Configuration Library
Configuration Library

Dynamic Blacklists With JunOS

[ Edited ]
‎07-18-2013 12:26 PM

Hi All, 

 

I'm reposting this here, having already posted it to the SRX forum, but a suggestion was that it may be useful here too. 

 

I wrote a process for integrating certain dynamic blacklists with JunOS. I thought it might be useful to someone other than me. It uses SpamHaus DROP/EDROP, Team-Cymru Bogons, DShield Recommended and Emerging Threats RBN lists. 

 

Blocklists with JunOS

 

Something of the kind has been done before, but it requires the use of binaries on the CF which I wasn't happy doing. 

 

Thanks

Andy

2 REPLIES 2
Configuration Library

Re: Dynamic Blacklists With JunOS

‎10-02-2013 04:42 AM

Hi Andy,

 

Cool .. Any idea how many false positives you run into ? This is a like a do not peer list correct ? Not just for email but for connectivity as a whole.

 

Thanks,

Justin

Configuration Library

Re: Dynamic Blacklists With JunOS

‎12-08-2013 02:30 AM

Hi Justin, 

 

Sorry for the delay, I haven't checked in in a while. 

 

I have run into one or two false positives where a destination IP is within a subnet blocked by one of the lists. I've gotten around it by adding a 'whitelists' term and maintaining a 'whitelists.txt' file on the same Linux host which runs the cron script. I don't white lists whole subnets as a rule, only single IP's.

 

The filter covers any protocol. 

 

I updated the blog article recently so the filter now shows what is matching on a per-term basis (each blocklists gets a term to itself). This makes it easier to see where things are matching, for example - 

 

andy@NWB-SRX100> show firewall filter dropped 

 

Filter: dropped                                                

Counters:

Name                                                Bytes              Packets

blocked-bogons                                          0                    0

ciarmy-dropped                                        416                    9

dshield-block                                        7452                  156

emergingcc-dropped                                      0                    0

emergingrbn-dropped                                133240                 2612

malbots-dropped                                    382896                 6467

spamhaus-drop                                        8828                  177

spamhaus-edrop                                          0                    0

whitelist                                       134089696               162553

 

Best regards

Andy