Network and Security Manager (NSM) Release Notes DMI Schema

Release version 212 ver 1.0, 10-24-2011

Juniper Networks, Inc.

1194 North Mathilda Avenue Sunnyvale, CA 94089 USA 408-745-2000

www.juniper.net

Network and Security Manager (NSM) Release Notes

Version Summary
Juniper Networks Network and Security Manager (NSM) is a software application that centralizes control and management of your Juniper Networks devices. With Network and Security Manager, Juniper Networks delivers integrated, policy-based security and network management for all security devices and other Juniper Networks devices in your networks. Network and Security Manager uses the technology developed for Juniper Networks ScreenOS to enable and simplify management support for previous and current versions of ScreenOS and now for Junos Software. By integrating management of all Juniper Networks devices, Network and Security Manager enhances the overall security and manageability of the Internet gateway

Known Issues
PR 692185: vlan l3 interface config is not supported for 11.2 junos devices. If the vlan l3 config is present on the device, NSM will remove it on next update. PR 688353: Serial Number is not displayed for SRX110 device (New platform) under Hardware inventory Chassis information. PR 691493: server-reject-vlan option under Dot1x cannot be configured for 11.2 junos devices. If the config is present on the device, NSM will remove it on next update.

Addressed Issues
Predefined application support for srx210h-poe devices. PR 680976 - SRX When removing CHAP config from an interface, it is not completely removed PR 690125: NSM tries to delete idp related config from J-series device

Added Support
10.4R7.5 schema release for junos, junos-es and junos-ex devices.

DMI Schema Release 2

Network and Security Manager (NSM) Release Notes

Supported releases
This DMI schema update supports the following device code releases: Note: Junos 10.4R2 will not be supported. Junos Service Releases have limited support in NSM. Junos Service Release device CLI changes will not be supported in NSM. SA 7.0r7 and 7.1r3 do not have published schema and will not be supported from NSM. Please refer to the SA release notes for more details.

Device Family

JunOS version Release 11.2 11.2R1.10 Release 11.1 11.1R1.14, 11.1R2.3, 11.1R3.5, 11.1R4.4 Release 10.4 10.4R1.9, 10.4R3.4, 10.4R4.5, 10.4R5.5, 10.4R6.5 10.4R7.5 Release 10.3 10.3R1.9, 10.3R2.11, 10.3R3.7, 10.3R4.4 Release 10.2 10.2R2.11, 10.2R4.8 Release 10.1 10.1R1.8, 10.1R2.8, 10.1R3, 10.1R4.4 Release 10.0 10.0R1, 10.0R2, 10.0R3, 10.0R4 Release 9.6 9.6R1, 9.6R2, 9.6R4 Release 9.5 9.5R1, 9.5R2, 9.5R3, 9.5R4 Release 9.4 9.4R1, 9.4R2, 9.4R3, 9.4R4 Release 11.2 11.2R1.10 Release 11.1 11.1R1.14, 11.1R2.3, 11.1R3.5, 11.1R4.4 Release 10.4 10.4R1.9, 10.4R3.4, 10.4R4.5, 10.4R5.5, 10.4R6.5 10.4R7.5 Release 10.3 10.3R1.9, 10.3R2.11, 10.3R3.7, 10.3R4.4 Release 10.2 10.2R2.11, 10.2R4.8 Release 10.1 10.1R1.11, 10.1R1.8, 10.1R2.8, 10.1R3, Release 10.1 10.1R4.4 Release 10.0 10.0R1, 10.0R2, 10.0R3, 10.0R4 Release 9.6 9.6R1, 9.6R2, 9.6R4 Release 9.5 9.5R1, 9.5R2, 9.5R3, 9.5R4 Release 9.4 9.4R1, 9.4R2, 9.4R3, 9.4R4

