Discussion

More documents

Recommendations

Info

Solution Create a firewall filter for all incoming traffic to the router that will be used on interfaces facing the Internet. The filter contains a number of terms for different types of packets and for specific addresses. The first term discards unwanted traffic from specific addresses: [edit firewall incoming-to-me] aviva@RouterF# set term reject-addresses from source-address 172.68.0.0/16 aviva@RouterF# set term reject-addresses from source-address 192.168.0.0/24 aviva@RouterF# set term reject-addresses then discard The second term accepts traffic from BGP peers: [edit firewall filter incoming-to-me] aviva@RouterF# set term bgp-peers from destination-address 10.0.31.0/24 aviva@RouterF# set term bgp-peers from protocol tcp aviva@RouterF# set term bgp-peers from port bgp aviva@RouterF# set term bgp-peers from tcp-established aviva@RouterF# set term bgp-peers then accept The third term accepts all ICMP traffic: [edit firewall filter incoming-to-me] aviva@RouterF# set term icmp from protocol icmp aviva@RouterF# set term icmp then accept The last term accepts all other packets: [edit firewall filter incoming-to-me] aviva@RouterF# set term final-accept then accept For the filter to take effect, apply it to an Internet-facing interface: [edit interfaces t1-0/0/3] aviva@RouterF# set unit 0 family inet filter input incoming-to-me <strong>Discussion</strong> There are two basic ways to design a firewall filter. One way is to block packets and traffic that the router shouldn’t receive and accept everything else, which is how the filter in this recipe operates. This type of filter design is fairly intuitive and, as you can see from this recipe, these filters are reasonably short and fairly easy to configure. One downside to this approach is that if you forget to block a particular type of traffic, you are opening yourself up to security breaches. The second design philosophy, of accepting only desired traffic and blocking everything else, is discussed in Recipe 9.15. This recipe is for an EBGP edge router that connects to the Internet. The filter is very straightforward, accepting all packets except for traffic coming from a few IP prefixes. 312 | Chapter 9: Routing Policy and Firewall Filters This is the Title of the Book, eMatter Edition Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Firewall filter terms are evaluated in order, so place the terms at the beginning of the filter that you want executed first. The first term in this recipe, reject-addresses, looks for packets from two networks that you never want to accept traffic from and immediately discards them, dropping them without sending any notification to the sender. Placing this term at the top of the filter improves the packet-processing efficiency of the interface. The second term, bgp-peers, accepts BGP traffic only from the specified peer. The conditions in this term look for TCP protocol traffic from the BGP port and match TCP connections that have been established. Again, all BGP traffic is accepted by the final term, so including a separate term for the router’s BGP peer just speeds up the processing of traffic from the peer. The final term, ospf, accepts all OSPF traffic. You might wonder why you need this term when the final term will also accept OSPF traffic. The only reason to do this is that you want OSPF traffic to be handled more quickly than the other remaining traffic. If other operations on your network are time-critical, include them early in the filter. If you are going to apply this filter to a high-speed interface or to traffic flowing at a high rate, you gain efficiency from this type of firewall filter design. The last term in the filter accepts all other traffic. It is important to note that you must be very cognizant of what you are enabling and what the other protocols are that run on the router when you design firewall filters that, as a last term, accept all other traffic. While this example illustrates a way to design filters that is easy and intuitive, it is generally better practice to explicitly accept what you want and discard everything else. Recipe 9.15 illustrates this firewall filter design approach. As the last step in the configuration, apply the filter to an interface, here the t1-0/0/3 interface. The set filter input command applies the filter to incoming traffic. To apply a filter to traffic going out of the interface, use the set filter output command. Here’s the entire configuration to show all the contents together: [edit firewall] aviva@RouterF# show filter incoming-to-me { term reject-addresses { from { source-address { 172.68.0.0/16; 192.168.0.0/24; } then { discard; } } term ospf { from { protocol ospf; } Filtering Traffic Transiting the Router | 313 This is the Title of the Book, eMatter Edition Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Page 3 and 4:
JUNOS Cookbook
Page 5 and 6:
JUNOS Cookbook Aviva Garrett Beijin
Page 7 and 8:
Table of Contents Foreword . . . .
