Page is loading ...
Contrail Service Orchestration Customer
Portal User Guide
Release
Published
2021-07-29
6.1.0
Juniper Networks, Inc.
1133 Innovation Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc. in
the United States and other countries. All other trademarks, service marks, registered marks, or registered service marks
are the property of their respective owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right
to change, modify, transfer, or otherwise revise this publication without notice.
Contrail Service Orchestration Customer Portal User Guide
6.1.0
Copyright © 2021 Juniper Networks, Inc. All rights reserved.
The information in this document is current as of the date on the title page.
YEAR 2000 NOTICE
Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related
limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with)
Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement
(“EULA”) posted at https://support.juniper.net/support/eula/. By downloading, installing or using such software, you
agree to the terms and conditions of that EULA.
ii
Table of Contents
About the Documentation | xxx
Documentation and Release Notes | xxx
Documentation Conventions | xxx
Documentation Feedback | xxxiii
Requesting Technical Support | xxxiii
Self-Help Online Tools and Resources | xxxiv
Creating a Service Request with JTAC | xxxiv
Introduction
1
Customer Portal Overview | 2
About the Customer Portal User Guide | 2
Customer Portal Overview | 3
Accessing Customer Portal | 10
Personalize the Customer Portal | 12
Switching the Tenant Scope | 13
Setting Up Your Network with Customer Portal | 14
About the Customer Portal Dashboard | 15
Tasks You Can Perform | 15
Field Descriptions | 16
Changing the Customer Portal Password | 19
Resetting the Password | 19
Changing the Password on First Login | 21
Set a New Password After Your Existing Password Expires | 22
Configuring Two-Factor Authentication | 23
Extending the User Login Session | 25
Resend Activation Link in Customer Portal | 26
iii
View and Edit Tenant Settings | 27
Users and Roles | 35
Role-Based Access Control Overview | 35
About the Users Page in Customer Portal | 36
Tasks You Can Perform | 37
Field Descriptions | 37
Adding Tenant and OpCo Tenant Users | 38
Editing and Deleting Tenant and OpCo Tenant Users | 40
Editing Tenant and OpCo Tenant Users | 40
Deleting Tenant and OpCo Tenant Users | 41
Resetting the Password for Tenant Users | 41
Roles Overview | 42
Types of Roles | 42
Role Scopes | 43
Access Privileges | 43
Relationship Between User, Roles, and Access Privileges | 43
Benefits of role-based access control (RBAC) | 44
About the Tenant Roles Page | 45
Tasks You Can Perform | 45
Field Descriptions | 45
Adding User-Defined Roles for Tenant Users | 46
Editing, Cloning, and Deleting User-Defined Roles for Tenant Users | 47
Editing Roles | 48
Cloning Roles | 48
Deleting Roles | 49
Access Privileges for Role Scopes (Tenant and Operating Company) | 50
SD-WAN and NGFW Deployments | 59
SD-WAN and NGFW Workflows for a Tenant Administrator | 59
SD-WAN Deployment Workflow | 59
NFGW Deployment Workflow | 62
iv
Managing Sites, Site Groups, and Site Templates
2
Managing Sites | 67
About the Site Management Page | 68
Tasks You Can Perform | 68
Field Descriptions | 69
Multihoming Overview | 71
Enterprise Hubs Overview | 71
Benefits of Enterprise Hubs | 72
Understand BGP Underlay Routing and Provider Edge (PE) Resiliency | 73
BGP Underlay Routing and Route Advertisements | 74
Benefits of BGP Underlay Routing and PE Resiliency | 74
Upgrading Sites Overview | 75
Add Enterprise Hubs with SD-WAN Capability | 76
Add Provider Hub Sites in SD-WAN Deployments | 103
Adding Cloud Spoke Sites for SD-WAN Deployment | 105
Provisioning a Cloud Spoke Site in AWS VPC | 115
Add a Cloud Spoke Site | 116
Download the Cloud Formation Template | 117
Provision the Device on AWS Server | 117
Activate the Device | 118
Manually Adding Branch Sites | 119
Add a Branch Site with SD-WAN Capability | 120
Adding and Provisioning a Next Generation Firewall Overview | 151
Overview | 151
Topology | 151
Workflow | 152
Enabling Integration with Mist Access Points | 152
Add a Standalone Next-Generation Firewall Site | 153
Managing LAN Segments on a Tenant Site | 161
Adding LAN Segments | 162
Edit a LAN segment | 168
Deploying LAN Segments | 169
Deleting LAN Segments | 170
v
Manage a Site | 170
Start a Network Service | 178
Disable a Network Service | 180
Delete a Network Service | 181
Add IP VPN Configuration to Provider Hubs | 182
Edit IP VPN Configuration for Provider Hubs | 185
Delete IP VPN Configuration from Provider Hubs | 186
Viewing the Sites History | 187
Viewing Jobs Initiated to Add and Configure Sites | 187
Viewing Jobs Initiated to Delete Sites | 188
Edit Site Overview | 189
Benefits of Editing Site Parameters | 192
Edit Branch and Enterprise Hub Site Parameters | 192
Reconfigure Static Tunnels | 203
Edit Site Examples | 204
Example 1: Configure a Site with a LAN segment, WAN link, and Local Breakout Enabled | 205
Example 2: Configure a Site with a LAN Segment, Active WAN Link, Backup WAN Link, and
Local Breakout Enabled | 206
Example 3: Configure a Site with a LAN Segment and Two Active WAN Links | 207
Example 4: Configure a Site integrated with Zscaler | 208
Example 5: Configure Site-to-Site Traffic Through DVPN Tunnels | 209
Example 6: Configure a Fully Functional Site with Enterprise and Provider Hubs | 210
Upgrading Sites | 211
Upgrading Junos OS | 211
Upgrading a Site | 212
Upgrading Sites in Bulk | 213
Delete a Site—Enterprise Hub, Cloud Spoke, and Branch | 213
Managing Site Groups | 216
About the Site Groups Page | 216
Tasks You Can Perform | 216
Field Descriptions | 217
Creating Site Groups | 217
vi
Managing Site Templates | 219
About the Site Templates Page | 219
Tasks You Can Perform | 219
Add Branch Sites by Using a Site Template | 220
Cloning, Editing, and Deleting Site Templates | 221
Cloning Site Templates | 222
Editing Site Templates | 222
Deleting Site Templates | 223
Adding a Site Template | 224
Adding and Configuring Sites by Importing a JSON File | 238
Managing Mesh Tags | 240
Mesh Tags Overview | 240
About the Mesh Tags Page | 241
Tasks You Can Perform | 241
Field Descriptions | 241
Creating User-defined Mesh Tags | 242
Managing Dynamic Mesh | 243
Dynamic Mesh Tunnels Overview | 243
Adding On-Demand Mesh Tunnels | 244
Deleting On-Demand Mesh Tunnels | 246
Managing Devices and Resources
3
Managing Devices | 249
Device Redundancy Support Overview | 250
Prerequisites for SRX Series Devices | 250
Supported Connection Plans | 250
Create and Configure an SD-WAN Site | 251
Dual CPE Devices Logical Topology for NFX Network Services Platform | 251
vii
Dual CPE Devices Logical Topology for SRX Series Gateway Devices | 251
Activate a Device | 252
Manually Activate a Device That Supports Phone-Home Client | 253
Manually Activate a Device That Does Not Support Phone-Home Client | 254
Activating Dual CPE Devices (Device Redundancy) | 255
Viewing the History of Tenant Device Activation Logs | 257
Zero Touch Provisioning Overview | 259
Devices Supported | 260
Benefits | 261
Workflow for Onboarding a Device Using ZTP | 262
Configure an SRX Series CPE to Discover an EX Series Switch or AP Connected to the CPE | 265
Managing Device Images | 266
Device Images Overview | 266
About the Device Images Page | 266
Tasks You Can Perform | 266
Field Descriptions | 267
Deleting Device Images | 267
viii
Managing Resources | 269
Multidepartment CPE Device Support | 270
Overlapping IP Addresses Across Departments | 270
About the Devices Page | 271
Tasks You Can Perform | 272
Field Descriptions | 273
Perform Return Material Authorization (RMA) for a Device | 275
Perform Return Material Authorization (RMA) for a Single-CPE, Enterprise Hub and
Next-Generation Firewall | 276
Perform Return Material Authorization (RMA) for a Dual-CPE Device | 278
Perform RMA for an NFX Cluster | 278
Perform RMA for an SRX Cluster | 281
Grant Return Material Authorization (RMA) for a Device | 283
Grant Return Material Authorization (RMA) for a Single-CPE, Enterprise Hub, and
Next-Generation Firewall | 283
Grant RMA for a Dual-CPE Device | 285
Grant RMA for an SRX Device within an SRX Cluster | 287
Manage a Single CPE Device | 288
Rebooting a CPE Device | 290
Configuring APN Settings on CPE Devices | 291
Configuring APN Settings with SIM Change on CPE Devices | 291
Configuring APN Settings without SIM Change on CPE Devices | 293
Identifying Connectivity Issues by Using Ping | 294
Identifying Connectivity Issues by Using Traceroute | 298
Remotely Accessing a Device CLI | 300
View the Current Configuration on a Device | 301
Generate Device RSI for Enterprise Hub and Spoke Devices | 302
Configuring the Firewall Device | 303
About the Physical Interfaces Page | 305
Tasks You Can Perform | 305
Field Descriptions | 306
About the Logical Interfaces Page | 306
Tasks You Can Perform | 306
Field Descriptions | 307
ix
Adding a Logical Interface | 307
Editing, Deleting, and Deploying Logical Interfaces | 310
Editing Logical Interfaces | 310
Deleting Logical Interfaces | 311
Deploying Logical Interfaces | 311
Enable LLDP on a CPE Interface | 311
Create LAG Interface | 312
Create a RETH Interface | 314
Create a Redundancy Group | 316
Manage Redundancy Groups | 317
Adding a Security Zone | 318
Adding a Routing Instance | 321
Create Management Connectivity Between a CPE and a Switch | 322
Discover an EX Series Switch or APs Configured Behind a CPE | 325
View an EX Series Switch or an AP on Mist | 325
View an SRX Series CPE on Juniper Mist | 326
About the Static Routes Page | 326
Tasks You Can Perform | 326
Field Descriptions | 327
Adding a Static Route | 327
Editing, Deleting, and Deploying Static Routes | 330
Editing Static Routes | 330
Deleting Static Routes | 331
Deploying Static Routes | 331
Managing Device Templates | 332
Device Template Overview | 332
Platform | 333
SD-WAN CPE | 333
Secure Internet CPE | 335
Managed Internet CPE | 336
About the Device Template Page | 337
Tasks You Can Perform | 337
Field Descriptions | 337
x
Supported Device Templates | 338
Cloning a Device Template | 340
Importing a Device Template | 341
Creating a Device Template File | 342
Importing a Device Template File | 342
Updating Stage-2 Configuration Template in a Device Template | 343
Configuring Stage-2 Initial Configuration in a Device Template | 348
Managing Configuration Templates | 351
Configuration Templates Overview | 351
Benefits | 352
Configuration Templates Workflow | 353
About the Configuration Templates Page | 354
Tasks You Can Perform | 354
Field Descriptions | 355
Predefined Configuration Templates | 357
Edit, Clone, and Delete Configuration Templates | 361
Edit a Configuration Template | 361
Clone a Configuration Template | 362
Delete a Configuration Template | 363
Deploy Configuration Templates to Devices | 363
Deploy from the Configuration Templates Page | 364
Deploy from the Devices Page | 368
Undeploy a Configuration Template from a Device | 369
Dissociate a Configuration Template from a Device | 371
Preview and Render Configuration Templates | 371
Import Configuration Templates | 373
Export a Configuration Template | 375
Assign Configuration Templates to Device Templates | 376
Add Configuration Templates | 378
Jinja Syntax and Examples for Configuration Templates | 387
Jinja Syntax and CSO Keywords | 388
