Trước khi thực hiện: SRX cần ra được Internet, cấu hình DNS
Intrusion Detection Prevention (IDP); or sometimes known as IPS, is a feature of the Juniper SRX range. IDP is available on the branch SRX’s all the way through to the datacentre versions and is a fantastic item under the IT Services feature set. IDP is particularly useful as another layer of security to inspect data transmissions between client and server and perform an actions upon it, a good example is IDP’s ability to detect known Shell code buffer overflow exploits that are out there in the wild and stop them in their tracks AND also block that IP for set period of time, like 1 hour, 1 day or a week! These buffer overflow style attacks are typically launched at a server once traditional enumeration steps have been performed by the remote attacker. To thwart the enumeration attacks juniper makes use of SCREENS, but that is a discussion for another time.
so how do we configure an SRX for IDP?
Step by Step IDP configuration
The first thing you do is tell the Juniper were to get the latest packages for the IDP updates from root@iLab.SRX#set security idp security-package url https://services.netscreen.com/cgi-bin/index.cgi root@iLab.SRX#commit
Next we download the packages to the device, first checking that the we can see the update server, the actually downloading the packages
you can monitor the status of the IDP package download with the following command, just keep checking the status until you get the completed notification
root@iLab.SRX> request security idp security-package download
status
In
progress: Downloading ..
Check again;
root@iLab.SRX> request security idp security-package download
status
Will be processed in async mode. Check the status using the status checking CLI
root@iLab.SRX> request security idp security-package install status
Done;policy-templates has been successfully updated into internal repository
(=>/var/db/scripts/commit/templates.xsl)!
Here is the results
root@iLab.SRX# set security idp idp-policy ?
Possible completions:
<policy-name> IDP policy name
Client-And-Server-Protection IDP policy name
Client-And-Server-Protection-1G IDP policy name
Client-Protection IDP policy name
Client-Protection-1G IDP policy name
DMZ_Services IDP policy name
DNS_Service IDP policy name
File_Server IDP policy name
Getting_Started IDP policy name
IDP_Default IDP policy name
Recommended IDP policy name
Server-Protection IDP policy name
Server-Protection-1G IDP policy name
Web_Server IDP policy name
[edit]
We have 2 ways to use IDP:
1. active IDP default and use the available templates
2. we create the actual IDP rule and then apply these to policy
To monitor the effectiveness of the IDP policies, you can perform the following commands. The ‘attack table’ command shows how many and what type of exploits have been launched at your servers and is quite informative > show security idp active-policy > show security idp attack table > show security idp status > show security idp application-statistics
- Traceroute/ping/probe hosts behind a firewall that blocks attempts using the standard utilities. - Perform the idle scan (now implemented in nmap with an easy user interface). - Test firewalling rules. - Test IDSes. - Exploit known vulnerabilties of TCP/IP stacks. - Networking research. - Learn TCP/IP (hping was used in networking courses AFAIK). - Write real applications related to TCP/IP testing and security. - Automated firewalling tests. - Proof of concept exploits. - Networking and security research when there is the need to emulate complex TCP/IP behaviour. - Prototype IDS systems. - Simple to use networking utilities with Tk interface.
DoS using hping3 with random source IP
Let me explain the syntax’s used in this command:
hping3 = Name of the application binary.
-c 100000 = Number of packets to send.
-d 120 = Size of each packet that was sent to target machine.
-S = I am sending SYN packets only.
-w 64 = TCP window size.
-p 21 = Destination port (21 being FTP port). You can use any port here.
--flood = Sending packets as fast as possible, without taking care to show incoming replies. Flood mode.
--rand-source = Using Random Source IP Addresses. You can also use -a or –spoof to hide hostnames. See MAN page below.
