SRX

Hi Experts

I want to make two custom login classes.

1- Who can configure only sytem configurations on SRX

2- Who can configure only security configurations on SRX

Any body can help me

Thanks

Hi, the following configuration should work fine (of course if the operators don't need to view the configuration, the view-configuration statement can be deleted):

class SECURITY_ADM {
    permissions [ configure view-configuration ];
    allow-configuration security;
}
class SYSTEM_ADM {
    permissions [ configure view-configuration ];
    allow-configuration system;
}

Hi

Thanks for the reply but for the below class you mean "security" OR "routing-option"

class SECURITY_ADM {
    permissions [ configure view-configuration ];
    allow-configuration routing-options;
}

Hi

The following should help you .. and according to specific requirments, permissions can be changed.

root@SRX> show configuration system login                   
class sec-admin {
    permissions [ configure security security-control view ];
}
class sys-admin {
    permissions [ admin admin-control configure system system-control view ];
}
user sec {
    uid 2000;
    class sec-admin;
    authentication {
        encrypted-password "$1$TzGd3vy8$EAyD0f4MeBTxe72f0wZ0F0"; ## SECRET-DATA
    }
}
user sys {
    uid 2001;
    class sys-admin;
    authentication {
        encrypted-password "$1$YBRsSQld$qK0NeCL5YQfuPg9cdZ1TU1"; ## SECRET-DATA
    }
}

 This is what all these two users can do :

System Administrator : 


--- JUNOS 11.2R1.10 built 2011-07-29 08:46:06 UTC
sys@SRX> show cli authorization 
Current user: 'sys         ' class 'sys-admin'
Permissions:
    admin       -- Can view user accounts
    admin-control-- Can modify user accounts
    configure   -- Can enter configuration mode
    system      -- Can view system configuration
    system-control-- Can modify system configuration
    view        -- Can view current values and statistics
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: none
    Allow configuration regular expression: none
    Deny configuration regular expression: none

sys@SRX> edit 
Entering configuration mode

[edit]
sys@SRX# set sec
                ^
syntax error.

sys@SRX# set s?
Possible completions:
> schedulers           Security scheduler
> services             System services
> smtp                 Simple Mail Transfer Protocol service configuration
> system               System parameters
[edit]


Security Administrator : 


--- JUNOS 11.2R1.10 built 2011-07-29 08:46:06 UTC
sec@SRX> show cli authorization 
Current user: 'sec         ' class 'sec-admin'
Permissions:
    configure   -- Can enter configuration mode
    view        -- Can view current values and statistics
    security    -- Can view security configuration
    security-control-- Can modify security configuration
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: none
    Allow configuration regular expression: none
    Deny configuration regular expression: none

sec@SRX> edit 
Entering configuration mode

sec@SRX# set sy?
Possible completions:
> schedulers           Security scheduler
> security             Security configuration
> services             System services
> smtp                 Simple Mail Transfer Protocol service configuration
[edit]
sec@srx#

Hi, sorry for the typo, I meant security! 🙂 I edited my first post!

Actually I checked both solutions are working exactly the same. So I am not sure what is the optimal one 😉   But by the way If I get the security permissions then I am also getting the  access to "SMTP", "SCHEDULAR" "ACCES-PROFILE" .... Should I need to deny these?

Thanks

Hi ,

There is a change from Junos 11.2 onwards . " allow-configuration-regexps " statement is introduced in 11.2  ( now there is NO allow-configuration statement) .

For more info on this please check -  http://www.juniper.net/techpubs/en_US/junos/topics/reference/configuration-statement/allow-configuration-regexps-edit-system.html

To be able to configure only security and system hierarchies (no others like smtp,services,access-profile etc) , here;s the final configuration on SRX running  Junos 11.4R1 - 

set system login class sec-admin permissions configure
set system login class sec-admin permissions security-control
set system login class sec-admin permissions view
set system login class sec-admin allow-configuration-regexps security
set system login class sys-admin permissions admin-control
set system login class sys-admin permissions configure
set system login class sys-admin permissions system-control
set system login class sys-admin permissions view
set system login class sys-admin allow-configuration-regexps system
set system login user sec uid 2002
set system login user sec class sec-admin
set system login user sec authentication encrypted-password /* SECRET-DATA */
set system login user sys uid 2003
set system login user sys class sys-admin
set system login user sys authentication encrypted-password /* SECRET-DATA */



--- JUNOS 11.4R1.6 built 2011-11-15 12:44:14 UTC
sec@SRX> show cli authorization 
Current user: 'sec         ' class 'sec-admin'
Permissions:
    configure   -- Can enter configuration mode
    view        -- Can view current values and statistics
    security-control-- Can modify security configuration
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: none
    Allow configuration regular expression: none
    Deny configuration regular expression: none

sec@SRX> edit 
Entering configuration mode

[edit]
sec@SRX# set ?
Possible completions:
> security             Security configuration
[edit]


