Juniper Networks SSG 20 User Manual
Security Products
SSG 20 Hardware Installation and Configuration Guide
Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, CA 94089
USA
408-745-2000
www.juniper.net
Part Number: 530-015646-01, Revision 03
Copyright Notice
Copyright © 2006 Juniper Networks, Inc. All rights reserved.
Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other
trademarks, service marks, registered trademarks, or registered service marks in this document are the property of Juniper Networks or their respective
owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for
any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication
without notice.
FCC Statement
The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A
digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the
equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and
used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense.
The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency
energy. If it is not installed in accordance with Juniper Networks’ installation instructions, it may cause interference with radio and television reception.
This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC
rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no
guarantee that interference will not occur in a particular installation.
If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user
is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna.
Increase the separation between the equipment and receiver.
Consult the dealer or an experienced radio/TV technician for help.
Connect the equipment to an outlet on a circuit different from that to which the receiver is connected.
Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device.
Disclaimer
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED
WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED
WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY.
2
Table of Contents
About This Guide 5
Organization .................................................................................................... 6
WebUI Conventions .........................................................................................6
CLI Conventions............................................................................................... 7
Obtaining Documentation and Technical Support ............................................8
Chapter 1
Chapter 2
Hardware Overview 9
Port and Power Connectors ...........................................................................10
Front Panel ....................................................................................................11
System Status LEDs .................................................................................11
Port Descriptions .....................................................................................13
Ethernet Ports ................................................................................... 13
Console Port .....................................................................................13
AUX Port........................................................................................... 14
Mini Physical Interface Module Port Descriptions .................................... 14
Back Panel ..................................................................................................... 16
Power Adapter.........................................................................................16
Radio Transceivers ..................................................................................16
Grounding Lug ......................................................................................... 17
Antennae Types.......................................................................................18
USB Port..................................................................................................18
Installing and Connecting the Device 19
Before You Begin ........................................................................................... 20
Installing Equipment ......................................................................................20
Connecting Interface Cables to a Device ........................................................22
Connecting the Power.................................................................................... 22
Connecting a Device to a Network .................................................................23
Connecting a Device to an Untrusted Network ........................................23
Ethernet Ports ................................................................................... 24
Serial (AUX/Console) Ports ................................................................24
Connecting Mini PIMs to an Untrusted Network ......................................24
ADSL2/2+ Mini PIM .........................................................................24
ISDN, T1, E1, and V.92 Mini PIMs.....................................................25
Connecting a Device to an Internal Network or a Workstation ................25
Ethernet Ports ................................................................................... 25
Wireless Antennae ............................................................................ 26
Chapter 3
Configuring the Device 27
Accessing a Device......................................................................................... 28
Using a Console Connection .................................................................... 28
Using the WebUI .....................................................................................29
Table of Contents 3
SSG 20 Hardware Installation and Configuration Guide
Using Telnet ............................................................................................30
Default Device Settings .................................................................................. 31
Basic Device Configuration ............................................................................33
Root Admin Name and Password ............................................................33
Date and Time.........................................................................................34
Bridge Group Interfaces ........................................................................... 34
Administrative Access .............................................................................35
Management Services.............................................................................. 35
Hostname and Domain Name ................................................................. 36
Default Route........................................................................................... 36
Management Interface Address ...............................................................36
Backup Untrust Interface Configuration ................................................... 37
Basic Wireless Configuration.......................................................................... 37
Mini PIM Configuration ..................................................................................41
ADSL2/2+ Interface ................................................................................41
ISDN Interface .........................................................................................45
T1 Interface ............................................................................................. 45
E1 Interface ............................................................................................. 46
V.92 Modem Interface .............................................................................47
Basic Firewall Protections .............................................................................. 48
Verifying External Connectivity......................................................................48
Resetting a Device to Factory Defaults ...........................................................49
Virtual Circuits ..................................................................................42
VPI/VCI and Multiplexing Method...................................................... 42
PPPoE or PPPoA ...............................................................................43
Static IP Address and Netmask..........................................................44
Chapter 4
Appendix A
Appendix B
Servicing the Device 51
Required Tools and Parts ...............................................................................51
Replacing a Mini-Physical Interface Module ...................................................51
Removing a Blank Faceplate.................................................................... 52
Removing a Mini PIM .............................................................................. 52
Installing a Mini PIM................................................................................ 53
Upgrading Memory ........................................................................................54
Specifications 57
Physical..........................................................................................................58
Electrical ........................................................................................................ 58
Environmental Tolerance ............................................................................... 58
Certifications.................................................................................................. 59
Safety ...................................................................................................... 59
EMC Emissions........................................................................................ 59
EMC Immunity ........................................................................................59
ETSI......................................................................................................... 59
T1 Interface ............................................................................................. 60
Connectors.....................................................................................................60
Initial Configuration Wizard 63
Index.......................................................................................................................... 85
4 Table of Contents
About This Guide
The Juniper Networks Secure Services Gateway (SSG) 20 device is an integrated
router and firewall platform that provides Internet Protocol Security (IPSec) virtual
private network (VPN) and firewall services for a branch office or a retail outlet.
