> Intermittent ssh disconnections to SRX for all users. (However fxp0 IP of the SRX is pingable at all times)> Intermittent CPU spikes with the user consuming most of the CPU( idle percentage going below 30 %)
There can be several symptoms of high RE CPU like bgp flaps, unexpected reboots etc.>show log messages
Aug 3 15:37:32 SRX-LAB sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '167.X.Y.Z'
Aug 3 15:37:32 SRX-LAB sshd[81915]: Failed password for root from 167.X.Y.Z port 56434 ssh2
Aug 3 15:37:32 SRX-LAB sshd[81916]: Received disconnect from 167.X.Y.Zport 56434:11: Bye Bye
Aug 3 15:37:32 SRX-LAB sshd[81915]: Received disconnect from 167.X.Y.Z port 56434:11: Bye Bye [preauth]
Aug 3 15:37:32 SRX-LAB sshd[81915]: Disconnected from authenticating user root 167.X.Y.Z port 56434 [preauth]
Aug 3 15:37:32 SRX-LAB inetd[1980]: /usr/sbin/sshd[81915]: exited, status 123
Aug 3 15:38:50 SRX-LAB sshd: PAM_TACPLUS_SEND_AUTHEN_FAIL: Failed in sending authentication with error connect: Connection refused.
Ssh connection is to-the-box traffic for SRX (like FTP, BGP, telnet), and as such impact on RE CPU can cause issues with respect to these protocols. Below are a few steps that can be checked on SRX to prevent/mitigate such issues.
> Firewall filter on the loopback interface of the SRX should be configured correctly. (JTAC suggests blocking all the ports except the ones which are being used(eg: ports for bgp, or shh, telnet, FTP etc). The Loopback filter will be checked for all types of to-the-box traffic and hence traffic for all the ports (which are not exclusively allowed will be blocked by the default implicit term)
> Attackers can use dest port 830 (netconf-ssh) to exploit the firewall with random IP and ports. If not using this, it is better to block.
> It is a good practice to configure a device mgmt prefix-list that will have IP addresses that are trusted and only allow them access to the firewall (on ports ssh, telnet, netconf-ssh)
> Even a high sampling rate (like 100) may cause high re or high pfe issues. Please check that too.
Introducing the below commands in the already configured loopback filter can help us to mitigate unwanted connection attacks from the internet.
set firewall family inet filter <any name> term terminal_access_denied from destination-port telnet
set firewall family inet filter <any name> term terminal_access_denied from destination-port ssh
set firewall family inet filter <any name> term terminal_access_denied from destination-port 830
Article for - Restrict Mgmt access to specific IP address (as mentioned in point no. 3)
https://supportportal.juniper.net/s/article/J-Series-SRX-How-to-restrict-management-access-to-specific-IP-addresses-in-Junos