J/SRX family

M/MX

DMI Schema Release 3

Network and Security Manager (NSM) Release Notes

EX

Release 11.2 11.2R1.2 Release 11.1 11.1R1.14, 11.1R2.3, 11.1R3.5, 11.1R4.4 Release 10.4 10.4R1.9, 10.4R3.4, 10.4R4.5, 10.4R5.5, 10.4R6.5 10.4R7.5 Release 10.3 10.3R1.9, 10.3R2.11, 10.3R3.7, 10.3R4.4 Release 10.2 10.2R2.11, 10.2R4.8 Release 10.1 10.1R1.8, 10.1R2.8, 10.1R3, 10.1R4.4 Release 10.0 10.0R1, 10.0R2, 10.0R3, 10.0R4 Release 9.6 9.6R1, 9.6R2, 9.6R4 Release 9.5 9.5R1, 9.5R2, 9.5R3, 9.5R4 Release 9.4 9.4R1, 9.4R2, 9.4R3, 9.4R4 JunOS version Release 7.1 7.1R1, 7.1R2, 7.1R4 Release 7.0 7.0R1, 7.0R3, 7.0R6 Release 6.5 6.5R1, 6.5R2, 6.5R3, 6.5R4, 6.5R5, Release 6.5 6.5R7, 6.5R9, 6.5R10, 6.5R11 Release 6.4 6.4R4, 6.4R5 Release 6.3 6.3R2, 6.3R3, 6.3R5, 6.3R6, 6.3R7 Release 4.0 4.0R1, 4.0R3 Release 3.1 3.1R2, 3.1R1, 3.1R2, 3.1R4, 3.1R5 Release 3.0 3.0R3 Release 2.2 2.2R2, 2.2R3 Release 11.1 11.1R1.2

Device Family

Secure Access

Infranet Controller

Junos - MAG

NSM releases are bundled with specific versions of Schema. All listed versions of NSM can be upgraded to the latest schema.

NSM Release NSM 2011.1 NSM 2010.4 NSM 2010.3 NSM 2010.2 NSM 2010.1 NSM 2009.1r1 NSM 2008.2r2

Bundled Schema version Version 166 Version 158 Version 143 Version 134 Version 119 Version 87 Version 66

DMI Schema Release 4

Network and Security Manager (NSM) Release Notes

DMI Schema Release 5

Network and Security Manager (NSM) Release Notes

Schema Update considerations

Online Schema update KB12561 Offline Schema update KB12756 Before the Schema is applied on the NSM servers, the below changes may need to be performed. These changes are required on 2010.3 and 2010.4 versions of NSM. These changes may also be required when upgrading to a later NSM version.

1. Login to the NSM GUI Server & edit the /usr/netscreen/GuiSvr/var/guiSvr.cfg Modify the line that looks as below guiSvrDirectiveHandler.max.heap 1024000000 to guiSvrDirectiveHandler.max.heap 1536000000 2. Login to the NSM Device Server & edit the /usr/netscreen/DevSvr/var/devSvr.cfg Modify the line that looks as below devSvrDirectiveHandler.max.heap 1024000000 to devSvrDirectiveHandler.max.heap 1536000000 3. Login to the NSM Dev Server & edit the file /usr/netscreen/DevSvr/var/be/cfg/SWRPCInfo.prop Modify the below parameters to new values as shown below: get-re-info.response.retry=60 request-package-add.response.retry=10 request-reboot.response.retry=10 file-put.response.timeout=120 file-put.response.retry=10 (may be set as high as 40 if upgrade is timing out)

These changes are required due to the increased JUNOS image sizes. 4. Stop all the NSM processes Non-HA environment /etc/init.d/haSvr stop /etc/init.d/guiSvr stop /etc/init.d/devSvr stop HA environment /etc/init.d/haSvr stop 5. Start all the processes Non-HA environment /etc/init.d/guiSvr start

DMI Schema Release 6

Network and Security Manager (NSM) Release Notes

/etc/init.d/devSvr start /etc/init.d/haSvr start HA environment /etc/init.d/haSvr start 6. On the client we need to update the heap size Go to C:\Program Files\Network and Security Manager/ Edit NSM.lax file & modify the heap size to the below values lax.nl.java.option.java.heap.size.initial=48m to lax.nl.java.option.java.heap.size.initial=64m lax.nl.java.option.java.heap.size.max=768m to lax.nl.java.option.java.heap.size.max=1280m

Getting Help
For more assistance with Juniper Networks products, visit: www.juniper.net/support Juniper Networks provides maintenance releases (updates and upgrades) for NSM software. To have access to these releases, you must register your NetScreen devices and NSM application with Juniper Networks at the above web address. Copyright 2007 Juniper Networks, Inc. All rights reserved. Juniper Networks and the Juniper Networks logo are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered trademarks, or registered service marks in this document are the property of Juniper Networks or their respective owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without receiving written permission from: Juniper Networks, Inc. ATTN: General Counsel 1194 N. Mathilda Ave. Sunnyvale, CA 94089 U.S.A. http://www.juniper.net

DMI Schema Release 7