Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Security Zones in Logical Systems

 

Security zones are the building blocks for policies. Security zones are logical entities to which one or more interfaces are bound and provides a means of distinguishing groups of hosts (user logical systems and other hosts, such as servers), resources from one another in order to apply different security measures. For more information, see the following topics:

Understanding Logical Systems Zones

Security zones are logical entities to which one or more interfaces are bound. Security zones can be configured on the master logical system by the master administrator or on user logical systems by the user logical system administrator. On a logical system, the administrator can configure multiple security zones, dividing the network into network segments to which various security options can be applied.

The master administrator configures the maximum and reserved numbers of security zones for each user logical system. The user logical system administrator can then create security zones in the user logical system and assign interfaces to each security zone. From a user logical system, the user logical system administrator can use the show system security-profile zones command to view the number of security zones allocated to the user logical system and the show interfaces command to view the interfaces allocated to the user logical system.

Note

The master administrator can configure a security profile for the master logical system that specifies the maximum and reserved numbers of security zones applied to the master logical system. The number of zones configured in the master logical system count toward the maximum number of zones available on the device.

The master and user administrator can configure the following properties of a security zone in a logical system:

  • Interfaces that are part of a security zone.

  • Screen options—For every security zone, you can enable a set of predefined screen options that detect and block various kinds of traffic that the device determines as potentially harmful.

  • TCP-Reset—When this feature is enabled, the system sends a TCP segment with the RESET flag set when traffic arrives that does not match an existing session and does not have the synchronize flag set.

  • Host inbound traffic—This feature specifies the kinds of traffic that can reach the device from systems that are directly connected to its interfaces. You can configure these parameters at the zone level, in which case they affect all interfaces of the zone, or at the interface level. (Interface configuration overrides that of the zone.)

There are no preconfigured security zones in the master logical system or user logical system.

The management functional zone (MGT) can only be configured for the master logical system. There is only one management interface per device and that interface is allocated to the master logical system.

The all interface can only be assigned to a zone in the master logical system by the master administrator.

The user logical system administrator can configure and view all attributes for a security zone in a user logical system. All attributes of a security zone in a user logical system are also visible to the master administrator.

Example: Configuring User Logical Systems

This example shows the configuration of interfaces, routing instances, zones, and security policies for user logical systems.

Requirements

Before you begin:

Overview

This example configures the ls-marketing-dept and ls-accounting-dept user logical systems shown in Example: Creating User Logical Systems, Their Administrators, Their Users, and an Interconnect Logical System.

This example configures the parameters described in Table 1 and Table 2.

Table 1: ls-marketing-dept Logical System Configuration

Feature

Name

Configuration Parameters

Interface

ge-0/0/6.1

  • IP address 13.1.1.1/24

  • VLAN ID 800

Routing instance

mk-vr1

  • Instance type: virtual router

  • Includes interfaces ge-0/0/6.1 and lt-0/0/0.5

  • Static routes:

    • 12.1.1.0/24 next-hop 10.0.1.2

    • 14.1.1.0/24 next-hop 10.0.1.4

    • 12.12.1.0/24 next-hop 10.0.1.1

Zones

ls-marketing-trust

Bind to interface ge-0/0/6.1.

ls-marketing-untrust

Bind to interface lt-0/0/0.5

Address books

marketing-internal

  • Address marketers: 13.1.1.0/24

  • Attach to zone ls-marketing-trust

marketing-external

  • Address design: 12.1.1.0/24

  • Address accounting: 14.1.1.0/24

  • Address others: 12.12.1.0/24

  • Address set otherlsys: design, accounting

  • Attach to zone ls-marketing-untrust

Policies

permit-all-to-otherlsys

Permit the following traffic:

  • From zone: ls-marketing-trust

  • To zone: ls-marketing-untrust

  • Source address: marketers

  • Destination address: otherlsys

  • Application: any

permit-all-from-otherlsys

Permit the following traffic:

  • From zone: ls-marketing-untrust

  • To zone: ls-marketing-trust

  • Source address: otherlsys

  • Destination address: marketers

  • Application: any

Table 2: ls-accounting-dept Logical System Configuration

Feature

Name

Configuration Parameters

Interface

ge-0/0/7.1

  • IP address 14.1.1.1/24

  • VLAN ID 900

Routing instance

acct-vr1

  • Instance type: virtual router

  • Includes interfaces ge-0/0/7.1 and lt-0/0/0.7

  • Static routes:

