Introduction

Juniper Sky Enterprise delivers cloud-based network management for Juniper SRX Series, EX Series, QFX Series and NFX Series devices. It provides a secure web-based user interface that is quick to set up and connect devices to. With Sky Enterprise, network engineers with no prior Juniper Networks experience can easily deploy and manage devices and the network.

This User Guide describes the features within Sky Enterprise and how to use them.

The video below provides an overview of Sky Enterprise capabilities (duration 3:46).

Getting Access to Sky Enterprise

Trial Accounts

Juniper Networks offers free 30-day accounts to customers who are interested in a trial of the system. Once the trial account is activated trial users can add their Juniper devices to Sky Enterprise where they will have access to the full set features enjoyed by subscribers.

To request a trial account complete the form found at: https://www.juniper.net/us/en/forms/sky-enterprise-free-trial/. Juniper will send you an email with an activation link. The link expires after 48 hours, if you are unable to activate before it expires, contact Juniper Customer Care to request the link to be resent.

Demonstration Accounts

Demonstration accounts are available for Juniper Networks staff. These can be requested via email to: skyent-trial@juniper.net

Activating Sky Enterprise Licenses

When you purchase Sky Enterprise licenses you can activated your account via the Juniper Agile Licensing Portal.

1. If you don't already have a Juniper User Account, register for one at: https://userregistration.juniper.net/entitlement/setupAccountinfo.do

2. Sign into the Juniper Agile Licensing Portal at: https://license.juniper.net/licensemanage/

3. Activate your license in the Juniper Agile Licensing Portal:

• If you are activating a new license, click New Cloud Registration. Then enter the Authorization Code/Activation Code located in your certificate and follow the onscreen instructions.

• If you are adding licenses to your existing cloud service, find your new purchase in the entitlement screen and select it. Follow the on-screen instructions to activate the new license for your cloud instance.

For assistance you can open a Customer Care case at: https://support.juniper.net/support

Sites

Logging in to Sky Enterprise automatically takes users to the 'Sites' view. This is the first tab on the 'Home' page. This page gives users a quick network overview including interactive world map view, devices online/offline, alarms and sites.

The main part of the screen shows the Google Maps view where you can view, add and edit your site details for locations around the world. Below the map is a list of existing sites.

Devices

The Devices Dashboard provides a single list view of all your managed devices. This view can be organised using Device and Site tags, and offline devices can be filtered out using the display options menu.

The following tools are accessible from this view:

Add Device

• Display Options - toggle on or off:

  • System Alarms

  • License Alarms

  • Device & Site Tags

  • Show Online Devices

  • Show Offline Device

• Download

This button downloads a CSV file of all your Juniper device, including: hostname, description, device models, Junos versions, serial numbers, site details, IP address, up time, last backup time, reboot reason. Think of this as a near real time asset report.

• Set Tags

Create tags and add them to any device, this is a useful tool for grouping devices by model, function, location or any other common element. You can use tags in search functions, and for selecting groups of devices for bulk update actions.

• Search

Fast search option to find any string within your device list

The list of devices is displayed as a table with the following information and tools:

• Action - the Action menu provides easy access to device management and configuration workflows.

• Host/(hostname) - displays the name of the device as configured within the system with the device's hostname in brackets next to it.

• Model - Juniper device model

• Description/IP address - manually added description / IP address is the public IP address of the network that the devices is connected to

• Status - online or offline, also has hover for last connect time

Tenants

The 'Tenants' tab is visible when the 'Multi Tenancy' option is selected in the 'Settings' tab. To enable 'Multi Tenacy' see Enable Multi Tenancy.

To add a new tenant, click on the 'Add Tenant' button.

Users created at a tenant hierarchy are bound to that hierarchy. Different users roles are available during user creation. See Creating Multi Tenant Users and Understanding User Roles.

A logo can be shared from a higher level tenant with sub tenants. To do so see; Share Logo with Tenants.

Tenants is a great way for managed service providers (MSP's) and/or large organizations to segment users and devices into responsibility domains.

Tools

The Tools tab contains features to help you locate specific devices.

There are two search options available:

• IP Address search performs a search of all your managed devices across you network to quickly locate a specific IP address. Enter the IP address that you are looking for and click 'Search'.

• MAC Address will search your network for the specific MAC address that you entered.

Topology

The Topology tab presents a real time layer-2 view of your network devices. The view is generated using LLDP (link layer discovery protocol). LLDP is a vendor neutral protocol so non-Juniper devices running this protocol will be displayed in this view e.g. other vendor network devices, access points, IP phones, servers configured with LLDP.

Sky Enterprise will display up to 250 devices in the Topology view. Views can be network-wide, or site specific. To view an individual site, select the site from the dropdown menu on the middle-right of the screen.

Alarms

The 'Alarms' tab is visible when 'Enable Global Device Alarms' option is selected in the 'Settings' tab.

WiFi

This tab displays information about SRX WIFi mPIM Access Points. SRX WiFi mPIM Access Points are cards that can be installed in Juniper SRX320, SRX340, SRX345, SRX380 and SRX550M devices. Additional details below.

When an SRX WiFi mPIM is installed in an SRX, Sky Enterprise will automatically detect it and enable the WiFi menu for configuring the device.

The 'WiFi' tab displays a list of all SRX WiFi Access Points currently active on the network. The table (shown below) includes SSID, Parent AP, the associated device (that the WiFi mPIM is installed in), country code, Mode, Channel, Security, VLAN, active client count and connection status.

Using the Action menu on a Mist Access Point the following options are available:

• View details - shows the Access Points details including hostname, ID, model, version, serial number, MAC, IP address and more

• Update Associations - allows an Access Point to be associated with a Juniper device (EX) and/or a site within Sky Enterprise

• View AP in Mist Portal - launching you into the Mist portal directly to the Access Point you are looking at in Sky Enterprise

The video below shows an overview of establishing the Mist API integration, and the simple user interface in Sky Enterprise for viewing you wifi access points and clients.

Managing Devices

This section provides information about managing devices from the Action menu in the Devices tab.

There are menu items that are common across multiple device types, for example: Interfaces/VLANs; System and Monitoring; and Junos CLI. Other menu items are specific to certain device types. For example, Security Policies and Zones is available for SRX devices, but not for EX and QFX.

For each of the Action menu items described below, the device type that that the menu applies to is listed in the title.

Custom SD-WAN and Routing

What is Custom SD-WAN?

Custom SD-WAN is a group of features within Sky Enterprise that contribute to the deployment and ongoing management of SD-WAN environments. It is called 'custom' because these features can be used at the discretion of the network administrator to add configuration to an SRX device in any manner they want.

The video below describes the Custom SD-WAN features.

Application Routes

Layer 7 application routes can be managed on the Application Routes view within Custom SD-WAN. All common interface types like Ethernet, 3G/4G LTE, T1/E1, are supported. Direct internet break-out along with IPSec tunnels are supported with no custom underlay required.

Security - Policies (SRX)

The screenshot below shows the Security Policies view in Sky Enterprise. There are two tabs available: Firewall and App Firewall.

Managing firewall security policies in the Firewall section of Sky Enterprise is simple. The top menu allows users to:

• + Add Security Policy Template

• + New Policy

• Change Default Policy

• Download

• Expand all

• Close all

• Full policy detail

Security - NAT (SRX)

Source NAT

Source NAT is the default NAT setup on SRX firewalls. It allows private internal networks (Trust Zone) to traverse and be translated to the public internet (Untrust Zone). A security policy is also needed to permit traffic.

Security - VPNs (SRX)

Sky Enterprise makes it easier for administrators to create and manage VPNs between their network devices. In the VPN section a list of existing VPNs is shown (if any exist), and the button to add an IPSec VPN using the Sky Enterprise wizard.

Clicking on the VPN wizard opens up a modal that requires basic details to be added to create the VPN. As shown below, the information required includes:

• VPN Name

• Local address range and policy zone

• Tunnel details

• Remote Address details

The wizard also includes and 'Advanced' section with further options including: mode and advanced IKE and IPsec details.

Security - IDP (SRX)

Sky Enterprise provides a simple interface for Intrusion Detection and Prevention (IDP) Policy and Custom Attack creation. Please note that you do not need any additional licensing in Sky Enterprise for this, but it is a licensed feature on the SRX device(s). Please ensure that the SRX you wish to configure IDP on is licensed (see device license checking in Sky Enterprise) and the IDP database is downloaded and installed.

For IDP specific questions, please refer to the IDP best practices guide; https://kb.juniper.net/InfoCenter/index?page=content&id=KB25915&actp=METADATA for more information.

Security - Applications (SRX)

Security applications or sometimes referred to as custom applications can be created using Sky Enterprise. This application list is the port and protocol based custom applications. To create advanced L7 dynamic applications please see "App Firewall".

