1

Recently we've got a SRX240 router, and I'm doing first steps in understanding JunOS.

I want to make really damn simple thing, here is the situation. We've got a huge intranet in our organization, every sub-organization has it's own subnet, and should use addresses from it only without any additional NATs or something else, but, still, we can restrict access from subnets from other sub-organizations to prevent unnecessary activity from it.

For the first time I simplified task as much as possible (I'm configuring device from console port) — block ALL incoming traffic to configured VLAN, but unfortunately all I got is losing access to assigned to VLAN IP-address, but NOT to the hosts connected to this VLAN. They are still accessible from anywhere, and this is wrong.

Topology is pretty simple too — one VLAN from 0 to 15 port, uplink might be connected to any of them. More details here: http://i.imgur.com/AGf1bVB.png

Here is the configuration:

version 12.1X44-D60.2;
system {
    time-zone Europe/Moscow;
    root-authentication {
        encrypted-password "HIDDED_DATA"; ## SECRET-DATA
    }
    services {
        ssh;
        telnet;
        xnm-clear-text;
        web-management {
            http {
                interface vlan.0;
            }
            https {
                system-generated-certificate;
                interface vlan.0;
            }
        }
    }
    syslog {
        archive size 100k files 3;
        user * {
            any emergency;
        }
        file messages {
            any critical;
            authorization info;
        }
        file interactive-commands {
            interactive-commands error;
        }
    }
    max-configurations-on-flash 5;
    max-configuration-rollbacks 5;
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
    ntp {
        server 10.20.30.51 version 1 prefer;
    }
}
interfaces {
    ge-0/0/0 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/1 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/2 {
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/3 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/4 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/5 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/6 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/7 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/8 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/9 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/10 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/11 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/12 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/13 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/14 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    ge-0/0/15 {
        unit 0 {
            family ethernet-switching {
                vlan {
                    members MAIN_VLAN;
                }
            }
        }
    }
    vlan {
        unit 0 {
            family inet {
                filter {
                    input TestBlock;
                    output TestBlock;
                }
                address 10.20.30.99/24;
            }
        }
    }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 10.20.30.1;
    }
}
security {
    policies;
    zones {
        security-zone trust {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                vlan.0;
            }
        }
    }
}
firewall {
    family inet {
        filter TestBlock {
            term blockall {
                then {
                    discard;
                }
            }
        }
    }
}
vlans {
    MAIN_VLAN {
        vlan-id 10;
        interface {
            ge-0/0/1.0;
            ge-0/0/2.0;
            ge-0/0/3.0;
            ge-0/0/4.0;
            ge-0/0/5.0;
            ge-0/0/6.0;
            ge-0/0/7.0;
            ge-0/0/8.0;
            ge-0/0/9.0;
            ge-0/0/10.0;
            ge-0/0/11.0;
            ge-0/0/12.0;
            ge-0/0/13.0;
            ge-0/0/14.0;
            ge-0/0/15.0;
            ge-0/0/0.0;
        }
        l3-interface vlan.0;
    }
}

What did I miss? Or maybe I use completely wrong approach to achieve this goal?..

  • I'm not entirely sure what topology you are trying to build, but it certainly is not a typical way to deploy an SRX firewall. In general you would put different interfaces in different security zones, and use security policies to control traffic between them. I wouldn't use (stateless) firewall filters on an SRX, security policies are much more powerful. Check rtoodtoo.net/juniper-srx-for-beginners for an example. – RobinG Feb 26 '16 at 7:42
  • OK, I'll try to clarify. On every remote branch we have a special ethernet connection from our ISP (without direct internet access — only to our intranet, kind of VPN I guess, but it's transparent for us). To use it without any additional devices (if not include unmanaged switches) we should configure on clients IP, subnet mask (usually it's /24 or /25) and default gateway, which provided by our ISP. All I want is to filter packets "on flow", just like it could be done on D-Link DES-1210-28-ME (to example) with it's ACL feature. I don't need any kind of NAT at this moment :) – Alexander O. Feb 26 '16 at 10:06
1

If I understand your topology correctly, you are using the SRX as a layer-2 device between your ISP router and the hosts in the branch (in place of the managed switch in the drawing). Branch topology

In this case you will have to run the SRX in "Transparent Mode", in stead of the default "Routed Mode". This has a couple of caveats and limitations, so be sure to check the documentation first.