Juniper Networks offers two models of the SSG 20 device:
SSG 20, which supports auxiliary (AUX) connectivity
SSG 20-WLAN, which supports integrated 802.11a/b/g wireless standards
Both SSG 20 devices support universal serial bus (USB) storage and two mini
physical interface module (PIM) slots that can hold any of the mini PIMs. The
devices also provide protocol conversions between local area networks (LANs) and
wide area networks (WANs).
NOTE: The configuration instructions and examples in this document are based on the
functionality of a device running ScreenOS 5.4. Your device might function
differently depending on the ScreenOS version you are running. For the latest
device documentation, refer to the Juniper Networks Technical Publications
website at http://www.juniper.net/techpubs/hardware
versions are currently available for your device, refer to the Juniper Networks
Support website at http://www.juniper.net/customers/support/
. To see which ScreenOS
.
5
SSG 20 Hardware Installation and Configuration Guide
Organization
This guide contains the following sections:
Chapter 1, “Hardware Overview,” describes the chassis and components of an
SSG 20 device.
Chapter 2, “Installing and Connecting the Device,” describes how to mount an
SSG 20 device and how to connect cables and power to the device.
Chapter 3, “Configuring the Device,” describes how to configure and manage
an SSG 20 device and how to perform some basic configuration tasks.
Chapter 4, “Servicing the Device,” describes service and maintenance
procedures for the SSG 20 device.
Appendix A, “Specifications,” provides general system specifications for the
SSG 20 device.
WebUI Conventions
Appendix B, “Initial Configuration Wizard,” provides detailed information about
using the Initial configuration Wizard (ICW) for an SSG 20 device.
To perform a task with the WebUI, you first navigate to the appropriate dialog box,
where you then define objects and set parameters. A chevron ( > ) shows the
navigational sequence through the WebUI, which you follow by clicking menu
options and links. The set of instructions for each task is divided into navigational
path and configuration settings.
The following figure lists the path to the address configuration dialog box with the
following sample configuration settings:
Objects > Addresses > List > New: Enter the following, then click OK:
Address Name: addr_1
IP Address/Domain Name:
IP/Netmask: (select), 10.2.2.5/32
Zone: Untrust
6 Organization
CLI Conventions
About This Guide
Figure 1: Navigational Path and Configuration Settings
The following conventions are used to present the syntax of CLI commands in
examples and in text.
In examples:
Anything inside square brackets [ ] is optional.
Anything inside braces { } is required.
If there is more than one choice, each choice is separated by a pipe ( | ). For
example:
set interface { ethernet1 | ethernet2 | ethernet3 } manage
means “set the management options for the ethernet1, the ethernet2, or the
ethernet3 interface.”
Variables are in italic type:
set admin user name1 password xyz
In text:
Commands are in boldface type.
