<div>
Hi,<br />
<br />
JunOS and ScreenOS resemble a lot. You can check out the below comparison;<br />
<br />
<a href="http://www.networkworld.com/news/2008/041708-cisco-juniper-operating-systems.html" rel="ugc">http://www.networkworld.com/news/2008/041708-cisco-juniper-operating-systems.html</a>
</div>


<div>
although you said you dont want to use web ui i think you should give it a go, its way better that the UI on cisco devices and you can do alot with it. i have used many ssg's in the past and very rerely needed the cli, where it did come handy was when i needed to bulk edit access rules than i would use notepad and paste in to cli.<br />
<br />
Give it a go..
</div>


<div>
I do not know of any 1-by-1 transfer guide for Cisco and Juniper. It's a bit difficult as a block of IOS commands resemble to one single ScreenOS line. However, when thinking in command blocks, it should be easier then by many other devices to translate the command set to ScreenOS CLI.<br />

</div>


<div>
Mysidia,<br />
thorough explanation. I have to agree in all points stated, but in &quot;cryptic&quot;. The question mark and the tab keystroke are your friends in CLI, providing you with step by step syntax info.<br />
<br />
That said, it can be a pain indeed to use a line 200 chars long to change just a single VPN setting ...<br />
<br />
I'm using CLI for automation (enabling of VPN policies on demand), and for initial VPN tunnel setup. Fine tuning or minimal changes are done by WebUI, as it is more intuitive and does all the work ... So the normal practise is to use WebUI in most cases, and CLI for the more advanced or structured jobs.<br />

</div>


<div>
Mysidia:<br />
Thanks for this comprehensive answer which covered almost everything. &nbsp;<br />
<b>Why use CLI as opposed to Web Front-End?</b> The choice for CLI is for automation purpose. We have about 18,000 sites at the moments running Cisco platforms and we do have some automation in place. I am not saying that we are planning to migrate all 18,000 Cisco sites to ScreenOS, but ideally, when we do introduce the ScreenOS platforms, we would expect them to be treated the same way. Obviously, the Web front-end will help but as designers, we want to focus on the CLI side so that we can generate standard configuration templates.<br />
<b>Management</b>: anything to do with management, is currently done via interface loopback 10, which should be classified as untrust zone in this case. &nbsp;So we use loopback 10 for tacacs source, ip tftp or ftp source, snmp source, etc. That does not seem to be impacted very much.<br />
<b>SNMP</b>: this is a little problematic. Our current design for Cisco IOS, has two separate communities: a read-only community and a write community. &nbsp;We also explicitly define the traps for the agent (CPE router) and these have to match with the traps enabled on the SNMP server otherwise, the trap is simply thrown away by the server. In our design, the agent is added to the host and we have a primary and secondary host. I have noticed with ScreenOS that you have to assign the host on the community basis. &nbsp;Below is the Cisco IOS version:<br />
------------------Cisco version below----<br />
snmp-server community myReadOnlyCommunity RO 10<br />
snmp-server community myWriteCommunity RW 10<br />
snmp-server community SNMP RO 5<br />
snmp-server community AnotherReadOnlyCommunity RO 5<br />
snmp-server ifindex persist<br />
snmp-server trap-source Loopback10<br />
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart<br />
snmp-server enable traps envmon<br />
snmp-server enable traps hsrp<br />
snmp-server enable traps config<br />
no snmp-server enable traps tty<br />
snmp-server host Primary_Host_IP version 2c Agent_Hostname<br />
snmp-server host Secondary_Host_IP version 2c Agent_Hostname<br />
--------------------------<wbr />----------<wbr />----------<wbr />----------<wbr />----------<wbr />----------<wbr />----------<wbr /> &nbsp;<br />
In ScreenOS, it is not possible to explicitly define the traps as we have done with Cisco. Also when I tried to add the host command, ScreenOS forced me to specify the community and when I tried to use the same host for another community, it would not let me do that. Our platform offers local resilience at every component level and we need to be able to build this into the design. &nbsp;<br />
The question, is, how to make all the communities (it does not matter how many), use the same host and repeat the same config for the backup host. &nbsp;<br />
I have managed to achieve the config below but that is only a single point of failure for each community and as such does not reflect our platform:<br />
----------ScreenOS SNMP config----------<br />
set interface loopback.10 manage snmp <br />
set snmp contact MyContact<br />
set snmp name MyName<br />
set snmp location AgentLocation<br />
set snmp port listen 161 <br />
set snmp port trap 162<br />
set snmp auth-trap enable<br />
set snmp community myReadOnlyCommunity Read-Only Trap-on traffic version v2c<br />
set snmp community myWriteCommunity &nbsp;Read-Write Trap-on traffic version v2c <br />
set snmp host myReadOnlyCommunity 10.1.1.1/32 src-interface loopback.10 trap v2<br />
set snmp host myWriteCommunity 10.1.2.1/32 src-interface loopback.10 trap v2<br />
--------------------------<wbr />----------<wbr />----------<wbr />----------<wbr />---------<br />
As you can see here, the second IP (10.1.2.1/32) should be the backup but I am now using it for the second community (write) because when I tried to use the same IP as I used for the read-only community, I get the &quot;Host 10.1.1.1 already exists&quot; error. <br />
As I go through our current Cisco design, I will come across various other bits with which I will need some help. So if it is OK with you, I will leave the question open for now.<br />
I appreciate your contribution here. I must admit it is very good. If you have any other information that could help, I am very grateful.<br />

