Ethernet Switching
Ethernet Switching

How do I block port 25 on EX4600

[ Edited ]
05.01.17   |  
‎05-01-2017 10:35 AM

We need to block traffic on one switch port, from port 25 smtp.

What is the best way to accomplish this task.?

I could go into Security and Filters to create it.

 

 

 

 

Thanks

JNCIA-Junos
9 REPLIES
Ethernet Switching

Re: How do I block port 25 on EX4600

05.01.17   |  
‎05-01-2017 11:21 AM
I'd say firewall filter , but I don't see that 4600 support firewall filters :
https://www.juniper.net/techpubs/en_US/junos/topics/reference/general/firewall-filter-ex-series-matc...
Regards,
A'bed AL-R.
[JNCSP-SEC JNCDA JNCIS-ENT Ingenious Champion|Sec]
https://srxtech.wordpress.com
Ethernet Switching

Re: How do I block port 25 on EX4600

05.01.17   |  
‎05-01-2017 12:22 PM

I think it does, I will test it soon.

 

Capture.GIF

JNCIA-Junos
Ethernet Switching

Re: How do I block port 25 on EX4600

05.01.17   |  
‎05-01-2017 04:24 PM

Note that this is a two step process, you create the desired block filter then apply the filter to the port where you want to block the traffic.

 

Also note that the default action is th block, so be sure to add a final accept term to your filter or you will drop all traffic at the port.

Steve Puluka BSEET
Juniper Ambassador
Senior IP Engineer - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
JNCIA-Junos JNCIS-SEC JNCIP-SEC JNCSP-SEC
JNCIS-FWV
JNCDA JNCDS-DC JNCDS-SEC
JNCIS-SP
ACE PanOS 6 ACE PanOS 7
http://puluka.com/home
Ethernet Switching

Re: How do I block port 25 on EX4600

05.01.17   |  
‎05-01-2017 05:41 PM

Andy,

 

Thanks, I believe I figured it out earlier, but wanted to make sure someone kept me honest.

 

[edit]
+  firewall {
+      family ethernet-switching {
+          filter BLOCK-25 {
+              term PORT-25-BLOCK {
+                  from {
+                      interface ge-3/0/0.0;
+                      ether-type ipv4;
+                      source-port smtp;
+                      destination-port smtp;
+                      ip-protocol tcp;
+                  }
+                  then discard;
+              }
+          }
+      }
+  }
JNCIA-Junos
Ethernet Switching

Re: How do I block port 25 on EX4600

[ Edited ]
05.01.17   |  
‎05-01-2017 08:49 PM

starlog wrote:

Andy,

 

Thanks, I believe I figured it out earlier, but wanted to make sure someone kept me honest.

 

[edit]
+  firewall {
+      family ethernet-switching {
+          filter BLOCK-25 {
+              term PORT-25-BLOCK {
+                  from {
+                      interface ge-3/0/0.0;
+                      ether-type ipv4;
+                      source-port smtp;
+                      destination-port smtp;
+                      ip-protocol tcp;
+                  }
+                  then discard;
+              }
+          }
+      }
+  }

That would drop all trafic entering the port on which it is applied. You need a secon term to accept all other traffic.

"Also note that the default action is to block, so be sure to add a final accept term to your filter or you will drop all traffic at the port."

e.g

set term allow-all then accept

[KUDOS PLEASE! If you think I earned it!
If this solution worked for you please flag my post as an "Accepted Solution" so others can benefit..]
Ethernet Switching

Re: How do I block port 25 on EX4600

05.02.17   |  
‎05-02-2017 02:37 AM

In addition to the missing final term, you need to apply this filter to the interface. 

 

You have added the interface as a criteria here but the filter does not do anything until assigned to an interface in that hierarchi.

 

set interface ge-3/0/0 input PORT-25-BLOCK

 

Optionally you can also add count to your block term so you can see a packet count of dropped packets.

Steve Puluka BSEET
Juniper Ambassador
Senior IP Engineer - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
JNCIA-Junos JNCIS-SEC JNCIP-SEC JNCSP-SEC
JNCIS-FWV
JNCDA JNCDS-DC JNCDS-SEC
JNCIS-SP
ACE PanOS 6 ACE PanOS 7
http://puluka.com/home
Highlighted
Ethernet Switching

Re: How do I block port 25 on EX4600

05.02.17   |  
‎05-02-2017 07:04 AM

Something like this.?

 

[edit interfaces ge-3/0/0 unit 0 family ethernet-switching]
+       filter {
+           input BLOCK-25;
+       }
[edit]
+  firewall {
+      family ethernet-switching {
+          filter BLOCK-25 {
+              term PORT-25-BLOCK {
+                  from {
+                      source-port smtp;
+                      destination-port smtp;
+                  }
+                  then discard;
+              }
+              term allow-all {
+                  then accept;
+              }
+          }
+      }
+  }

 

 

Could I equally add to ge-3/0/0     output BLOCK-25  ?

JNCIA-Junos
Ethernet Switching

Re: How do I block port 25 on EX4600

05.02.17   |  
‎05-02-2017 08:42 AM
That should be OK ..
This filter will block traffic entering the port (ingress) , so the output filter would be unnecessary .
Regards,
A'bed AL-R.
[JNCSP-SEC JNCDA JNCIS-ENT Ingenious Champion|Sec]
https://srxtech.wordpress.com
Ethernet Switching

Re: How do I block port 25 on EX4600

[ Edited ]
05.02.17   |  
‎05-02-2017 08:49 AM

starlog,

 

Hello! One configuration snippet in particular caught my attention. In your original request you asked to block traffic "from port 25 smtp". In the below configuration, you have a match condition of source-port 25 and destination-port 25.

 

+              term PORT-25-BLOCK {
+                  from {
+                      source-port smtp;
+                      destination-port smtp;

According to this article all conditions in the from stanza must be met to match and execute the then statement. If your intent is to block all traffic sourcing from port 25 then you should only use source-port smtp. If you are attempting to block communications destined to port 25 you should use destination-port smtp. If you want either or, try using the port match condition.

 

All in all, if your original ask is to block traffic from port 25, the below configuration should meet your needs.

 

set firewall family ethernet-switching filter BLOCK-25 term BLOCK-SMTP from source-port smtp
set firewall family ethernet-switching filter BLOCK-25 term BLOCK-SMTP then discard
set firewall family ethernet-switching filter BLOCK-25 term BLOCK-SMTP then log
set firewall family ethernet-switching filter BLOCK-25 term PERMIT-ANY then accept
set interfaces ge-3/0/0.0 family ethernet-switching filter input BLOCK-25

 

 

Raymond Beaudoin
@synackray