0

Greetings and sorry for my English.

I'm setting firewall filters on several Juniper SRX3xx appliances running Junos 15.1X49. What I'm actually trying to accomplish is to minimize my future manual labor in case I need to reconfigure some of the rules. On Cisco ASA the answer is simple: use objects instead of actual IP addresses. In case you need to change some server's IP only the object representing it should be changed while all related rules are left intact.

Junos has address books (security address-book ...) which serve similar purpose except they aren't applicable (?!) to firewall rules (firewall ... filter ... term ...). It also has prefix lists (policy-options prefix-list ...) which theoretically can be used in firewall rules (firewall ... filter ... term ... from source-prefix-list ...). It's weird to have two sets of the objects representing same IPs, but I can live with that. However prefix lists seem to be much more than just some object definitions to use elsewhere. Or should I say not the object definitions that I need at all? The topic is sadly pretty unclear in Juniper documentation which in most other cases is excellent.

So my question is: How does the typical Junos admin organize his firewall rules? Should it be the rules with the explicit IP addresses and than you edit it for few hours when you need to change single address? Or is it okay to use prefix lists extensively in firewall rules? Or maybe do I miss something?

Improve this question
2
  • You are saying firewall rules but do you actually mean security policies? You should be creating security zones, attached address books to those zones, creating objects in those zones and then creating polices from those objects
    – Drifter104
    Jun 19, 2019 at 11:28
  • I mean firewall filters (firewall ... filter ... term ...). I created similar thread at Juniper forum, and based on the answers I have problems understanding which branch of configuration represents stateful and stateless firewall (see it here if you want: forums.juniper.net/t5/Junos/…). Nevertheless, my question is still actual: how can I avoid using of the explicit IP addresses in firewall filters? Are the prefix-lists correct way to do that?
    – Fmy Oen
    Jun 19, 2019 at 12:56

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .