On switches managed through Mist, a firewall filter was configured on an IRB interface to allow SSH access only from specific source IP addresses and deny all other SSH connections. However, SSH connections from unauthorized hosts were still successfully reaching the switch.

Investigation determined that RE protection filter (protect_re) applied to the lo0 interface contained a broad permit term matching the 10.0.0.0/8 network before the SSH-specific permit and deny terms. Because Junos firewall filters are evaluated sequentially, traffic matched the broad permit term and was accepted before reaching the intended SSH restriction terms.

SSH access to the switch management IP configured on an IRB interface is accepted from unauthorized hosts.

A firewall filter similar to the following is applied to the IRB interface:

set interfaces irb unit 100 family inet filter input filter-name

set firewall family inet filter filter-name term ssh_access from source-address 10.2.x.x/32

set firewall family inet filter filter-name term ssh_access from source-address 10.2.x.x/32

set firewall family inet filter filter-name term ssh_access from protocol tcp

set firewall family inet filter filter-name term ssh_access from port ssh

set firewall family inet filter filter-name term ssh_access then accept

set firewall family inet filter filter-name term ssh_denied from protocol tcp

set firewall family inet filter filter-name term ssh_denied from port ssh

set firewall family inet filter filter-name term ssh_denied then discard

Firewall counters in filter-name remain at zero during SSH connection attempts, indicating the traffic is not being processed as expected by the filter.

{master:0}

mist@EXSwitch> show firewall | no-more 

Filter: protect_re                       

Filter: filter-name                      

Counters:

Name                                      Bytes       Packets

allow_ssh                                      0          0

deny_ssh                                      0          0

other_traffic                 

The protect_re filter contains a broad permit statement such as:

set groups top firewall family inet filter protect_re term trusted_hosts from source-prefix-list 10-0-0-0_8

set groups top firewall family inet filter protect_re term trusted_hosts then accept

SSH connections sourced from the 10.0.0.0/8 network are allowed regardless of the restrictions configured in filter-name.

Review the protect_re filter applied to the lo0 interface and ensure that SSH-specific permit and deny terms are evaluated before any broad permit statements.

Create and move the SSH allow terms and an explicit SSH deny term ahead of the trusted_hosts permit term:

set groups top firewall family inet filter protect_re term terminal_access_denied from destination-port ssh

set groups top firewall family inet filter protect_re term terminal_access_denied then discard

insert groups top firewall family inet filter protect_re term custom_01 before term trusted_hosts

insert groups top firewall family inet filter protect_re term custom_02 before term trusted_hosts

insert groups top firewall family inet filter protect_re term terminal_access_denied before term trusted_hosts

This ensures that:

1. SSH traffic from authorized source addresses is explicitly permitted.
2. SSH traffic from unauthorized sources is explicitly denied.
3. Broad source-based permit statements do not bypass SSH access restrictions.

After reordering the terms, testing confirmed that direct SSH access from unauthorized hosts was blocked while SSH access from the approved jump hosts remained functional.