Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Protection of Routing Engine

The Protection of Routing Engine feature ensures that the Routing Engine accepts traffic only from trusted systems. Enabling this feature results in creation of a stateless firewall filter that discards all traffic destined for the Routing Engine, except those from the specified trusted sources. Protecting the Routing Engine involves filtering incoming traffic on the router’s lo0 interface. Enabling this feature on Juniper Switches is suggested as a best practice.

Configure Protection of Routing Engine

When Protection of Routing Engine is enabled, Mist by default ensures that the following services (if configured) are allowed to communicate with the switch: BGP, BFD, NTP, DNS, SNMP, TACACS, RADIUS, and Mist cloud connectivity.

If you want to additionally configure ICMP or SSH to access the switch from, you can enable them under Trusted Services. Note that enabling ICMP and SSH opens these protocols to all networks.

If you want to configure the commonly used IP networks to access the switch from, you can configure that under Trusted Networks. Use this option if you want to access the switch from the entire network.

If you have other custom services (which are a specific combination of IP, Port and Protocol) that you would like to reach the switch from, you can configure them under Trusted IP/Port/Protocol. This option allows you to use a particular port and protocol to access the switch.

You can configure Protection of Routing Engine at the organization level (Organization > Switch Templates), at the site level (Site > Switch Configuration), and at the switch level (Switches > Switch Name).

The following procedure lists steps for configuring Protection of Routing Engine at the switch level.

To configure Protection of Routing Engine at the switch level:

  1. Click Switches > switch name to navigate to the switch details page.
  2. Scroll down to the PROTECTION OF ROUTING ENGINE tile in the Management section.
  3. Select the Override Site/Template Settings check box.
  4. Select the Enabled check box.

    When Protection of Routing Engine is enabled, Mist automatically parses the configuration and allows the end hosts (BGP neighbors, DNS/NTP/TACACS/RADIUS servers, SNMP Clients etc) to communicate with the switch. If you want to add additional IP or IP Subnet that you want the switch to communicate with, add those networks in the Trusted Networks section as mentioned in the next step.

  5. To add additional IP or IP Subnet that you want the switch to communicate with, enter the IP addresses in a comma separated format in the Trusted Networks field.
  6. If you want the switch to respond to the SSH and ICMP services, select the ssh and icmp check boxes.
  7. If you want the switch to respond to custom services (which are a specific combination of IP, Port and Protocol), follow the below steps:
    1. Click Add IP/Protocol/Port.
      The Add Trusted IP/Protocol/Port window is displayed.
    2. In the Add Trusted IP/Protocol/Port window, specify the IP Address, a Protocol, and an applicable Port Range.
    3. Click Add.
  8. Save the configuration.

Configuration Commands (CLIs)

Verify Protection of Routing Engine Configuration

Protection of Routing Engine (Trusted Networks Configuration)

Configuration commands (CLI)

APIs

Use the show bgp summary command to get a summary of the status of BGP connections:

To test the Trusted Networks functionality, ping 100.100.100.2 from the switch, as shown below. You can see that all the transmitted packets are received without any packet loss.

Also, ping or ssh a network other than the trusted networks. As you can see below, the ping shows 100 percent packet loss.

Protection of Routing Engine (Trusted Services Configuration)

Configuration commands (CLI)

APIs

To test the trusted services configuration, log in to a device which is not on the trusted network.

To check the discarded packet, run the following additional CLI commands on the device:

Read also: Example: Configuring a Stateless Firewall Filter to Accept Traffic from Trusted Sources and Example: Configuring a Stateless Firewall Filter to Protect Against TCP and ICMP Floods.