www.hping3testsite.com = Destination IP address or target machines IP address. You can also use a website name here. In my case resolves to 127.0.0.1 (as entered in /etc/hosts file)
1. Configure Screen. root@iLab.SRX# show security screen ids-option Test-01 { icmp { ip-sweep; fragment; large; flood; ping-death; } ip { bad-option; record-route-option; timestamp-option; security-option; stream-option; spoofing; source-route-option; loose-source-route-option; strict-source-route-option; unknown-protocol; block-frag; tear-drop; } tcp { syn-fin; fin-no-ack; tcp-no-flag; syn-frag; port-scan; syn-ack-ack-proxy; syn-flood; land; winnuke; tcp-sweep; } udp { flood; udp-sweep; port-scan; } } - Add Screen to Zones root@iLab.SRX# set security zones security-zone Internet screen Test-01 2. Configure sending security logs to remote syslog server root@iLab.SRX# show security log mode stream; format sd-syslog; source-address 192.168.221.11; stream ilab-logs { format sd-syslog; category all; host { 192.168.221.135; port 5014; } }
3. Test by using Kali to attack to capture logs
Reference: 1. How to forward traffic logs from an SRX device to STRM (https://kb.juniper.net)
- Set the security log mode:
root@iLab.SRX# set security log mode stream -Set the security log format to sd-sylog, which is for structured syslog format: root@iLab.SRX#set security log format sd-syslog
- Set the security log source-address, which is the SRX IP address expected by the STRM device. Here we are using the IP address of an egress interface ge-0/0/0 on the SRX: root@iLab.SRX#set security log source-address 192.168.221.11
-Give the security log stream a name and category. In this case, the name is 'securitylog', and the 'all' category is specified. root@iLab.SRX#set security log stream securitylog category all
-Set the host IP address of the STRM or Syslog server device that will receive the traffic logs. root@iLab.SRX#set security log stream securitylog host 192.168.221.135
-Also, set the host port of the STRM device that will collect the traffic logs. This is the port the STRM device is configured to listen on. The default syslog port is 5014. root@iLab.SRX#set security log stream securitylog host port 5014
Chú ý: khi đẩy log về thì trước tiên phải đồng bộ time Configure sending to a Remote Syslog Server
root@iLab.SRX# show system syslog
user * {
any emergency;
}
host 192.168.221.135 {
any any;
authorization any;
port 5014;
source-address 192.168.221.11;
structured-data;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
- Cấu hình timezone: set system time-zone Asia/Saigon - Cấu hình NTP set system ntp server 192.168.221.135 - Kiểm tra NTP hoạt động đúng không. >show ntp status root@iLab.SRX# run show ntp status status=0664 leap_none, sync_ntp, 6 events, event_peer/strat_chg, version="ntpd 4.2.0-a Wed Nov 12 01:45:13 UTC 2014 (1)", processor="i386", system="JUNOS12.1X47-D15.4", leap=00, stratum=3, precision=-17, rootdelay=49.590, rootdispersion=1.560, peer=9012, refid=192.168.221.135, reftime=dd06e9fe.95f2d4e7 Wed, Jul 5 2017 11:30:54.585, poll=6, clock=dd06ea11.e6634925 Wed, Jul 5 2017 11:31:13.899, state=3, offset=0.000, frequency=0.000, jitter=1.053, stability=0.000 >show system uptime | match current Current time: 2017-07-05 11:31:46 ICT >show ntp associations no-resolve root@iLab.SRX# run show ntp associations no-resolve remote refid st t when poll reach delay offset jitter ============================================================================== *192.168.221.135 216.239.35.12 2 - 13 64 3 0.365 4.851 2.476 - Troubleshooting root@iLab.SRX# run show log messages | match ntp Jun 29 17:36:35 iLab.SRX mgd[5968]: UI_COMMIT_PROGRESS: Commit operation in progress: activating '/var/etc/ntp.keys'
Jun 30 00:37:39 iLab.SRX mgd[5968]: UI_CFG_AUDIT_OTHER: User 'root' set: [system ntp] -Khi làm Lab trên VMWare workstation cần chú ý đồng bộ lại time. bằng cách: login web -> system properties -> date time -> edit (chọn đồng bộ cùng NTP) -> OK
- Address book có 2 loại: như trong hình
+ Trên thiết bị chỉ cấu hình hoặc A hoặc B, không thể cấu hình vừa A vừa B. Nếu cấu hình vừa A vừa B, khi commit sẽ thông báo lỗi:
root@iLab.SRX# commit check [edit security zones security-zone Internet] 'address-book' Zone specific address books are not allowed when there are global address books defined error: configuration check-out failed: (statements constraint check failed) [edit] - Cấu hình B: + Global address:có thể sử dụng cho bất kỳ zone trong security policy root@iLab.SRX#set security address-book globaladdress TEST172.16.1.3/32 + Zone Attached: chỉ được dùng cho 1 zone cụ thể
Mô hình : bài SRX for beginer : Configuring Destination NAT Phần này chuyển port ssh từ 22 sẽ NAT sang port 2202. Các service khác tương tự -Cấu hình NAT
root@iLab.SRX# set security nat destination pool ssh-internal address 172.16.1.3/32
root@iLab.SRX# set security nat destination pool ssh-internal address port 22
root@iLab.SRX# set security nat destination rule-set rs1 from zone Internet
root@iLab.SRX# set security nat destination rule-set rs1 rule SSH-rule match destination-address 192.168.221.11/32
root@iLab.SRX# set security nat destination rule-set rs1 rule SSH-rule match destination-port 2202
root@iLab.SRX# set security nat destination rule-set rs1 rule SSH-rule then destination-nat pool ssh-internal
-Cấu hình security policy
root@iLab.SRX# set security policies from-zone Internet to-zone DMZ policy allow-ssh match source-address any
root@iLab.SRX# set security policies from-zone Internet to-zone DMZ policy allow-ssh match destination-address SSH
root@iLab.SRX# set security policies from-zone Internet to-zone DMZ policy allow-ssh match application junos-ssh
root@iLab.SRX# set security policies from-zone Internet to-zone DMZ policy allow-ssh then permit
- Modify application ssh from port 22 to port 2202
root@iLab.SRX#set applications application custom-ssh protocol tcp
root@iLab.SRX#set applications application custom-ssh destination-port 2202
Cấu hình :
root>edit
root#set system root-authentication plain-text-password
root#set system host-name vSRX
Cấu hình login bằng Web cho interface management set system services web-management http interface ge-0/0/0.0 set interface ge-0/0/0 unit 0 family inet address 192.168.222.23/24 còn tiếp ...
