Understanding Protocol Support
The administrator can configure the devices running Junos OS to perform stateful network traffic filtering on network packets using network traffic protocols and network fields as described in Table 1.
|
Protocol or RFC |
Fields |
|---|---|
|
ICMPv4 - RFC 792, Internet Control Message Protocol version 4 |
|
|
ICMPv6 - RFC 2463, Internet Control Message Protocol version 6 |
|
|
IPv4 - RFC 791, Internet Protocol |
|
|
IPv6 - RFC 8200, Internet Protocol Note:
IPv6 Protocols 43, 44, and 60 are not supported by the TOE, so packets are dropped without logging. |
|
|
TCP - RFC 793, Transmission Control Protocol |
|
|
UDP - RFC 768, User Datagram Protocol |
|
The following protocols are also supported on devices running Junos OS and are a part of this evaluation.
IPsec
IKE
SSH
The following protocols are supported on devices running Junos OS but are not included in the scope of this evaluation.
OSPF
BGP
RIP
Configuration Examples
The firewall filters can be used to define rules for all the mentioned protocols and fields.
Statefull packet filter firewall rules can be created that permit, drop, and log packets for each of the following attributes:
ICMPv4 - Configure a filter on the TOE to accept and drop ICMPv4 packets according to its type.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input ICMP-type set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter ICMP-type term permit from icmp-type 8 set firewall family inet filter ICMP-type term permit then log set firewall family inet filter ICMP-type term permit then accept set firewall family inet filter ICMP-type term deny from icmp-type 3 set firewall family inet filter ICMP-type term deny then log set firewall family inet filter ICMP-type term deny then discard
ICMPv4 - Configure a filter on the TOE to accept and drop ICMPv4 packets according to its code.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input ICMP-code set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter ICMP-code term permit from icmp-code 0 set firewall family inet filter ICMP-code term permit then log set firewall family inet filter ICMP-code term permit then accept set firewall family inet filter ICMP-code term deny from icmp-code 1 set firewall family inet filter ICMP-code term deny then log set firewall family inet filter ICMP-code term deny then discard
ICMPv6 - Configure a filter on the TOE to accept and drop ICMPv6 packets according to its type.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input ICMPv6-type set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter ICMPv6-type term permit from icmp-type 128 set firewall family inet filter ICMPv6-type term permit then log set firewall family inet filter ICMPv6-type term permit then accept set firewall family inet filter ICMPv6-type term deny from icmp-type 1 set firewall family inet filter ICMPv6-type term deny then log set firewall family inet filter ICMPv6-type term deny then discard
ICMPv6 - Configure a filter on the TOE to accept and drop ICMPv6 packets according to its code.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input ICMPv6-code set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter ICMPv6-code term permit from icmp-code 0 set firewall family inet filter ICMPv6-code term permit then log set firewall family inet filter ICMPv6-code term permit then accept set firewall family inet filter ICMPv6-code term deny from icmp-code 1 set firewall family inet filter ICMPv6-code term deny then log set firewall family inet filter ICMPv6-code term deny then discard
IPV4 Source Address - Configure a filter on the TOE to drop and accept traffic with specified IPv4 source addresses.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input Source_Address set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter Source_Address term permit from source-address 10.1.9.40/32 set firewall family inet filter Source_Address term permit then log set firewall family inet filter Source_Address term permit then accept set firewall family inet filter Source_Address term deny from source-address 10.1.9.41/32 set firewall family inet filter Source_Address term deny then log set firewall family inet filter Source_Address term deny then discard
IPV4 Destination Address - Configure a filter on the TOE to drop and accept traffic with specified IPv4 destination addresses.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input Destn_Address set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter Destn_Address term permit from destination-address 10.1.9.29/32 set firewall family inet filter Destn_Address term permit then log set firewall family inet filter Destn_Address term permit then accept set firewall family inet filter Destn_Address term deny from destination-address 10.1.5.11/32 set firewall family inet filter Destn_Address term deny then log set firewall family inet filter Destn_Address term deny then discar
IPv4 Transport Layer Protocol - Configure a filter on the TOE to drop and accept traffic with a specified IPv4 transport layer protocol.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input IPv4_Transport set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter IPv4_Transport term permit from protocol tcp set firewall family inet filter IPv4_Transport term permit then log set firewall family inet filter IPv4_Transport term permit then accept set firewall family inet filter IPv4_Transport term deny from protocol udp set firewall family inet filter IPv4_Transport term deny then log set firewall family inet filter IPv4_Transport term deny then discard
