Thứ Năm, 16 tháng 10, 2014

SRX for beginners

I was thinking if I should write a short article for beginners to quickly configure an SRX firewall.
I don’t know how many people will find it useful but I hope it will be for those who use SRX for
the first time in their life.  Let’s get started.
Our topology in this tutorial is below;


srx_beginner
We will configure the followings from scratch:
  1. Loading default config and setting the root password
  2. Configuring interfaces and default route
  3. Configuring security zones
  4. Configuring address book entries
  5. Creating security policies
  6. Creating source nat for internal clients


Loading default config and setting the root password

I assume you are connected to the SRX device via console
[stextbox id="grey" caption=CLI]
[edit]
root# load factory-default
warning: activating factory configuration
[edit]
root# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root# set system host-name srx220
[edit]
root# commit
commit complete
[edit]
root@srx220#
[/stextbox]
Once we commit the changes, we should see the new hostname srx220 in the prompt.

Configuring interfaces and default route


Interfaces
[stextbox id="grey" caption="CLI"]
#delete interfaces ge-0/0/0
#delete interfaces ge-0/0/1
#set interfaces ge-0/0/0 unit 0 family inet address 192.168.100.38/24
#set interfaces ge-0/0/1 unit 0 family inet address 192.168.239.1/24
[/stextbox]
Default route
[stextbox id="grey" caption="CLI"]
#set routing-options static route 0.0.0.0/0 next-hop 192.168.100.1
[/stextbox]

Configuring security zones

SRX is a zone based firewall and you must assign each interface to a zone to be able to pass traffic through.
There must be two default zones trust and untrust coming with the factory-default config but we will delete them
and configure our own zones.  Following will be our zone configuration;
  • Our zone facing pc clients is named internal
  • zone facing internet is named internet
  • Internal clients will be able to reach SRX i.e ping and ssh service will be enabled towards SRX
[stextbox id="grey" caption="CLI" collapsing="true"]
#set security zones security-zone internal interfaces ge-0/0/1.0 host-inbound-traffic system-services ping
#set security zones security-zone internal interfaces ge-0/0/1.0 host-inbound-traffic system-services ssh
#set security zones security-zone internet interfaces ge-0/0/0.0
[/stextbox]
Now we have assigned interfaces to each zone.

Configuring address book entries

If you want to configure a security policy you must create an address book entry for the network ranges you would like to use.
We will create one address book entry for our internal network block 192.168.239.0/24 as follows;
[stextbox id="grey" caption="Address Book "]
#set security zones security-zone internal address-book address network_239 192.168.239.0/24
[/stextbox]
Our address book entry is also ready for security policy. Now it is time to enforce the security policy to allow internal users to access outside networks.

Creating security policies

We first start with deleting already existing policies
[stextbox id="grey" caption="Security Policies"]
#delete security policies
#set security policies from-zone internal to-zone internet policy allow-internal-clients match source-address network_239
#set security policies from-zone internal to-zone internet policy allow-internal-clients match destination-address any
#set security policies from-zone internal to-zone internet policy allow-internal-clients match application any
#set security policies from-zone internal to-zone internet policy allow-internal-clients then permit
[/stextbox]
A policy is must be placed within a context which means the direction of the policy e.g from internal zone to internet zone
with this configuration we enabled traffic from internal clients to internet zone.

Creating source nat for internal clients

You may also need to source NAT internal clients with your outside interface IP address. Here is how we configure source nat in SRX:
First start deleting previous left over nat rules.
[stextbox id="grey" caption="CLI"]
#delete security nat
#set security nat source rule-set internal-to-internet from zone internal
#set security nat source rule-set internal-to-internet to zone internet
#set security nat source rule-set internal-to-internet rule internet-access match source-address 192.168.239.0/24
#set security nat source rule-set internal-to-internet rule internet-access match destination-address 0.0.0.0/0
#set security nat source rule-set internal-to-internet rule internet-access then source-nat interface
[/stextbox]
and last commit the changes!

As you can see source NAT is also a context based configuration. You define from which zone you are coming and to which zone you are heading.
After these configuration your internal clients whose gateway is 192.168.239.1 should be able to reach Internet if I haven’t made any mistake so far.
source : http://rtoodtoo.net/2012/12/12/juniper-srx-for-beginners/#more-938
Người đăng: vào lúc Không có nhận xét nào:

Port Scanner in Python

Python is a great tool to do some socket operations. I have written a piece of code by which I can scan a port range.
It is very basic and missing bunch of checks as aim is the simplicity here.