You have to do a couple of things to make this work.

First of all, get rid of all the "VLAN" configuration, and start using a bridge domain:

interfaces {
    ge-0/0/0 {
        uniy 0 {
            family bridge {
                interface-mode access;
                vlan-id 10;
            }
        }
    }
    ge-0/0/1 { ## and the same for all other ge- interfaces
        uniy 0 {
            family bridge {
                interface-mode access;
                vlan-id 10;
            }
        }
    }
    irb {
        unit 0 {
            family inet {
                address 10.20.30.99/24;
            }
        }
    }
}
bridge-domains {
    branch_vlan {
        domain-type bridge;
        vlan-id 10;
        routing-interface irb.0;
    }
}

Next, you must add interfaces to security zones. Normally I would recommend to put the "uplink" in a seperate zone, because that will make your policies much easier. I will assume that the uplink is in ge-0/0/0. If it really is impossible to predict in which port the uplink will be, you will have to put all interfaces in the same zone and figure it out with the policies.

security {
    zones {
        security-zone intranet {
            interfaces {
                ge-0/0/0.0;
            }
        }
        security-zone branch {
            interfaces {
                ge-0/0/1.0;
                ge-0/0/2.0;  ## etcetera for all other ge- interfaces
            }
        }
    }
}

Now you can set policies on traffic to and from the intranet

security {
    address-book {
        global {
            address allowed-subnet 10.0.10.0/24; ## just an example to illustrate the point
        }
    }
    policies {
        from-zone branch to-zone intranet {
            policy allow-some-traffic {
                match {
                    source-address any;
                    destination-address allowed-subnet;
                    application any;
                }
                then {
                    permit;

                }
            }
        }
        from-zone intranet to-zone branch {
            policy allow-some-traffic {
                match {
                    source-address allowed-subnet;
                    destination-address any;
                    application any;
                }
                then {
                    permit;

                }
            }
        }           
    }
}

These security policies have an implicit "deny", so all traffic not specified is dropped.

When you're this far, the SRX is working as transparent firewall, but unfortunately you can no longer manage it remotely since we didn't specify any rules for that. Assuming you would want to manage the device from the "Intranet" side only, we need to allow traffic to the SRX device (host-inbound-traffic) in the intranet zone:

security {
    zones {
        security-zone intranet {
            host-inbound-traffic {
                system-services {
                    all;
                }
            }
        }       
    }
}

You will need to reboot the switch after you commit the configuration (you'll get a warning to do this):

root# commit
warning: Interfaces are changed from route mode to transparent mode. Please reboot the device or all nodes in the HA cluster!
commit complete
| improve this answer | |
  • Thank you a lot! This approach actually worked! Also I had to make branch-to-branch policy to allow traffic between hosts (for printer sharing, cameras, etc). One question left... By some reason I'm able to manage device with using SSH and HTTPS, but not HTTP. Here is the cfg: services { ssh; web-management { http { interface irb.0; } https { system-generated-certificate; interface irb.0; } } } Is that a limitation of L2-mode in SRX too? Didn't notice that in your link... – Alexander O. Feb 29 '16 at 7:52
0

So a couple suggestions and questions:

I only see one VLAN and one corresponding L3 interface. Are you planning on adding more VLANs and interfaces for other subnets?

  1. You don't have any policies set. Even if you want the SRX to pass traffic between interfaces/sub-interfaces on the same VLAN and subnet, you have to have a policy permitting that. The exception to this is your switch ports. Those ports are able to communicate between each other without a policy. In your case, and again, I'm not exactly sure where your trying to get your traffic to/from, you need a policy like trust-to-trust permit. Let me show you:

What you have is:

security {
policies;
zones {
    security-zone trust {
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }
        interfaces {
            vlan.0;
        }

There is nothing under policies. What you need is:

security {
policies;
    from-zone trust to-zone trust {
        policy permit-all {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit;
                 }
            }
    }
zones {
    security-zone trust {
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }
        interfaces {
            vlan.0;
        }

If there was certain traffic you didn't want your SRX to allow from trust to trust then your policies would like a little different and wouldn't permit all.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.