Variables are in italic type.
NOTE: When entering a keyword, you need to type only enough letters to identify the
word uniquely. For example, typing set adm u kath j12fmt54 is enough to enter
the command set admin user kathleen j12fmt54. Although you can use this
shortcut when entering commands, all the commands documented here are
presented in their entirety.
CLI Conventions 7
SSG 20 Hardware Installation and Configuration Guide
Obtaining Documentation and Technical Support
To obtain technical documentation for any Juniper Networks product, visit
www.juniper.net/techpubs/
For technical support, open a support case using the Case Manager link at
http://www.juniper.net/support/
1-408-745-9500 (outside the United States).
If you find any errors or omissions in this document, please contact us at the
following email address:
techpubs-comments@juniper.net
.
or call 1-888-314-JTAC (within the United States) or
8 Obtaining Documentation and Technical Support
Chapter 1
Hardware Overview
This chapter provides detailed descriptions of the SSG 20 chassis and its
components. It contains the following sections:
“Port and Power Connectors” on page 10
“Front Panel” on page 11
“Back Panel” on page 16
9
SSG 20 Hardware Installation and Configuration Guide
Port and Power Connectors
This section describes and displays the location of the built-in ports and power
connectors. Refer to the following figure for built-in port locations and Table 1 for
the power connector descriptions.
Figure 2: Built-in Port and Mini-PIM Location
Mini-PIM 2Mini-PIM 1
SSG 20
POWER
STATUS
12
802.11a
PIM 1
PIM 2
b/g
WLAN
AUX
AUX
LINK
10/100
10/100
10/100
10/100
0/0
0/0
0/0
10/100
0/0
0/0
AUX Console 0/0 0/1 0/2 0/3 0/4
Table 1: SSG 20 Ports and Power Connectors
Port Description Connector Speed/Protocol
0/0-0/4 Enables direct connections to workstations or a LAN
connection through a switch or hub. This
connection also allows you to manage the device
RJ-45 10/100 Mbps Ethernet
Autosensing duplex and auto MDI/MDIX
through a Telnet session or the WebUI.
USB Enables a 1.1 USB connection with the system. N/A 12M (full speed) or 1.5M (low speed)
Console Enables a serial connection with the system. Used
RJ-45 9600 bps/RS-232C serial
for terminal-emulation connectivity to launch CLI
sessions.
AUX Enables a backup RS-232 async serial Internet
RJ-45 9600 bps — 115 Kbps/RS-232C serial
connection through an external modem.
Mini PIM
ADSL 2/2+ Enables an Internet connection through an ADSL
data link.
RJ-11
(Annex A)
RJ-45
(Annex B)
ANSI T1.413 Issue 2 (Annex A only)
ITU G.992.1 (G.dmt)
ITU G.992.3 (ADSL2)
ITU G.992.5 (ADSL2+)
V.92 Modem Enables a primary or backup Internet or untrusted
network connection to a service provider.
T1 Enables a connection to the T1 line to the untrusted
RJ-11 9600 bps — 115 Kbps/RS-232 serial
autosensing duplex and polarity
RJ-45 1.544 Mbps (full-time slots)
network.
E1 Enables a connection to the E1 line to the untrusted
RJ-45 2.048 Mbps (full-time slots)
network.
ISDN Enables the ISDN line to be used as the untrust or
backup interface. (S/T)
Antenna A & B
(SSG 20-WLAN)
Enables a direct connection to workstations in the
vicinity of a wireless radio connection.
RJ-45 B-channels at 64 Kbps
Leased line at 128 Kbps
RPSMA 802.11a (54 Mbps on 5GHz radio band)
802.11b (11 Mbps on 2.4 GHz radio band)
802.11g (54 Mbps on 2.4 GHz radio band)
802.11 superG (108 Mbps on 2.4 GHz and
5GHz radio bands)
10 Port and Power Connectors
Front Panel
System Status LEDs
This section describes the following elements on the front panel of an SSG 20
device:
System Status LEDs
Port Descriptions
Mini Physical Interface Module Port Descriptions
The system status LEDs display information about critical device functions. Figure 3
illustrates the position of each status LED on the front of the SSG 20-WLAN device.
