How To Manage A Network On A Microsoft Ipsec Server (Networking) On A Pcode (Netware) On An Ipsec 2.5 (Network) On Pcode On A Network (Netnet) On Your Pcode

Transcription

1 WX Application Acceleration Platforms WX Central Management System (CMS) Administrator s Guide Release September 2010 Juniper Networks, Inc North Mathilda Avenue Sunnyvale, CA USA

2 Copyright Notice This product includes the Envoy SNMP Engine, developed by Epilogue Technology, an Integrated Systems Company. Copyright , Epilogue Technology Corporation. All rights reserved. This program and its documentation were developed at private expense, and no part of them is in the public domain. This product includes memory allocation software developed by Mark Moraes, copyright 1988, 1989, 1993, University of Toronto. This product includes FreeBSD software developed by the University of California, Berkeley, and its contributors. All of the documentation and software included in the 4.4BSD and 4.4BSD-Lite Releases is copyrighted by the Regents of the University of California. Copyright 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, The Regents of the University of California. All rights reserved. GateD software copyright 1995, the Regents of the University. All rights reserved. Gate Daemon was originated and developed through release 3.0 by Cornell University and its collaborators. Gated is based on Kirton's EGP, UC Berkeley's routing daemon (routed), and DCN's HELLO routing protocol. Development of Gated has been supported in part by the National Science Foundation. Portions of the GateD software copyright 1988, Regents of the University of California. All rights reserved. Portions of the GateD software copyright 1991, D. L. S. Associates. This product includes software developed by Maker Communications, Inc., copyright 1996, 1997, Maker Communications, Inc. Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785. Juniper Networks, the Juniper Networks logo, JUNOS, NetScreen, ScreenOS, and Steel-Belted Radius are registered trademarks of Juniper Networks, Inc. in the United States and other countries. JUNOSe is a trademark of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Copyright 2010 Juniper Networks, Inc. All rights reserved. FCC Statement The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with the instruction manual, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/tv technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected. Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device and may result in the equipment no longer complying with FCC requirements for Class A or Class B digital devices. In that event, your right to use the equipment may be limited by FCC regulations, and you may be required to correct any interference to radio or television communications at your own expense. U.S. Government Rights Commercial software and commercial software documentation: This documentation is commercial computer software documentation and the products (whether hardware or software) covered by this documentation are or contain commercial computer software. Government users are subject to the Juniper Networks, Inc. standard end user license agreement and any applicable provisions of the FAR and its supplements. No further rights are granted. Products (whether hardware or software) covered by, and information contained in, this documentation are controlled by U.S. Export Control laws and may be subject to the export or import laws in other countries. Nuclear, missile, chemical, biological weapons end uses or end users, whether direct or indirect, are strictly prohibited. Export or re-export to countries subject to U.S. embargo or to entities identified on US export exclusion lists, including, but not limited to, the denied persons and specially designated national lists, is strictly prohibited. ii

3 Disclaimer THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. End User License Agreement READ THIS END USER LICENSE AGREEMENT ("AGREEMENT") BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE. BY DOWNLOADING, INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS CONTAINED HEREIN, YOU (AS CUSTOMER OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO BIND THE CUSTOMER) CONSENT TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED HEREIN, THEN (A) DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE, AND (B) YOU MAY CONTACT JUNIPER NETWORKS REGARDING LICENSE TERMS. 1. The Parties. The parties to this Agreement are (i) Juniper Networks, Inc. (if the Customer's principal office is located in the Americas) or Juniper Networks (Cayman) Limited (if the Customer's principal office is located outside the Americas) (such applicable entity being referred to herein as "Juniper"), and (ii) the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable license(s) for use of the Software ("Customer") (collectively, the "Parties"). 2. The Software. In this Agreement, "Software" means the program modules and features of the Juniper or Juniper-supplied software, for which Customer has paid the applicable license or support fees to Juniper or an authorized Juniper reseller, or which was embedded by Juniper in equipment which Customer purchased from Juniper or an authorized Juniper reseller. "Software" also includes updates, upgrades and new releases of such software. "Embedded Software" means Software which Juniper has embedded in or loaded onto the Juniper equipment and any updates, upgrades, additions or replacements which are subsequently embedded in or loaded onto the equipment. 3. License Grant. Subject to payment of the applicable fees and the limitations and restrictions set forth herein, Juniper grants to Customer a non-exclusive and non-transferable license, without right to sublicense, to use the Software, in executable form only, subject to the following use restrictions: a. Customer shall use Embedded Software solely as embedded in, and for execution on, Juniper equipment originally purchased by Customer from Juniper or an authorized Juniper reseller. b. Customer shall use the Software on a single hardware chassis having a single processing unit, or as many chassis or processing units for which Customer has paid the applicable license fees; provided, however, with respect to the Steel-Belted Radius or Odyssey Access Client software only, Customer shall use such Software on a single computer containing a single physical random access memory space and containing any number of processors. Use of the Steel-Belted Radius or IMS AAA software on multiple computers or virtual machines (e.g., Solaris zones) requires multiple licenses, regardless of whether such computers or virtualizations are physically contained on a single chassis. c. Product purchase documents, paper or electronic user documentation, and/or the particular licenses purchased by Customer may specify limits to Customer's use of the Software. Such limits may restrict use to a maximum number of seats, registered endpoints, concurrent users, sessions, calls, connections, subscribers, clusters, nodes, realms, devices, links, ports or transactions, or require the purchase of separate licenses to use particular features, functionalities, services, applications, operations, or capabilities, or provide throughput, performance, configuration, bandwidth, interface, processing, temporal, or geographical limits. In addition, such limits may restrict the use of the Software to managing certain kinds of networks or require the Software to be used only in conjunction with other specific Software. Customer's use of the Software shall be subject to all such limitations and purchase of all applicable licenses. d. For any trial copy of the Software, Customer's right to use the Software expires 30 days after download, installation or use of the Software. Customer may operate the Software after the 30-day trial period only if Customer pays for a license to do so. Customer may not extend or create an additional trial period by re-installing the Software after the 30-day trial period. e. The Global Enterprise Edition of the Steel-Belted Radius software may be used by Customer only to manage access to Customer's enterprise network. Specifically, service provider customers are expressly prohibited from using the Global Enterprise Edition of the Steel-Belted Radius software to support any commercial network access services. The foregoing license is not transferable or assignable by Customer. No license is granted herein to any user who did not originally purchase the applicable license(s) for the Software from Juniper or an authorized Juniper reseller. 4. Use Prohibitions. Notwithstanding the foregoing, the license provided herein does not permit the Customer to, and Customer agrees not to and shall not: (a) modify, unbundle, reverse engineer, or create derivative works based on the Software; (b) make unauthorized copies of the Software (except as necessary for backup purposes); (c) rent, sell, transfer, or grant any rights in and to any copy of the Software, in any form, to any third party; (d) remove any proprietary notices, labels, or marks on or in any copy of the Software or any product in which the Software is embedded; (e) distribute any copy of the Software to any third party, including as may be embedded in Juniper equipment sold in the secondhand market; (f) use any 'locked' or key-restricted feature, function, service, application, operation, or capability without first purchasing the applicable license(s) and obtaining a valid key from Juniper, even if such feature, function, service, application, operation, or capability is enabled without a key; (g) distribute any key for the Software provided by Juniper to any third party; (h) use the Software in any manner that extends or is broader than the uses purchased by Customer from Juniper or an authorized Juniper reseller; (i) use Embedded Software on non-juniper equipment; (j) use Embedded Software (or make it available for use) on Juniper equipment that the Customer did not originally purchase from Juniper or an authorized Juniper reseller; (k) disclose the results of testing or benchmarking of the Software to any third party without the prior written consent of Juniper; or (l) use the Software in any manner other than as expressly provided herein. 5. Audit. Customer shall maintain accurate records as necessary to verify compliance with this Agreement. Upon request by Juniper, Customer shall furnish such records to Juniper and certify its compliance with this Agreement. iii

