- Enter into firewall filter mode by creating
a filter with name filter1
- Configure the match-condition
that permit traffic from address 192.168.10.5, and block all other traffic by
creating a term by name term1.
- Create term by name term2 that blocks only the single IP address 196.145.25.5
- Create a term by name term3 that allows traffic from any ip address.
user@R1>configure
[edit]
user@R1#edit firewall family inet filter filter1
[edit firewall family inet filter filter1]
user@R1#set term term1 from source-address 192.168.10.5/24
[edit firewall family inet filter filter1]
user@R1#set term term1 then accept
[edit firewall family inet filter filter1]
user@R1#set term term2 from source-address 196.145.25.5/24
[edit firewall family inet filter filter1]
user@R1#set term term2 then reject
[edit firewall family inet filter filter1]
user@R1#set term term3 then accept
[edit firewall family inet filter filter1]
user@R1#exit
[edit]
Applying
firewall filter to an interface
user@R1#edit interfaces so-0/0/0 unit 0 family inet
[edit interfaces so-0/0/0 unit 0 family inet]
user@R1#set filter input filter1
[edit interfaces so-0/0/0 unit 0 family inet]
user@R1#exit
[edit]
user@R1#show
Configure a static route
with destination sub-network number as 172.16.1.0, subnet mask as 24 and IP
address of the next-hop router in the destination path to 172.16.2.1.
Trước khi thực hiện: SRX cần ra được Internet, cấu hình DNS
Intrusion Detection Prevention (IDP); or sometimes known as IPS, is a feature of the Juniper SRX range. IDP is available on the branch SRX’s all the way through to the datacentre versions and is a fantastic item under the IT Services feature set. IDP is particularly useful as another layer of security to inspect data transmissions between client and server and perform an actions upon it, a good example is IDP’s ability to detect known Shell code buffer overflow exploits that are out there in the wild and stop them in their tracks AND also block that IP for set period of time, like 1 hour, 1 day or a week! These buffer overflow style attacks are typically launched at a server once traditional enumeration steps have been performed by the remote attacker. To thwart the enumeration attacks juniper makes use of SCREENS, but that is a discussion for another time.
so how do we configure an SRX for IDP?
Step by Step IDP configuration
The first thing you do is tell the Juniper were to get the latest packages for the IDP updates from root@iLab.SRX#set security idp security-package url https://services.netscreen.com/cgi-bin/index.cgi root@iLab.SRX#commit
Next we download the packages to the device, first checking that the we can see the update server, the actually downloading the packages
you can monitor the status of the IDP package download with the following command, just keep checking the status until you get the completed notification
root@iLab.SRX> request security idp security-package download
status
In
progress: Downloading ..
Check again;
root@iLab.SRX> request security idp security-package download
status
Will be processed in async mode. Check the status using the status checking CLI
root@iLab.SRX> request security idp security-package install status
Done;policy-templates has been successfully updated into internal repository
(=>/var/db/scripts/commit/templates.xsl)!
Here is the results
root@iLab.SRX# set security idp idp-policy ?
Possible completions:
<policy-name> IDP policy name
Client-And-Server-Protection IDP policy name
Client-And-Server-Protection-1G IDP policy name
Client-Protection IDP policy name
Client-Protection-1G IDP policy name
DMZ_Services IDP policy name
DNS_Service IDP policy name
File_Server IDP policy name
Getting_Started IDP policy name
IDP_Default IDP policy name
Recommended IDP policy name
Server-Protection IDP policy name
Server-Protection-1G IDP policy name
Web_Server IDP policy name
[edit]
We have 2 ways to use IDP:
1. active IDP default and use the available templates
2. we create the actual IDP rule and then apply these to policy
To monitor the effectiveness of the IDP policies, you can perform the following commands. The ‘attack table’ command shows how many and what type of exploits have been launched at your servers and is quite informative > show security idp active-policy > show security idp attack table > show security idp status > show security idp application-statistics
Power off your switch by unplugging the power cord or turning off the power at the wall switch.
Insert one end of the Ethernet cable into the serial port on the management device and connect the other end to the console port on the back of the switch.
On the management device, start your asynchronous terminal emulation application (such as Microsoft Windows Hyperterminal) and select the appropriate COM port to use (for example, COM1).
Configure the port settings as follows:
Bits per second: 9600
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None
Power on your switch by plugging in the power cord or turning on the power atthe wall switch.
When the following prompt appears, press the Spacebar to access the switch's bootstrap loader command prompt:
Hit [Enter] to boot immediately, or space bar for command prompt.
Booting [kernel] in 1 second...
At the following prompt, type boot -s to start up the system in single-user mode:
loader> boot -s
At the following prompt, type recovery to start the root password recovery procedure:
Enter full path name of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery
A series of messages describe consistency checks, mounting of filesystems, and initialization and checkout of management services. Then the CLI prompt appears.
Enter configuration mode in the CLI:
user@switch> cli
Set the root password. For example:
user@switch# set system root-authentication plain-text-password
At the following prompt, enter the new root password. For example:
New password: juniper1
Retype new password:
At the second prompt, reenter the new root password.
If you are finished configuring the network, commit the configuration.root@switch# commit
