Juniper防火墙日常维护

1. 日常操作

1.1 查看硬件信息

（1）ScreenOS

在CLI下命令为：get chassis 示例：

JP1000A-> get chassis Chassis Environment: Power Supply: Good Fan Status: Good

CPU Temperature: 98'F ( 37'C) Slot Information:

Slot Type S/N Assembly-No Version Temperature

0 System Board 0993072011000999 0066-004 F01 86'F (30'C), 87'F (31'C) 4 Management 0099082011000999 0049-004 D19 98'F (37'C) 5 ASIC Board 002079351g110017 0065-002 B00 Marin FPGA version 9, Jupiter ASIC version 1, Fresno FPGA version 110 I/O Board

Slot Type S/N Version FPGA version 2 4 port miniGBIC (0x3) 0994092011000999 B02 26 1 4 port 10/100/1000T 38 Alarm Control Information:

Power failure audible alarm: disabled Fan failure audible alarm: disabled Low battery audible alarm: disabled Temperature audible alarm: disabled Normal alarm temperature is 132'F (56'C)

Severe alarm temperature is 150'F (66'C)

《Juniper防火墙日常维护手册-v20131112》 第 5页 共59页

（2）JunOS

在CLI - 操作模式下命令为：show chassis hardware 示例：

syro@JP650A> show chassis hardware Hardware inventory:

Item Version Part number Serial number Description Chassis AJ4309AA0999 SRX650 Midplane REV 08 710-023875 AAAS7310

System IO REV 08 710-023209 AAAS9446 SRXSME System IO Routing Engine REV 14 750-023223 AAAW4729 RE-SRXSME-SRE6 FPC 0 FPC

PIC 0 4x GE Base PIC FPC 2 REV 07 750-026182 AAAS7999 FPC

PIC 0 16x GE gPIM Power Supply 0 Rev 03 740-024283 TH01999 PS 645W AC Power Supply 1 Rev 03 740-024283 TH01099 PS 645W AC

1.2 查看OS信息

（1）ScreenOS

在CLI下命令为：get system 示例：

JP1000A-> get system

Product Name: NetScreen-ISG1000

Serial Number: 0993072011000999, Control Number: 00000000

Hardware Version: 3010(0)-(04), FPGA checksum: 00000000, VLAN1 IP (0.0.0.0) Software Version: 6.1.0r7-cu12.0, Type: Firewall+VPN OS Loader Version: 1.0.2

Compiled by build_master at: Wed Apr 28 23:08:24 PDT 2010 Base Mac: 0026.889b.fa80

File Name: default (screenos_image), Checksum: de317771 , Total Memory: 1024MB

Date 01/01/2013 11:50:43, Daylight Saving Time disabled The Network Time Protocol is Enabled

Up 3286 hours 23 minutes 35 seconds Since 17Aug2012:13:27:08 Total Device Resets: 0

《Juniper防火墙日常维护手册-v20131112》 第 6页 共59页

（2）JunOS

在CLI - 操作模式下命令为：show system software 示例：

syro@JP650A> show system software Information for junos:

Comment:

JUNOS Software Release [10.4R10.7]

1.3 查看CPU/SPU使用率信息 1.3.1 查看CPU/SPU使用率信息

（1）ScreenOS —— CPU

在CLI下命令为：get performance cpu 示例：

JP1000A-> get performance cpu Average System Utilization: 1%

Last 1 minute: 2%, Last 5 minutes: 2%, Last 15 minutes: 2%

（2）JunOS —— SPU

当SPU使用率达到60%就要引起关注，可能网络或设备有异常。

在CLI - 操作模式下查看SRX Branch防火墙的SPU使用率命令为：show security monitoring fpc 0

示例：

syro@JP650A> show security monitoring fpc 0 FPC 0 PIC 0

CPU utilization : 0 % Memory utilization : 67 % Current flow session : 16

Max flow session : 524288

《Juniper防火墙日常维护手册-v20131112》 第 7页 共59页

SRX Hign-end防火墙为分布式架构，需要根据SPC卡的槽位来确定查看命令。例如SRX3600配备2块SPC，分别插在7槽 和 8槽中，需要分别查看其SPU使用率。另，SRX3600的双机采用虚拟机箱技术后，node0为主墙、node1为备墙。

在CLI - 操作模式下查看SRX3600防火墙的spu命令为：show security monitoring fpc 7 和 show security monitoring fpc 8

示例：

syro@JP3600A > show security monitoring fpc 7 node0:

--------------------------------------------------------------------------

FPC 7 PIC 0

CPU utilization : 2 % Memory utilization : 64 % Current flow session : 5265 Max flow session : 524288 Current CP session : 16401 Max CP session : 2359296

node1:

-------------------------------------------------------------------------- FPC 7 PIC 0

CPU utilization : 0 % Memory utilization : 64 % Current flow session : 5582 Max flow session : 524288 Current CP session : 17131 Max CP session : 2359296

{primary:node0}

syro@JP3600A> show security monitoring fpc 8 node0:

-------------------------------------------------------------------------- FPC 8 PIC 0

CPU utilization : 3 % Memory utilization : 66 % Current flow session : 10977 Max flow session : 1048576 Current CP session : 0

《Juniper防火墙日常维护手册-v20131112》 第 8页 共59页