简介
1、本教程仅适用于Juniper MX系列和QFX系列设备。（验证过）
2、提交配置时候，建议使用可自动回退的提交，防止无法远程管理。
3、本教程主要用于Juniper设备的登录防护，限制IP登录SSH或Telnet等远程控制协议。
PS：设备如果有公网IP，几乎无时不刻都有扫描和登录攻击。而且Juniper某些版本有Bug可能因此重启。
配置命令
编写过滤规则
set firewall family inet filter RE-Protect term management_permit from source-address 192.168.2.0/24
set firewall family inet filter RE-Protect term management_permit from source-address 172.16.0.1/24
set firewall family inet filter RE-Protect term management_permit from protocol tcp
set firewall family inet filter RE-Protect term management_permit from destination-port telnet
set firewall family inet filter RE-Protect term management_permit from destination-port ssh
set firewall family inet filter RE-Protect term management_permit from destination-port ftp
set firewall family inet filter RE-Protect term management_permit then accept
set firewall family inet filter RE-Protect term management_deny from protocol tcp
set firewall family inet filter RE-Protect term management_deny from destination-port telnet
set firewall family inet filter RE-Protect term management_deny from destination-port ssh
set firewall family inet filter RE-Protect term management_deny from destination-port ftp
set firewall family inet filter RE-Protect term management_deny then reject
set firewall family inet filter RE-Protect term other-permit then accept
- management_permit 语句匹配指定源地址访问SSH Telnet ftp协议允许。
- management_deny 语句匹配访问SSH Telnet ftp协议拒绝。
- other-permit 语句允许所有。
注意：此规则只匹配了IPv4
应用到lo0口
set interfaces lo0 unit 0 family inet filter input RE-Protect
- 一般情况下，将过滤规则应用到 lo0.0口的入方向，即可全局生效。
验证
show firewall log
Log:
Time Filter Action Interface Protocol Src Addr Dest Addr
15:17:11 pfe R ge-0/0/0.0 TCP 192.168.255.1 192.168.255.2
15:12:04 pfe R ge-0/0/0.0 TCP 192.168.255.1 192.168.255.2
- 输出确认来自 192.168.255.1 源地址 的信息流与过滤器术语匹配。列
Action显示一个R来指示这些数据包被拒绝。还列出了接口、传输协议以及 源和目标地址。这些结果确认此示例的防火墙过滤器工作正常。
show log messages | last 100 | match ssh
- 查看日志匹配ssh，可查看是否有ssh登录失败日志。无则生效。
show system connections
- 可查看监听端口与建立的连接。
lo口加入VRF导致SSH过滤不生效
- 将过滤规则应用到lo0.0 的确可以全局生效，但是在没有lo0其他子接口未被配置到其他routing-instances情况。如果配置了，此routing-instances的IP是不受匹配规则影响。
- 只需要单独匹配加入routing-instances的lo0的过滤规则即可。