#!/usr/bin/python
 
import socket,sys
 
try:
  sys.argv[3]
except:
  print "Usage: port_scanner.py [hostname|IP] [port_start] [port_end]"
  sys.exit()
 
host = sys.argv[1]
start_port = int(sys.argv[2])
end_port = int(sys.argv[3])
 
#CREATE SOCKET
try:
  s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
except socket.error,err_msg:
  print 'Socket creation failed. Error code: '+ str(err_msg[0]) + ' Error mesage: ' + err_msg[1]
  sys.exit()
 
#RESOLVE HOSTNAME
try:
  remote_ip = socket.gethostbyname(host)
 
except socket.error,error_msg:
  print 'ERROR:'
  print error_msg
  sys.exit()
 
#ITERATE PORT RANGE
end_port+=1
for port in range(start_port,end_port):
  try:
    s.connect((remote_ip,port))
    print 'port ' + str(port) + ' open'
 
    s.close()
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
  except socket.error:
    pass
 
You can run the script in the following way by which you scan ports between 1 and 1024:
[stextbox id="grey" caption="portscanner"]
$ ./port_scanner.py remotehost.com 1 1024
port 80 open
port 443 open
[/stextbox]
However I need to give some more info in here. If you send a TCP SYN segment to a closed port, normal behavior is to send a TCP RST segment back to the source. Under normal circumstances script runs through the port range and knocks every port on the remote destination. If a TCP RST is received, socket is closed and script knocks the other port in the list but what if you don’t receive any TCP RST back? For example there is a firewall in between and you can’t even knock some ports. Then what happens?  In this case Linux kernel does 5 TCP SYN by default according to my ubuntu sysctl settings;
[stextbox id="grey" caption="sysctl"]
$ sysctl -a | grep tcp_syn_retries
net.ipv4.tcp_syn_retries = 5
[/stextbox]
This is a terrible setting which causes lots of delay in every port knock. That is why to speed up test I decrease this retry value to 1 temporarily
[stextbox id="grey" caption="sysctl"]
# sysctl net.ipv4.tcp_syn_retries=1
net.ipv4.tcp_syn_retries = 1
[/stextbox]
Actually I wanted to set my own retry scheme via python but it seems it isn’t possible to manipulate kernel’s behavior on this.  In python there is a “setsockopt” method of socket by which you can send certain options but no related option I could find in socket manual of Linux. There may be a way but I don’t know it yet.
When you run the test,  you can check the SYN requests with the following tcpdump command, you can have a better picture of what the script is doing;
[stextbox id="grey" caption="tcpdump"]
#tcpdump -nni any host remotehost.com and ‘tcp[tcpflags] & tcp-syn!=0′
[/stextbox]


source : http://rtoodtoo.net/2012/12/20/port-scanner-in-python/#more-964
Người đăng: vào lúc Không có nhận xét nào:

SRX Transparent Mode

SRX can also function as a firewall device when it is in layer 2 mode i.e
it can perform firewall functionality transparently.
As of now there are certain limitations on transparent mode. If not changed already;
  • You can either run the firewall in route mode or transparent mode but not mixed
  • NAT and IPSEC aren’t supported in this mode
Below I will try to show how you can convert an SRX firewall to transparent mode
and configure it. In our topology, we have two Linux servers each in the same VLAN
(282) and we will inspect traffic between these nodes without those Linux hosts are
being aware of SRX
transparent_mode_srx

