Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Configuring Default Reject Rules

    The following guidelines describe when to configure the default reject rules:

    • Source address is defined on a multicast network, a loopback address, or a multicast address.
    • The source or destination address of a packet is a link-local address, an address “reserved for future use” as specified in RFC 5735 for IPv4, an “unspecified address” or an address “reserved for future definition and use” as specified in RFC 3513 for IPv6.
    • An illegal or out-of-sequence TCP packet is received.
    • Before you begin, log in with your root account on a Junos OS device running Junos OS Release 12.1X46-D20 and edit the configuration.

      Note: You can enter the configuration commands in any order and commit all the commands at once.

    To configure default reject rules:

    1. Configure the security screen features and enable the IP address spoofing IDS option.
      [edit security]user@host# set security screen ids-option trustScreen ip spoofing
    2. Configure the security flow feature to log the dropped illegal packets.
      [edit security]user@host# set security flow log dropped-illegal-packet
    3. Specify the name of the security zone and the IDS option object applied to the zone.
      [edit security]user@host# set security zones security-zone trustZone screen trustScreen
    4. Configure the mandatory TCP reject rule.
      [edit security]user@host# set security flow tcp-session strict-syn-check

    Modified: 2015-11-23