IPv6 Source address - Configure a filter on the TOE to drop and accept traffic with specified IPv6 source addresses.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input Source_Address set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter Source_Address term allow from source-address 2001:10:1:9::41/128 set firewall family inet filter Source_Address term allow then log set firewall family inet filter Source_Address term allow then accept set firewall family inet filter Source_Address term deny from source-address 2001:10:1:9::40/128 set firewall family inet filter Source_Address term deny then log set firewall family inet filter Source_Address term deny then discard
IPv6 Destination Address - Configure a filter on the TOE to drop and accept traffic with specified IPv6 destination addresses.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input Destn_Address set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter Destn_Address term allow from destination-address 2001:10:1:9::29/128 set firewall family inet filter Destn_Address term allow then log set firewall family inet filter Destn_Address term allow then accept set firewall family inet filter Destn_Address term deny from destination-address 2001:10:1:5::11/128 set firewall family inet filter Destn_Address term deny then log set firewall family inet filter Destn_Address term deny then discard
IPv6 Transport Layer Protocol - Configure a filter on the TOE to drop and accept traffic with a specified IPv6 transport layer protocol.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input IPv6_Transport set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter IPv6_Transport term allow from next-header tcp set firewall family inet filter IPv6_Transport term allow then log set firewall family inet filter IPv6_Transport term allow then accept set firewall family inet filter IPv6_Transport term deny from next-header udp set firewall family inet filter IPv6_Transport term deny then log set firewall family inet filter IPv6_Transport term deny then discard
TCP Source Port - Configure a filter on the TOE to drop and accept traffic according to specified TCP source ports
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input TCP_Src_Port set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter TCP_Src_Port term permit from source-port 1234 set firewall family inet filter TCP_Src_Port term permit then log set firewall family inet filter TCP_Src_Port term permit then accept set firewall family inet filter TCP_Src_Port term deny from source-port 5678 set firewall family inet filter TCP_Src_Port term deny then log set firewall family inet filter TCP_Src_Port term deny then discard
TCP Destination Port - Configure a filter on the TOE to drop and accept traffic according to specified TCP destination ports.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input TCP_Destn_Port set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter TCP_Destn_Port term permit from destination-port 1234 set firewall family inet filter TCP_Destn_Port term permit then log set firewall family inet filter TCP_Destn_Port term permit then accept set firewall family inet filter TCP_Destn_Port term deny from destination-port 23 set firewall family inet filter TCP_Destn_Port term deny then log set firewall family inet filter TCP_Destn_Port term deny then discard
UDP Source Port - Configure a filter on the TOE to drop and accept traffic according to specified UDP source ports.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input UDP_Src_Port set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter UDP_Src_Port term permit from source-port 1234 set firewall family inet filter UDP_Src_Port term permit then log set firewall family inet filter UDP_Src_Port term permit then accept set firewall family inet filter UDP_Src_Port term deny from source-port 5678 set firewall family inet filter UDP_Src_Port term deny then log set firewall family inet filter UDP_Src_Port term deny then discard
UDP Destination Port - Configure a filter on the TOE to drop and accept traffic according to specified UDP destination ports.
set interfaces ge-1/0/1 vlan-tagging set interfaces ge-1/0/1 unit 0 vlan-id 900 set interfaces ge-1/0/1 unit 0 family inet filter input UDP_Destn_Port set interfaces ge-1/0/1 unit 0 family inet address 10.1.9.29/24 set interfaces ge-1/0/1 unit 0 family inet6 address 2001:10:1:9::29/64 set firewall family inet filter UDP_Destn_Port term permit from destination-port 1234 set firewall family inet filter UDP_Destn_Port term permit then log set firewall family inet filter UDP_Destn_Port term permit then accept set firewall family inet filter UDP_Destn_Port term deny from destination-port 5678 set firewall family inet filter UDP_Destn_Port term deny then log set firewall family inet filter UDP_Destn_Port term deny then discard
The TOE enforces the first rule for both IPv4 and IPv6 when two equal stateful traffic filtering rules with conflicting operations (permit and drop) are configured and deployed in two distinct orders.
