The following guidelines describe when to configure the
default reject rules:
Source address is defined on a multicast network, a loopback
address, or a multicast address.
The source or destination address of a packet is a link-local
address, an address “reserved for future use” as specified
in RFC 5735 for IPv4, an “unspecified address” or an address
“reserved for future definition and use” as specified
in RFC 3513 for IPv6.
An illegal or out-of-sequence TCP packet is received.
-
Before you begin, log in with your root account on a Junos OS device running
Junos OS Release
22.2R1
and edit the configuration.
Note:
You can enter the configuration commands in any order and commit all the
commands at once.
To configure default reject rules:
- Configure the security screen features and enable the
IP address spoofing IDS option.
[edit]
user@host# set security screen ids-option trustScreen ip spoofing
- Configure the security flow feature to log the dropped
illegal packets.
[edit]
user@host# set security flow log dropped-illegal-packet
- Configure the rule to block reserved addresses.
[edit]
user@host# set security flow advanced-options drop-matching-reserved-ip-address
Note: After running the set security flow advanced-options drop-matching-reserved-ip-address
command, you must create a neighbor cache entry on each host on a
local link to the SRX device. For example, on a Linux host you would
enter the following command:ip -6 neigh add 2001:db8:c18:1::2
lladdr 2c:6b:f5:69:ce:00 dev eth1 where, 2001:db8:c18:1::2 is the IPv6 address of the adjacent SRX interface, and 2c:6b:f5:69:ce:00 is the MAC address of the adjacent SRX interface.You will also need
to create neighbor cache entries on the SRX Series Firewall for all hosts on
the local link, as shown in the following example:
interfaces {
ge-0/0/0 {
unit 0 {
family inet6 {
address 2001:db8:c18:1::2/64 {
ndp 2001:db8:c18:1::3 mac 00:0c:29:97:70:a5;
}
}
}
}
}
In the example, 2001:db8:c18:1::2 is the IPv6 address
of the SRX ge-0/0/0 interface, 2001:db8:c18:1::3 is a host
on the local link, and 00:0c:29:97:70:a5 is the MAC address
of that host.
- Specify the name of the security zone and the IDS option
object applied to the zone.
[edit]
user@host# set security zones security-zone trustZone screen trustScreen
- Configure the mandatory TCP reject rule.
[edit]
user@host# set security flow tcp-session strict-syn-check