</div>


<div>
Yes, unfortunately, you don't have explicit control of all the traps.<br />
IOS allows you more explicit control of SNMP.<br />
<br />
In ScreenOS, 'trap-on' &nbsp;is used to designate a community used for sending traps<br />
<br />
set snmp community myReadOnlyCommunity read-only &nbsp;trap-on version any<br />
set snmp auth-trap enable<br />
<br />
When you specify a host for trap sending, the traps can only be sent with one community, the SNMP protocol doesn't let you send a trap packet with two communities on it.<br />
<br />
For simple query access, you should be able to issue things like<br />
<br />
set snmp host myOtherReadOnlyCommunity 10.1.1.1/24 &nbsp;trap v2<br />
<br />

</div>


<div>
I do not have any problems defining two SNMP trap targets:<br />
<br />
set snmp host myReadOnlyCommunity 10.1.1.1/32 src-interface loopback.10 trap v2<br />
set snmp host myReadOnlyCommunity 10.1.2.1/32 src-interface loopback.10 trap v2<br />

</div>


<div>
Qlemo:<br />
You are right, if you only have one community. In our Cisco, we have two communities, one is read-only and the other is write. &nbsp;If you only have one community then, there is no issue. However, if you have two, then ScreenOS does not allow you to repeat the same host, e.g. if you try the following command, it will fail:<br />
set snmp host myWriteCommunity 10.1.1.1/32 src-interface loopback.10 trap v2<br />
The reason of the failure would be because 10.1.1.1/32 &nbsp;was already used for the myReadOnlyCommunity community. If this works on your device, please let me know.<br />
Many thanks.<br />

</div>


<div>
Forgive my ignorance, but what are different snmp trap communities for?<br />

</div>


<div>
Qlemo:<br />
You have asked a very important question. &nbsp;<br />
I am only following a design whereby we have a read-only community and a write community and both communities are served by the same host as defined using the &quot;snmp-server host&quot; command in Cisco IOS.<br />
Now that it looks like we cannot use the same host for more than one community, I have been thinking about a change of design to have a single community for read-write. &nbsp;But before I do that, I need to discuss with my colleagues designers to understand why we have 2 different communities in the first place. I am sure there is a very good reason for the current design.<br />
In any ways, it looks like we have to adopt a separate design for the SSG-20 box since we cannot use our Cisco IOS design for it. <br />
When I find any further info on why we are using two different communities, I will get back to &nbsp;you.<br />
Thanks.<br />