The WLAN LEDs are only present on the SSG 20-WLAN device.
Figure 3: Status LEDs
12
POWER
STATUS
PIM 1
PIM 2
802.11a
b/g
WLAN
When the system powers up, the POWER LED changes from off to blinking green,
and the STATUS LED changes in the following sequence: red, green, blinking green.
Startup takes approximately two minutes to complete. If you want to turn the
system off and on again, we recommend you wait a few seconds between shutting
it down and powering it back up. Table 2 provides the name, color, status, and
description of each system status LED.
Table 2: Status LED Descriptions
Name Color Status Description
POWER Green On steadily Indicates that the system is receiving power.
Off Indicates that the system is not receiving
power.
Red On steadily Indicates that the device is not operating
normally.
Off Indicates that the device is operating
normally.
STATUS Green On steadily Indicates that the system is starting or
performing diagnostics.
Blinking Indicates that the device is operating
normally.
Red Blinking Indicates that there is an error detected.
PIM 1 Green On steadily Indicates that the mini PIM is functioning.
Blinking Indicates that the mini PIM is passing traffic.
Off Indicates that the mini PIM is not
operational.
Front Panel 11
SSG 20 Hardware Installation and Configuration Guide
Name Color Status Description
PIM 2 Green On steadily Indicates that the mini PIM is functioning.
WLAN (On WLAN device only)
802.11a Green On steadily Indicates that a wireless connection is
b/g Green On steadily Indicates that a wireless connection is
Blinking Indicates that the mini PIM is passing traffic.
Off Indicates that the mini PIM is not
operational.
established but there is no link activity.
Blinking slowly Indicates that a wireless connection is
established. The baud rate is proportional to
the link activity.
Off Indicates that there is no wireless connection
established.
established but there is no link activity.
Blinking slowly Indicates that a wireless connection is
established. The baud rate is proportional to
the link activity.
Off Indicates that there is no wireless connection
established.
12 Front Panel
Port Descriptions
This section explains the purpose and function of the following:
Ethernet Ports
Console Port
AUX Port
Ethernet Ports
Five 10/100 Ethernet ports provide LAN connections to hubs, switches, local servers,
and workstations. You can also designate an Ethernet port for management traffic.
The ports are labeled 0/0 through 0/4. For the default zone bindings for each
Ethernet port, see “Default Device Settings” on page 31.
When configuring one of the ports, reference the interface name that corresponds
to the location of the port. From left to right on the front panel, the interface names
for the ports are ethernet0/0 through ethernet0/4.
Figure 4 displays the location of the LEDs on each Ethernet port.
Figure 4: Activity Link LEDs Location
TX/RX
LINK
Table 3 describes the Ethernet port LEDs.
Table 3: LAN Port LEDs
Name Color Status Description
LINK Green On steadily
Off
TX/RX Green Blinking
Off
Port is online.
Port is offline.
Traffic is passing through. The baud rate is
proportional to the link activity.
Port might be on but is not receiving data.
Console Port
The Console port is an RJ-45 serial port wired as data circuit-terminating equipment
(DCE) that can be used for local administration. Use a straight-through cable when
using a terminal connection and a crossover cable when connecting to another DCE
device. An RJ-45 to DB-9 adapter is supplied.
See “Connectors” on page 60 for the RJ-45 connector pinouts.
Front Panel 13
SSG 20 Hardware Installation and Configuration Guide
AUX Port
The auxiliary (AUX) port is an RJ-45 serial port wired as data terminal equipment
(DTE) that can be connected to a modem to allow remote administration. We do not
recommend using this port for regular remote administration. The AUX port is
typically assigned to be the backup serial interface. The baud rate is adjustable from
9600 bps to 115200 bps and requires hardware flow control. Use a straight-through
cable when connecting to a modem and a crossover cable when connecting to
another DTE device.
See “Connectors” on page 60 for the RJ-45 connector pinouts.
Mini Physical Interface Module Port Descriptions
Each mini physical interface module (PIM) supported on a device has the following
components:
One cable connector port—Accepts a network media connector. Figure 5 shows
the available mini PIMs. You can install up to two mini PIMs in a device.
Figure 5: Mini PIMs for the SSG 20
ADSL 2/2+ B
ADSL 2 /2+ A
ISDN (BRI )
T1
E1
V.92
Two to three status LEDs—Indicate port status. Table 4 describes the meaning
SYNC
TX/RX
SYNC
TX/RX
Channel B1
Channel B2
ALARM
LOOP BACK
CD
ALARM
LOOP BACK
CD
TX/RX
CD
ADSL2/2+ Annex B
ADSL2/2+ Annex A
ISDN BRI
T1
E1
V.9 2
of the LED states.
14 Front Panel
Table 4: Mini PIM LED States on the SSG 20
Type Name Color State Description
ADSL 2/2+
(Annex A
and B)
ISDN (BRI) CH B1 Green On steadily Indicates that B-Channel 1 is active
T1/E1 ALARM Yellow On steadily Indicates that there is a local or remote
V.92 CD Green On steadily Indicates that the link is active
SYNC Green On steadily Indicates that the ADSL interface is trained
Blinking Indicates training is in progress
Off Indicates that the interface is idle
TX/RX Green Blinking Indicates that traffic is passing through
Off Indicates that no traffic is passing through
Off Indicates that B-Channel 1 is not active
CH B2 Green On steadily Indicates that B-Channel 2 is active
Off Indicates that B-Channel 2 is not active
alarm; device has detected a failure
Off Indicates that there are no alarms or failures
LOOP BACK Yellow On steadily Indicates that a loopback or line state is
detected
Off Indicates that the loopback is not active
CD Green On steadily Indicates a carrier was detected and the
internal DSU/CSU in the mini PIM is
communicating with another DSU/CSU
Off Indicates that carrier detect is not active
Off Indicates that the serial interface is not in
service
TX/RX Green Blinking Indicates that traffic is passing through
Off Indicates that no traffic is passing through
CAUTION: Mini PIMs are not hot-swappable. You must install them in the front
panel slots before powering on the device.
Front Panel 15
SSG 20 Hardware Installation and Configuration Guide
Back Panel
This section describes the following elements on the back panel of an SSG 20
device:
Power Adapter
Radio Transceivers
Grounding Lug
Antennae Types
USB Port
Figure 6: Back Panel of an SSG 20-WLAN Device
Power Adapter
Radio Transceivers
Antenna B Antenna A
USB
Device
security lock
LOCK
RESET
Reset
pinhole
DC POWER
12VA4
Power
adapter
Grounding
lug
USB port
B A
The POWER LED on the front panel of a device either glows green or is off. Green
indicates correct function, and off indicates power-adapter failure or that the device
is off.
The SSG 20-WLAN contains two wireless connectivity radio transceivers, which
support 802.11a/b/g standards. The first transceiver (WLAN 0) uses the 2.4 GHz
radio band, which supports the 802.11b standard at 11 Mbps, the 802.11g standard
at 54 Mbps, and 802.11 SuperG standard at 108 Mbps. The second radio transceiver
(WLAN 1) uses the 5GHz radio band, which supports the 802.11a standard at 54
Mbps. For information on configuring the wireless radio band, see “This section
provides information for configuring the wireless interface on the SSG 20-WLAN
device. Wireless networks consist of names referred to as Service Set Identifiers
(SSIDs). Specifying SSIDs allows you to have multiple wireless networks reside in
the same location without interfering with each other. An SSID name can have a
maximum of 32 characters. If a space is part of the SSID name string, then the
string must be enclosed with quotation marks. Once the SSID name is set, more
SSID attributes can be configured.To use the wireless local area network (WLAN)
capabilities on the device, you must configure at least one SSID and bind it to a
wireless interface.” on page 37.
16 Back Panel
Grounding Lug
A one-hole grounding lug is provided on the rear of the chassis to connect the
device to earth ground (see Figure 6).
To ground the device before connecting power, connect a grounding cable to earth
ground and then attach the cable to the lug on the rear of the chassis.
Back Panel 17
SSG 20 Hardware Installation and Configuration Guide
Antennae Types
The SSG 20-WLAN device supports three types of custom-built radio antennae:
Diversity antennae — The diversity antennae provide 2dBi directional
coverage and a fairly uniform level of signal strength within the area of
coverage and are suitable for most installations. This type of antennae is
shipped with the device.
External omnidirectional antenna — The external antenna provides 2dBi
omnidirectional coverage. Unlike diversity antennae, which function as a pair,
an external antenna operates to eliminate an echo effect that can sometimes
occur from slightly delayed characteristics in signal reception when two are in
use.
External directional antenna — The external directional antenna provides
2dBi unidirectional coverage and is appropriate for locations like hallways and
outer walls (with the antenna facing inward).
USB Port
The USB port on the back panel of an SSG 20 device accepts a universal serial bus
(USB) storage device or USB storage device adapter with a compact-flash disk
installed, as defined in the CompactFlash Specification published by the
CompactFlash Association. When the USB storage device is installed and
configured, it automatically acts as a secondary boot device if the primary
compact-flash disk fails on startup.
The USB port allows file transfers such as device configurations, user certifications,
and update version images between an external USB storage device and the
internal flash storage located in the security device. The USB port supports USB 1.1
specification at either low speed (1.5M) or full speed (12M) file transfer.
To transfer files between the USB storage device and an SSG 20, perform the
following steps:
1. Insert the USB storage device into the USB port on the security device.
2. Save the files from the USB storage device to the internal flash storage on the
device with the save {software | config | image-key} from usb filename to
flash CLI command.
3. Before removing the USB storage device, stop the USB port with the exec
usb-device stop CLI command.
4. It is now safe to remove the USB storage device.
18 Back Panel
If you want to delete a file from the USB storage device, use the delete file
usb:/filename CLI command.
If you want to view the saved file information on the USB storage device or internal
flash storage, use the get file CLI command.
Chapter 2
Installing and Connecting the Device
This chapter describes how to mount an SSG 20 device and connect cables and
power to the device. This chapter contains the following sections:
“Before You Begin” on page 20
“Installing Equipment” on page 20
“Connecting Interface Cables to a Device” on page 22
“Connecting the Power” on page 22
“Connecting a Device to a Network” on page 23
NOTE:
For safety warnings and instructions, refer to the Juniper Networks Security
Products Safety Guide. Before working on any equipment, you should be aware of
the hazards involved with electrical circuitry and be familiar with standard
practices for preventing accidents.
19
SSG 20 Hardware Installation and Configuration Guide
Before You Begin
The location of the chassis, the layout of the mounting equipment, and the security
of your wiring room are crucial for proper system operation.
WARNING: To prevent abuse and intrusion by unauthorized personnel, install the
SSG 20 device in a secure environment.
Observing the following precautions can prevent shutdowns, equipment failures,
and injuries:
Before installation, always check that the power supply is disconnected from
any power source.
Ensure that the room in which you operate the device has adequate air
circulation and that the room temperature does not exceed 104
°F (40°C).
Do not place the device in an equipment-rack frame that blocks an intake or
Correct these hazardous conditions before any installation: moist or wet floors,
Installing Equipment
You can front-mount, wall-mount, or desk-mount an SSG 20 device. The mounting
kits may be purchased separately.
To mount an SSG 20 device, you need a number-2 phillips screwdriver (not
provided) and screws that are compatible with the equipment rack (included in the
kit).
NOTE: When mounting a device, make sure that it is within reach of the power outlet.
exhaust port. Ensure that enclosed racks have fans and louvered sides.
leaks, ungrounded or frayed power cables, or missing safety grounds.