4 6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper. As such, Customer shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence, which at a minimum includes restricting access to the Software to Customer employees and contractors having a need to use the Software for Customer's internal business purposes. 7. Ownership. Juniper and Juniper's licensors, respectively, retain ownership of all right, title, and interest (including copyright) in and to the Software, associated documentation, and all copies of the Software. Nothing in this Agreement constitutes a transfer or conveyance of any right, title, or interest in the Software or associated documentation, or a sale of the Software, associated documentation, or copies of the Software. 8. Warranty, Limitation of Liability, Disclaimer of Warranty. The warranty applicable to the Software shall be as set forth in the warranty statement that accompanies the Software (the "Warranty Statement"). Nothing in this Agreement shall give rise to any obligation to support the Software. Support services may be purchased separately. Any such support shall be governed by a separate, written support services agreement. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JUNIPER SHALL NOT BE LIABLE FOR ANY LOST PROFITS, LOSS OF DATA, OR COSTS OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, THE SOFTWARE, OR ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. IN NO EVENT SHALL JUNIPER BE LIABLE FOR DAMAGES ARISING FROM UNAUTHORIZED OR IMPROPER USE OF ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. EXCEPT AS EXPRESSLY PROVIDED IN THE WARRANTY STATEMENT TO THE EXTENT PERMITTED BY LAW, JUNIPER DISCLAIMS ANY AND ALL WARRANTIES IN AND TO THE SOFTWARE (WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE), INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT DOES JUNIPER WARRANT THAT THE SOFTWARE, OR ANY EQUIPMENT OR NETWORK RUNNING THE SOFTWARE, WILL OPERATE WITHOUT ERROR OR INTERRUPTION, OR WILL BE FREE OF VULNERABILITY TO INTRUSION OR ATTACK. In no event shall Juniper's or its suppliers' or licensors' liability to Customer, whether in contract, tort (including negligence), breach of warranty, or otherwise, exceed the price paid by Customer for the Software that gave rise to the claim, or if the Software is embedded in another Juniper product, the price paid by Customer for such other product. Customer acknowledges and agrees that Juniper has set its prices and entered into this Agreement in reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same reflect an allocation of risk between the Parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss), and that the same form an essential basis of the bargain between the Parties. 9. Termination. Any breach of this Agreement or failure by Customer to pay any applicable fees due shall result in automatic termination of the license granted herein. Upon such termination, Customer shall destroy or return to Juniper all copies of the Software and related documentation in Customer's possession or control. 10. Taxes. All license fees payable under this agreement are exclusive of tax. Customer shall be responsible for paying Taxes arising from the purchase of the license, or importation or use of the Software. If applicable, valid exemption documentation for each taxing jurisdiction shall be provided to Juniper prior to invoicing, and Customer shall promptly notify Juniper if their exemption is revoked or modified. All payments made by Customer shall be net of any applicable withholding tax. Customer will provide reasonable assistance to Juniper in connection with such withholding taxes by promptly: providing Juniper with valid tax receipts and other required documentation showing Customer's payment of any withholding taxes; completing appropriate applications that would reduce the amount of withholding tax to be paid; and notifying and assisting Juniper in any audit or tax proceeding related to transactions hereunder. Customer shall comply with all applicable tax laws and regulations, and Customer will promptly pay or reimburse Juniper for all costs and damages related to any liability incurred by Juniper as a result of Customer's non-compliance or delay with its responsibilities herein. Customer's obligations under this Section shall survive termination or expiration of this Agreement. 11. Export. Customer agrees to comply with all applicable export laws and restrictions and regulations of any United States and any applicable foreign agency or authority, and not to export or re-export the Software or any direct product thereof in violation of any such restrictions, laws or regulations, or without all necessary approvals. Customer shall be liable for any such violations. The version of the Software supplied to Customer may contain encryption or other capabilities restricting Customer's ability to export the Software without an export license. 12. Commercial Computer Software. The Software is "commercial computer software" and is provided with restricted rights. Use, duplication, or disclosure by the United States government is subject to restrictions set forth in this Agreement and as provided in DFARS through , FAR , FAR (b)(2), FAR , or FAR (ALT III) as applicable. 13. Interface Information. To the extent required by applicable law, and at Customer's written request, Juniper shall provide Customer with the interface information needed to achieve interoperability between the Software and another independently created program, on payment of applicable fee, if any. Customer shall observe strict obligations of confidentiality with respect to such information and shall use such information in compliance with any applicable terms and conditions upon which Juniper makes such information available. 14. Third Party Software. Any licensor of Juniper whose software is embedded in the Software and any supplier of Juniper whose products or technology are embedded in (or services are accessed by) the Software shall be a third party beneficiary with respect to this Agreement, and such licensor or vendor shall have the right to enforce this Agreement in its own name as if it were Juniper. In addition, certain third party software may be provided with the Software and is subject to the accompanying license(s), if any, of its respective owner(s). To the extent portions of the Software are distributed under and subject to open source licenses obligating Juniper to make the source code for such portions publicly available (such as the GNU General Public License ("GPL") or the GNU Library General Public License ("LGPL")), Juniper will make such source code portions (including Juniper modifications, as appropriate) available upon request for a period of up to three years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194 N. Mathilda Ave., Sunnyvale, CA 94089, ATTN: General Counsel. You may obtain a copy of the GPL at and a copy of the LGPL at Miscellaneous. This Agreement shall be governed by the laws of the State of California without reference to its conflicts of laws principles. The provisions of the U.N. Convention for the International Sale of Goods shall not apply to this Agreement. For any disputes arising under this Agreement, the Parties hereby consent to the personal and exclusive jurisdiction of, and venue in, the state and federal courts within Santa Clara County, California. This Agreement constitutes the entire and sole agreement between Juniper and the Customer with respect to the Software, and supersedes all prior and contemporaneous agreements relating to the Software, whether oral or written (including any inconsistent terms contained in a purchase order), except that the terms of a separate written agreement executed by an authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict with terms contained herein. No modification to this Agreement nor any waiver of any rights hereunder shall be effective unless expressly assented to in writing by the party to be charged. If any portion of this Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity of the remainder of this Agreement. This Agreement and associated documentation has been written in the English language, and the Parties agree that the English version will govern. (For Canada: Les parties aux présentés confirment leur volonté que cette convention de même que tous les documents y compris tout avis qui s'y rattaché, soient redigés en langue anglaise. (Translation: The parties confirm that this Agreement and all related documentation is and will be in the English language)). iv

