To verify a stateless firewall filter configuration, perform these tasks:
Verify the configuration of the firewall filter. You can analyze the flow of the filter terms by displaying the entire configuration.
From the J-Web interface, select Configuration>View and Edit>View Configuration Text. Alternatively, from configuration mode in the CLI, enter the show firewall command.
The sample output in this section displays the following firewall filters (in order):
- [edit]
- user@host# show firewall
- firewall {
-
- family inet {
-
- filter protect-RE {
-
- term ssh-term {
-
- from {
-
- source-address {
- 192.168.122.0/24;
- }
- protocol tcp;
- destination-port ssh;
- }
- then accept;
- }
-
- term bgp-term {
-
- from {
-
- source-address {
- 10.2.1.0/24;
- }
- protocol tcp;
- destination-port bgp;
- }
- then accept;
- }
-
- term discard-rest-term {
-
- then {
- log;
- syslog;
- discard;
- }
- }
- }
- }
- }
-
- [edit]
- user@host# show firewall
- firewall {
-
- policer tcp-connection-policer {
- filter-specific;
-
- if-exceeding {
- bandwidth-limit 500k;
- burst-size-limit 15k;
- }
- then discard;
- }
-
- policer icmp-policer {
- filter-specific;
-
- if-exceeding {
- bandwidth-limit 1m;
- burst-size-limit 15k;
- }
- then discard;
- }
-
- family inet {
-
- filter protect-RE {
-
- term tcp-connection-term {
-
- from {
-
- source-prefix-list {
- trusted-addresses;
- }
- protocol tcp;
- tcp-flags “(syn & !ack) | fin | rst”;
- }
-
- then {
- policer tcp-connection-policer;
- accept;
- }
- }
-
- term icmp-term {
-
- from {
- protocol icmp;
- icmp-type [ echo-request echo-reply unreachable time-exceeded
];
- }
-
- then {
- policer icmp-policer;
- count icmp-counter;
- accept;
- }
- }
-
additional terms...
- }
- }
- }
-
- [edit]
- user@host# show firewall
- firewall {
-
- family inet {
-
- filter fragment-RE {
-
- term small-offset-term {
-
- from {
- fragment-offset 1-5;
- }
-
- then {
- syslog;
- discard;
- }
- }
-
- term not-fragmented-term {
-
- from {
-
- source-address {
- 10.2.1.0/24;
- }
- fragment-offset 0;
- fragment-flags 0x0;
- protocol tcp;
- destination-port bgp;
- }
- then accept;
- }
-
- term first-fragment-term {
-
- from {
-
- source-address {
- 10.2.1.0/24;
- }
- first-fragment;
- protocol tcp;
- destination-port bgp;
- }
- then accept;
- }
-
- term fragment-term {
-
- from {
- fragment-offset 6-8191;
- }
- then accept;
- }
-
additional terms ...
- }
- }
- }
-
Verify that the output shows the intended configuration of the firewall filter.
Verify that the terms are listed in the order in which you want the packets to be tested. You can move terms within a firewall filter by using the insert CLI command.
Verify that packets are being logged. If you included the log or syslog action in a term, verify that packets matching the term are recorded in the firewall log or your system logging facility.
From operational mode in the CLI, enter the show firewall log command.
The log of discarded packets generated from the stateless firewall filter configured in Configuring a Routing Engine Firewall Filter for Services and Protocols from Trusted Sources is displayed in the following sample output.
user@host> show firewall log
Log : Time Filter Action Interface Protocol Src Addr Dest Addr 15:11:02 pfe D ge-0/0/0.0 TCP 172.17.28.19 192.168.70.71 15:11:01 pfe D ge-0/0/0.0 TCP 172.17.28.19 192.168.70.71 15:11:01 pfe D ge-0/0/0.0 TCP 172.17.28.19 192.168.70.71 15:11:01 pfe D ge-0/0/0.0 TCP 172.17.28.19 192.168.70.71 ...
Each record of the output contains information about the logged packet. Verify the following information:
Verify that packets are being policed and counted.
From operational mode in the CLI, enter the show firewall filter filter-name command.
The value of the counter, icmp-counter, and the number of packets discarded by the policers in the stateless firewall filter configured in Configuring a Routing Engine Firewall Filter to Protect Against TCP and ICMP Floods are displayed in the following sample output.
user@host> show firewall filter protect-RE
Filter: protect-RE Counters: Name Bytes Packets icmp-counter 1040000 5600 Policers: Name Packets tcp-connection-policer 643254873 icmp-policer 7391
Verify the following information:
Verify the stateless firewall filter configured in Configuring a Routing Engine Firewall Filter for Services and Protocols from Trusted Sources.
To verify that the actions of the firewall filter terms are taken, send packets to the Services Router that match the terms. In addition, verify that the filter actions are not taken for packets that do not match.
% ssh 192.168.249.71
%ssh host user@host's password: --- JUNOS 6.4-20040518.0 (JSERIES) #0: 2004-05-18 09:27:50 UTC user@host>
user@host> show route summary
Router ID: 192.168.249.71
inet.0: 34 destinations, 34 routes (33 active, 0 holddown, 1 hidden)
Direct: 10 routes, 9 active
Local: 9 routes, 9 active
BGP: 10 routes, 10 active
Static: 5 routes, 5 active
...
Verify the following information:
Verify the stateless firewall filter configured in Configuring a Routing Engine Firewall Filter to Protect Against TCP and ICMP Floods.
To verify that the actions of the firewall filter terms are taken, send packets to the Services Router that match the terms. In addition, verify that the filter actions are not taken for packets that do not match.
user@host> telnet 192.168.249.71
Trying 192.168.249.71... Connected to host.acme.net. Escape character is '^]'. host (ttyp0) login: user Password: --- JUNOS 6.4-20040521.1 built 2004-05-21 09:38:12 UTC user@host>
user@host> ping 192.168.249.71
PING host-ge-000.acme.net (192.168.249.71): 56 data bytes 64 bytes from 192.168.249.71: icmp_seq=0 ttl=253 time=11.946 ms 64 bytes from 192.168.249.71: icmp_seq=1 ttl=253 time=19.474 ms 64 bytes from 192.168.249.71: icmp_seq=2 ttl=253 time=14.639 ms ...
user@host> ping 192.168.249.71 size
20000
PING host-ge-000.acme.net (192.168.249.71): 20000 data bytes ^C --- host-ge-000.acme.net ping statistics --- 12 packets transmitted, 0 packets received, 100% packet loss
Verify the following information:
Verify the firewall filter configured in Configuring a Routing Engine Firewall Filter to Handle Fragments.
To verify that the actions of the firewall filter terms are taken, send packets to the Services Router that match the terms. In addition, verify that the filter actions are not taken for packets that do not match.
user@host> show route summary
Router ID: 192.168.249.71
inet.0: 34 destinations, 34 routes (33 active, 0 holddown, 1 hidden)
Direct: 10 routes, 9 active
Local: 9 routes, 9 active
BGP: 10 routes, 10 active
Static: 5 routes, 5 active
...
Verify that the show route summary command does not display a protocol other than Direct, Local, BGP, or Static.