Page 9 and 10:
3. IPSec . . . . . . . . . . . . .
Page 11 and 12:
8.5 Creating Static Routes 263 8.6
Page 13 and 14:
13.5 Adjusting Local Preference Val
Page 15 and 16:
Foreword The early days at Juniper
Page 17 and 18:
Throughout 1997 and early 1998, all
Page 19 and 20:
Preface1 Over the past decade, netw
Page 21 and 22:
Organization As the name suggests,
Page 23 and 24:
Constant width Used for code sectio
Page 25 and 26:
Chapter 1 CHAPTER 1 Router Configur
Page 27 and 28:
You can use a number of operational
Page 29 and 30:
The show command displays the items
Page 31 and 32:
Each listed completion is the confi
Page 33 and 34:
command on the left side of the pip
Page 35 and 36:
The > tells you that you are in ope
Page 37 and 38:
} } } root@# commit root@router1# e
Page 39 and 40:
For the initial router configuratio
Page 41 and 42:
At this point in configuring the ro
Page 43 and 44:
1.4 Displaying the Commands to Recr
Page 45 and 46:
Discussion It is generally good pra
Page 47 and 48:
is often the first thing to check w
Page 49 and 50:
In this example, the error is in th
Page 51 and 52:
To track down what changed in the c
Page 53 and 54:
Solution Use the following command
Page 55 and 56:
login { class superuser-local { per
Page 57 and 58:
If PIM is not yet configured, merge
Page 59 and 60:
You can also save it to a file in y
Page 61 and 62:
These files are also compressed. av
Page 63 and 64:
You see that the running configurat
Page 65 and 66:
Solution The rollback configuration
Page 67 and 68:
See Also Recipe 1.17 1.19 Backing U
Page 69 and 70:
ad1 11513 MB IBM-DARA-212000 AH0AHG
Page 71 and 72:
J-series filesystems on a device co
Page 73 and 74:
1.22 Installing a Different Softwar
Page 75 and 76:
Use the request system software add
Page 77 and 78:
support site (http://www.juniper.ne
Page 79 and 80:
JUNOS 7.0 was released in the fourt
Page 81 and 82:
Some of the main processes are MGD,
Page 83 and 84:
switching board (the SSB), and two
Page 85 and 86:
1.28 Gathering Information Before C
Page 87 and 88:
The apply-groups statement causes t
Page 89 and 90:
} } } address 10.0.16.1/24; Finally
Page 91 and 92:
The commit synchronize command comm
Page 93 and 94:
modules/ packages/ proc/ root/ sbin
Page 95 and 96:
At this point, you can also upgrade
Page 97 and 98:
lets them gain access to the router
Page 99 and 100:
client/server systems—the RADIUS
Page 101 and 102:
You need to enable FTP only if you
Page 103 and 104:
use of the root account. Logging in
Page 105 and 106:
A slight twist to this recipe is to
Page 107 and 108:
Also, you will not be able to commi
Page 109 and 110:
Solution Set all plain-text passwor
Page 111 and 112:
Discussion When you want users to b
Page 113 and 114:
individual user accounts with passw
Page 115 and 116:
ead-only Can perform all actions in
Page 117 and 118:
If you try to enter a command that
Page 119 and 120:
aviva@router1# set class operator-p
Page 121 and 122:
If you use a centralized server, it
Page 123 and 124:
aviva@RouterF# set term ssh-telnet
Page 125 and 126:
statement in the configuration, whi
Page 127 and 128:
een idle, and what they are doing.