20 Before You Begin
To front-mount an SSG 20 device onto a standard 19-inch equipment rack, perform
the following steps:
Figure 7: SSG 20 Front-mount
Power
Supply
1. Align the power supply rack-mount ear to the left-front edge of the device.
2. Place the screws in the holes and use a phillips screwdriver to secure them.
3. Align the other rack-mount ear to the right-front edge of the device.
4. Place the screws in the holes and use a phillips screwdriver to secure them.
5. Mount the device on the rack with the provided screws.
6. Plug the power supply into the power outlet.
To wall-mount an SSG 20 device, perform the following steps:
Figure 8: SSG 20 Wall-mount
1. Align the wall-mount ears to the device.
2. Place the screws in the holes and use a phillips screwdriver to secure them.
3. Ensure that the wall to be used is smooth, flat, dry, and sturdy.
4. Mount the device on the wall using the provided screws.
5. Plug the power supply into the power outlet.
Installing Equipment 21
SSG 20 Hardware Installation and Configuration Guide
To desk-mount an SSG 20 device, perform the following steps:
Figure 9: SSG 20 Desk-mount
1. Attach the desktop stand to the side of the device. We recommend using the
side closest to the power adapter.
2. Place the mounted device on the desktop.
3. Plug in the power adapter and connect the power supply to the power outlet.
Connecting Interface Cables to a Device
To connect the interface cable to a device, perform the following steps:
1. Have ready a length of the type of cable used by the interface.
2. Insert the cable connector into the cable-connector port on the interface
faceplate.
3. Arrange the cable as follows to prevent it from dislodging or developing stress
points:
a. Secure the cable so that it is not supporting its own weight as it hangs to
the floor.
b. Place any excess cable out of the way in a neatly coiled loop.
c. Use fasteners to maintain the shape of the cable loops.
Connecting the Power
To connect the power to a device, perform the following steps:
1. Plug the DC-connector end of the power cable into the DC-power receptacle on
the back of the device.
2. Plug the AC-adapter end of the power cable into an AC-power source.
WARNING: We recommend using a surge protector for the power connection.
22 Connecting Interface Cables to a Device
Connecting a Device to a Network
An SSG 20 device provides firewall and general security for networks when it is
placed between internal networks and the untrusted network. This section
describes the following:
Connecting a Device to an Untrusted Network
Connecting a Device to an Internal Network or a Workstation
Connecting a Device to an Untrusted Network
You can connect your SSG 20 device to an untrusted network in one of the following
ways:
Ethernet Ports
Serial (AUX/Console) Ports
Connecting Mini PIMs to an Untrusted Network
Figure 10 shows the SSG 20 with basic network cabling connections with two blank
mini-PIMs and the 10/100 Ethernet ports cabled as follows:
The port labeled 0/0 (ethernet0/0 interface) is connected to the untrust
network.
The port labeled 0/1 (ethernet0/1 interface) is connected to a workstation in the
DMZ security zone.
The port labeled 0/3 (brgoup0 interface) is connected to a workstation in the
Trust security zone.
The Console port is connected to a serial terminal for management access.
Figure 10: Basic Networking Example
Untrust
Zone
Console
SSG 20
12
802.11a
POWER
PIM 1
PIM 2
b/g
STATUS
WLAN
AUX
AUX
DMZ
LINK
10/100
10/100
10/100
10/100
0/0
0/0
10/100
0/0
0/0
0/0
Trust
Zone
Connecting a Device to a Network 23
SSG 20 Hardware Installation and Configuration Guide
Ethernet Ports
To establish a high-speed connection, connect the provided Ethernet cable from the
Ethernet port marked 0/0 on an SSG 20 device to the external router. The device
autosenses the correct speed, duplex, and MDI/MDIX settings.
Serial (AUX/Console) Ports
You can connect to the untrusted network with an RJ-45 straight-through serial
cable and an external modem.
