Description

This article explains which TCP/UDP ports are used for ICCP and provide sample filter terms for ICCP, which can be used when configuring an allowlist filter for lo0 or management interface.

Symptoms

In some networks, devices have an allowlist filter to protect their control plane and the filter is applied to lo0 or management interface (example: fxp0/me0/vme/em0) in Junos.

To make an allowlist filter, you must know which TCP/UDP ports are used for each control plane protocols. However, Junos does not provide any CLI commands to show which TCP/UDP ports are used for ICCP protocol.

Solution

In many cases, users apply allowlist filters to their devices to protect the control plane. To create the filter, it is necessary to know which TCP/UDP ports are used for ICCP.

According to the source code and Understanding Distributed BFD for Junos 15.1:

  • ICCP Session: TCP 33012
  • Multihop BFD: UDP 4784
  • BLD (Backup Liveness Detection): UDP 50015

If you are using a allowlist filter for the control plane and MCLAG (ICCP) together, add the following filter terms to the lo0 interface filter or management interface filter:
Note: source-address/destination-address for each term are options according to your security level

For ICCP communication initiated by peer device
set firewall family inet filter Lo0_Filter term ICCP-IN from protocol tcp
set firewall family inet filter Lo0_Filter term ICCP-IN from destination-port 33012
set firewall family inet filter Lo0_Filter term ICCP-IN then accept

For ICCP communication initiated by the device itself
 

set firewall family inet filter Lo0_Filter term ICCP-OUT from protocol tcp

set firewall family inet filter Lo0_Filter term ICCP-OUT from source-port 33012

set firewall family inet filter Lo0_Filter term ICCP-OUT then accept

  


For ICCP keepalive
set firewall family inet filter Lo0_Filter term MHBFD from source-prefix-list pl-ICCP-PEER
set firewall family inet filter Lo0_Filter term MHBFD from protocol udp
set firewall family inet filter Lo0_Filter term MHBFD from destination-port 4784
set firewall family inet filter Lo0_Filter term MHBFD then accept

For Backup Liveness Detection
set firewall family inet filter Lo0_Filter term ICCP-BLD from protocol udp
set firewall family inet filter Lo0_Filter term ICCP-BLD from source-port 50015
set firewall family inet filter Lo0_Filter term ICCP-BLD from destination-port 50015
set firewall family inet filter Lo0_Filter term ICCP-BLD then accept


* If configuring BLD through management interface (example: vme/em0/fxp0), which is strongly recommended, there is no need to configure the term ‘ICCP-BLD’ for lo0, but it must be configured on management interface filter if it also has an allowlist filter.

Modification History

2020-09-22: Minor, non-technical edit.

Related Information