Description

This article describes the difference in behavior of firewall filter applied on loopback interface on Junos OS and Junos EVO platform.

Symptoms

In customer setup, the SNMP server is reachable via management interface. Customer configured the below firewall filter on QFX5220 [EVO] to block snmp traffic and applied the same to the loopback interface. But still the snmp traffic was passing through.

 

admin@qfx5220# run show configuration firewall | display set
set firewall family inet filter IPV4_PROTECT_RE term accept_ssh from protocol tcp
set firewall family inet filter IPV4_PROTECT_RE term accept_ssh from destination-port ssh
set firewall family inet filter IPV4_PROTECT_RE term accept_ssh then log
set firewall family inet filter IPV4_PROTECT_RE term accept_ssh then accept
set firewall family inet filter IPV4_PROTECT_RE term reject_bgp from protocol tcp
set firewall family inet filter IPV4_PROTECT_RE term reject_bgp from destination-port 179
set firewall family inet filter IPV4_PROTECT_RE term reject_bgp then count reject_bgp_acl
set firewall family inet filter IPV4_PROTECT_RE term reject_bgp then discard
set firewall family inet filter IPV4_PROTECT_RE term reject_snmp from protocol udp
set firewall family inet filter IPV4_PROTECT_RE term reject_snmp from destination-port 161
set firewall family inet filter IPV4_PROTECT_RE term reject_snmp then count reject_snmp_acl
set firewall family inet filter IPV4_PROTECT_RE term reject_snmp then log
set firewall family inet filter IPV4_PROTECT_RE term reject_snmp then discard

 

The same was tested on QFX5200 and the firewall filter is blocking SNMP traffic via management interface as expected.

Solution

It is an expected behavior with EVO platforms. In order to block traffic via management interface, the firewall filter to be applied to management interface.

Kindly refer below document:
 How Junos OS Evolved Differs from Junos OS | Junos OS Evolved | Juniper Networks
 

On Junos OS: Firewall filters applied to the loopback interface apply to both network control traffic and management traffic. [Hence, it was working fine on QFX5200 running Junos OS].

On Junos EVO: Firewall filters applied to the loopback interface apply only to network control traffic. You must explicitly apply firewall filters to the management interface to filter management traffic.

On EVO platforms, we need to configure the firewall filter on both loopback interface and management interface for applying filter to network control traffic and management traffic respectively.

set interfaces re0:mgmt-0.0 family inet filter input IPV4_PROTECT_RE
set interfaces lo0.0 family inet filter input IPV4_PROTECT_RE
 

Once the firewall filter was applied to management interface, SNMP traffic via management interface was blocked as expected.

Modification History

2023-11-06 : Article Created
2023-11-07: minor modification