Switching

Hi,

 

can sombody can paste config how to secure mgmt access to ex switches?

 

just for server class or specific ip addresses.

 

thanks

 

Lukasz

There is an excellent guide to hardening JunOS devices here: http://www.juniper.net/us/en/community/junos/training-certification/day-one/fundamentals-series/hardening-junos-devices-checklist/

but nothing about acls ..

Chapter 4 in that book, page 90, Protecting the Routing Engine.

There's a configuration example of firewall filter which is how to do an acl in junos.

 

Add a firewall input filter on your lo0 interface:

 

family inet {
    filter protect_re {
        term allow_ssh {
            from {
                source-address {
                    10.1.2.0/24;
                }
                protocol tcp;
                destination-port ssh;
            }
            then accept;
        }
        term deny_ssh {
            from {
                protocol tcp;
                destination-port ssh;
            }
            then {
                discard;
            }
        }
        term default {
            then accept;
        }
    }
}

 Instead of the address you could just use a prefix-list configured under policy-options.

thanks,

 

it works fine:)

 

what kind of other security stuff are you enabling on ex access switches?

one more question:

i have 2 ex4200 switches in virtual-chassis and few l3 vlans, how should i secure mgmt access, currently i can login to all l3 vlans and would like to limit it only to mgmt i configured it according to guide but doesn’t work any suggestions?

For example you could add the destination-address of your management in the firewall filter.

 filter mgmt {
        term allow {
            from {
                source-address {
                    10.X.X.0/24;
                    10.X.X.0/24;
                    10.X.X.X/32;
 
                }
                destination-address {
                    10.X.X.254/32;
                }
                protocol tcp;
                destination-port ssh;
            }
            then accept;
        }
        term deny_ssh {
            from {
                protocol tcp;
                destination-port ssh;
            }
            then {
                discard;
            }
        }
        term default {
            then accept;
        }
    }

 

and it shuld be assing under int vlan mgmt or under all?

 

right now i can access it from subnet which i shouldnt

you should add it under interfaces lo0.0 as input filter.
If you don't have a lo0.0 configured, it doesn't matter, just do set interfaces lo0.0 family inet filter input filter mgmt

i don't have int lo but i will try:)