5 Table of Contents About This Guide 13 Audience Document Contents Document Conventions Requesting Technical Support Self-Help Online Tools and Resources Opening a Case with JTAC Chapter 1 Introduction 17 About CMS What s New in Version How CMS Works Understanding CMS CMS Support of Device Software Versions Logging In to CMS CMS Web Interface Where to Go Next Chapter 2 Installing CMS 23 System Requirements Supported Browsers and Character Sets Installation Procedure Pre-Installation Tasks Installing the Windows FTP Server Windows Server Windows Server Windows Server Upgrading to CMS From a Previous Release Installing WX CMS Uninstalling WX CMS Logging In for the First Time Using CMS Servers with Multiple Network Interfaces Recommended Configuration Tasks Where to Go Next Chapter 3 Managing Devices 37 Viewing and Accessing WX Devices from CMS Viewing WX Devices Viewing WX Device Events Accessing the WXOS Web Interface from CMS Exporting WX Community and Device Information Scheduling Tasks for Multiple WX Devices Table of Contents v

6 WX Central Management System (CMS) Administrator s Guide Managing WX Device Boot Images Loading WXOS Boot Images Rolling Back Device Boot Images Rebooting Devices Managing WX Device Configurations Viewing WX Device Configuration Summaries Analyzing Device Configurations Loading Device Configurations Rolling Back Device Configurations Backing Up Device Configurations Restoring Device Configurations Running Packet Capture and Other WX Maintenance Tasks Running Packet Capture for WX Devices Resetting the HTTP Cache on WX Devices Retrieving WX Device Files Applying a WX Registration Server Password Putting WX Devices in Safe Mode Managing CMS Schedules Managing Scheduled Tasks Exporting a Schedule Log Chapter 4 Managing Device Configurations 71 Overview of Device Configurations About Device Configurations Partial Configuration Settings Downloading Global and Partial Configurations Merging Configurations Creating and Editing Configurations Consistency Checking Tracking Configuration Versions Using Cross Site Scripting Mode Tips for Managing Configurations Viewing Configurations Managing Configurations Extracting Configurations Duplicating Configurations Creating New Configurations with Factory Defaults Comparing Configurations Displaying Configurations Viewing Configuration History Publishing Configurations Importing a Single Configuration File Importing Configuration Files in Bulk Exporting Configurations Changing Referenced Configurations Changing the Cross Site Scripting Mode Deleting Configurations Defining Configuration Settings Configuring Device Settings Configuring Device Addresses Defining Communities Configuring Time Zone Settings Configuring the ARP Table Advertising Compression Subnets vi Table of Contents

7 Table of Contents Defining Outbound QoS Exclusions Adding Static Routes Configuring Router Polling Configuring Multi-Path Addresses Configuring the RADIUS Source Address Configuring the TACACS+ Source Address Configuring Basic Setup Parameters Configuring the Interface Settings Configuring NTP Enabling SNMP Defining Syslog Servers Configuring Dynamic Local Routes Enabling Route-Based Router Balancing Designating a Registration Server Generating NetFlow Records Configuring AAA Settings Selecting Authentication Methods Enabling Authorization Checking Defining RADIUS Servers and Server Groups Defining TACACS+ Servers Defining Local Users Configuring a Login Banner Securing Operator Access Securing Front Panel Access Configuring Application Settings Default Application Definitions Viewing the Application Overview Configuring Application Definitions Testing New Application Definitions Assigning Applications to Traffic Classes Monitoring Applications Configuring Compression Settings Configuring Endpoints for Compression Configuring Network Sequence Caching Compressing Applications Configuring Remote Routes Configuring Tunnel Load Balancing Policies Configuring Default Decompressors Defining Preferred Decompressors Configuring Tunnel Mode Settings Configuring QoS Settings Using Outbound QoS to Enhance Performance Understanding Outbound QoS Traffic Classes and Bandwidths QoS Templates and Endpoints WAN Circuit Speeds and Router Overhead Dedicated, Oversubscribed, and Variable Rate WANs Direct Setup Versus Wizard Configuration Results Class Priorities and Excess Bandwidth Allocation ToS/DSCP Values Unadvertised Subnets Procedure for Configuring Outbound QoS Policies Using the Outbound QoS Setup Wizard Defining Outbound QoS Settings by Endpoint Table of Contents vii

