Driver Support Document

Juniper (formerly NetScreen) firewalls & VPNs, OS version 2.6.1, 5.x, 6.x

• Internal Driver Name: NetScreen
• Driver Package: NetScreen.rdp
  
• Driver Tier: 3
• Vendor: NetScreen
• Family: NetScreen
• IPv6 Support: Yes

Show Tested Devices Grid

Driver Features Support Grid

General Access

Release Notes

NAS may fail to connect if maximum logins exceeded

Netscreen devices allow a maximum of three terminal sessions. If NAS tries to log in when the maximum number of sessions are already established, then it will fail to log in to the device. All tasks requiring CLI access - including snapshost, password changes, and configuration deployments - will fail in this case.

SSH connection may fail if additional command is set

On the Netscreen devices it is possible to turn off "SSH Password Authentication" for a user. To disable this feature, enter in the CLI the "set admin scs password enable username $user" command (where $user is the desired username). By default this option is not active.

SSH versions

On the Netscreen you can enable SSH v1 or SSH v2 protocol, but not simultaneously.

Device console timeout value

The device console times out and automatically terminates sessions after 10 minutes of idle time. To prevent the device form closing the CLI session during Software Upgrade tasks, the console timeout should be set to a higher value.

Workaround:

If you want to modify the console timeout to a custom value, you must define the following custom variable:

1. Login to the system. 2. On the menu bar, select Devices and click Inventory. 3. On the Inventory page, locate the Juniper device 4. In the Actions column for the Juniper device, click the Edit option. 5. On the Edit Device page, scroll down to the Device Access Settings field. 6. Add the following Custom Setting variable: console_timeout 7. Set the Value: desired timeout in minutes 8. Click the Save Device button.

return to top

Custom Scripts and Diagnostics

Release Notes

Command scripts with multiple line banners

Command scripts that set a multiple line banner should be deployed as bulk using TFTP, rather than line-by-line using the CLI. In addition, configuration deployments that have multiple line banners should be executed using TFTP.

return to top

Password Management

Release Notes

Managing SNMP Community Strings

The system is able to add, remove and modify SNMP community strings, however, they will not become active on the device, until the user associate them with a host or a network. The command used for this purpose has the following format:
"set snmp host 'community_name' 'IP_Address/Netmask'"

Managing SNMP Community Strings

When Removing all SNMP community strings and then adding SNMP community strings that exceed the maximum number that is configurable on the device, the fall back mechanism will fail to restore the old SNMP community strings as the maximum number of SNMP community strings has already been reached.

return to top

Retrieve Running Configuration

Release Notes

TFTP Interface specification

The NetScreen allows for specification of the interface used for TFTP transmissions. Some device configurations may require this specification to use TFTP. In such cases, the TFTPInterface access variable should be set to "from <interface>" where <interface> denotes the interface from which the NA TFTP server address can be reached.

Configuraton generation failures are not detected

The device uses a redirect operator to transmit the result of "get config" by TFTP, but does not indicate any errors in the command itself, choosing instead to just send the error mesage as the data relayed by TFTP. Because of this, the error condition is not detectable by NA and will be stored as the configuration. If the device issue is corrected, the snapshot will work as expected.

return to top

Software Center

Release Notes

TFTP Interface specification

The NetScreen allows for specification of the interface used for TFTP transmissions. Some device configurations may require this specification to use TFTP. In such cases, the TFTPInterface access variable should be set to "from <interface>" where <interface> denotes the interface from which the NA TFTP server address can be reached.

return to top

Configuration Deployment to Running

Release Notes

Certain configuration commands cannot be used in deployment

The NetScreen does not accept certain commands when deploying configurations to the device. For example, the device does not allow the user to modify the command "set admin sys-location" via Deploy Configuration.

Also, the NetScreen occasionally has difficulty merging new configuration commands with the existing configuration. Opsware recommends that you verify the NetScreen configuration after you deploy it from NAS.

To veryify that your changes were correctly deployed to the running configuration, use the Compare to Previous link provided in the task details of a successful Deploy Configuration task.

TFTP Interface specification

The NetScreen allows for specification of the interface used for TFTP transmissions. Some device configurations may require this specification to use TFTP. In such cases, the TFTPInterface access variable should be set to "from <interface>" where <interface> denotes the interface from which the NA TFTP server address can be reached.

return to top

Syslog Triggering

Trigger Patterns

Devices supported by this driver trigger changes using the following patterns:
System configuration saved
System Config saved from host
User (\S+) logged out of
User (\S+) logged in for Web


User Patterns

These patterns are used to determine the username/IP responsible for a change:
/User (\S+) logged out of/
/User (\S+) logged in for Web/
/System configuration saved by (?:admin )?(\S+) via/

return to top