This article demonstrates how to allow selected source IP addresses to access the device that is running Junos OS with a sample configuration.

I need to restrict management access.

The configuration parameters that are required to limit the IP addresses that can access the device via SSH are shown below.

This is an example for an EX device that uses a VLAN interface for management. ( Note: You can modify the configuration according to the management interface of each Junos device.)

Allowed IP address:

10.130.38.26

10.130.38.30

Blocked IP address:

All other IP addresses are denied access via SSH.

EX_Juniper# show
MGMT {
    vlan-id 100;
    l3-interface vlan.100;
}

set interfaces vlan unit 100 family inet address 10.130.238.229/24 (10.130.238.229 is configured for VLAN 100)

set firewall family inet filter RE_FILTER term SSH from source-address 10.130.38.26/32 (This host, 10.130.38.26, is allowed to do SSH.)
set firewall family inet filter RE_FILTER term SSH from source-address 10.130.38.30/32 (This host, 10.130.38.30, is allowed to do SSH.)
set firewall family inet filter RE_FILTER term SSH from destination-address 10.130.238.229/32 
set firewall family inet filter RE_FILTER term SSH from protocol tcp
set firewall family inet filter RE_FILTER term SSH from destination-port ssh
set firewall family inet filter RE_FILTER term SSH then count allow.ssh [optional config statement]
set firewall family inet filter RE_FILTER term SSH then accept

set firewall family inet filter RE_FILTER term SSH_BLOCK from destination-address 10.130.238.229/32 (10.130.238.229 is a Switch Management IP Address)
set firewall family inet filter RE_FILTER term SSH_BLOCK from protocol tcp
set firewall family inet filter RE_FILTER term SSH_BLOCK from destination-port ssh
set firewall family inet filter RE_FILTER term SSH_BLOCK then count discard.ssh [optional config statement]
set firewall family inet filter RE_FILTER term SSH_BLOCK then discard
set firewall family inet filter RE_FILTER term default then accept

set interfaces lo0 unit 0 family inet filter input RE_FILTER

2020-03-31: Article reviewed for accuracy; it is valid and accurate; added a note about ability to modify the configuration according to the management interface of each Junos device.

2021-12-11 : Added comment  [optional config statement] because count is not supported on ingress on some devices