Create ACL to limit access to management of a device.

• Applying the firewall filter to restrict the traffic on either lo0 or vme interface.
• Missing lines of configuration in below link for firewall filter:

Example: Control Management Access on Juniper Networking Devices | Junos OS | Juniper Networks

• Misconfiguration of firewall filter as below configuration line will not apply the configuration as expected.

set firewall filter limit-mgmt-access term block_non_manager from source-address 0.0.0.0/0
set firewall filter limit-mgmt-access term block_non_manager from source-prefix-list manager-ip except
set firewall filter limit-mgmt-access term block_non_manager from protocol tcp
set firewall filter limit-mgmt-access term block_non_manager from destination-port ssh
set firewall filter limit-mgmt-access term block_non_manager from destination-port telnet
set firewall filter limit-mgmt-access term block_non_manager then log
set firewall filter limit-mgmt-access term block_non_manager then discard
set firewall filter limit-mgmt-access term accept_everything_else then accept

• When applying a firewall filter the configuration need to be applied with either family inet filter (L3-filter) or family ethernet-switching filter(layer2-filter).
• Need to apply the configuration as below:

set firewall family inet filter limit-mgmt-access term ssh_allowed from source-prefix-list manager-ip except

set firewall family inet filter limit-mgmt-access term ssh_allowed from protocol tcp

set firewall family inet filter limit-mgmt-access term ssh_allowed from destination-port ssh

set firewall family inet filter limit-mgmt-access term ssh_allowed from destination-port telnet

set firewall family inet filter limit-mgmt-access term ssh_allowed from destination-port http

set firewall family inet filter limit-mgmt-access term ssh_allowed from destination-port https

set firewall family inet filter limit-mgmt-access term ssh_allowed then log

set firewall family inet filter limit-mgmt-access term ssh_allowed then accept

set firewall family inet filter limit-mgmt-access term icmp_allowed from protocol icmp

set firewall family inet filter limit-mgmt-access term icmp_allowed then accept

set firewall family inet filter limit-mgmt-access term radius_allowed from source-prefix-list radius-ip

set firewall family inet filter limit-mgmt-access term radius_allowed from protocol udp

set firewall family inet filter limit-mgmt-access term radius_allowed from source-port 1812

set firewall family inet filter limit-mgmt-access term radius_allowed from source-port 1645

set firewall family inet filter limit-mgmt-access term radius_allowed then accept

set firewall family inet filter limit-mgmt-access term other_than_discard then discard