Description

This article discusses why host-inbound-traffic sometimes works even when it is not permitted in a security-zone. This is expected behavior.

Symptoms

Topology:

100-1 (fe-0/0/5) ------- (fe-0/0/5)100-2

BGP, OSPF and VPN have been configured between two devices terminated on the fe-0/0/5 interface. These three protocols are not allowed as host-inbound-traffic under security-zone on 100-2, yet it is possible to see the following status:

root@100-1# run show security ike security-associations
Index   State  Initiator cookie  Responder cookie     Mode   Remote Address
4907988 UP     7a50b80aca76fa85  38cecaeb15a14bcd     Main   172.27.201.5  

[edit]
root@100-1# run show security ipsec security-associations
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon vsys Port      Gateway
  <131073 ESP:3des/sha1 4a964527 3524/ unlim   -   root 500    172.27.201.5
  >131073 ESP:3des/sha1 95abba13 3524/ unlim   -   root 500    172.27.201.5

[edit]
root@100-1# run show bgp summary
Groups: 1 Peers: 1 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
inet.0
                       0          0          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
172.27.201.5           1002         24         25       0       0       10:03 0/0/0/0              0/0/0/0

ru[edit]
root@100-1# run show ospf neighbor
Address          Interface              State     ID               Pri  Dead
172.27.201.5     fe-0/0/5.0             Full      172.27.201.5     128    3



Solution

Configuration on 100-1 is as follows (only relevant snippet of configuration:

interfaces {
    fe-0/0/5 {
        unit 0 {
            family inet {
                address 172.27.201.4/24;
            }
        }
    }
}
protocols {
    bgp {
        group g1 {
            type external;
            peer-as 1002;
            local-as 1001;
            neighbor 172.27.201.5;
        }
    }
    ospf {
        area 0.0.0.0 {
            interface fe-0/0/5.0;
        }
    }
}
security {
    ike {
        policy ikep {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$.fQ3ApBSrv69rvWLVb.P5Q69tuORcy"; ## SECRET-DATA
        }
         gateway ikeg {
            ike-policy ikep;
            address 172.27.201.5;
            external-interface fe-0/0/5.0;
        }
    }
    ipsec {
        policy ipsecp {
            proposal-set standard;
        }
        vpn vpn1 {
            bind-interface st0.0;
            ike {
                gateway ikeg;
                ipsec-policy ipsecp;
            }
            establish-tunnels immediately;
        }
    }
    zones {
        security-zone mgmt {
            host-inbound-traffic {
                system-services {
                    all;
                }
                protocols {
                    all;
                }
            }
            interfaces {
                fe-0/0/5.0;
            }
        }
    }
}

Configuration on 100-2 is as follows:
interfaces {
    fe-0/0/5 {
        unit 0 {
            family inet {
                address 172.27.201.5/24;
            }
        }
    }
}
protocols {
    bgp {
        group g1 {
            type external;
            peer-as 1001;
            local-as 1002;
            neighbor 172.27.201.4;
        }
    }
    ospf {
        area 0.0.0.0 {
            interface fe-0/0/5.0;
        }
    }
}
security {
    ike {
        policy ikep {
            mode main;
            proposal-set standard;
            pre-shared-key ascii-text "$9$.fQ3ApBSrv69rvWLVb.P5Q69tuORcy"; ## SECRET-DATA
        }
        gateway ikeg {
            ike-policy ikep;
            address 172.27.201.4;
            external-interface fe-0/0/5.0;
        }
    }
    ipsec {
        policy ipsecp {
            proposal-set standard;
        }
        vpn vpn1 {
            bind-interface st0.0;
            ike {
                gateway ikeg;
                ipsec-policy ipsecp;
            }
            establish-tunnels immediately;
        }
    }
    zones {
        security-zone mgmt {
            host-inbound-traffic {                 system-services {                     snmp;                     ping;                     http;                     https;                     ftp;                     ssh;                 }             }
            interfaces {
                fe-0/0/5.0;
            }
        }
    }
}

From 100-2 configuration, OSPF, BGP and IKE are not configured as host-inbound-traffic, thus OSPF, BGP and IKE traffic will not be allowed to be inbound to 100-2.  However, OSPF, BGP and IKE traffic initiate from 100-2 will not be affected by the mentioned configuration.  Once the traffic has been initiated, a session will be formed on 100-2. Traffic which is sent in reply to this traffic flow will match this session, and thus be accepted, resulting in negotiation being successful.

If the VPN tunnel is clear and then restarted, ipsec-key-management on 100-1 VPN will not come up:

[edit]
root@100-1# run clear security ipsec security-associations

[edit]
root@100-1# run clear security ike security-associations

[edit]
root@100-1# run show security ipsec security-associations
  Total active tunnels: 0

[edit]
root@100-1# run show security ike security-associations
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
4907989 DOWN   655db9fa8ad70a72  0000000000000000  Main           172.27.201.5 

But if the same restart is performed on 100-2:

[edit]
root@100-2# ...session protocol udp destination-port 500
Total sessions: 0

[edit]
root@100-2# run restart ipsec-key-management
run showIPSec Key Management daemon started, pid 3977

[edit]
root@100-2# run show security ike security-associations
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
1913866 UP     0fedf70688766ad5  abbf4a38e0cc8191  Main           172.27.201.4  

[edit]
root@100-2# run show security ipsec security-associations
  Total active tunnels: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon vsys Port  Gateway
  <131073 ESP:3des/sha1 311b00cd 3598/ unlim   -   root 500   172.27.201.4
  >131073 ESP:3des/sha1 950e870b 3598/ unlim   -   root 500   172.27.201.4

[edit]
root@100-2# ...w security flow session protocol udp destination-port 500
Session ID: 3809, Policy name: self-traffic-policy/1, Timeout: 50, Valid
  In: 172.27.201.5/500 --> 172.27.201.4/500;udp, If: .local..0, Pkts: 5, Bytes: 1192
  Out: 172.27.201.4/500 --> 172.27.201.5/500;udp, If: fe-0/0/5.0, Pkts: 4, Bytes: 976
Total sessions: 1

Note : UDP 500 session was not there earlier, but after restart it is present. The same goes for other traffic as well, i.e., BGP, OSPF.


This is expected and working correctly, as host-inbound-traffic configuration will guard ingress traffic according to the system service/protocol configured. Self initiated traffic is permitted to send out by default.

After traffic is sent, a corresponding session will be created so that the return traffic will be permitted by session matching.