简介

1、本教程仅适用于Juniper MX系列和QFX系列设备。（验证过）

2、提交配置时候，建议使用可自动回退的提交，防止无法远程管理。

3、本教程主要用于Juniper设备的登录防护，限制IP登录SSH或Telnet等远程控制协议。

PS：设备如果有公网IP，几乎无时不刻都有扫描和登录攻击。而且Juniper某些版本有Bug可能因此重启。

配置命令

编写过滤规则

1
2
3
4
5
6
7
8
9
10
11
12
13
14
set firewall family inet filter RE-Protect term management_permit from source-address 192.168.2.0/24
set firewall family inet filter RE-Protect term management_permit from source-address 172.16.0.1/24
set firewall family inet filter RE-Protect term management_permit from protocol tcp
set firewall family inet filter RE-Protect term management_permit from destination-port telnet
set firewall family inet filter RE-Protect term management_permit from destination-port ssh
set firewall family inet filter RE-Protect term management_permit from destination-port ftp
set firewall family inet filter RE-Protect term management_permit then accept
set firewall family inet filter RE-Protect term management_deny from protocol tcp
set firewall family inet filter RE-Protect term management_deny from destination-port telnet
set firewall family inet filter RE-Protect term management_deny from destination-port ssh
set firewall family inet filter RE-Protect term management_deny from destination-port ftp
set firewall family inet filter RE-Protect term management_deny then reject
set firewall family inet filter RE-Protect term other-permit then accept

  • management_permit 语句匹配指定源地址访问SSH Telnet ftp协议允许。
  • management_deny 语句匹配访问SSH Telnet ftp协议拒绝。
  • other-permit 语句允许所有。

注意：此规则只匹配了IPv4

应用到lo0口

1
2
set interfaces lo0 unit 0 family inet filter input RE-Protect

  • 一般情况下，将过滤规则应用到 lo0.0口的入方向，即可全局生效。

验证

1
2
3
4
5
6
7
show firewall log

Log:
Time      Filter  Action  Interface     Protocol   Src Addr        Dest Addr
15:17:11  pfe     R       ge-0/0/0.0    TCP        192.168.255.1   192.168.255.2
15:12:04  pfe     R       ge-0/0/0.0    TCP        192.168.255.1   192.168.255.2

  • 输出确认来自 192.168.255.1 源地址 的信息流与过滤器术语匹配。列Action显示一个R来指示这些数据包被拒绝。还列出了接口、传输协议以及 源和目标地址。这些结果确认此示例的防火墙过滤器工作正常。
1
2
show log messages | last 100 | match ssh

  • 查看日志匹配ssh，可查看是否有ssh登录失败日志。无则生效。
1
2
show system connections

  • 可查看监听端口与建立的连接。

lo口加入VRF导致SSH过滤不生效

  • 将过滤规则应用到lo0.0 的确可以全局生效，但是在没有lo0其他子接口未被配置到其他routing-instances情况。如果配置了，此routing-instances的IP是不受匹配规则影响。
  • 只需要单独匹配加入routing-instances的lo0的过滤规则即可。

参考

Juniper文档