8 WX Central Management System (CMS) Administrator s Guide Defining Outbound QoS Templates Defining Outbound QoS Endpoints Changing Outbound ToS/DSCP Values Starting and Stopping Outbound QoS Configuring Inbound QoS Policies Configuring Traffic Acceleration Overview of Packet Flow Acceleration TCP Acceleration Forward Error Correction Fast Connection Setup Overview of Application Flow Acceleration Microsoft CIFS and Microsoft Exchange Acceleration HTTP Acceleration Enabling Acceleration by Endpoint Enabling Acceleration by Application Enabling TCP Acceleration by Application Enabling Fast Connection Setup by Application Enabling Microsoft CIFS Acceleration Enabling Microsoft Exchange Acceleration Enabling HTTP Acceleration Configuring Advanced Setup Parameters Configuring Topology Settings Selecting a Topology Partial Mesh Example Tiered Network Example Selecting a Community Size Configuring Source/Destination Filters Defining the Prime Time Configuring Packet Interception Methods of Packet Interception Configuring Packet Interception for Off-Path Devices RIP Router/Switch Configuration Commands WCCP Router Configuration Commands External Policy-Based Router Commands Alternatives to Packet Interception Configuring WAN Performance Monitoring Configuring Multiple Tunnels Between WX 100 Servers Adding CLI Commands to Configurations Configuring Policy-Based Multi-Path Procedure for Configuring Multi-Path Enabling Policy-Based Multi-Path Defining Multi-Path Templates Defining Multi-Path Endpoints Configuring Routers to Support Multi-Path Configuring IPsec Default IPsec Policy IPsec Implementation Details Procedure for Configuring IPsec Policies Defining IPsec Settings by Endpoint Defining IPsec Templates Defining the Default IPsec Policy Defining the IPsec Application Filter Optimizing SSL Traffic Overview of SSL Optimization viii Table of Contents

9 Table of Contents Importing SSL Certificates Enabling Applications for SSL Optimization Configuring Events Chapter 5 Automatic Deployment and License Management 245 About Automatic Deployment Configuring Auto-Deployment Auto-Deployment Procedure Defining Deployment Groups Defining Deployment Records Importing Deployment Records in Bulk Viewing the Auto-Deployment Status Configuring License Management Licensing Procedure Importing and Validating Authorization Codes Generating and Applying Licenses Viewing the License Status Chapter 6 Monitoring Performance 259 Viewing and Printing Reports Configuring the My WAN Page Viewing Reports on the Monitor Page WAN Statistics WAN Performance Statistics WAN Throughput Statistics WAN Application Summary WAN Optimization Summary WAN Optimization by Destination Compression Statistics Data Compression Statistics Application Summary Statistics Passthrough Statistics Packet Size Distribution Statistics Monitoring Tunnel Status QoS Statistics Outbound QoS Statistics Inbound QoS Statistics Acceleration Statistics Acceleration Summary TCP Acceleration Statistics Fast Connection Setup Statistics CIFS and Exchange Acceleration Statistics HTTP Acceleration Statistics Top Traffic Statistics Executive Summary Trend Reports Events Reports Scheduling Reports Managing Scheduled Reports Chapter 7 Content Management 317 Defining and Distributing Content Defining Distribution Groups Table of Contents ix

