Example: Configuring a Security Policy to Permit or Deny Wildcard Address Traffic

Requirements

• Understand wildcard addresses. See Understanding Security Policy Rules.
• Create zones. See Example: Creating Security Zones.
• Configure an address book and create addresses for use in the policy. See Example: Configuring Address Books and Address Sets.
• Create an application (or application set) that indicates that the policy applies to traffic of that type. See Example: Configuring Applications and Application Sets.
• Permit traffic to and from trust and untrust zones. See Example: Configuring a Security Policy to Permit or Deny All Traffic.
• Permit e-mail traffic to and from trust and untrust zones. See Example: Configuring a Security Policy to Permit or Deny Selected Traffic

Overview

In the Junos operating system (Junos OS), security policies enforce rules for the transit traffic, in terms of what traffic can pass through the device, and the actions that need to take place on the traffic as it passes through the device. From the perspective of security policies, the traffic enters one security zone and exits another security zone. In this example, you configure a specific security to allow only wildcard address traffic from a host in the trust zone to the untrust zone. No other traffic is allowed.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. Configure the interfaces and security zones.
   [edit security zones]user@host# set security-zone trust interfaces ge-0/0/2 host-inbound-traffic system-services all user@host# set security-zone untrust interfaces ge-0/0/1 host-inbound-traffic system-services all
2. Create an address book entry for the host and attach the address book to a zone.
   [edit security address-book book1]user@host# set address wildcard-trust wildcard-address 192.168.0.11/255.255.0.255 user@host# set attach zone trust
3. Define the policy to permit wildcard address traffic.
   [edit security policies from-zone trust to-zone untrust]user@host# set policy permit-wildcard match source-address wildcard-trustuser@host# set policy permit-wildcard match destination-address anyuser@host# set policy permit-wildcard match application anyuser@host# set policy permit-wildcard then permit

Results

From configuration mode, confirm your configuration by entering the show security policies and show security zones commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, perform this task:

• Verifying Policy Configuration

Verifying Policy Configuration

Purpose

Verify information about security policies.

Action

From operational mode, enter the show security policies policy-name permit-wildcard detail command to display details about the permit-wildcard security policy configured on the device.

Meaning

The output displays information about the permit-wildcard policy configured on the system. Verify the following information:

• From and To zones
• Source and destination addresses
• Match criteria