Customer Management Instructions: Juniper Advanced Firewall Virtual .

AT&T FlexWare Applications: Customer Management InstructionsCustomer Management Instructions:Juniper Advanced Firewall Virtual SecurityThis guide is designed to assist customers in understanding what steps to taketo launch their Juniper Networks Advanced Firewall Virtual Securityapplication (vSRX-VM).AT&T Recommendations: Network administrators have a working knowledge of Juniper Networks nextgeneration security appliance policy administration.Network administrators must thoroughly review the Juniper Networksdocumentation and be familiar with the configuration options and details.Your company is 100% responsible for the configuration and policies on theJuniper Networks-VM Virtual Security.Section One: Service Launch RequirementsStep 1: Review Juniper Networks-VM Documentation(NOTE: website and documentation are maintained by Juniper Networks)1. Juniper Networks Documentation – Provides detailed information on all aspects ofJuniper Networks vSRX Security Platform administration (by version)vSRX rvices/security/srx-series/vsrx/Note: At the bottom of this main page are tiles for different topics such as TechnicalDocumentation, Support, Training, etc.Juniper Networks Learning user activity info.aspx?id 53572. Version can be selected via links dependent on availability on the web page. Someguides may be only listed under major release if there are no changes. vSRX15.1X49-D60 should be selected when a reference to a specific release is required.Example under Technical Documentation:June 7, 2017 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property.

AT&T FlexWare Applications: Customer Management Instructions3. The following guides are recommended reading: Technical Documentation – Release Notes J-Web User Interface J-Web User Guide for Security DevicesStep 2: Verify configuration settings and policy in Juniper Networks VM GUI(NOTE: AT&T Technician will be online with you to complete Step 2 as part of thetest and turn-up process)1. Access the Juniper Networks-VM GUI at https:/yourmgmt ip/login.The ‘yourmgmt ip’ in the URL is the management IP that you provided to the AT&TLead Engineer during the initial data gathering consultation for your service.2. AT&T Technician will supply temporary admin password that must be changedimmediately.3. Login with supplied credentials.4. Navigate to Configuration wizard Change root passwordVerify new password is working5. Verify that the Juniper Networks-VM is licensed and Next Gen (if Enhanced featureset) features are active. Navigate to Maintain/Licenses Check that required licenses are installed with a value of 1June 7, 2017 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property.Page 2

AT&T FlexWare Applications: Customer Management Instructions Check that desired features are active.6. Enable Test Policy – pre-configured to allow http/https access and DNS (domainname service) queries to Internet. Prior to enabling policy Internet access through the Juniper-VM will deny alltraffic Highlight Test-Policy and click activate and commit policy Verify that policy is working to your satisfaction by browsing websites7. Create alternate test policy, if desired. Verify policy is working to your satisfactionAfter these steps the Juniper Networks-VM is now operational and you are free to add anyadditional policies that are desired.June 7, 2017 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property.Page 3