10 WX Central Management System (CMS) Administrator s Guide Managing Scheduled Content Distribution Tasks Viewing the Schedule Log Accessing Network Drives Chapter 8 CMS Setup and Administration 329 Administering CMS Users Partitioning Users by Customer Viewing My Account and Changing Passwords Defining CMS User Accounts Defining User Groups Defining User Roles Viewing Logged In Users Administering WX Devices Importing and Managing Communities Changing a Registration Server Address or Password Managing Device Groups Configuring Device Polling Configuring Data Retention Uploading a Boot Image Viewing the Polling Catch-Up and Failure Logs Managing Event Forwarding Filters and Distribution Lists Defining Distribution Lists Defining Event Forwarding Filters Administering CMS Setting WAN Performance Thresholds Entering a Permanent CMS License Key Controlling Client Device Access to CMS Configuring AAA Settings for Remote Authentication Defining a Proxy Server Defining the Session Timeout Configuring the FTP Server Defining an SMTP Server Enabling Syslog Reporting Stopping and Starting the Scheduler Changing the CMS Server IP Address Changing the Web Server Port Viewing System Logs Generating a Diagnostic File Backing Up and Restoring the Database Manual MySQL Database Backups Restoring Manual MySQL Database Backups Automatic MySQL Database Backups Restoring Automatic MySQL Database Backups CMS Configuration Backups Moving CMS to Another Disk Drive Purging Temporary Java Files Changing the CMS Time Zone Appendix A CMS Licenses 375 Appendix B System Events 377 Severity Levels CMS Syslog Messages x Table of Contents

11 Table of Contents WX System Events and SNMP Traps WX Syslog Messages Appendix C Understanding Exported Data Results 387 NetFlow Version 5 Export Performance Statistics Export General Device Information Data Section Information System Session Statistics Compression Session Statistics Application Session Statistics WAN Statistics Application Flow Acceleration Statistics Bandwidth Management Statistics WAN Performance Statistics Inbound Traffic By Port Statistics Top Traffic Export Appendix D Common Application Port Numbers 397 Glossary 399 Index 403 Table of Contents xi

12 WX Central Management System (CMS) Administrator s Guide xii Table of Contents

13 About This Guide Welcome to the Juniper WX Central Management System (CMS) a powerful management and configuration tool for the WX and WXC Application Acceleration Platforms. This section describes the audience, organization, and typographical conventions used in this manual. Audience This manual is intended for administrators who install and use CMS, and for network managers who monitor device performance. Readers are assumed to be familiar with their network architecture and devices, and can perform basic network configuration procedures. Document Contents Chapter 1, Introduction on page 17, provides an overview of CMS, and describes the new features in this release. Chapter 2, Installing CMS on page 23, describes how to install the CMS software. Chapter 3, Managing Devices on page 37, describes how to centrally manage devices in a community by performing such tasks as loading new configurations and WXOS boot images on selected devices. It also describes how to use the scheduler to manage scheduled tasks. Chapter 4, Managing Device Configurations on page 71, describes how to create and maintain global and partial configurations in CMS. Chapter 5, Automatic Deployment and License Management on page 245, describes how to configure new devices automatically, and how to distribute permanent licenses to devices that have evaluation licenses. Chapter 6, Monitoring Performance on page 259, describes how to monitor the percentage of data compression, outbound bandwidth management by traffic class, and the tunnel status for the devices in each community. Chapter 7, CMS Setup and Administration on page 329, describes CMS administration tasks, such as importing communities and defining user accounts. Audience 13

14 WX Central Management System (CMS) Administrator s Guide Appendix A, CMS Licenses on page 375, describes the evaluation and permanent licenses for CMS. Appendix B, System Events on page 377, describes the SNMP traps and syslog messages for the system events generated by CMS and the WX devices. Appendix C, Understanding Exported Data Results on page 387, describes the contents of the statistics file that CMS can retrieve from a device. Appendix D, Common Application Port Numbers on page 397, lists common application port numbers, as listed by the Internet Assigned Numbers Authority (IANA). Glossary on page 399, includes definitions of networking terms as well as terms specific to devices and CMS. Document Conventions The following tables show the conventions used throughout this book. Table 1 defines notice icons; Table 2 defines text conventions; and Table 3 defines GUI conventions. Table 1: Notice Icons Icon Meaning Description Informational note Indicates important features or instructions. Caution Warning Indicates that you may risk losing data or damaging your hardware. Alerts you to the risk of personal injury. Table 2: Text Conventions Convention Plain sans serif type Italics Description Filenames and directory names. Terms defined in text. Variable elements for which you supply values. Book titles. + (plus sign) Key names linked with a plus sign indicate that you must press two or more keys simultaneously. Table 3: GUI Conventions Convention Description > (chevron) Navigation paths through the UI. Bold type Italics User interface elements that you select in a procedure, such as tabs, buttons, and menu options. Variables for which you supply values. 14 Document Conventions

15 About This Guide Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need postsales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings Find product documentation Find solutions and answer questions using our Knowledge Base Download the latest versions of software and review your release notes Search technical bulletins for relevant hardware and software notifications Join and participate in the Juniper Networks Community Forum Open a case online in the CSC Case Manager To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Manager tool in the CSC at Call JTAC ( toll free in USA, Canada, and Mexico). For international or direct-dial options in countries without toll-free numbers, visit us at Requesting Technical Support 15

16 WX Central Management System (CMS) Administrator s Guide 16 Requesting Technical Support

17 Chapter 1 Introduction This chapter introduces the WX Central Management System (CMS) and covers the following topics: About CMS in the next section What s New in Version on page 18 How CMS Works on page 18 Understanding CMS on page 19 About CMS CMS provides easy and extensive central configuration and monitoring for WX devices in geographically dispersed locations. CMS can manage up to 2000 devices in multiple communities. CMS offers the following benefits: Cost effective CMS reduces the cost of ownership for WX devices by creating a single location from which to manage all devices and leverage configurations on devices already deployed in the network. Eases configuration Using CMS, you can quickly and easily configure tens or hundreds of newly deployed devices, modify the configuration of already deployed devices, and view and manage the newly created WAN capacity generated by our Molecular Sequence Reduction (MSR) and Network Sequence Caching (NSC) technology. Simplifies software deployment CMS dramatically simplifies the configuration and management of software upgrades. From a single location, and in a single operation, you can upgrade all devices in the same community to a new software version. Creates global policies CMS allows network managers to centrally manage and modify global and device-specific configuration settings on all devices. Global settings include basic and advanced setup options, such as for NTP and SNMP, authentication settings, application definitions, outbound QoS settings, and the applications being compressed, monitored, and accelerated. Manage events CMS can centrally configure WX system and performance events, monitor CMS and WX event occurrences, and selectively forward events to syslog servers and/or an server to generate alerts. About CMS 17

18 WX Central Management System (CMS) Administrator s Guide Schedules all tasks Using CMS, you can schedule all device management tasks to be performed at the optimal time for the individual location. Centrally views all application acceleration and WAN performance statistics CMS provides a single, clear window into the performance of devices around the globe. It presents historical per-tunnel and per-application compression statistics for each device. Centrally views global device and tunnel status Using CMS, you can immediately view the status of all tunnels and of each deployed device. All features are available through the CMS Web-based graphical user interface. Up to 50 users can access CMS simultaneously. You can control access to CMS with user accounts and passwords, as well as access control lists. What s New in Version CMS provides the following new features: Web Proxy Support CMS now supports the use of a web proxy server to access the internet (see Defining a Proxy Server on page 362). Windows Server 2008 Support CMS can now be installed on Microsoft Windows Server Virtual Machine Support CMS now supports the following virtual machine environments: VMware ESX version 4.0 Citrix XenServer with XenCenter version 5.5 Hyper-V Manager version 6.0 Timeout Setting for Loading WXOS Images The time allowed to download a WXOS boot image can now be increased to allow the task to complete over a slow connection, such as a satellite link (see Loading WXOS Boot Images on page 43). How CMS Works CMS is deployed on a server in your network running Windows Server 2008, Windows Server 2003, or Windows Server 2000 (Figure 1). CMS includes a Web server that can be accessed by multiple remote clients using secure Web access. A CMS client is a workstation in your network that supports the Microsoft Internet Explorer 6.0 (or later) Web browser. You can access the Web by directing the browser to the IP address or host name of the CMS server (to use the host name, the host name must have a DNS entry.) 18 What s New in Version 5.7.2

19 Chapter 1: Introduction Figure 1 shows a logical flow of the communication between the WX devices, a CMS server, and the CMS Web clients. Configuration data between the devices and the CMS server is securely transmitted via a proprietary protocol (UDP is used to poll devices for some basic status information). Monitoring data is collected from the devices in clear text (compressed). Data between the CMS server and the Web clients is securely transmitted via HTTPS. Figure 1: CMS Communication LAN LAN Secure Protocol WX CMS HTTPS CMS Web Clients LAN Understanding CMS The following topics provide general information about CMS. CMS Support of Device Software Versions in the next section. Logging In to CMS on page 19. CMS Web Interface on page 20. CMS Support of Device Software Versions CMS manages devices running WXOS version 5.4 and later. Devices running WXOS versions prior to 5.4 are displayed in some Web pages (such as the Devices page), but they cannot be managed through CMS. Logging In to CMS When you log in to CMS for the first time, you must specify the user name root and a default password. The root user account has the CMS administrator role, which provides access to all CMS functions. As a CMS administrator, you can create additional user accounts and specify the level of access for each user, as described in Defining CMS User Accounts on page 331. If two or more users modify the same settings concurrently, the last set of saved changes is used. Understanding CMS 19

