This article discusses why host-inbound-traffic sometimes works even when it is not permitted in a security-zone. This is expected behavior.
100-1 (fe-0/0/5) ------- (fe-0/0/5)100-2
BGP, OSPF and VPN have been configured between two devices terminated on the fe-0/0/5 interface. These three protocols are not allowed as host-inbound-traffic under security-zone on 100-2, yet it is possible to see the following status:
root@100-1# run show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 4907988 UP 7a50b80aca76fa85 38cecaeb15a14bcd Main 172.27.201.5 [edit] root@100-1# run show security ipsec security-associations Total active tunnels: 1 ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway <131073 ESP:3des/sha1 4a964527 3524/ unlim - root 500 172.27.201.5 >131073 ESP:3des/sha1 95abba13 3524/ unlim - root 500 172.27.201.5 [edit] root@100-1# run show bgp summary Groups: 1 Peers: 1 Down peers: 0 Table Tot Paths Act Paths Suppressed History Damp State Pending inet.0 0 0 0 0 0 0 Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped... 172.27.201.5 1002 24 25 0 0 10:03 0/0/0/0 0/0/0/0 ru[edit] root@100-1# run show ospf neighbor Address Interface State ID Pri Dead 172.27.201.5 fe-0/0/5.0 Full 172.27.201.5 128 3
Configuration on 100-1 is as follows (only relevant snippet of configuration:
interfaces { fe-0/0/5 { unit 0 { family inet { address 172.27.201.4/24; } } } } protocols { bgp { group g1 { type external; peer-as 1002; local-as 1001; neighbor 172.27.201.5; } } ospf { area 0.0.0.0 { interface fe-0/0/5.0; } } } security { ike { policy ikep { mode main; proposal-set standard; pre-shared-key ascii-text "$9$.fQ3ApBSrv69rvWLVb.P5Q69tuORcy"; ## SECRET-DATA } gateway ikeg { ike-policy ikep; address 172.27.201.5; external-interface fe-0/0/5.0; } } ipsec { policy ipsecp { proposal-set standard; } vpn vpn1 { bind-interface st0.0; ike { gateway ikeg; ipsec-policy ipsecp; } establish-tunnels immediately; } } zones { security-zone mgmt { host-inbound-traffic { system-services { all; } protocols { all; } } interfaces { fe-0/0/5.0; } } } }
interfaces { fe-0/0/5 { unit 0 { family inet { address 172.27.201.5/24; } } } } protocols { bgp { group g1 { type external; peer-as 1001; local-as 1002; neighbor 172.27.201.4; } } ospf { area 0.0.0.0 { interface fe-0/0/5.0; } } } security { ike { policy ikep { mode main; proposal-set standard; pre-shared-key ascii-text "$9$.fQ3ApBSrv69rvWLVb.P5Q69tuORcy"; ## SECRET-DATA } gateway ikeg { ike-policy ikep; address 172.27.201.4; external-interface fe-0/0/5.0; } } ipsec { policy ipsecp { proposal-set standard; } vpn vpn1 { bind-interface st0.0; ike { gateway ikeg; ipsec-policy ipsecp; } establish-tunnels immediately; } } zones { security-zone mgmt { host-inbound-traffic { system-services { snmp; ping; http; https; ftp; ssh; } } interfaces { fe-0/0/5.0; } } } }
From 100-2 configuration, OSPF, BGP and IKE are not configured as host-inbound-traffic, thus OSPF, BGP and IKE traffic will not be allowed to be inbound to 100-2. However, OSPF, BGP and IKE traffic initiate from 100-2 will not be affected by the mentioned configuration. Once the traffic has been initiated, a session will be formed on 100-2. Traffic which is sent in reply to this traffic flow will match this session, and thus be accepted, resulting in negotiation being successful.
If the VPN tunnel is clear and then restarted, ipsec-key-management on 100-1 VPN will not come up:
[edit] root@100-1# run clear security ipsec security-associations [edit] root@100-1# run clear security ike security-associations [edit] root@100-1# run show security ipsec security-associations Total active tunnels: 0 [edit] root@100-1# run show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 4907989 DOWN 655db9fa8ad70a72 0000000000000000 Main 172.27.201.5
But if the same restart is performed on 100-2:
[edit] root@100-2# ...session protocol udp destination-port 500 Total sessions: 0 [edit] root@100-2# run restart ipsec-key-management run showIPSec Key Management daemon started, pid 3977 [edit] root@100-2# run show security ike security-associations Index State Initiator cookie Responder cookie Mode Remote Address 1913866 UP 0fedf70688766ad5 abbf4a38e0cc8191 Main 172.27.201.4 [edit] root@100-2# run show security ipsec security-associations Total active tunnels: 1 ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway <131073 ESP:3des/sha1 311b00cd 3598/ unlim - root 500 172.27.201.4 >131073 ESP:3des/sha1 950e870b 3598/ unlim - root 500 172.27.201.4 [edit] root@100-2# ...w security flow session protocol udp destination-port 500 Session ID: 3809, Policy name: self-traffic-policy/1, Timeout: 50, Valid In: 172.27.201.5/500 --> 172.27.201.4/500;udp, If: .local..0, Pkts: 5, Bytes: 1192 Out: 172.27.201.4/500 --> 172.27.201.5/500;udp, If: fe-0/0/5.0, Pkts: 4, Bytes: 976 Total sessions: 1
Note : UDP 500 session was not there earlier, but after restart it is present. The same goes for other traffic as well, i.e., BGP, OSPF.
This is expected and working correctly, as host-inbound-traffic configuration will guard ingress traffic according to the system service/protocol configured. Self initiated traffic is permitted to send out by default.