Description

This article provides information on how to generate syslog messages for the traffic that is directed to the device itself, which is also known as host inbound traffic.

Symptoms

To configure a security policy to generate syslog messages for the host inbound traffic.

Solution

Starting with Junos OS 11.4, a new security zone, known as junos-host, has been included. The junos-host zone can be used in security policies. This zone contains the logical interfaces that handle the host inbound traffic.

Interface Configuration 

 root@# show interfaces 
 ge-0/0/1 {
    unit 0 {
        family inet {
            address 10.10.10.1/32;
        }
    }
 }

Security Policy Configuration :
root# show security policies
from-zone untrust to-zone junos-host {    
  policy log-host-traffic {
    match {
      source-address any;
      destination-address any;
      application any;
    }
    then {
      permit;
      log {
        session-init;
        session-close;
      }
    }
  }
}

Syslog Configuration :  

root# show system syslog
file host-inbound-logs {
  any any;
  match "RT_FLOW.*junos-host";
  structured-data;
}
Sample Output :
root# run show security flow session 
node0:

Session ID: 5, Policy name: log-host-traffic/14, State: Active, Timeout: 1784, Valid < The host inbound traffic that hits the configured security policy (log-host-traffic)
In: 10.10.10.2/53836 --> 10.10.10.1/22;tcp, If: ge-0/0/1.0, Pkts: 64, Bytes: 5593
Out: 10.10.10.1/22 --> 10.10.10.2/53836;tcp, If: .local..0, Pkts: 112, Bytes: 12305
Total sessions: 1


root# run show log host-inbound-logs <  generated syslog messages

Dec 17 08:04:45 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.10.10.2/53836->10.10.10.1/22 junos-ssh 10.10.10.2/53836->10.10.10.1/22 None None 6 log-host-traffic untrust junos-host 5 N/A(N/A) ge-0/0/1.0

Dec 17 08:05:30 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed TCP FIN: 10.10.10.2/53836->10.10.10.1/22 junos-ssh 10.10.10.2/53836->10.10.10.1/22 None None 6 log-host-traffic untrust junos-host 5 78(6657) 122(13305) 45 UNKNOWN UNKNOWN N/A(N/A) ge-0/0/1.0 No

Modification History

2020-07-18: Article reviewed for accuracy; no changes required.