This article provides information on how to establish a SSH trust relationship between a pair of SRX devices.

• A SSH trust relationship between a pair of SRX devices allows the seamless login from a device, by providing authentication via RSA public keys.
• This can be used to transfer device configuration by executing the system archival command.

• Devices - SRX0 and SRX1.

• The archival configuration will be transferred via SCP by using superuser login <testuser> .

1. Logon as root on the shell of SRX1 and create a directory to receive the archival configuration; with permission for the testuser :

   root@srx1% mkdir /var/tmp/srx0_backup
root@srx1% chown testuser:wheel /var/tmp/srx0_backup

• Logon as root on the shell of SRX0 and create the public/private RSA key pair:
  
  Note : Leave all questions as default (press enter).
  root@srx0% ssh-keygen -t rsa
  
  

  Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:

Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.

The key fingerprint is:
c3:eb:48:bb:e4:db:cf:c7:25:37:d5:ab:e4:58:d8:87 root@srx0

• Copy id_rsa.pub from the shell of SRX0 to SRX1:

  root@srx0% scp id_rsa.pub root@ <srx1 ip> :/root/.ssh/id_rsa.pub

• When the keys are copied, create the testuser user on SRX1:

  set system login user testuser class super-user
set system login user testuser authentication load-key-file /root/.ssh/id_rsa.pub

commit

  This will create /var/home/testuser/.ssh/authorized_keys on SRX1.

• The following commands will ensure that SRX0's configuration is copied to a file on SRX1, upon the SRX0 commit. Enter the following configuration on SRX0:

  set system archival configuration transfer-on-commit set system archival configuration archive-sites set
set system archival configuration archive-sites "scp://testuser@ <srx1 iP> :/var/tmp/srx0_backup"

commit
  

• Verify if the configuration is transferred:
  
  

  On SRX0:

  root@srx0> show log messages | match Juniper.conf

May 4 00:41:44 srx0 logger: transfer-file: Transferred /var/transfer/config/srx0_juniper.conf.gz_20120504_003626

  On SRX1:

  root@srx1% ls -al /var/tmp/srx0_backup/

-rw-r----- 1 testuser wheel 1400 May 4 00:36 srx0_juniper.conf.gz_20120504_003626