Page 129 and 130:
Mike would be logged out: mike@rout
Page 131 and 132:
Encryption, which is the encoding o
Page 133 and 134:
networks, it does not scale well. A
Page 135 and 136:
} } [edit interfaces] es-3/0/0 { #
Page 137 and 138:
have to set up an IKE SA and a fire
Page 139 and 140:
Here’s what the relevant portions
Page 141 and 142:
Finally, configure the domain’s I
Page 143 and 144:
Configure the security gateway rout
Page 145 and 146:
[edit protocols ospf area 0.0.0.0]
Page 147 and 148:
Then, configure the IPSec tunnel to
Page 149 and 150:
Issuer: Organization: mycompany, Co
Page 151 and 152:
Alternate subject: RouterB.mycompan
Page 153 and 154:
Chapter 4 CHAPTER 4 SNMP4 4.0 Intro
Page 155 and 156:
juniperMIB, which is the top node o
Page 157 and 158:
Juniper Networks provides several d
Page 159 and 160:
4.2 Setting Router Information for
Page 161 and 162:
Table 4-1. SNMP trap categories Key
Page 163 and 164:
Solution You can add a term to the
Page 165 and 166:
You might want to give access to al
Page 167 and 168:
aviva@router1> show snmp mib get "j
Page 169 and 170:
4.9 Collecting Router Operational I
Page 171 and 172:
CPU utilization: User 0 percent Bac
Page 173 and 174:
Table 4-2. System logging severity
Page 175 and 176:
Discussion RMON is an SNMP specific
Page 177 and 178:
See Also RFC 2819, Remote Network M
Page 179 and 180:
nms1 sha/3des nonvolatile active Gr
Page 181 and 182:
Again, this recipe is somewhat invo
Page 183 and 184:
Finally, configure which traps the
Page 185 and 186:
} notify chassis-notification-list
Page 187 and 188:
Some are the same as those used by
Page 189 and 190:
Solution Use the following commands
Page 191 and 192:
5.2 Limiting the Messages Collected
Page 193 and 194:
Discussion The default maximum size
Page 195 and 196:
no longer need. Here, we logged RIP
Page 197 and 198:
Discussion This configuration redir
Page 199 and 200:
This command causes all messages se
Page 201 and 202:
Apr 29 22:55:16 router xntpd[4977]:
Page 203 and 204:
The traceoption flags indicate the
Page 205 and 206:
Chapter 6 CHAPTER 6 NTP6 6.0 Introd
Page 207 and 208:
6.2 Setting the Time Zone Problem Y
Page 209 and 210:
Engine boots, the ntpdate utility r
Page 211 and 212:
You can also have all the routers s
Page 213 and 214:
6.6 Checking NTP Status Problem You
Page 215 and 216:
Chapter 7 CHAPTER 7 Router Interfac
Page 217 and 218:
under the name of the interface and
Page 219 and 220:
Solution Use the show interfaces co
Page 221 and 222:
the physical interface. It allows y
Page 223 and 224:
Solution The show interfaces extens
Page 225 and 226:
Broadcast packets 0 [0] Multicast p
Page 227 and 228:
Input packets : 5 Output packets: 5
Page 229 and 230:
1.0.12.2/30 so-1/0/0 Mars 1.0.0.1/3
Page 231 and 232:
To remove an extra IP address, use
Page 233 and 234:
Discussion For MPLS traffic to tran
Page 235 and 236:
Flags: None Addresses, Flags: Is-Pr
Page 237 and 238:
Solution Configure the router’s m
Page 239 and 240:
On an M-series or a T-series router
Page 241 and 242:
You can confirm the presence of the
Page 243 and 244:
Protocol inet6, MTU: 1500 Flags: Is
Page 245 and 246:
Solution Use the Virtual Router Red
Page 247 and 248:
Solution There are three steps to s
Page 249 and 250:
7.16 Configuring T1 Interfaces Prob
Page 251 and 252:
Run the loopback test, which sends
Page 253 and 254:
7.18 Setting Up a BERT Test on a T1
Page 255 and 256:
You can configure an error rate to
Page 257 and 258:
Discussion Synchronous Optical Netw
Page 259 and 260:
SEF 22 182 OK LOS 22 1 OK LOF 22 1
Page 261 and 262:
Use the show aps command to check t
Page 263 and 264:
type of ATM PIC, the configuration
Page 265 and 266:
gre up ipip up lo0 up up lo0.0 up u
Page 267 and 268:
Solution Add the new interface to t
Page 269 and 270:
While this does what you want, it m
Page 271 and 272:
When a single routing protocol prov
