Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to filter SSH, BGP, and OSPD on my Juniper MX routers (allowing only certain IP addresses to initiate connections). I expanded on an example from http://www.juniper.net/techpubs/en_US/junos11.4/topics/example/firewall-filter-stateless-example-trusted-source-block-telnet-and-ssh-access.html. But it only seems to work for one destination IP address (199.11.225.238) which is directly attached to interface xe-0/0/0. The other directly connected IP addresses on my IRB interfaces allow all traffic still.

Here is the 3 firewall filters I created:

ashinn@mx1# show firewall family inet   
filter management {
    term office {
        from {
            source-address {
                157.11.10.114/32;
                157.11.10.115/32;
            }
        }
        then accept;
    }
    term management_vlan {
        from {
            source-prefix-list {
                management;
            }
        }
        then accept;
    }
    term external_users {
        from {
            source-address {
                76.14.79.190/32;
            }
        }
        then {
            accept;
        }
    }
    term datacenter {
        from {
            prefix-list {
                internalpub;
                infrastructure;
                dmz;
            }
        }
        then accept;
    }
}
filter bgp {
    term providers {
        from {
            source-address {            
                4.11.208.90/32;
                199.11.225.237/32;
            }
            destination-port bgp;
        }
        then accept;
    }
    term eyefi {
        from {
            source-address {
                199.11.198.246/32;
                199.11.196.246/32;
            }
            destination-port bgp;
        }
        then accept;
    }
}
filter ospf {
    term eyefi {
        from {
            source-address {
                4.11.208.90/32;
            }
            protocol ospf;
        }
    }
}

I then created and applied the filters as a list to the lo0.0 interface:

ashinn@mx1# show interfaces lo0 
unit 0 {
    family inet {
        filter {
            input-list [ management bgp ospf ];
        }
    }
}

I left out explicit deny term per article http://kb.juniper.net/InfoCenter/index?page=content&id=KB13057&cat=T_SERIES&actp=LIST stating that input-list adds an implicit deny after the last term in the list.

Why doesn't the filter work to protect IRB interfaces?

share|improve this question
    
You are testing from an IP that doesn't match those prefix-list's right? –  LapTop006 May 12 '13 at 13:55
    
Correct, I'm testing from an outside host. I also test using online port scan tools to scan port 22 and they report it being 'open'. They do report the port 'closed' when I test the xe-0/0/0 IP though (199.11.225.238) so it is working properly for a regular non-IRB interface. –  Andy Shinn May 13 '13 at 16:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.