20 WX Central Management System (CMS) Administrator s Guide To log out, click Logout in the taskbar of any page. Users are logged out automatically if their sessions are inactive for the session timeout time (default is 30 minutes). NOTE: If you close the Web browser without logging out, your session remains open until the session timeout time expires. CMS Web Interface The CMS Web interface (Figure 2) contains a taskbar across the top of each page, a left-hand navigation pane, and a data pane for configuring and viewing policies and performance data. Figure 2: CMS Web Interface The taskbar indicates the name of the current user and provides the following links: My WAN Select and view a personalized set of performance charts specific to the user account. Monitor Monitor tunnel status and performance statistics. Management Manage devices, configurations, automatic deployment, and scheduled tasks. Content Maximize response times by preloading compression dictionaries for large files and Web content. 20 Understanding CMS

21 Chapter 1: Introduction Admin Administer CMS, such as add and delete user accounts, and import communities. Help Open the About window, which includes the CMS software version and license information, or open a PDF version of this manual. Logout Log out of the CMS Web interface. Where to Go Next To install the CMS software, see Installing CMS on page 23. Where to Go Next 21

22 WX Central Management System (CMS) Administrator s Guide 22 Where to Go Next

23 Chapter 2 Installing CMS This chapter describes the installation procedure for the Central Management System (CMS) and covers the following topics: System Requirements in the next section Supported Browsers and Character Sets on page 24 Installation Procedure on page 25 Logging In for the First Time on page 31 Using CMS Servers with Multiple Network Interfaces on page 34 Recommended Configuration Tasks on page 34 System Requirements Verify that the designated CMS server meets or exceeds the following hardware and software requirements: NOTE: CMS should be installed on a dedicated server that is not running any other applications, particularly database backup and anti-virus software, which may lock files and interfere with the CMS database. For online database backups, use the backup utility provided with CMS (see Backing Up and Restoring the Database on page 370). One of the following versions of Microsoft Windows: Windows Server 2008 (Standard or Professional Edition) Windows Server 2003 Standard Edition Windows Server 2003 Enterprise Edition with Service Pack 1 Windows Server 2000 with Service Pack 4 System Requirements 23

24 WX Central Management System (CMS) Administrator s Guide Minimum CPU, memory, and disk space requirements shown in the following table for each range of devices being managed. These estimates assume a dedicated server with high speed drives, and a 60-minute polling interval. Number of WX Devices Pentium 4 CPU (GHz) RAM (GB) Estimated Disk Space (GB) Under (min. 1.8) 1.0 (minimum) 40+ (min. 40) 100 to (min. 2.0) 1.5 (min. 1.0) 60+ (min. 40) 500 to (min. 2.8) 2.0 (min. 1.5) 80+ (min. 60) 1000 to (min. 3.0) 3.0 (min. 2.0) 100+ (min. 80) 1500 to dual CPU (min. 3.2) 4.0 (min. 3.0) 120+ (min. 100) CD-ROM drive and Video display with 1024 x 768 resolution 10/100 Ethernet Network Interface Controller (NIC) A user account with administrator privileges (to perform the installation) Microsoft FTP Server installed and running, with an anonymous or password-protected user account that has read/write access to the FTP home directory Supported Browsers and Character Sets CMS can be administered through the CMS Web interface using Microsoft Internet Explorer version 6.0 or later. All other Web browsers are currently not supported. Only English characters are supported. Verify that your browser accepts cookies (required to log in), and that the server is always checked for the latest configuration information: 1. Select Internet Options from the Tools menu. 2. Click Settings under Temporary Internet Files, select Every visit to the page, and click OK. 3. Click the Privacy tab and verify that the setting is Medium High or lower. 4. Click the Security tab, click Default Level, and verify that the setting is Medium or lower. 5. Click the Advanced tab, and verify that Play animations in web pages is selected (required for in-progress indicators on the Devices page). On Windows Server 2003, the browser's default Security setting is High, which will prevent you from logging in to CMS. Change the Security setting to Medium. NOTE: The Executive report does not display correctly if the browser uses the Sun Java Virtual Machine. To display the Executive report correctly, use the Internet Explorer JVM. 24 Supported Browsers and Character Sets