Security - Security Feeds (SRX)

Sky Enterprise’s Dynamic Security Feed enables SRX devices to subscribe to a feed to dynamically update their security policies. The following feeds are available in Sky Enterprise:

• • • • Microsoft Office 365 (O365)

      • Microsoft Azure

      • AWS

Sky Enterprise constantly checks the IP infrastructure lists of these vendor services and if a change is detected, the security feed is updated. This update is automatically applied to SRX devices that are subscribed to the feed without the need for a commit.

As shown below, feeds can simply be selected from a dropdown list.

Feeds can be selected individually or using the "_all" options e.g. "ms_azure_all".

Once selections are finalised, click the 'Submit' button and the feeds will be added to the SRX.

Adding Custom Feeds

You can create and maintain your own custom IP feeds to Sky Enterprise. These can then be added to your devices by selecting them from the list as shown above.

To create a new Custom feed, browse to the 'Settings' section and select the 'Dynamic Address Book Feeds' tab. Any existing Custom feeds will be shown in a list. You can add new feeds by selecting the 'Add Custom Security Feed' button.

DHCP

In the DHCP section you can create and manage the dynamic host configuration protocol capabilities of your SRX and EX devices.

As shown below, there are sections for managing DHCP Groups, and DHCP Pools.

Interfaces

In the Interfaces tab you can view the device's interface, logical and physical. The table view includes mode details e.g. access or trunk mode, VLAN membership, DHCP, connected status and enabled status.

The Interface action menu also provides a link to view the real-time graph of each interface.

VLANs

In the VLANs tab you can create and manage VLANs on your devices.

Ranges

Ranges provides an easy way to manage interfaces as a group. Using the Ranges feature in Sky Enterprise you can easily and quickly create and manage interface ranges.

Spanning Tree Protocol

There are still many networks running Spanning Tree Protocol, also know as Rapid Spanning Tree Protocol (RSTP). This Sky Enterprise feature makes is easy to configure and maintain RSTP in your network.

System and Monitoring

The System and Monitoring section in the Devices Action menu is where you will find a range of visibility and monitoring tools for individual devices.

The System and Monitoring menu contains a range a tab, these include:

• System Graphs - near real-time graphs showing CPU, Memory and temperature based on data gathered continuously every 5 minutes. Graphs are available in hourly, daily, weekly and monthly view. Graph data for weekly and hourly views is aggregated over time. For SRX and VSRX device, a graph of security sessions is also provided.

• Interface graphs - near real-time graphs showing ingress and egress traffic volumes on interfaces

• Application and Network Risk (ANR) Reports - For SRX devices only. Reports showing details of applications and risks traversing the device. For best results devices must be configured to send syslog details to Sky Enterprise. Licenses for AppID, IDP, WebSense, Sky ATP and other services are required.

• Commits - up to 50 of the last commits are listed in this feature, with options to compare and rollback.

• Configuration Backup - when enabled on a device, Sky Enterprise will check the device every hour to determine whether the config has changed. If a change is detected, the new config will be uploaded to Sky Enterprise. Using this feature you can view, download and compare backups.

• Licenses - Sky Enterprise lists all licenses detected on a device and the expiry date. Sky Enterprise can request new licenses from Juniper's License Management System, and request trial licenses.

• Alarms - a display of Junos system and chassis alarms, with remediation activities on selected alarms.

• Actions - a range of action items that make a network administrator's job a little easier, such as reboot options, system storage cleanup, and more.

• Real-time Logs - the ability to view syslog (message or interactive) in real time on a device, and download those logs for further analysis.

• Diagnostics - the ability to run commands like ping directly from the device.

• RPM Probes - real-time performance monitoring is a great way to measure network performance from a device's perspective. This feature allows RPM probes to be created on a device quickly and easily, and the results to be visualised on graphs. Monitoring Policies can be added to take action when thresholds are breached e.g. to implement network interface failover.

Interface Graphs

In this tab you can view graphs for all interfaces. Data is collected every 5 minutes and graphs are available in hourly, daily, weekly and monthly views. Note: data for weekly and monthly views is aggregated.

As shown below, graphs can be filtered using Unit, Connected or All options. Graphs can also be set to refresh automatically, either on a 5 minute or 10 minute interval - this is useful for displaying graphs on a monitor where there is no regular user interaction.

To select which interfaces are polled for data, use the 'Configure Monitored Interfaces' button in the top right corner. This is particularly useful for devices that are only reachable via low bandwidth connections and allows you to turn polling off for some or all your interfaces.