Example 1: Convert a Single Junos OS Command to Jinja Syntax | 390
Example 2: Convert a Junos OS Configuration Snippet to Jinja Syntax | 391
xi
Example 3: Use Conditional Logic | 393
Example 4: Use Variable Substitution | 395
Example 5: Use Filters, Concatenation, and Set Variables | 396
Example 6: Test a Value | 397
View the Configuration Deployed on Devices | 399
Managing Licenses | 401
About the Device Licenses Page | 401
Tasks You Can Perform | 401
Field Descriptions | 402
Add a Device License File | 403
Edit a Device License File | 404
Delete a Device License File | 404
Push a Device License File | 405
About the CSO Licenses Page | 406
Tasks You Can Perform | 406
Field Descriptions | 407
Managing Signature Database and Certificates | 409
Signature Database Overview | 409
About the Signature Database Page | 410
Tasks You Can Perform | 410
Field Descriptions | 410
Manually Installing Signatures | 411
Automating Signature Database Installation | 413
Managing Signature Installation Settings (Auto Installation) | 416
Certificates Overview | 416
About the Certificates Page | 417
Tasks You Can Perform | 417
Field Descriptions | 417
Importing a Certificate | 419
Installing and Uninstalling Certificates | 421
Installing a Certificate | 421
Uninstalling a Certificate | 422
xii
About the VPN Authentication Page | 422
Tasks You Can Perform | 423
Field Descriptions | 423
Modify PKI Settings for All Sites | 425
Modify PKI Settings for Selected Sites | 428
Managing Juniper Identity Management Service | 430
Juniper Identity Management Service Overview | 430
Access Token Query | 431
Batch or Periodic Query | 431
IP Address Query | 432
User Mapping Query | 432
About the Identity Management Page | 433
Tasks You Can Perform | 433
Configuring CSO and JIMS Connection | 434
Configuring JIMS for an SRX Device | 436
Managing Policies, Profiles, and Proxies
4
Managing Firewall Policies | 440
Firewall Policy Overview | 441
About the Firewall Policy List Page | 443
Tasks You Can Perform | 443
Field Descriptions | 443
About the Firewall Policy Name Page | 444
Tasks You Can Perform | 444
Field Descriptions | 445
Adding a Firewall Policy | 445
Editing and Deleting Firewall Policies | 447
Editing Firewall Policies | 448
Deleting Firewall Policies | 448
Adding Firewall Policy Intents | 449
Editing, Cloning, and Deleting Firewall Policy Intents | 455
Editing Firewall Policy Intents | 456
Cloning Firewall Policy Intents | 456
xiii
Deleting Firewall Policy Intents | 457
Selecting Firewall Source | 457
Adding an End Point as Firewall Source | 458
Selecting Firewall Source Using Abbreviations | 459
Selecting a Firewall Source from the End Points Panel | 459
Creating and Selecting a Firewall Source from the End Points Panel | 460
Creating Addresses from Source | 460
Selecting Firewall Destination | 461
Adding an End Point as Firewall Destination | 461
Selecting Firewall Destination Using Abbreviations | 462
Selecting a Firewall Destination from the End Points Panel | 462
Creating and Selecting a Firewall Destination from the End Points Panel | 463
Creating Addresses from Destination | 463
Firewall Policy Examples | 464
Example 1: Firewall Policy that Permits Traffic from Departments in Site A to the Departments
in Site B | 466
Example 2: Firewall Policy that Permits Internet Access for all Departments in Site A and Site
B| 468
Example 3: Firewall Policy that Permits Any Public Internet Address to Access the Sales
Department in Site B | 471
Example 4: Firewall Policy that Permits Social Media Access to all Departments in Site A | 472
Example 5: Firewall Policy that Controls Access to Specific Applications for Various
Departments | 474
Example 6: Firewall Policy that Denies Access to Social Networking Sites | 482
Example 7: Firewall Policy that Controls Access to an Address over the Internet (HTTP) | 485
Example 8: Firewall Policy that Permits or Denies the Use of HTTP or FTP as a Service | 491
Example 9: Firewall Policy that Denies Access to BitTorrent to the Finance Departments across
both Site A and Site B | 493
Example 10: Firewall Policy that Allows Access to Facebook for Users in User Group A | 496
Example 11: Firewall Policy that Permits User B in Site A Access to YouTube with UTM
Enabled | 500
Example 12: Firewall Policy that blocks access to Internet and allow access to Google
Drive. | 503
Firewall Policy Schedules Overview | 504
xiv
About the Firewall Policy Schedules Page | 505
Tasks You Can Perform | 505
Field Descriptions | 505
Creating Schedules | 506
Editing, Cloning, and Deleting Schedules | 508
Editing Schedules | 508
Cloning Schedules | 508
Deleting Schedules | 509
Deploying Firewall Policies | 509
About the Default Profiles for Unified Firewall Policy Page | 510
Tasks You Can Perform | 511
Field Descriptions | 511
Editing Default Settings for the Unified Firewall Policy | 512
Importing Policies Overview | 514
Importing Firewall Policies | 516
Managing UTM Profiles | 518
UTM Overview | 519
UTM Licensing | 520
UTM Components | 520
Configuring UTM Settings | 521
About the UTM Profiles Page | 523
Tasks You Can Perform | 523
Field Descriptions | 523
Creating UTM Profiles | 525
Editing, Cloning, and Deleting UTM Profiles | 528
Editing UTM Profiles | 528
Cloning UTM Profiles | 529
Deleting UTM Profiles | 529
xv
About the Web Filtering Profiles Page | 530
Tasks You Can Perform | 530
Field Descriptions | 531
Creating Web Filtering Profiles | 532
Editing, Cloning, and Deleting Web Filtering Profiles | 536
Editing Web Filtering Profiles | 537
Cloning Web Filtering Profiles | 537
Deleting Web Filtering Profiles | 538
About the Antivirus Profiles Page | 538
Tasks You Can Perform | 539
Field Descriptions | 539
Creating Antivirus Profiles | 540
Editing, Cloning, and Deleting Antivirus Profiles | 543
Editing Antivirus Profiles | 543
Cloning Antivirus Profiles | 543
Deleting Antivirus Profiles | 544
About the Antispam Profiles Page | 545
Tasks You Can Perform | 545
Field Descriptions | 545
Creating Antispam Profiles | 546
Editing, Cloning, and Deleting Antispam Profiles | 548
Editing Antispam Profiles | 549
Cloning Antispam Profiles | 549
Deleting Antispam Profiles | 550
About the Content Filtering Profiles Page | 550
Tasks You Can Perform | 550
Field Descriptions | 551
Creating Content Filtering Profiles | 552
Editing, Cloning, and Deleting Content Filtering Profiles | 556
Editing Content Filtering Profiles | 556
Cloning Content Filtering Profiles | 556
Deleting Content Filtering Profiles | 557
xvi
About the URL Patterns Page | 558
Tasks You Can Perform | 558
Field Descriptions | 558
Creating URL Patterns | 559
Editing, Cloning, and Deleting URL Patterns | 560
Editing URL Patterns | 561
Cloning URL Patterns | 561
Deleting URL Patterns | 562
About the URL Categories Page | 562
Tasks You Can Perform | 562
Field Descriptions | 563
Creating URL Categories | 563
Editing, Cloning, and Deleting URL Categories | 565
Editing URL Categories | 565
Cloning URL Categories | 565
Deleting URL Categories | 566
Managing SLA Profiles and SD-WAN Policies | 567
Traffic Steering Profiles and SD-WAN Policies Overview | 568
Traffic Steering Profiles | 568
SD-WAN Policies | 571
About the SD-WAN Policy Page | 573
Tasks You Can Perform | 573
Field Descriptions | 574
Creating SD-WAN Policy Intents | 575
Editing and Deleting SD-WAN Policy Intents | 583
Editing SD-WAN Policy Intents | 583
Deleting SD-WAN Policy Intents | 584
Application Quality of Experience Overview | 584
Benefits of Application Quality of Experience | 586
Configure and Monitor Application Quality of Experience | 586
xvii
About the SLA-Based Steering Profiles Page | 587
Tasks You Can Perform | 587
Field Descriptions | 588
Adding SLA-Based Steering Profiles | 591
Editing and Deleting SLA-Based Steering Profiles | 598
Editing an SLA-Based Steering Profile | 598
Deleting SLA-Based Steering Profiles | 599
About the Path-Based Steering Profiles Page | 600
Tasks You Can Perform | 600
Field Descriptions | 600
Adding Path-Based Steering Profiles | 602
Editing and Deleting Path-Based Steering Profiles | 604
Editing a Path-Based Steering Profile | 605
Deleting a Path-Based Steering Profile | 606
Breakout and Breakout Profiles Overview | 606
Cloud Breakout | 608
Breakout Profiles | 608
SD-WAN Policy Intents for Breakout | 608
Benefits of Breakout Profiles | 609
About the Breakout Profiles Page | 609
Tasks You Can Perform | 610
Breakout Profiles Field Descriptions | 610
Cloud Breakout Settings Field Descriptions | 612
Adding Breakout Profiles | 614
Adding Cloud Breakout Settings | 616
Assigning Cloud Breakout Settings to Sites | 620
Detaching Cloud Breakout Settings from Sites | 622
Editing Breakout Profiles and Cloud Breakout Settings | 623
Editing Breakout Profiles | 623
Editing Cloud Breakout Settings | 624
Deleting Breakout Profiles and Cloud Breakout Settings | 625
Deleting Breakout Profiles | 625
Deleting Cloud Breakout Settings | 625
Configuring Breakout on SD-WAN Sites | 626
xviii
Managing NAT Policies | 628
NAT Policies Overview | 629
About the NAT Policies Page | 632
Tasks You Can Perform | 632
Field Descriptions | 632
Creating NAT Policies | 633
Editing and Deleting NAT Policies | 635
Editing NAT Policies | 635
Deleting NAT Policies | 635
About the Single NAT Policy Page | 636
Tasks You Can Perform | 636
Field Descriptions | 637
Creating NAT Policy Rules | 638
Editing, Cloning, and Deleting NAT Policy Rules | 645
Editing NAT Policy Rules | 645
Cloning NAT Policy Rules | 645
Deleting NAT Policy Rules | 646
Deploying NAT Policy Rules | 647
Selecting NAT Source | 648
Adding an Endpoint as NAT Source | 648
Selecting Interfaces when GWR Resides Inside an NFX Box | 648
Selecting NAT Source Using Abbreviations | 649
Selecting a NAT Source from the End Points Panel | 650
Creating and Selecting a NAT Source from the End Points Panel | 650
Creating Addresses from Source Field | 651
Selecting NAT Destination | 652
Adding an Endpoint as NAT Destination | 652
Selecting Interfaces when GWR Resides Inside an NFX Box | 652
Selecting NAT Destination Using Abbreviations | 653
Selecting a NAT Destination from the End Points Panel | 654
Creating and Selecting a NAT Destination from the End Points Panel | 654
Creating Addresses from Destination Field | 655
Creating Services from Destination Field | 655
NAT Pools Overview | 656
xix
About the NAT Pools Page | 656
Tasks You Can Perform | 657
Creating NAT Pools | 658
Editing, Cloning, and Deleting NAT Pools | 660
Editing NAT Pools | 660
Cloning NAT Pools | 661
Deleting NAT Pools | 661
Deploying NAT Policies | 662
Importing NAT Policies | 662
Managing IPS Signatures and Profiles | 665
About the IPS Signatures Page | 665
Tasks You Can Perform | 666
Field Descriptions | 666
Create IPS Signatures | 670
Create IPS Signature Static Groups | 678
Create IPS Signature Dynamic Groups | 679
Edit, Clone, and Delete IPS Signatures | 685
Edit IPS Signatures | 685
Clone IPS Signatures | 686
Delete IPS Signatures | 686
Edit, Clone, and Delete IPS Signature Static Groups | 687
Edit IPS Signature Static Groups | 687
Clone IPS Signature Static Groups | 688
Delete IPS Signature Static Groups | 689
Edit, Clone, and Delete IPS Signature Dynamic Groups | 690
Edit IPS Signature Dynamic Groups | 690
Clone IPS Signature Dynamic Groups | 691
Delete IPS Signature Dynamic Groups | 692
About the IPS Profiles Page | 692
Tasks You Can Perform | 693
Field Descriptions | 693
Create IPS Profiles | 694
xx
/