--- JUNOS 11.4R1.6 built 2011-11-15 12:44:14 UTC
sys@SRX> edit 
Entering configuration mode
[edit]
sys@SRX# run show cli authorization 
Current user: 'sys         ' class 'sys-admin'
Permissions:
    admin-control-- Can modify user accounts
    system-control-- Can modify system configuration
    view        -- Can view current values and statistics
Individual command authorization:
    Allow regular expression: none
    Deny regular expression: none
    Allow configuration regular expression: none
    Deny configuration regular expression: none

[edit]
sys@SRX# set ?
Possible completions:
> system               System parameters
[edit]

 Note : If you omit allow-configuration-regexps statement from class definition , you will get those(services,smtp etc)  extra hierarchies.

Hope this helps

One more thing - if we do not include security-control /system-control in the respective class permissions , with just allow-conifiguration-regexps security/system statement, that particular user will not be able to configure any thing .

For example, with just configure permissions

set system login class sec-admin permissions configure
set system login class sec-admin permissions view
set system login class sec-admin allow-configuration-regexps security

sec user will not be able to configure any hierarchy(not even security) , as he does not have security-control permission.

Hi All,

Longing to ask a few questions about the SRX series gateway hopefully will get some answers over here

Doubts :

1. Can we incrase the bandwidth of the internal interface joining RE and PFE or it is the same for all the device models or does it vary from model to model . I suppose that the bandwidth is 100 mbps as per juniper datasheets. Correct me if i am wrong

2. Do we have any limit on the number of  terms i can define with in a routing policy and a firewall filter?

3. What is the default interface mtu size in junos platforms?

4. Maximum number of VLAN's that can be created on a physical interface ? Is it the 4096 or 1024 in Junos?

5. The switch which is connected to the 2 physical interfaces , which are combined together to form a Reth interface should it necessarily be a L2 switch or an L3 switch will also do the same functionality?

6. When i use Radius server in my authentication order , do i still need to have users mapped in my device? If yes how do i map only the usernames , because anyways authorization is already defined on the radius server

7.In Firewall Authentication, lets say there is a NAT enabled device before the firewall , once the user who has the right credential gets authenticated subsequently all the users will be given access to my server because authentication table entry is stored based on the ip address and not usernames. So how do i restrict that other users who dont have the credentials without accessing my server?

8. Shoud i use application as telnet , ftp and http in the security policy when i am using pass through authentication? Because pass through supports only ftp,http and telnet traffic?

9. Can we use the primary interface ip address as the web authentication ip address or is it mandatory that we define one more ip address on the interface as web auth ip

10. When is a real time scenario that we have 2 ip address defined on the interface and both being actually used?

NAT questions : 

11. How many actual translations can we have with 1 public IP when i disable PAT ?

12. What does this actually mean D-NAT will generate allow incoming packets for voip algs?

13. Can we use the same ip for S NAT and D NAT then wat is the use of static NAT?

14. When we r doing Static NAT , can we have both the internal and external communication happen at the same time , because  there can be only one translation per one public IP when i disable PAT?

15. In source NAT with address shifting , the user will bind private IP range to public ip range . 

Lets imagine my private range starts from 10.1.10.5 to 10.1.10.254

My public pool is from 100.1.1.1 to 100.1.1.200

I map my private base address to public address from 10.1.10.5 to 100.1.1.1

So lets say 10.1.10.5 gets translated to 100.1.1.1

What happens if 10.1.10.7 intiates a session before 10.1.10.6 will he be assigned 100.1.1.3 or 100.1.1.2

VPN : 

16.Can we actualy load balance between redundant VPN tunnels between two branch offices?

17.In the IPSEC header , what does the Next Header information mean?

Thanks Pradeep. Just last thing, When I giving the permissions to only security-control then why JUNOS is giving access to extra directires like SMPT/ACCESS-PROFILE/SCHEDULARS/APPLY-GROUPS/GROUPS. Is this because these directries also used with security directory?? Should I keep them or remove using deny-confiugrations (as I am running 10.4 version)

Thanks

I think so , It is giving access to related hierarchies as well .

But according to the documentation , only security hierarchy should be available .

I think it is OK to leave them (which came by default) as it is ... so that the sec user can complete all related hierarchies configuration . For example, In security policies if we need firewall authentication , for completeness, he needs access to profile.  

Same behaviour with system-control - it gives access to additional hierarchies like wlan,ethernet-switching-options etc.