For SSH access, the DX supports enabling/disabling SSHv1 and/or SSHv2:
% show admin ssh SSH: up SSHv1: enabled SSHv2: enabled
% set admin ssh Insufficient arguments. Possible arguments for "set admin ssh": down disable ssh logins up enable ssh logins version configure a particular SSH protocol
The SSH daemon listens on the admin interface VIP address, if it is configured. If no explicit VIP is configured, then it will listen on the IP address configured on the admin ether interface. If the admin interface is not set, then it will listen on all IP addresses - this can be seen with 'netstat -an'.
a) No admin interface or VIP:
% show admin vip VIP Address: % show admin interface Admin Interface:
% netstat -an | grep 22
tcp4 0 0 *.22 *.* LISTEN
b) Admin Interface configured; no admin VIP (ether0: IP address = 172.26.31.203):
Welcome To Juniper Networks DX Application Acceleration Platform
If I try and SSH to the primary ether0 address I now get:
$ ssh 172.26.31.203 ssh: connect to host 172.26.31.203 port 22: Operation timed out
Another option is to have a different ether interface on an internal subnet to be the admin interface, so SSH/WebUI connections can only come via this internal network.
The DX does not have a way to filter client IPs to SLB groups and Forwarders, clusters can use apprules to block/allow client IP addresses. It is recommended to use a firewall to filter connections so you can have the granular control with logging.