</div>


<div>
I think having multiple snmp communities for different actions is ok. However, for SNMP Traps one community (maybe even a different one) is enough. You can't do anything with the community in traps but use it for reporting.<br />
<br />
What does Cisco use as an community with SNMP Traps? Does it send two traps, one for each assigned community?<br />

</div>


<div>
Qlemo:<br />
I don't think Cisco sends two traps. I think it sends only one trap per configured traps. My understanding is that the read-only community is for users and systems with read-only access and the read-write community, is for users and systems with read and write access.<br />
I don't have the details of what or who those users and systems are. But I checked with a colleague today and he confirmed that both communities are required for the design. &nbsp;<br />
It is a shame that the host is tied to the community... &nbsp;If it was mapped to the SNMP agent (router), then one could configure as many communities as needed and they will be using the same host.<br />
I also sense that the SSG-20 box is mainly firewall and vpn box and may not be adequate for what we are trying to do. &nbsp;But that is another story. For now, I will try my best to see how far I can take it.<br />
Thanks.<br />

</div>


<div>
Unfortunately, you can't do that bit, at least not according to Juniper...<br />
<a href="http://kb.juniper.net/index?page=content&id=KB5087" rel="ugc">http://kb.juniper.net/index?page=content&id=KB5087</a><br />
I wonder if you set a community string by 'subnet', &nbsp;the host would still be allowed to use it<br />
<br />
set snmp community queryCommunity Read-Only Trap-off traffic version v2c<br />
set snmp host queryCommunity 0.0.0.0/0 src-interface loopback.10 trap v2<br />
<br />
Traps won't be generated for subnet community strings.<br />
However, &nbsp;the more-specific 'host community' string may override.<br />
<br />
From a security POV, it may be best to avoid using read-write community strings; &nbsp;SNMP is not a particularly secure protocol, in version 2, the community strings were sent in cleartext, &nbsp;and it would be trivial for a sophisticated attacker to generate a &nbsp;'snmp set' &nbsp;packet with a spoofed source address, &nbsp;if they had any manner of guessing the SNMP management station's address<br />
<br />
(not hard, if they sniff the LAN and see traps or SNMP management traffic going across).<br />
<br />
<br />
<br />

</div>


<div>
Mysidia:<br />
Thanks for this. &nbsp;I need to investiage a little bit more around the communities.<br />
For both read-only and read &amp;&nbsp;write communities, we use access list as addional security mechanism. &nbsp;This is shown in the SNMP sample configuration above. &nbsp;In the access lists, we permit the host IP addresses and deny anything else. &nbsp;For example, if I use a new SNMP host without changing the access-lists, that host will never be permitted. In addition to that, we deploy another access-list on the customer LAN interface where we also apply a firewall configuration because the traffic from the customer network cannot be trusted. <br />
So we have the security aspects of the SNMP covered. However, I will still investigate and see if there could be some vulnerability. I will let you &nbsp;know.<br />
Thanks.<br />

</div>


<div>
As Mysidia told us, IP spoofing is no hard job. That would circumvent the access list.<br />

</div>


<div>
Qlemo:<br />
OK thanks. I will investiage this.<br />

</div>


<div>
Thanks to Mysidia for taking time to help with this question and for the comprehensive answer. <br />
<br />
My conclusion is that a lot of work is required to master the ScreenOS environment in order to get the best out of the SSG devices. Unfortunately, I don't have much time although I am not giving up on this. &nbsp;<br />
<br />
The way forward is that, I will be exploring the J-Series platform which runs on JunOS as I believe that may offer more flexibility than ScreenOS. Since the SSG-20 device is a firewall and VPN device, it may not be the best choice for what we are trying to do.<br />
<br />
Thanks very much for Qlemo, for contributing to this question. I award the full point to Mysidia who provided the best answer.
</div>