Commits

Sky Enterprise presents the commit history of a device in an easy to consume list. The list shows up to the last 50 commits made on the device, plus additional details like:

• the user who made the commit

• the client or method used e.g. CLI, netconf

• the date of the commit

• a log message (Note: log entry messages for Sky Enterprise commits can be customized in the Settings tab.)

As shown below, using the Action menu found alongside each commit in the list, several options are available. These include:

• Show this commit

• Show difference to running configuration (commit 0)

• Rollback this commit

Config Backups

The Config Backups tab shows a history of configuration files for the device.

Backups are done automatically for the device configuration whenever a change has been detected. Configuration change checks are made hourly. If no change is detected the current latest backup in the list remains in place and unchanged.

Actions

The Actions menu option provides a range of useful, automated actions commonly used by network administrators. Examples include:

• Save rescue configuration

• Renew DHCP leases

• Reboot (multiple options)

• Show full configuration

• Request system cleanup

Configlet

The Configlet is the Junos configuration snippet that enables the device to call home to Sky Enterprise to be authenticated and managed. It enables and maintains a secure Outbound-SSH connection to the Sky Enterprise platform, allowing devices to connect and re-connect without requiring any special firewall policies or NAT to be put in place (it uses port 4087 outbound).

Configlets are unique per device and should not be copied and used on other devices.

Users

As a Juniper Sky Enterprise administrator, you can create and manage user accounts. In this section you can learn more about:

• • Creating New User Accounts

  • Activating User Accounts

  • Managing User Accounts

  • Resetting Passwords

  • Enabling Two Factor Authentication

  • Disabling Two Factor Authentication

  • Resetting Your Two Factor Authentication

  • Creating Multi-Tenant Users

  • Understanding User Roles

Resetting Your Two Factor Authentication

If two factor authentication is enabled but you are unable to generate two factor codes you can ask another administrator in your company to remove your account and recreate it.

Alternatively during the login procedure you can request a two factor code to be sent to your email.

If you continue to experience issues, contact Juniper Technical Assistance Center (JTAC) at support@juniper.net.

Understanding User Roles

The Sky Enterprise system provides predefined roles that you can assign to users to define administrative responsibilities and specify the management tasks that a user can perform in the system.

READ-ONLY

• • Read-only access to view interfaces and security related configuration details.

  • View troubleshooting information for interfaces (for example, ARP, LLDP, and the ethernet-switching table).

  • View graphs.

  • View and create ANR reports.

USER

• • Read-and-write access to interfaces and security related configuration.

  • View troubleshooting information for interfaces (for example, ARP, LLDP, and the ethernet-switching table).

  • View graphs.

  • View and create ANR reports.

  • Set and update device rescue configuration and auto recovery.

Administrator

• • Read-and-write access to interfaces and security related configuration.

  • View troubleshooting information for interfaces (for example, ARP, LLDP, and the ethernet-switching table).

  • View graphs.

  • View and create ANR reports.

  • Set and update device rescue configuration and auto recovery.

  • Create and edit user accounts.

  • Create and edit devices.

  • Create and edit managed service provider tenant companies (for MSP use case only)

  • Manage devices for tenant companies (for MSP use case only)

Read-only User Administrator - similar to the read-only role. Except it also allows you to create and delete read-only users:

• • Create and delete read-only users.

  • View interfaces and security related configuration details.

  • View troubleshooting information for interfaces (for example, ARP, LLDP, and the ethernet-switching table).

  • View graphs.

  • View and create ANR reports.

Configuration

The Configuration tab is home to the following functions:

• Bulk Updates - providing the capability to update one or many devices in one action using a variety of configuration techniques.

• Bulk Update Templates - a repository of custom and publicly available templates for making bulk updates easier and more flexible.

• Junos Upgrade - upgrade your Junos devices easily with images hosted by Sky Enterprise.

• Software Distribution - providing the capability for distributing images that you host in your network for device upgrades, and VNFs for deployment onto NFX devices.

• Software Library - a repository of images and VNFs for the Software Distribution feature to call upon.

• ZTP - the zero touch provisioning tab where configuration templates are created and stored, and devices are prepared and authorized.

• Security Policy Templates - providing the capability to create and manage security templates, apply to devices and perform compliance checks.

Bulk Updates

The Bulk Updates enables single or multiple devices to be configured in one action. Target devices can be selected individually, on a per site basis, or using tags. Once selected, devices can be updated using one of the following options:

• Set commands

• Junos Configuration

• Using templates, with or without variables

To start a new Bulk Update job, click the green 'New Update' button on the right of the screen.