Note: dùng để publish 1 website,... ra ngoài internet - Cấu hình ip interface và gán vào zone root@iLab.SRX#set interfaces ge-0/0/1 unit 0 family inet address 172.16.1.11/24 root@iLab.SRX#set security zones security-zone DMZ root@iLab.SRX#set security zones security-zone DMZ interfaces ge-0/0/1.0
root@iLab.SRX#set interfaces ge-0/0/2 unit 0 family inet address 192.168.221.11/24 root@iLab.SRX#set security zones security-zone Internet root@iLab.SRX#set security zones security-zone Internet interfaces ge-0/0/2.0
-Cấu hình Destination NAT root@iLab.SRX#set security nat destination pool dst-nat-pool-1 address 172.16.1.3/32 root@iLab.SRX#set security nat destination rule-set rs1 from zone Internet hoăc: root@iLab.SRX#set security nat destination rule-set rs1 rule r1 match destination-address 192.168.221.11/24 Hoăc: Nếu muốn NAT ra 1 ip public khác thì có thể cấu hình sau: root@iLab.SRX#set security nat destination rule-set rs1 rule r1 match destination-address 192.168.221.12/24 root@iLab.SRX#set security nat proxy-arp interface ge-0/0/1.0 address 192.168.221.12/24
root@iLab.SRX#set security nat destination rule-set rs1 rule r1 then destination-nat pool dst-nat-pool-1 root@iLab.SRX#set security nat destination rule-set rs1 rule r1 match destination-port 80
-Cấu hình Security Policy root@iLab.SRX#set security zones security-zone DMZ address-book address Server-HTTP-1 172.16.1.3/32 root@iLab.SRX#set security policies from-zone Internet to-zone DMZ policy server-access match source-address any root@iLab.SRX#set security policies from-zone Internet to-zone DMZ policy server-access match destination-address Server-HTTP-1 root@iLab.SRX#set security policies from-zone Internet to-zone DMZ policy server-access match application junos-http root@iLab.SRX#set security policies from-zone Internet to-zone DMZ policy server-access then permit
Kiểm tra:
+ Trên client ngoài internet ( ip: 192.168.221.128 ) chạy http://192.168.221.11 ( http://192.168.221.12)
+ Trên SRX:
root@iLab.SRX# run show security flow session destination-port 80
Session ID: 10582, Policy name: server-access/7, Timeout: 16, Valid
In: 192.168.221.128/41756 --> 192.168.221.11/80;tcp, If: ge-0/0/2.0, Pkts: 3, Bytes: 164
Out: 172.16.1.3/80 --> 192.168.221.128/41756;tcp, If: ge-0/0/1.0, Pkts: 2, Bytes: 120
Total sessions: 1
Phần cấu hình tổng quát: - NAT:
root@iLab.SRX# show security nat destination
pool dst-nat-pool-1 {
address 172.16.1.3/32;
}
rule-set rs1 {
from zone Internet;
rule r1 {
match {
destination-address 192.168.221.11/24;
destination-port {
80;
}
}
then {
destination-nat {
pool {
dst-nat-pool-1;
}
}
}
}
}
[edit]
- Security policy
root@iLab.SRX# show security policies from-zone Internet to-zone DMZ
policy server-access {
match {
source-address any;
destination-address Server-HTTP-1;
application junos-http;
}
then {
permit;
}
}
