Firewall traffic to external interfaces

[mmcgilly]

For a remote site, with a SRX100, I want to be able to manage it with ssh and web but only from my external ip address. Similarly there will be an IPSec VPN between the sites but I only want to accept ike from it's specific peer's ip address.

Am I right in thinking that security policies won't have any effect as I'm not going between zones?

[rfrederick]

You are correct in stating the the security policies will not have an effect.  The features you are looking for are "host-inbound-traffic", where you set the allowed services on the particular interfaces in a security zone (or the entire zone), and then setting up a firewall filter and applying it to the loopback interface to specifically allow and / or deny certain remote addresses.

Ron

[Screenie]

The host-inbound traffic defines what service is allowed, not where from. If you want that: ttake a look at the post I wrote about this in the config library: http://forums.juniper.net/t5/Configuration-Library/Configuration-Example-permited-IP-on-SRX/m-p/5839... .