Bulk Update Job using Template

To create a Bulk Update job using a template, you must first create your template in the 'Bulk Update Templates' tab. For details on how to create a template please see the section below - <link here>.

Bulk Update Templates can include variables. Where variables are used you can specify values for each device, allowing for a unique configuration to be applied to multiple devices through a single operation.

Bulk Update Templates

The Bulk Update Templates tab is the location for creating, editing and storing templates used for performing advanced Bulk Updates on your devices, including variables.

Junos Upgrade

The Junos Upgrade feature provides a simple method for upgrading Junos devices using images hosted by Sky Enterprise.

Sky Enterprise typically hosts mainstream image versions, including Suggested Releases. If you need to install an image that is not currently available on Sky Enterprise you can use the Software Library and Software Distribution features that allows you to host images on your own network. [Note: The Software Distribution mechanism can fail due to file copy and disk space issues on certain Juniper devices, particularly smaller EX devices.]

The image below shows the Junos Upgrade feature plus a history of upgrades performed.

Zero Touch Provisioning (ZTP)

ZTP is a process whereby a factory new Juniper device can 'call home' to Sky Enterprise to be configured after being unboxed, powered on and plugged into a network. The process is simple to setup within Sky Enterprise and provides a fast and reliable way to deploy new devices without requiring onsite engineers and truck rolls.

The image below depicts the steps involved in a successful ZTP deployment.

ZTP Supported Devices

ZTP is made possible by a feature in Junos called 'phone home'. This feature is initiated when a device boots. It starts the device polling, or 'calling home' to a Juniper provisioning service, to determine to IP address of its configuration service. The provisioning service inspects the device's serial number and does a lookup to determine which configuration server this serial number is associated with. Therefore, if a new Junos device has been added to Sky Enterprise, its request to be configured will be sent to Sky Enterprise.

The table below shows the type of devices, and the version of Junos, that supports ZTP.

Note: ZTP is limited to branch devices only, high-end devices not currently support .

Performing a ZTP Deployment

To perform a ZTP deployment the following steps are to be observed.

Step 1 Power on a device that has the 'phone home' feature in Junos available (see list above of compatible devices and Junos versions). Not all Branch SRX, EX and NFX devices shipping from the factory are ZTP capable.

Step 2 Plug the device into a network that provides DHCP with DNS to ensure the device can reach the internet and resolve the required URL i.e redirect.juniper.net

Step 3 Login into Sky Enterprise and add a new device, selecting the ZTP option. Choose an appropriate template and add the target device's Serial Number.

Step 4 The device will call home and be directed to Sky Enterprise. When Sky Enterprise receives a request from the device, it will send an email to the user who created the new device, requesting authorization to configure the device. Authorization is a measure put in place to ensure security.

Step 5 Once authorized Sky Enterprise will configure the device, including the configuration required to connect to Sky Enterprise for management. Typically configuration takes 10-15 minutes, after which time the device will appear online in the Sky Enterprise dashboard.

ZTP Templates

Junos mandates the use of XML for ZTP templates. In this section of Sky Enterprise you can:

• view, create, edit and delete ZTP templates

• add or remove users who can authorize ZTP deployments for a particular template

Managing ZTP Devices

The screenshot below shows the ZTP Devices in the ZTP tab. The list of devices includes several columns:

• Action Menu - options for editing and managing the device

• Name - device name including company name and serial number

• ZTP Template

• Serial Number

• Authorization status

• State:

  • Entitle - the serial number is in the process of being added to the provisioning server

  • Start - Sky Enterprise is ready, device not yet detected

  • Bootstrap complete - the device has been given the final ZTP configuration

  • Configuration Failed - there were commit errors, and the device couldn't commit the configuration. (This usually is a result of an issue with the template or variable data. You can follow troubleshooting procedure: https://github.com/Juniper/sky-enterprise-templates/tree/master/ztp).

A list of all existing templates is shown within the tab. Templates can be edited using the Action menu, including:

• Show Configuration - this shows the existing template details

• Edit - allows the template and template properties to be edited, including the list of users permitted to authorize devices using this template

• Delete

Software Library

You can add JunOS software images or VNF files to the Sky Enterprise software library. This allows you to upgrade images or distribute VNF files to one or many Juniper Networks devices easily using the Sky Enterprise software distribution feature.

To use the Sky Enterprise software distribution feature, software images are placed on a file server in your network or another location reachable from your devices.

Settings

Additional Sky Enterprise Resources

Juniper Sky Enterprise YouTube Playlist

Juniper Sky Enterprise Templates on GitHub