Page 273 and 274:
IPv6 uses 128-bit addresses that co
Page 275 and 276:
8.1 Viewing the Routes in the Routi
Page 277 and 278:
oute is learned from a dynamic rout
Page 279 and 280:
} } family iso { address 49.0020.19
Page 281 and 282:
8.2 Viewing Routes to a Particular
Page 283 and 284:
8.3 Viewing Routes Learned from a S
Page 285 and 286: ff00::/8 perm 0 mdsc 53 1 ff02::1/1
Page 287 and 288: The actual forwarding tables that t
Page 289 and 290: and the traffic to these networks i
Page 291 and 292: Attacker A B Target Real source add
Page 293 and 294: Check the firewall filter counts wi
Page 295 and 296: Solution Create a routing policy th
Page 297 and 298: Discussion Martian addresses are pr
Page 299 and 300: Solution After configuring both OSP
Page 301 and 302: To verify the preference change, lo
Page 303 and 304: Peer supports Refresh capability (2
Page 305 and 306: This recipe shows how to enable gra
Page 307 and 308: Because the policy and filter condi
Page 309 and 310: then accept; } } } protocols { ospf
Page 311 and 312: The first command in the recipe def
Page 313 and 314: [edit] aviva@router1# set protocols
Page 315 and 316: Table 9-4. Actions that change rout
Page 317 and 318: (called longest-match lookup), so t
Page 319 and 320: aviva@router1# set term 2 then reje
Page 321 and 322: See Also IANA, http://www.iana.org/
Page 323 and 324: the community string from the route
Page 325 and 326: used to verify that the router is m
Page 327 and 328: } } Discussion } } Placing firewall
Page 329 and 330: Table 9-5. Header match conditions
Page 331 and 332: counterintuitive. However, understa
Page 333 and 334: protocol-except tcp; } then { count
Page 335: protocol tcp; destination-port [ te
Page 339 and 340: 9.12 Using a Firewall Filter to Cou
Page 341 and 342: 04:58:41 pfe A t1-0/0/3.0 TCP 10.0.
Page 343 and 344: which traffic is more important and
Page 345 and 346: The next term allows TCP traffic: [
Page 347 and 348: Routing Engine, you want to make su
Page 349 and 350: from { source-address { 10.0.8.0/24
Page 351 and 352: 9.16 Rate-Limiting Traffic Flow to
Page 353 and 354: list of IP addresses in one place i
Page 355 and 356: lished TCP connections and you sudd
Page 357 and 358: By default, the JUNOS software impl
Page 359 and 360: } } } neighbor fe-0/0/0.0; neighbor
Page 361 and 362: 10.0.0.0/24 *[Direct/0] 2w4d 23:05:
Page 363 and 364: The routing policy you set up is a
Page 365 and 366: so the inbound metrics are 1. The m
Page 367 and 368: can use it in the authentication-ke
Page 369 and 370: 10.6 Sending Version 1 Update Messa
Page 371 and 372: Mar 31 10:11:13 Group beta-rip-grou
Page 373 and 374: Chapter 11 CHAPTER 11 IS-IS11 11.0
Page 375 and 376: oundary. This means that the IS-IS
Page 377 and 378: might be useful when migrating two
Page 379 and 380: Interface System L State Hold (secs
Page 381 and 382: RouterA.02-00 0x59 0xeda9 632 L1 L2
Page 383 and 384: The next four lines show the IP pre
Page 385 and 386: configuring the preference statemen
Page 387 and 388:
11.5 Configuring a Level 1-Only Rou
Page 389 and 390:
11.6 Controlling DIS Election Probl
Page 391 and 392:
key, or password, for each interfac
Page 393 and 394:
} } from protocol static; then acce
Page 395 and 396:
Again, we expect the metric to chan
Page 397 and 398:
RouterA Level 2 RouterB Level 2 Rou
Page 399 and 400:
Increasing the IS-IS cost of Router
Page 401 and 402:
11.12 Moving IS-IS Traffic off a Ro
Page 403 and 404:
11.14 Tracing IS-IS Protocol Traffi
Page 405 and 406:
Using some of the other flags, you
Page 407 and 408:
OSPF views routers as nodes, which
Page 409 and 410:
Area 0.0.0.0 RouterG lo0:192.168.19
Page 411 and 412:
Another common problem in establish
Page 413 and 414:
The route entries starting with [OS
Page 415 and 416:
entries that originated from the lo
Page 417 and 418:
OSPF network. Route 192.168.18.1:0.
