简介

1、本教程仅适用于Juniper MX系列和QFX系列设备。(验证过)

2、提交配置时候,建议使用可自动回退的提交,防止无法远程管理。

3、本教程主要用于Juniper设备的登录防护,限制IP登录SSH或Telnet等远程控制协议。

PS:设备如果有公网IP,几乎无时不刻都有扫描和登录攻击。而且Juniper某些版本有Bug可能因此重启。

配置命令

编写过滤规则

1
2
3
4
5
6
7
8
9
10
11
12
13
14
set firewall family inet filter RE-Protect term management_permit from source-address 192.168.2.0/24
set firewall family inet filter RE-Protect term management_permit from source-address 172.16.0.1/24
set firewall family inet filter RE-Protect term management_permit from protocol tcp
set firewall family inet filter RE-Protect term management_permit from destination-port telnet
set firewall family inet filter RE-Protect term management_permit from destination-port ssh
set firewall family inet filter RE-Protect term management_permit from destination-port ftp
set firewall family inet filter RE-Protect term management_permit then accept
set firewall family inet filter RE-Protect term management_deny from protocol tcp
set firewall family inet filter RE-Protect term management_deny from destination-port telnet
set firewall family inet filter RE-Protect term management_deny from destination-port ssh
set firewall family inet filter RE-Protect term management_deny from destination-port ftp
set firewall family inet filter RE-Protect term management_deny then reject
set firewall family inet filter RE-Protect term other-permit then accept

  • management_permit 语句匹配指定源地址访问SSH Telnet ftp协议允许。
  • management_deny 语句匹配访问SSH Telnet ftp协议拒绝。
  • other-permit 语句允许所有。

注意:此规则只匹配了IPv4

应用到lo0口

1
2
set interfaces lo0 unit 0 family inet filter input RE-Protect

  • 一般情况下,将过滤规则应用到 lo0.0口的入方向,即可全局生效。

验证

1
2
3
4
5
6
7
show firewall log

Log:
Time Filter Action Interface Protocol Src Addr Dest Addr
15:17:11 pfe R ge-0/0/0.0 TCP 192.168.255.1 192.168.255.2
15:12:04 pfe R ge-0/0/0.0 TCP 192.168.255.1 192.168.255.2

  • 输出确认来自 192.168.255.1 源地址 的信息流与过滤器术语匹配。列Action显示一个R来指示这些数据包被拒绝。还列出了接口、传输协议以及 源和目标地址。这些结果确认此示例的防火墙过滤器工作正常。
1
2
show log messages | last 100 | match ssh 

  • 查看日志匹配ssh,可查看是否有ssh登录失败日志。无则生效。
1
2
show system connections    

  • 可查看监听端口与建立的连接。

lo口加入VRF导致SSH过滤不生效

  • 将过滤规则应用到lo0.0 的确可以全局生效,但是在没有lo0其他子接口未被配置到其他routing-instances情况。如果配置了,此routing-instances的IP是不受匹配规则影响。
  • 只需要单独匹配加入routing-instances的lo0的过滤规则即可。

参考

Juniper文档