11-09-2010 04:38 AM
I'm new to the SRX and JunOS, so trying to get my head around it.
In my company there are a number of SRX240s in production and I'm seeing some discrepencies in config.
My question is should services allowed such as ssh, ftp, http be defined on the interface or at the zone level?
set security zones security-zone untrust interfaces reth2.0 host-inbound-traffic system-services https
or like this:
set security zones security-zone untrust host-inbound-traffic system-services https
and what is the difference if any?
11-09-2010 05:24 AM - edited 11-09-2010 05:25 AM
It's really up to personal preference and configuration requirements. For example, if you only wanted to allow one interface in a zone to connect to a device with SSH you'd apply it as such. The exception to the rule is DHCP and BOOTP which need to be applied on the interface level if all protocols and services are not explicitly allowed.