Page 419 and 420:
Checking on RouterA at the other en
Page 421 and 422:
192.168.19.1/32 *[Direct/0] 3d 01:5
Page 423 and 424:
The routers in the stub area no lon
Page 425 and 426:
Router 192.168.16.1 192.168.16.1 0x
Page 427 and 428:
Solution You configure MD5 authenti
Page 429 and 430:
Use the show ospf interface detail
Page 431 and 432:
With the default metric, traffic fr
Page 433 and 434:
12.12 Improving OSPF Convergence Ti
Page 435 and 436:
This output shows two BFD sessions
Page 437 and 438:
aviva@RouterG# commit aviva@RouterG
Page 439 and 440:
Jun 14 22:00:26 CHANGE 192.168.17.1
Page 441 and 442:
Jun 13 16:55:20 IP Route added with
Page 443 and 444:
list of ASs to see whether a route
Page 445 and 446:
E Route was originally learned from
Page 447 and 448:
Then configure an EBGP session to t
Page 449 and 450:
NLRI for this session: inet-unicast
Page 451 and 452:
Next is information about routes le
Page 453 and 454:
Looking at the remote peer router,
Page 455 and 456:
* 10.0.31.0/24 Self I * 172.19.121.
Page 457 and 458:
aviva@RouterE> show bgp summary Gro
Page 459 and 460:
to 10.0.31.1 via t1-0/0/3.0 10.0.29
Page 461 and 462:
lem with BGP itself. When the TCP s
Page 463 and 464:
13.4 Adjusting the Next-Hop Attribu
Page 465 and 466:
The first configuration in this rec
Page 467 and 468:
13.7 Prepending AS Numbers to the A
Page 469 and 470:
13.8 Filtering BGP Routes Based on
Page 471 and 472:
Translated, this match looks for fo
Page 473 and 474:
Type: External State: Established F
Page 475 and 476:
This recipe configures MD5 authenti
Page 477 and 478:
oute reflector system has a set of
Page 479 and 480:
10.0.24.0/24 *[BGP/170] 00:18:38, l
Page 481 and 482:
AS 65500 Sub-AS 65501 RouterF 192.1
Page 483 and 484:
figure-of-merit value correlates to
Page 485 and 486:
Once the routing policy is set up,
Page 487 and 488:
change, the router will unsuppress
Page 489 and 490:
See Also RFC 2439, BGP Route Flap D
Page 491 and 492:
You see that the route to 192.168.1
Page 493 and 494:
When setting up policies, also crea
Page 495 and 496:
} See Also next-hop 192.0.2.1; acce
Page 497 and 498:
Another restriction for multipath B
Page 499 and 500:
This forwarding table is then copie
Page 501 and 502:
BGP establishes the connection, fro
Page 503 and 504:
Chapter 14a CHAPTER 14 MPLS14 14.0
Page 505 and 506:
Layer 2 header MPLS header Layer 3
Page 507 and 508:
RouterG 192.168.19.1 Ingress router
Page 509 and 510:
The main difference between LDP and
Page 511 and 512:
family to the t1-4/0/0 interface; o
Page 513 and 514:
Also verify the MPLS-enabled interf
Page 515 and 516:
The first line of the output shows
Page 517 and 518:
aviva@RouterG> show configuration p
Page 519 and 520:
via t1-4/0/0.0, Push 100000 192.168
Page 521 and 522:
aviva@RouterG> show route forwardin
Page 523 and 524:
This recipe shows how to configure
Page 525 and 526:
Oct 5 19:25:52 Msg Hello (0x100), l
Page 527 and 528:
aviva@R3# set rsvp interface fxp0.0
Page 529 and 530:
fxp0 up up fxp0.0 up up inet 192.16
Page 531 and 532:
aviva@R1> show rsvp interface RSVP
Page 533 and 534:
y 13:31:06 the LSP was up and runni
Page 535 and 536:
10.0.0.6 10.0.0.1 Up 0 1 FF 3 - R1-
Page 537 and 538:
Solution On the ingress router, loo
Page 539 and 540:
for LSP signaling. On the egress an
Page 541 and 542:
Discussion There are several ways t
Page 543 and 544:
14.9 Verifying that the RSVP-Signal
Page 545 and 546:
14.11 Protecting an LSP’s Path Pr
Page 547 and 548:
RSVP RRO in the path calculation lo
Page 549 and 550:
The configuration allocates 50 Mbps
Page 551 and 552:
However, RSVP cannot establish the
