Juniper SRX240 firewall family inet issue on VLAN

Question

Recently we've got a SRX240 router, and I'm doing first steps in understanding JunOS.

I want to make really damn simple thing, here is the situation. We've got a huge intranet in our organization, every sub-organization has it's own subnet, and should use addresses from it only without any additional NATs or something else, but, still, we can restrict access from subnets from other sub-organizations to prevent unnecessary activity from it.

For the first time I simplified task as much as possible (I'm configuring device from console port) — block ALL incoming traffic to configured VLAN, but unfortunately all I got is losing access to assigned to VLAN IP-address, but NOT to the hosts connected to this VLAN. They are still accessible from anywhere, and this is wrong.

Topology is pretty simple too — one VLAN from 0 to 15 port, uplink might be connected to any of them. More details here: https://i.stack.imgur.com/e2Dn9.png

Here is the configuration:

version 12.1X44-D60.2;
system {
    time-zone Europe/Moscow;
    root-authentication {
        encrypted-password "HIDDED_DATA"; ## SECRET-DATA
    }
    services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    ntp {
        server 10.20.30.51 version 1 prefer;
    }
}
interfaces {
    ge-0/0/0 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/3 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/4 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/7 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/8 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/9 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/10 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/11 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/12 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/13 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/14 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/15 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                filter {
                    input TestBlock;
                    output TestBlock;
                }
                address 10.20.30.99/24;
            }
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 10.20.30.1;
    }
}
security {
    policies;
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
            }
        }
    }
}
firewall {
    family inet {
        filter TestBlock {
            term blockall {
                then {
                    discard;
                }
            }
        }
    }
}
vlans {
    MAIN_VLAN {
        vlan-id 10;
        interface {
            ge-0/0/1.0;
            ge-0/0/2.0;
            ge-0/0/3.0;
            ge-0/0/4.0;
            ge-0/0/5.0;
            ge-0/0/6.0;
            ge-0/0/7.0;
            ge-0/0/8.0;
            ge-0/0/9.0;
            ge-0/0/10.0;
            ge-0/0/11.0;
            ge-0/0/12.0;
            ge-0/0/13.0;
            ge-0/0/14.0;
            ge-0/0/15.0;
            ge-0/0/0.0;
        }
        l3-interface vlan.0;
    }
}

What did I miss? Or maybe I use completely wrong approach to achieve this goal?..

Answer 1

If I understand your topology correctly, you are using the SRX as a layer-2 device between your ISP router and the hosts in the branch (in place of the managed switch in the drawing).

In this case you will have to run the SRX in "Transparent Mode", in stead of the default "Routed Mode". This has a couple of caveats and limitations, so be sure to check the documentation first.

You have to do a couple of things to make this work.

First of all, get rid of all the "VLAN" configuration, and start using a bridge domain:

interfaces {
    ge-0/0/0 {
        uniy 0 {
            family bridge {
                interface-mode access;
                vlan-id 10;
            }
        }
    }
    ge-0/0/1 { ## and the same for all other ge- interfaces
        uniy 0 {
            family bridge {
                interface-mode access;
                vlan-id 10;
            }
        }
    }
    irb {
        unit 0 {
            family inet {
                address 10.20.30.99/24;
            }
        }
    }
}
bridge-domains {
    branch_vlan {
        domain-type bridge;
        vlan-id 10;
        routing-interface irb.0;
    }
}

Next, you must add interfaces to security zones. Normally I would recommend to put the "uplink" in a seperate zone, because that will make your policies much easier. I will assume that the uplink is in ge-0/0/0. If it really is impossible to predict in which port the uplink will be, you will have to put all interfaces in the same zone and figure it out with the policies.

security {
    zones {
        security-zone intranet {
            interfaces {
                ge-0/0/0.0;
            }
        }
        security-zone branch {
            interfaces {
                ge-0/0/1.0;
                ge-0/0/2.0;  ## etcetera for all other ge- interfaces
            }
        }
    }
}

Now you can set policies on traffic to and from the intranet

security {
    address-book {
        global {
            address allowed-subnet 10.0.10.0/24; ## just an example to illustrate the point
        }
    }
    policies {
        from-zone branch to-zone intranet {
            policy allow-some-traffic {
                match {
                    source-address any;
                    destination-address allowed-subnet;
                    application any;
                }
                then {
                    permit;

                }
            }
        }
        from-zone intranet to-zone branch {
            policy allow-some-traffic {
                match {
                    source-address allowed-subnet;
                    destination-address any;
                    application any;
                }
                then {
                    permit;

                }
            }
        }           
    }
}

These security policies have an implicit "deny", so all traffic not specified is dropped.

When you're this far, the SRX is working as transparent firewall, but unfortunately you can no longer manage it remotely since we didn't specify any rules for that. Assuming you would want to manage the device from the "Intranet" side only, we need to allow traffic to the SRX device (host-inbound-traffic) in the intranet zone:

security {
    zones {
        security-zone intranet {
            host-inbound-traffic {
                system-services {
                    all;
                }
            }
        }       
    }
}

You will need to reboot the switch after you commit the configuration (you'll get a warning to do this):

root# commit
warning: Interfaces are changed from route mode to transparent mode. Please reboot the device or all nodes in the HA cluster!
commit complete

Answer 2

So a couple suggestions and questions:

I only see one VLAN and one corresponding L3 interface. Are you planning on adding more VLANs and interfaces for other subnets?

1. You don't have any policies set. Even if you want the SRX to pass traffic between interfaces/sub-interfaces on the same VLAN and subnet, you have to have a policy permitting that. The exception to this is your switch ports. Those ports are able to communicate between each other without a policy. In your case, and again, I'm not exactly sure where your trying to get your traffic to/from, you need a policy like trust-to-trust permit. Let me show you:

What you have is:

security {
policies;
zones {
    security-zone trust {
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }
        interfaces {
            vlan.0;
        }

There is nothing under policies. What you need is:

security {
policies;
    from-zone trust to-zone trust {
        policy permit-all {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit;
                 }
            }
    }
zones {
    security-zone trust {
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }
        interfaces {
            vlan.0;
        }

If there was certain traffic you didn't want your SRX to allow from trust to trust then your policies would like a little different and wouldn't permit all.