Yes I know, ScreenOS is “End of Everything” (EoE). However, for historical reasons I am still managing many Netscreen/ScreenOS firewalls for some customers. Similar to my troubleshooting CLI commands for Palo Alto and Fortinet I am listing the most common used commands for the ScreenOS devices as a quick reference / cheat sheet. These are only the commands that are needed for deep troubleshooting sessions that cannot be done solely on the GUI.

At first: Always remember that the default backspace key is “Ctrl + h” and not the backspace key itself! ;)

Basics

These are the very basics on the command line:

How to turn off the LED alarm on the firewall:

Basic Networking

The reason why we are all here:

 

Application Layer Gateway

I had some trouble with the application layer gateway functionality on the ScreenOS devices. Here are some hidden commands that help while troubleshooting the ALGs:

And a few links concerning ALGs:

• How to show which TCP/UDP ports trigger an ALG ?
• Viewing list of ALGs and disabling an ALG differs on ScreenOS versions
• Which ALGs are unset by default in ScreenOS 6.x?
• What is the Policy keyword “Application NONE”?

 

NSRP (High Availability)

The following command lists all details about an NetScreen Redundancy Protocol (NSRP) cluster, i.e., the IDs of all connected units, the current master, encryption and authentication passwords (in plain text!), etc.:

To sync the configuration from the master to the local device (AND NOT VICE VERSA!!!) [Link]:

And to do a manual failover. This brings the current master unit into backup mode. This command must be used on the current master! [Link]:

 

Session & Log

The session commands list sessions that are currently active. The traffic log shows already finished sessions (of course only if they were logged):

Link: “How to determine how long a session has been up in ScreenOS“.

 

IPsec VPN

This is one of the main use cases for using the CLI on the SSG firewalls: Many details about IPsec site-to-site VPNs, e.g., the proxy-IDs for policy-based VPNs:

In order to clear a current VPN connection, use one of the following commands for either phase 1 (IKE) or phase 2 (IPsec):

Flow

To display the most detailed information about active flows, for example to see which policies trigger or which routing table lookups are used, etc. [Link]:

 

Common Problems

Some more links to common problems or other scenarios:

• Packet taking the wrong route due to the route-cache feature
• What does ‘set flow mac-cache mgt’ do?
• Behavior of ScreenOS ‘set flow’ commands in asymmetric routing scenario
• How can I find the serial number for my Juniper Networks device?
• How to Update the New Image Authentication Key and Upgrade Boot Loader/ScreenOS Firmware

 

NSM Stuff

And finally some notes concerning the “Network and Security Manager“.

• Default port from ScreenOS device to NSM: TCP/7800 .
• Default https port to download the Java GUI: https://<ip>:8443 .
• Default port from Java GUI to NSM: TCP/7808 .

To become root on the NSM CLI:

And some links:

• What ports are used for communication between the Management System (NSM), the GUI client, and Juniper Firewall devices?
• Recommended starting and stopping sequences for NSM services
• Export NSM logs to CSV file from the NSM CLI

 

Factory Reset & Defaults

To do a factory reset you can either use the reset pinhole on the device or login to the serial console with the serial number as username and password. Both ways are explained here.

To do a reset via the CLI use the following commands, explained here. Note that this is NOT a complete factory reset but only an “unset” of all commands, while port modes, license keys, etc. will remain:

The default IPv4 address is 192.168.1.1. The switch ports which are configured with this IPv4 address vary! For example, on a SSG 5 it is bgroup0 = eth0/2 – 0/6 while on a SSG 140 it is eth0/0. The default login is netscreen:netscreen. (Followed by “tab tab enter” to login via the GUI. ;))

 

Update via USB

To update the imagekey and the ScreenOS firmware from an USB stick (rather than GUI, NSM, or TFTP) use the following commands:

Featured image “Warten auf Arbeit” by Günter Hentschel is licensed under CC BY-ND 2.0.