First of all converting to transparent mode means putting the interface families
to bridge. There isn’t any switch/knob by which you can convert to transparent.
You can start by deleting all interfaces config to start from scratch and configure
these two GE interfaces with interface mode access and vlan-ids. You also see an IRB
interface. We can think of this as a virtual interface on this vlan something like
vlan.282 when we are in L3 mode.
Then configure a bridge domain. Yeah but what is a bridge domain? Assume this isn’t
an SRX device but an EX switch. By assigning ge-0/0/1 and ge-0/0/2 to vlan 282 we are creating a broadcast segment and with the following config, we give BD282 name to
our new domain and assign irb.1 interface to this bridge domain to access the box i.e from any device on this vlan you can connect to SRX through irb interface as long
as the security zone of the ingress interface has the necessary system-services allowed.
If you commit after this configuration, you must be instructed to reboot which is required.
Now configure security zones and a simple security policy for testing.
Now we should be able to connect connect from hostP(5.5.5.3) to hostN(5.5.5.2). Let do SSH
and check session table and mac table on SRX
Yes SRX has learned mac addresses and flow session is installed from 5.5.5.3 to 5.5.5.2
You can also configure interfaces on trunk mode. For more information better to
check SRX layer 2 bridging and switching document.
source : http://rtoodtoo.net/2014/07/20/srx-transparent-mode/#more-2059
Người đăng: vào lúc Không có nhận xét nào:

Trunk between Cisco,EX switch and SRX


cisco2950switchex2200com
Today I needed to test communication between a Cisco switch and EX switch to carry traffic via a trunk port from a PC to
the final destination SRX device. I thought it is worth putting my config here for future reference as I am not working with cisco/ex switches much.
Above is my exact topology and I carry traffic from a PC in Vlan 200 to the port fe-0/0/7 in SRX which is in vlan 200 as well. Here is the config from Cisco switch till to SRX.

[stextbox id="grey" caption="cisco2950 config"]
cisco2950#show run interface fa0/1
Building configuration…
Current configuration : 109 bytes
!
interface FastEthernet0/1
 switchport access vlan 200
 switchport mode access
 spanning-tree portfast
end
cisco2950#show run int fa0/24
Building configuration…
Current configuration : 57 bytes
!
interface FastEthernet0/24
switchport mode trunk
end
cisco2950#show run vlan 200
Building configuration…
Current configuration:
!
vlan 200
 name vlan200
end
 vtp mode transparent
[/stextbox]
In an nutshell, we set the port fa0/1 to access mode assign vlan 200 and set port fa0/24 to trunk . Then we create the vlan 200 and set the vtp mode to transparent
[stextbox id="grey" caption="EX2200 Config"]
[edit]
root@ex2200-1# show interfaces ge-0/0/10
unit 0 {
    family ethernet-switching {
        port-mode trunk;
        vlan {
            members vlan200;
        }
    }
}
[edit]
root@ex2200-1# show interfaces ge-0/0/11
description “SRX100 TRUNK”;
unit 0 {
    family ethernet-switching {
        port-mode trunk;
        vlan {
            members all;
        }
    }
}
[/stextbox]
In EX side, we set ge-0/0/10 and ge-0/0/11 ports to trunk. I have only set vlan200 on ge-0/0/10 port as I have no other vlan there.
[stextbox id="grey" caption="SRX Config"]
[edit]
root@srx100-1# show interfaces fe-0/0/7
unit 0 {
    family ethernet-switching {
        port-mode trunk;
        vlan {
            members all;
        }
    }
}
[edit]
root@srx100-1# show interfaces vlan.200
family inet {
    address 192.168.200.1/24;
}
[/stextbox]
SRX side is also similar to EX. I set the EX facing interface fe-0/0/7 to trunk to accept any vlan traffic and vlan.200 interface to 192.168.200.1
Once I ping from the PC having address 192.168.200.100
[stextbox id="grey" caption="ping"]
root@asus:~$ ping 192.168.200.1
PING 192.168.200.1 (192.168.200.1) 56(84) bytes of data.
64 bytes from 192.168.200.1: icmp_req=1 ttl=64 time=0.540 ms
64 bytes from 192.168.200.1: icmp_req=2 ttl=64 time=0.532 ms
^C
— 192.168.200.1 ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.532/0.536/0.540/0.004 ms
[/stextbox]
You can see how it works!
source : http://rtoodtoo.net/2013/03/13/trunk-between-cisco-ex-switch-and-srx/
Người đăng: vào lúc Không có nhận xét nào:

Juniper switch ex2200 how to find port from ip address ?


run ping <ip> count 1
run show arp no-resolve hostname <ip>
run show ethernet-switching table | match <MAC from the ARP output>
Người đăng: vào lúc Không có nhận xét nào:
Đăng ký: Bài đăng (Atom)