<div>
<div class="content wysiwyg-content">
Dear colleagues,<br />
I am new to Juniper and have recently acquired a Juniper SSG-20-SB router for testing purpose. &nbsp;I am used to working with Cisco IOS and have configured several CPE services from DSL to Ethernet.<br />
<br />
I am trying to find a quick turnaround time to convert (manually) from Cisco IOS to Juniper, .i.e. use my Cisco IOS configuration to write the Juniper ScreenOS one for my small SSG-20 device. &nbsp;<br />
I have come across some reference materials on Juniper, e.g. <a href="http://www.juniper.net/techpubs/software/screenos/screenos5.3.0/CLI_5.3.0rB.pdf" rel="ugc">http://www.juniper.net/techpubs/software/screenos/screenos5.3.0/CLI_5.3.0rB.pdf</a>&nbsp;which is very comprehensive.<br />
<br />
The question I have, is, has any of you ever come across a comparison guide for Juniper OS and Cisco IOS, which I can use for my project? I am intending to cover the following areas in my configuration:<br />
<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;service<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;boot<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;aaa authentication and accounting<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tacacs<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;logging buffered and logging console<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;access-list and ip access-list<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;interface definition including loopback<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;snmp-server<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;banner motd and banner exec<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ntp server and ntp source<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;line console, vty, aux <br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ip inspec<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;router rip (v2)<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;QoS class-map, policy-map and service-policy<br />
&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;crypto<br />
<br />
Basically, I need all the usual suspects taken care of. I am aware of the Web UI but I do not want to go down that route yet because I want to familiarise myself with the CLI.<br />
<br />

</div>
</div>


Dear colleagues,
I am new to Juniper and have recently acquired a Juniper SSG-20-SB router for testing purpose.  I am used to working with Cisco IOS and have configured several CPE services from DSL to Ethernet.

I am trying to find a quick turnaround time to convert (manually) from Cisco IOS to Juniper, .i.e. use my Cisco IOS configuration to write the Juniper ScreenOS one for my small SSG-20 device.  
I have come across some reference materials on Juniper, e.g. http://www.juniper.net/techpubs/software/screenos/screenos5.3.0/CLI_5.3.0rB.pdf which is very comprehensive.

The question I have, is, has any of you ever come across a comparison guide for Juniper OS and Cisco IOS, which I can use for my project? I am intending to cover the following areas in my configuration:

"	service
"	boot
"	aaa authentication and accounting
"	tacacs
"	logging buffered and logging console
"	access-list and ip access-list
"	interface definition including loopback
"	snmp-server
"	banner motd and banner exec
"	ntp server and ntp source
"	line console, vty, aux 
"	ip inspec
"	router rip (v2)
"	QoS class-map, policy-map and service-policy
"	crypto

Basically, I need all the usual suspects taken care of. I am aware of the Web UI but I do not want to go down that route yet because I want to familiarise myself with the CLI.



Juniper ScreenOS vs Cisco IOS CLI

A router is a networking device that forwards data packets between computer networks. Routers perform the "traffic directing" functions on the Internet. The most familiar type of routers are home and small office cable or DSL routers that simply pass data, such as web pages, email, IM, and videos between computers and the Internet. More sophisticated routers, such as enterprise routers, connect large business or ISP networks up to the powerful core routers that forward data at high speed along the optical fiber lines of the Internet backbone. Though routers are typically dedicated hardware devices, use of software-based routers has grown increasingly common.

Routers

Networking hardware includes the physical devices facilitating the use of a computer network. Typically, networking hardware includes gateways, routers, network bridges, modems, wireless access points, networking cables, line drivers, switches, hubs, and repeaters. But it also includes hybrid network devices such as multilayer switches, protocol converters, bridge routers, proxy servers, firewalls, network address translators, multiplexers, network interface controllers, wireless network interface controllers, ISDN terminal adapters and other related hardware.