IPv4 - Configure a filter to allow and drop packets to a specific destination with the allow rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-allow set firewall family inet filter dest-allow term allow from destination-address 10.1.3.108/32 set firewall family inet filter dest-allow term allow then log set firewall family inet filter dest-allow term allow then accept set firewall family inet filter dest-allow term deny from destination-address 10.1.3.108/32 set firewall family inet filter dest-allow term deny then log set firewall family inet filter dest-allow term deny then discard
IPv4 - Configure a filter to allow and drop packets to a specific destination with the deny rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-deny set firewall family inet filter dest-deny term allow from destination-address 10.1.3.108/32 set firewall family inet filter dest-deny term allow then log set firewall family inet filter dest-deny term allow then discard set firewall family inet filter ddest-deny term deny from destination-address 10.1.3.108/32 set firewall family inet filter dest-deny term deny then log set firewall family inet filter dest-deny term deny then accept
IPv6 - Configure a filter to allow and drop packets to a specific destination with the allow rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-allow set firewall family inet filter dest-allow term allow from destination-address 2001:10:1:3::108/128 set firewall family inet filter dest-allow term allow then log set firewall family inet filter dest-allow term allow then accept set firewall family inet filter dest-allow term deny from destination-address 2001:10:1:3::108/128 set firewall family inet filter dest-allow term deny then log set firewall family inet filter dest-allow term deny then discard
IPv6 - Configure a filter to drop and allow packets to a specific destination with the drop rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-deny set firewall family inet filter dest-deny term allow from destination-address 2001:10:1:3::108/128 set firewall family inet filter dest-deny term allow then log set firewall family inet filter dest-deny term allow then discard set firewall family inet filter dest-deny term deny from destination-address 2001:10:1:3::108/128 set firewall family inet filter dest-deny term deny then log set firewall family inet filter dest-deny term deny then accept
Regardless of the specificity of the rule, the TOE enforces the first rule for both IPv4 and IPv6 when two rules are devised where one is a subset of the other (e.g., a specific address vs. a network segment).
IPv4 - Configure the firewall rule so that the first rule allows packets to a specific destination address and the second rule denies packets to its network segment with the allow rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-allow-IPv4 set firewall family inet filter dest-allow-IPv4 term allow from destination-address 10.1.3.108/32 set firewall family inet filter dest-allow-IPv4 term allow then log set firewall family inet filter dest-allow-IPv4 term allow then accept set firewall family inet filter dest-allow-IPv4 term deny from destination-address 10.1.3.0/24 set firewall family inet filter dest-allow-IPv4 term deny then log set firewall family inet filter dest-allow-IPv4 term deny then discard
IPv4 - Configure the firewall rule so that the first rule denies packets to a network segment and the second rule allows packets to a specific destination address of the network segment with the deny rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-deny-IPv4 set firewall family inet filter dest-deny-IPv4 term deny from destination-address 10.1.3.0/24 set firewall family inet filter dest-deny-IPv4 term deny then log set firewall family inet filter dest-deny-IPv4 term deny then discard set firewall family inet filter dest-deny-IPv4 term allow from destination-address 10.1.3.108/32 set firewall family inet filter dest-deny-IPv4 term allow then log set firewall family inet filter dest-deny-IPv4 term allow then accept
IPv6 - Configure the firewall rule so that the first rule allows packets to a specific destination address and the second rule denies packets to its network segment with the allow rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-allow-IPv6 set firewall family inet filter dest-allow-IPv6 term allow from destination-address 2001:10:1:3::108/128 set firewall family inet filter dest-allow-IPv6 term allow then log set firewall family inet filter dest-allow-IPv6 term allow then accept set firewall family inet filter dest-allow-IPv6 term deny from destination-address 2001:10:1:3::0/64 set firewall family inet filter dest-allow-IPv6 term deny then log set firewall family inet filter dest-allow-IPv6 term deny then discard
IPv6 - Configure the firewall rule so that the first rule denies packets to a network segment and the second rule allows packets to a specific destination address of the network segment with the deny rule being first.
set interfaces ge-1/0/1 unit 0 family inet filter input dest-deny-IPv6 set firewall family inet filter dest-deny-IPv6 term deny from destination-address 2001:10:1:3::0/64 set firewall family inet filter dest-deny-IPv6 term deny then log set firewall family inet filter dest-deny-IPv6 term deny then discard set firewall family inet filter dest-deny-IPv6 term allow from destination-address 2001:10:1:3::108/128 set firewall family inet filter dest-deny-IPv6 term allow then log set firewall family inet filter dest-deny-IPv6 term allow then accept