Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configuring Default Reject Rules

 

The following guidelines describe when to configure the default reject rules:

  • Source address is defined on a multicast network, a loopback address, or a multicast address.

  • The source or destination address of a packet is a link-local address, an address “reserved for future use” as specified in RFC 5735 for IPv4, an “unspecified address” or an address “reserved for future definition and use” as specified in RFC 3513 for IPv6.

  • An illegal or out-of-sequence TCP packet is received.

  • Before you begin, log in with your root account on a Junos OS device running Junos OS Release 20.2R1 and edit the configuration.

    Note

    You can enter the configuration commands in any order and commit all the commands at once.

To configure default reject rules:

  1. Configure the security screen features and enable the IP address spoofing IDS option.
  2. Configure the security flow feature to log the dropped illegal packets.
  3. Configure the rule to block reserved addresses.
    Note

    After running the set security flow advanced-options drop-matching-reserved-ip-address command, you must create a neighbor cache entry on each host on a local link to the SRX device. For example, on a Linux host you would enter the following command:

    ip -6 neigh add 2001:db8:c18:1::2 lladdr 2c:6b:f5:69:ce:00 dev eth1 where, 2001:db8:c18:1::2 is the IPv6 address of the adjacent SRX interface, and 2c:6b:f5:69:ce:00 is the MAC address of the adjacent SRX interface.You will also need to create neighbor cache entries on the SRX device for all hosts on the local link, as shown in the following example:

    In the example, 2001:db8:c18:1::2 is the IPv6 address of the SRX ge-0/0/0 interface, 2001:db8:c18:1::3 is a host on the local link, and 00:0c:29:97:70:a5 is the MAC address of that host.

  4. Specify the name of the security zone and the IDS option object applied to the zone.
  5. Configure the mandatory TCP reject rule.