This article will explain a possible option to block ssh to the switch at multiple IP's (irb)
All traffic received by the PFE that is intended for the RE to respond to can be filtered using ff on the lo0 interface
While this is certainly useful, it can pose a problem if the filter is not properly designed to account for the protocols that communicate with the RE (NTP, OSPF, BGP, SNMP, among others)
One possible alternative is to use filters on the IRBs; however, the way these process packets received on other broadcast domains or interfaces may result in access still occurring even with the filter in place
Here some examples of config
1) The Firewall Filter for FTP, can be set up with the following configuration mode commands:
set firewall family inet filter filter_FTP term 0 from protocol tcp
set firewall family inet filter filter_FTP term 0 from destination-port 21
set firewall family inet filter filter_FTP term 0 from destination-address <IP-FTP-Server>
set firewall family inet filter filter_FTP term 0 then count pkts_FTP
set firewall family inet filter filter_FTP term 0 then accept
set firewall family inet filter filter_FTP_IN term 0 from source-address <IP-FTP-Server>
set firewall family inet filter filter_FTP_IN term 0 then accept
2) The Firewall Filter for NTP, can be set up with the following configuration mode commands:
set firewall family inet filter filter_NTP term 0 from protocol udp
set firewall family inet filter filter_NTP term 0 from destination-port 123
set firewall family inet filter filter_NTP term 0 from destination-address <IP-NTP-Server>
set firewall family inet filter filter_NTP term 0 then count pkts_NTP
set firewall family inet filter filter_NTP term 0 then accept
set firewall family inet filter filter_NTP_IN term 0 from source-address <IP-NTP-Server>
set firewall family inet filter filter_NTP_IN term 0 then accept
3) The Firewall Filter for ICMP, can be set up with the following configuration mode commands:
set firewall family inet filter filter-Ping term 0 from source-address <ip-address>
set firewall family inet filter filter-Ping term 0 from destination-address <our-ip-address>
set firewall family inet filter filter-Ping term 0 from protocol icmp
set firewall family inet filter filter-Ping term 0 then count pkts_icmp
set firewall family inet filter filter-Ping term 0 then accept
4) The Firewall Filter for SSH, can be set up with the following configuration mode commands:
set firewall family inet filter filter_SSH term 0 from protocol tcp
set firewall family inet filter filter_SSH term 0 from destination-port 22
set firewall family inet filter filter_SSH term 0 then count pkts_SSH
set firewall family inet filter filter_SSH term 0 then accept
5) The Firewall Filter for Telnet, can be set up with the following configuration mode commands:
set firewall family inet filter filter_Telnet term 0 from protocol tcp
set firewall family inet filter filter_Telnet term 0 from destination-port 23
set firewall family inet filter filter_Telnet term 0 then count pkts_Telnet
set firewall family inet filter filter_Telnet term 0 then accept
These can be combined into multiple terms within the same filter
It should be noted that this configuration is merely an example, and further considerations, designs, and modifications must be made to ensure proper operation in a real production network
For reference when using Mist:
https://www.juniper.net/documentation/us/en/software/mist/mist-wired/topics/topic-map/configure-protection-of-re.html