Page 553 and 554:
Solution Fast reroute reduces packe
Page 555 and 556:
PATH sentto: 10.1.13.2 (so-0/0/2.0)
Page 557 and 558:
The RSVP interface status shows tha
Page 559 and 560:
14.13 Automatically Allocating Band
Page 561 and 562:
Then examine the history of the LSP
Page 563 and 564:
To understand how preemption works,
Page 565 and 566:
10.0.0.5 From: 10.0.0.1, State: Up,
Page 567 and 568:
9 Oct 14 10:51:20 Deselected as act
Page 569 and 570:
The router knows how to reach its i
Page 571 and 572:
10.1.13.1/32 *[Local/0] 2d 20:39:51
Page 573 and 574:
aviva@R1> clear log rsvp-trace-log
Page 575 and 576:
PATH rcvfrom: 10.1.13.2 (so-0/0/2.0
Page 577 and 578:
The discussion of Layer 3 VPNs invo
Page 579 and 580:
VPN, and routes announced by a remo
Page 581 and 582:
The third and final step is to conf
Page 583 and 584:
One last protocol that you need to
Page 585 and 586:
All routes that are part of the VPN
Page 587 and 588:
--- 192.168.13.1 ping statistics --
Page 589 and 590:
1 *[MPLS/0] 1d 18:03:41, metric 1 R
Page 591 and 592:
65500:3:10.0.31.0/24 *[BGP/170] 00:
Page 593 and 594:
emains private. When configuring th
Page 595 and 596:
} } peer-as 65500; neighbor 10.0.1.
Page 597 and 598:
The VPN2 routing table also knows n
Page 599 and 600:
Just to make sure that prefixes are
Page 601 and 602:
Multicast senders and receivers are
Page 603 and 604:
You administratively configure the
Page 605 and 606:
10.0.21.2/24 RouterB 192.168.12.1 R
Page 607 and 608:
IGMP Last Member Query Interval: 1.
Page 609 and 610:
Again, verify the configured group
Page 611 and 612:
willing to be an RP send RP Announc
Page 613 and 614:
JUNOS routers perform the encapsula
Page 615 and 616:
Now check the RP status on the rout
Page 617 and 618:
Also, make sure that the router’s
Page 619 and 620:
Check to see which RPs the various
Page 621 and 622:
The anycast PIM configuration is qu
Page 623 and 624:
Solution Specify the group address
Page 625 and 626:
The interfaces toward the multicast
Page 627 and 628:
Discussion Flags: sparse Upstream i
Page 629 and 630:
IGMP Query Response Interval: 10.0
Page 631 and 632:
If you are not sure that the domain
Page 633 and 634:
Discussion With PIM-SM, the RP in e
Page 635 and 636:
The full RIB group configuration lo
Page 637 and 638:
} address 192.168.19.1; # ping 224
Page 639 and 640:
Upstream interface: local Upstream
Page 641 and 642:
The first entry is for the source i
Page 643 and 644:
IGMP Last Member Query Interval: 1.
Page 645:
The command in this recipe is a sim
Page 648 and 649:
adjacencies (continued) IGPs and, 1
Page 650 and 651:
BGP (Border Gateway Protocol) (cont
Page 652 and 653:
configure command (continued) exclu
Page 654 and 655:
dotted quad notation, 248 down arro
Page 656 and 657:
firewall filters (continued) loggin
Page 658 and 659:
IBGP (internal BGP) (continued) LOC
Page 660 and 661:
IP multicast (continued) limiting g
Page 662 and 663:
Level 1 systems (IS-IS) authenticat
Page 664 and 665:
martian addresses/prefixes (continu
Page 666 and 667:
O Object Identifier (see OID) OID (
Page 668 and 669:
plain-text passwords (continued) JU
Page 670 and 671:
RFC (Request for Comment) on BGP, 4
Page 672 and 673:
outing tables (continued) checking
Page 674 and 675:
set route-filter command, 296 set r
Page 676 and 677:
show ospf interface command, 386, 3
Page 678 and 679:
ssh command, 3, 89 SSM (Source-Spec
Page 680 and 681:
tracing (trace logging) (continued)
Page 683:
About the Author Aviva Garrett has
show all

Discussion

Create successful ePaper yourself

Delete template?

Save as template?