Discussion

}
}
Discussion
}
}
Placing firewall filters on the router’s interfaces is one of the most critical actions you
can take to protect the security of the router and the integrity of traffic received and
sent by the router. Firewall filters also provide a mechanism for counting different
types of packets received or sent over an interface. What happens if you don’t configure
a firewall filter? By default, interfaces accept all incoming traffic and transmit all
outgoing traffic.
Unlike routing policy, which is part of RPD running on the Routing Engine and
which looks at routing-protocol traffic, firewall filters look at all traffic on router
interfaces, working as part of the PFE.
The firewall filter in this recipe has the same basic structure and components as a
routing policy. It uses the same JUNOS policy language, and you can read through
the show command output to understand what the firewall filter does.
The configuration creates a filter named incoming-to-me that has one term named
restrict-telnet-ssh. This term accepts TCP packets if the IP packet header has a
destination port or either Telnet (port 23) or SSH (port 22) and a source address that
falls in the subnetwork 10.0.0.0/8. By default, this filter rejects all other packets.
This recipe applies the filter to all IPv4 traffic on one of the router’s physical interfaces,
fe-0/0/0.
It’s important to remember that this recipe shows only one term in a longer firewall
filter as a way of illustrating how to configure a firewall filter. (Recipe 9.15 shows a
complete filter.) If you were to apply only this filter to an interface, you would be
able to use the interface only for Telnet and SSH connections from subnet 10.0.0.0/8,
and all other incoming traffic would be dropped. Although it’s possible that this is
what you might want to do, it’s not likely that you would want to do exactly this.
However, this recipe does illustrate the point that you need to very carefully design
and construct firewall files so that they do what you want and what you expect.
Because firewall filters apply to logical interfaces, not physical interfaces, each
address family on an interface can have one filter for incoming traffic and one for
outgoing traffic. This means you can have different filters for different logical interfaces.
For this recipe, it also means that if this is the only interface on which you
restrict SSH and Telnet access, using them to access the router through any other
interfaces is unrestricted. This might be exactly the action you want. However, if
your intent is to restrict SSH and Telnet access for all interfaces on the router, you
must apply this firewall filter to all the router’s interfaces. Again, you have a design
choice to make here. You can certainly apply the filter to all the interfaces—or to any
Creating a Simple Firewall Filter that Matches Packet Contents | 303
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.