WARNING: Make sure that you do not inadvertently connect the Console, AUX, or
Ethernet ports on the device to the telephone outlet.
Connecting Mini PIMs to an Untrusted Network
This section explains how to connect the device mini PIMs to an untrusted network.
ADSL2/2+ Mini PIM
Connect the provided ADSL cable from the ADSL2/2+ mini PIM to your telephone
outlet. The ADSL port on the Annex A version of the device uses an RJ-11 connector,
while the Annex B version uses an RJ-45 connector. In the case of Annex B models,
the cable you connect from the ADSL port to the telephone outlet is identical in
appearance and wiring to a straight-through 10 Base-T Ethernet cable.
Connecting Splitters and Microfilters
A signal splitter divides the telephone signal into low-frequency voice signals for
voice calls and high-frequency data signals for data traffic. Your service provider
usually installs the splitter as part of the equipment that connects your site
telephone lines to the provider network.
There are also splitters that you may be able to install yourself, depending upon
your service-provider equipment. If you are installing such a splitter yourself,
connect the ADSL cable from the device and the telephone line to the appropriate
connectors (for example, “data” or “voice”) on the splitter. You connect the other
end of the splitter to the telephone outlet.
You may need to install a microfilter on each telephone, fax machine, answering
machine, or analog modem that connects to the ADSL line. The microfilter filters
out high-frequency noise on the telephone line. You install the microfilter on the
telephone line between the telephone, fax machine, answering machine, or analog
modem and the voice connector on the splitter.
24 Connecting a Device to a Network
Figure 11 shows an example of a microfilter and a splitter that you install on your
site. (You must obtain the appropriate microfilters or splitters from your service
provider.)
Figure 11: Microfilter and Splitter on Your Network Connection
DATA VOICE
SSG 20
ADSL 2+
12
POWER
PIM 1
802.11a
PIM 2
STATUS
b/g
WLAN
CONSOLEAUX
ADSL 2/2+
SYNC
TXRX
SYNC
TX/RX
TX/RX
10/100
0/0
LINK
10/100
10/100
10/100
10/100
0/1
0/2
0/4
0/5
ISDN, T1, E1, and V.92 Mini PIMs
To connect the mini PIMs to a device, perform the following steps:
1. Have ready a length of the type of cable used by the interface.
2. Insert the cable connector into the cable-connector port on the interface
faceplate.
3. Arrange the cable as follows to prevent it from dislodging or developing stress
points:
a. Secure the cable so that it is not supporting its own weight as it hangs to
the floor.
b. Place any excess cable out of the way in a neatly coiled loop.
c. Use fasteners to maintain the shape of the cable loops.
To configure the ISDN, E1, T1, or V.92 mini PIM, see “Mini PIM Configuration” on
page 41.
Connecting a Device to an Internal Network or a Workstation
You can connect your local area network (LAN) or workstation with the Ethernet
and/or wireless interfaces.
Ethernet Ports
An SSG 20 device contains five Ethernet ports. You can use one or more of these
ports to connect to LANs through switches or hubs. You can also connect one or all
of the ports directly to workstations, eliminating the need for a hub or switch. You
can use either crossover or straight-through cables to connect the Ethernet ports to
other devices. See “Default Device Settings” on page 31 for the default
zone-to-interface bindings.
Connecting a Device to a Network 25
SSG 20 Hardware Installation and Configuration Guide
Wireless Antennae
If you are using the wireless interface, you need to connect the provided antennae
on the device. If you have the standard 2dB diversity antennae, use screws to attach
them onto the posts marked A and B at the back of the device. Bend each antenna
at its elbows, making sure not to put pressure on the bulkhead connectors.
Figure 12: SSG 20-WLAN Antennae Location
Antenna B Antenna A
LOCK
B A
USB
DC POWER
RESET
12VA4
Bulkhead connectorBulkhead connector
If you are using the optional external antenna, follow the connection instructions
that came with that antenna.
26 Connecting a Device to a Network
Loading...