1

Total newbie to Juniper.

Okay, I've been messing with the web interface on a SRX210 Firewall for a few hours now and looking like I need specific help now.

So the overall architecture is that I have a router connecting a remote office to the local office. I want the FW to be between the local router and the LAN switch and do IP filtering only when traffic is going into/out of the local office LAN. The ONLY traffic that should be hitting the remote link should be traffic destined for the remote network and vice versa.
The FW is there only if somehow the remote machines get hacked. Unlikely but just in case the firewall needs to be installed.

I've set up some policies under the Security settings to allow for trusted and untrusted zones to talk to each other based on the networks listed in the address book of the FW.

I have a Trusted to Untrusted Any to Any Permit Unrusted to Trusted [remote network] to Local Permit [Ed: removed] Untrusted to Trusted Any to Any Deny

I've setup two ports on the FW f/02 and f/03 to be set to Ethernet Mode Access and none VLan with f/02 as Trusted and f/03 as Untrusted.

I figure that anything coming in or out those ports should be filtered based on the policy filters.

Not happening though. I have two laptops set up plugged into each port and I set the IPs to a different network than the allowed nets and they can still ping back and forth.

As I have no experience with Juniper FW or any firewalls other than the crappy home stuff, do you folks have a couple ideas what I've missed?

Thanks.

[Edit: Okay, I reset to factory defaults and followed along in one of the Juniper set-up guides but it still doesn't work. Here's the config file below. I'm doing the config via the web-interface so if any feedback could reference that instead of CLI that would help me more...one less thing I need to learn in order to make it work.]

## Last changed: 2013-04-18 15:36:25 PDT
version 11.2R4.3;
system {
host-name Office;
time-zone *************;
root-authentication {
    encrypted-password "*********************";
}
name-server {
    208.67.222.222;
    208.67.220.220;
}
services {
    ssh;
    telnet;
    xnm-clear-text;
    web-management {
        http {
            interface vlan.0;
        }
        https {
            system-generated-certificate;
            interface vlan.0;
        }
    }
    dhcp {
        router {
            192.168.1.1;
        }
        pool 192.168.1.0/24 {
            address-range low 192.168.1.2 high 192.168.1.254;
        }
        propagate-settings ge-0/0/0.0;
    }
}
syslog {
    archive size 100k files 3;
    user * {
        any emergency;
    }
    file messages {
        any critical;
        authorization info;
    }
    file interactive-commands {
        interactive-commands error;
    }
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
license {
    autoupdate {
        url https://ae1.juniper.net/junos/key_retrieval;
    }
}
}
interfaces {
ge-0/0/0 {
    unit 0 {
        family inet {
            dhcp;
        }
    }
}
ge-0/0/1 {
    unit 0 {
        family ethernet-switching {
            vlan {
                members vlan-trust;
            }
        }
    }
}
fe-0/0/2 {
    unit 0 {
        description Remote_Side;
        family ethernet-switching {
            port-mode access;
        }
    }
}
fe-0/0/3 {
    unit 0 {
        description Local_Side;
        family ethernet-switching {
            port-mode access;
        }
    }
}
fe-0/0/4 {
    unit 0 {
        family ethernet-switching {
            vlan {
                members vlan-trust;
            }
        }
    }
}
fe-0/0/5 {
    unit 0 {
        family ethernet-switching {
            vlan {
                members vlan-trust;
            }
        }
    }
}
fe-0/0/6 {
    unit 0 {
        family ethernet-switching {
            vlan {
                members vlan-trust;
            }
        }
    }
}
fe-0/0/7 {
    unit 0 {
        family ethernet-switching {
            vlan {
                members vlan-trust;
            }
        }
    }
}
vlan {
    unit 0 {
        family inet {
            address 192.168.1.1/24;
        }
    }
}
}
routing-options {
static {
    route 0.0.0.0/0 next-hop 10.1.0.254;
}
}
protocols {
stp;
}
security {
screen {
    ids-option untrust-screen {
        icmp {
            ping-death;
        }
        ip {
            source-route-option;
            tear-drop;
        }
        tcp {
            syn-flood {
                alarm-threshold 1024;
                attack-threshold 200;
                source-threshold 1024;
                destination-threshold 2048;
                timeout 20;
            }
            land;
        }
    }
}
nat {
    source {
        rule-set trust-to-untrust {
            from zone trust;
            to zone untrust;
            rule source-nat-rule {
                match {
                    source-address 0.0.0.0/0;
                }
                then {
                    source-nat {
                        interface;
                    }
                }
            }
        }
    }
}
policies {
    from-zone trust to-zone untrust {
        policy trust-to-untrust {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit;
            }
        }
    }
    from-zone untrust to-zone trust {
        policy InBound {
            match {
                source-address Remote;
                destination-address any;
                application any;
            }
            then {
                permit;
            }
        }
    }
}
zones {
    security-zone trust {
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }
        interfaces {
            vlan.0;
            fe-0/0/3.0;
        }
    }
    security-zone untrust {
        address-book {
            address Remote 175.17.1.0/24;
        }
        screen untrust-screen;
        interfaces {
            ge-0/0/0.0 {
                host-inbound-traffic {
                    system-services {
                        dhcp;
                        tftp;
                    }
                }
            }
            fe-0/0/2.0;
        }
    }
}
}
vlans {
vlan-trust {
    vlan-id 3;
    l3-interface vlan.0;
}
}
1
  • Post your configuration... command line please. Apr 18, 2013 at 17:08

1 Answer 1

2

You haven't assigned a VLAN to fe-0/0/2 or fe-0/0/3 so both are in the default VLAN and should simply be passing traffic between them with no intervention from the SRX.

You need to actually make the SRX the IP router for it to do its job. The SRX does have a "transparent mode" but I wouldn't recommend it.

If you only need a single port on each side you can just avoid VLAN's and configure the ports manually. Whatever route you go don't forget to add the ports to a security zone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .