0

Currently, our ex4300 are managed in band using irb.20.

show configuration interfaces irb

unit 20 {

family inet6 {
    address 2001:db8:1::252/64;

show configuration routing-options

rib inet6.0 {

static {
    route ::/0 next-hop 2001:db8:1::254 (this is the MX10003 router's sub-interface IP).

vlan 20 is our MGMT vlan Vlan 10 is our production vlan

I need to restrict management plane traffic that is destined to the switch. For example, ssh traffic destined for 2001:db8:1::252 needs to be sourced from our NOC network (2001:db8:10::/64). The problem is when I apply a firewall filter to irb.20, it's checking everything coming through, even if it's not destined for 2001:db8:1::252, because we have other access ports in vlan 20. I figure the best way to fix this is to manage the switch with a different logical interface. Unfortunately, I can't seem to get this to work. I've tried configuring lo0, vme0, me0, and fxp0 all to no avail. When I configured the aforementioned interfaces, I gave them the inet6 address 2001:db8:1::200/64. I'm not certain what I'm missing, but any tips would be greatly appreciated.

11
  • You should not use Global IPv6 addresses that belong to someone else, and the 1000::/64 is a RESERVED range that should not be used at all.
    – Ron Maupin
    Mar 23, 2020 at 17:44
  • Thanks Ron. I, in fact, am not using those specific addresses. I just quickly used them to give as an easy example.
    – Ben
    Mar 23, 2020 at 17:47
  • IANA has set aside 2001:db8::/32 for such examples, and you can subnet that to create fake addresses, but do not use real Global addresses or RESERVED addresses for that.
    – Ron Maupin
    Mar 23, 2020 at 17:49
  • I did not know that. Thanks Ron.
    – Ben
    Mar 23, 2020 at 17:49
  • You should get familiar with the IANA IPv6 Special-Purpose Address Registry.
    – Ron Maupin
    Mar 23, 2020 at 17:51

1 Answer 1

1

Junos allows you to restrict control-plane traffic -- including SSH, routing protocol traffic, etc. -- by applying a filter to the lo0 interface. This is true even if you have not configured a loopback IP address.

For example, you can allow SSH and SNMP traffic only from 192.0.2.0/24, but allow all other traffic (default-allow) with the following configuration-fragment.

Remove your filter from the irb.20 interface -- you do not need it! With some exceptions (on buggy/limited platforms) lo0 filters do not affect any transit traffic; they only affect traffic being processed by the routing engine.

interfaces {
  lo0 {
    unit 0 {
      family inet {
        filter {
          input REv4-in;
        }
      }
    }
  }
}
policy-options {
  prefix-list ssh_allow {
    192.0.2.0/24;
  }
  prefix-list snmp_allow {
    192.0.2.0/24;
  }
}
firewall {
  family inet {
    filter REv4-in {
      term ssh_allow {
        from {
          protocol tcp;
          destination-port 22;
          source-prefix-list ssh_allow;
        }
        then {
          count ssh_allow;
          accept;
        }
      }
      term snmp_allow {
        from {
          protocol udp;
          destination-port 161;
          source-prefix-list snmp_allow;
        }
        then {
          count snmp_allow;
          accept;
        }
      }
      term control_default_discard {
        from {
          destination-port [ 22 161 ];
        }
        then {
          log;
          count control_default_discard;
          discard;
        }
      }
      term ELSE {
        then {
          count ELSE;
          accept;
        }
      }
    }
  }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.