AT&T FlexWare Applications: Customer Management InstructionsSection Two: Additional Configuration Guidelines Do NOT Add/Remove/Change IPs and VLANs (virtual local area network) on theJuniper Networks-VM application without a Change Order MACD.AT&T FLEXWARE DEVICE AND ROUTER CHANGES ARE REQUIRED TO SUPPORT THESECHANGES AND THIS INFORMATION WAS PROVIDED BY YOU DURING THE PREINSTALLATION PROCESS Do NOT alter RIP (routing information protocol) configuration.THIS IS REQUIRED FOR ROUTING BETWEEN THE JUNIPER VM AND YOUR AT&TMANAGED ROUTER NAT (network address translation) is enabled and uses aggress interface towardinterneto NAT is required for Internet Connectivity Do NOT do a hard shutdown on the Juniper Networks-VM.IF HARD SHUTDOWN OF THE APPLICATION OCCURS, IT WILL HAVE TO BE BROUGHT UPMANUALLY BY AT&T THROUGH A SUPPORT TICKET Do NOT lose the admin password.AT&T DOES NOT HAVE THE CAPABILITY TO RESET PASSWORD SINCE THE JUNIPER-VMIS CUSTOMER MANAGED Do NOT create a policy that locks you out of the Juniper Networks-VM.AT&T DOES NOT HAVE THE CAPABILITY TO MODIFY POLICY SINCE THE JUNIPER-VM ISCUSTOMER MANAGED Do regular backups of your Palo Alto Networks-VM configuration.o AT&T does not perform backups of the Juniper-VM when it is customer managedo AT&T has no visibility into actual configurationo AT&T can only restore the Juniper-VM to its original configuration prior to customerchanging password in Step 2 of this document. Do NOT upgrade/downgrade the firmware to a version that is not currently supportedby the AT&T FlexWare solution.o AT&T can provide currently supported versions upon request via support processCustomer Responsibilities: Juniper Networks-VM configuration and policy management Customer will have access to the Juniper-VM through the management IP that wasprovided to AT&T during consultation with the AT&T Lead Engineer The J-Web GUI can be configured via same mechanisms as Juniper Networks physicalfirewallsJune 7, 2017 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property.Page 4

AT&T FlexWare Applications: Customer Management Instructions Customer must provide Juniper Space or manage directly through GUI or CLI. Juniper Networks-VM monitoring and reporting Customer is responsible for any Juniper Networks-VM specific health monitoringo JUNOS UI/J-Web (user interface) provides dashboard with statisticso SNMP (simple network management protocol)/system logs (SYSLOG) monitoringcan be setup to monitor customer provided network management infrastructure Customer is responsible for Juniper Networks-VM reportingo Reports can be accessed through the following methods Juniper Networks Web UI – directly on device Log events can be forwarded to customer provided SIEM Log events can be forwarded to customer provided Juniper Director Juniper Networks VM backup and firmware upgrade Customer is responsible for backup of the Juniper Networks VM configuration Customer is responsible for firmware upgrade(NOTE: Customer must contact AT&T prior to any firmware upgrade to confirmupgrade version is supported by the AT&T FlexWare solution) Ensuring connectivity to Juniper Networks for license and feature updates These updates are automatically downloaded in real-time from Juniper Networksservice over the Internet AT&T will verify that updates are working during turn-up as part of initial licensing andprovisioning Customer should periodically check whether updates are workingAT&T Responsibilities: Provide Initial installation, configuration and licensing of the Juniper Networks VM AT&T will provision the Juniper Networks-VM with initial configuration as specified bycustomer in consultation with AT&T Lead Engineer AT&T will do the networking and router configuration on the FlexWare Device to put theJuniper Networks-VM in line of appropriate customer traffic on the FlexWare device AT&T will handle the Juniper Networks-VM licensing and provide serial number tocustomer in case direct support is needed from the vendor AT&T will monitor the Juniper Networks-VM on the FlexWare Device State of the virtual machine will only be monitored for up/down status on the FlexWareDevice AT&T will verify that the virtual machine is in an up status at all times and restart, ifnecessary AT&T operations team can restart the Juniper Networks-VM in consultation withcustomer, if necessaryJune 7, 2017 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property.Page 5

AT&T FlexWare Applications: Customer Management InstructionsSection Three: How to get supportAT&T Support Resources: Documentation Support URL: http://carecentral.att.com/attflexware Links to Customer Care Support Overview and how to speak to an agent Managing Your Solution documentationJune 7, 2017 2016 AT&T Intellectual Property. All rights reserved. AT&T and the Globe logo are registered trademarks of AT&T Intellectual Property.Page 6

documentation and be familiar with the configuration options and details. Your company is 100% responsible for the configuration and policies on the Juniper Networks-VM Virtual Security. Section One: Service Launch Requirements Step 1: Review Juniper Networks-VM Documentation (NOTE: website and documentation are maintained by Juniper Networks) 1.