What problem does it solve? First-time setup of a Juniper SRX is error-prone: factory-default remnants like phone-home ZTP can reboot the device mid-session, hidden NTP statements silently break log onboarding, and a wrong interface change can lock the operator out entirely. This Skill replaces ad-hoc bring-up with a deterministic assess-first workflow that classifies device state, computes only the open gaps, and applies every lockout-risk change behind a confirmed-commit gate with automatic rollback. ## Core Features & Use Cases - Read-only entry-state assessment: Classifies any SRX as factory-default, bare, partial, configured, or unreachable using evidence commands like show configuration chassis and show security zones, then generates a dependency-ordered gap list. - Five gated configuration stages: Access and recovery, management plane (hostname, DNS, NTP), interfaces and zones with host-inbound-traffic, starter IDS screens, and a baseline global security policy with default-deny and logging. - Branch factory-default removal: Hardware-validated handling of SRX300/400 shipped configuration, including auto-image-upgrade removal, per-interface untrust services, and atomic policy cutover from zone-pair to global policies. - Entitlement readout: Reports licensed, configured, and active state for features like IDP and AppID without ever mutating licenses. - Use Case: An engineer unboxes an SRX345, connects via console, and asks the agent to bring it to a usable baseline. The Skill detects factory-default state, disables ZTP first, then walks each stage under commit confirmed, rolling back automatically if verification fails. ## Quick Start Use the srx-initial-setup skill to assess this SRX and bring it to a usable baseline with staged approvals.
