0

I try to deny ssh access from routing-instance CPEs in Juniper MX960 device. I want to know if there is a way to deny only ssh access attempt from any routing-instance.

1

You have a couple of options::

Option 1

The filter can stay on the loopback interface, you can simply add firewall terms and specify from interface. So if xe-0/0/0.0 was one of the interfaces connected to a CPE in a routing-instance and 1.1.1.1 was the router's in-band management address, you could do something like this:

jhead@MX1# show firewall 
family inet {
    filter PROTECT {
        term BLOCK-VRF-1-SSH {
            from {
                destination-address {
                    1.1.1.1/32;
                }
                port ssh;
                interface xe-0/0/0.0;
            }
            then {
                discard;
            }
        }
    } 
}

Option 2

Configure firewall filters on the physical interfaces in the routing-instances facing the CPEs. Firewall filters are evaluated first on physical interfaces (ae, xe-, etc.), then on the loopback.

| improve this answer | |
1

Typically, you either restrict SSH access to only the out-of-band managementport (fxp0). If that's not possible, you can set a filter on your loopback interface to restrict SSH access to only IP addresses you want to allow. Juniper has some nice configuration examples in this TechLibrary document. Basically, it should look something like this (taken from that page and simplified a bit):

set firewall family inet filter local_acl term terminal_access from source-address 192.168.1.0/24
set firewall family inet filter local_acl term terminal_access from protocol tcp
set firewall family inet filter local_acl term terminal_access from port ssh
set firewall family inet filter local_acl term terminal_access then accept
set firewall family inet filter local_acl term terminal_access_denied from protocol tcp
set firewall family inet filter local_acl term terminal_access_denied from port ssh
set firewall family inet filter local_acl term terminal_access_denied then log
set firewall family inet filter local_acl term terminal_access_denied then reject
set firewall family inet filter local_acl term default-term then accept
set interfaces lo0 unit 0 family inet filter input local_acl

Keep in mind that this is just an example. The filter to protect your routing engine from unwanted traffic should be more elaborate to block all sorts of traffic and ratelimit other kinds. Changes to these policies should be made very carefully to avoid disruption of production traffic.

| improve this answer | |
  • Thanks for answer. That's right, the management in my device is in-band, so I'm using firewall filter to protect my control plane. But for example,if I have a CPE in "VRF A" with IP address 10.10.10.1 and I have the network manager with IP address 10.10.10.1 in inet.0 table, how can I deny only the IP 10.10.10.1 in "VRF A" using firewall filter? – Pablo Xavier Dec 4 '19 at 21:23
  • I don't use VRFs on my routers, so I'm guessing a bit here, but isn't your lo0 interface specifically available in one of the VRFs? – Teun Vink Dec 4 '19 at 21:28
  • The lo0 interfaces is only in inet.0 table, but I can see in logs a lot ssh access attempts from VRFs IP addresses so it seems that the firewall filter looks for matches in all routing tables. – Pablo Xavier Dec 4 '19 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.