Timeline for Difference between junos-host zone and a security zone
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 22, 2018 at 14:10 | comment | added | Andrey Prokhorov | @RRHS KB30461 | |
| Nov 22, 2018 at 14:05 | comment | added | Andrey Prokhorov | @RRHS Main feature of SRX devices - zone-based firewall and stateful inspections. So using zones and policies are required to implement that functionality. SRX can work in two modes: packet mode and flow mode. Packet mode required for some implementations (like MPLS) and converts device in stateless firewall. I've never had used it in packet mode, but probably if it's in use then you don't need zones. | |
| Nov 22, 2018 at 13:59 | comment | added | RRHS | Just one more query. Are configuring security zones a necessity? And i have also read that there has to be a minimum of 2 security zones to be configured. But some of the devices which i have used have only 1(security-zone HOST) and VSRX has none. Could you please shed some light on it. | |
| Nov 21, 2018 at 12:20 | comment | added | Andrey Prokhorov | @RRHS Check theese: Security Policies Feature Guide for Security Devices, KB24227 | |
| Nov 21, 2018 at 11:31 | comment | added | RRHS | Understood. Its all about levels and junos-host isnt given any priority over the host-inbound-traffic. And yes, please attach any docs if you have, it would be very helpful. | |
| Nov 21, 2018 at 11:27 | vote | accept | RRHS | ||
| Nov 21, 2018 at 9:51 | history | edited | Andrey Prokhorov | CC BY-SA 4.0 |
added 590 characters in body
|
| Nov 21, 2018 at 9:42 | comment | added | Andrey Prokhorov |
junos-host it's device itself. So yes, if you will configure policy from some zone, lets say RED to junos-host, and you will allow only ICMP ping, but your RED zone host-inbound-services will have ICMP ping and SSH - only ICMP ping will be allowed. You can think of it like consecutive levels of security. Let me check some docs, I will edit my answer with traffic flow sequence...
|
|
| Nov 21, 2018 at 9:07 | comment | added | RRHS | So correct me if I am wrong. If security policy to-zone junos-host is configured, its applicable to the whole device(all the interfaces included). So even if, host-inbound-traffic is configured for an interface or a zone(say Red-zone, allow only ssh) but the junos-host is configured to allow only ping, then it means the interfaces part of that Red-zone cannot allow ssh as the junos-host is configured to allow only ping to those interfaces. | |
| Nov 21, 2018 at 7:26 | history | answered | Andrey Prokhorov | CC BY-SA 4.0 |