    • 12.1.1.0/24 next-hop 10.0.1.2

    • 13.1.1.0/24 next-hop 10.0.1.3

    • 12.12.1.0/24 next-hop 10.0.1.1

Zones

ls-accounting-trust

Bind to interface ge-0/0/7.1.

ls-accounting-untrust

Bind to interface lt-0/0/0.7

Address books

accounting-internal

  • Address accounting: 14.1.1.0/24

  • Attach to zone ls-accounting-trust

accounting-external

  • Address design: 12.1.1.0/24

  • Address marketing: 13.1.1.0/24

  • Address others: 12.12.1.0/24

  • Address set otherlsys: design, marketing

  • Attach to zone ls-accounting-untrust

Policies

permit-all-to-otherlsys

Permit the following traffic:

  • From zone: ls-accounting-trust

  • To zone: ls-accounting-untrust

  • Source address: accounting

  • Destination address: otherlsys

  • Application: any

permit-all-from-otherlsys

Permit the following traffic:

  • From zone: ls-accounting-untrust

  • To zone: ls-accounting-trust

  • Source address: otherlsys

  • Destination address: accounting

  • Application: any

Configuration

Configuring the ls-marketing-dept User Logical System

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure a user logical system:

  1. Log in to the user logical system as the logical system administrator and enter configuration mode.
  2. Configure the logical interface for a user logical system.
  3. Configure the routing instance and assign interfaces.
  4. Configure static routes.
  5. Configure security zones and assign interfaces to each zone.
  6. Create address book entries.
  7. Attach address books to zones.
  8. Configure a security policy that permits traffic from the ls-marketing-trust zone to the ls-marketing-untrust zone.
  9. Configure a security policy that permits traffic from the ls-marketing-untrust zone to the ls-marketing-trust zone.

Results

From configuration mode, confirm your configuration by entering the show routing-instances and show security commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Configuring the ls-accounting-dept User Logical System

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

To configure a user logical system:

  1. Log in to the user logical system as the logical system administrator and enter configuration mode.
  2. Configure the logical interface for a user logical system.
  3. Configure the routing instance and assign interfaces.
  4. Configure static routes.
  5. Configure security zones and assign interfaces to each zone.
  6. Create address book entries.
  7. Attach address books to zones.
  8. Configure a security policy that permits traffic from the ls-accounting-trust zone to the ls-accounting-untrust zone.
  9. Configure a security policy that permits traffic from the ls-accounting-untrust zone to the ls-accounting-trust zone.

Results

From configuration mode, confirm your configuration by entering the show routing-instances and show security commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, perform these tasks:

Verifying Policy Configuration

Purpose

Verify information about policies and rules.

Action

From operational mode, enter the show security policies detail command to display a summary of all policies configured on the logical system.

Example: Configuring Security Zones for a User Logical Systems

This example shows how to configure zones for a user logical system.

Requirements

Before you begin:

Overview

This example configures the ls-product-design user logical system shown in Example: Creating User Logical Systems, Their Administrators, Their Users, and an Interconnect Logical System.

This example creates the zones and address books described in Table 3.

Table 3: User Logical System Zone and Address Book Configuration

Feature

Name

Configuration Parameters

Zones

ls-product-design-trust

  • Bind to interface ge-0/0/5.1.

  • TCP reset enabled.

ls-product-design-untrust

  • Bind to interface lt-0/0/0.3.

Address books

product-design-internal

  • Address product-designers: 12.1.1.0/24

  • Attach to zone ls-product-design-trust

product-design-external

  • Address marketing: 13.1.1.0/24

  • Address accounting: 14.1.1.0/24

  • Address others: 12.12.1.0/24

  • Address set otherlsys: marketing, accounting

  • Attach to zone ls-product-design-untrust

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure zones in a user logical system:

  1. Log in to the user logical system as the logical system administrator and enter configuration mode.
  2. Configure a security zone and assign it to an interface.
  3. Configure the TCP-Reset parameter for the zone.
  4. Configure a security zone and assign it to an interface.
  5. Create global address book entries.
  6. Attach address books to zones.

Results

From configuration mode, confirm your configuration by entering the show security command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.