The article explains the purpose of JSRV.1 interface using the public ip address of 128.0.x.x that are accessible from the world and to restrict attempts to brute force the router from these source ip ranges.
JSRV, which stands for Juniper Services Interface, is essential for the Captive Portal service on the EX/MX platform and is introduced by DOT1x (Port-Based Network Access Control).
This interface is a unique IFD associated with the "__juniper_services__.inet" routing table. 128.0.0.127/2 IP address is used by Juniper interface of jsrv.1
128.0.0.x (x can be 1,2,4,5,16,17,18 etc) series is used for internal communication for backplane management (TTP over IP)
labroot@MX-RE0> show interfaces extensive jsrv.1
Logical interface jsrv.1 (Index 329) (SNMP ifIndex 502) (Generation 138)
Flags: Up 0x24004000 Encapsulation: unknown
Bandwidth: 1Gbps
Routing Instance: None Bridging Domain: None
Traffic statistics:
Input bytes : 0
Output bytes : 0
Input packets: 0
Output packets: 0
Local statistics:
Transit statistics:
Input bytes : 0 0 bps
Output bytes : 0 0 bps
Input packets: 0 0 pps
Output packets: 0 0 pps
Protocol inet, MTU: 1514
Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0
Generation: 165, Route table: 7
Flags: Is-Primary
Addresses, Flags: Primary Is-Default Is-Preferred Is-Primary
Destination: 128/2, Local: 128.0.0.127, Broadcast: 191.255.255.255, Generation: 815
128.0.x.x are public ip address that are accessible from the world and allowing the range of 128.0.0.0/16 could attempts to brute force my router from these source ip ranges.
Some IPs can send high traffic from source such as 128.0.173.201 and 128.0.138.231 in this above cases as one of the IP address from /16 range
Below you can see the output of the "show route" :
The Sources are learn via default route from internet -- > 109.226.1.1 and 109.226.1.3 are Core routers that connected to upstream providers
show route 128.0.173.201 table inet
inet.0: 13345 destinations, 23402 routes (13338 active, 0 holddown, 13 hidden)
Restart Complete
+ = Active Route, - = Last Active, * = Both
0.0.0.0/0 *[BGP/170] 6d 20:18:25, localpref 301, from 109.226.1.3
AS path: 6762 I, validation-state: unverified
> to 109.226.0.97 via ae8.14
[BGP/170] 6d 20:27:29, localpref 300, from 109.226.1.1
AS path: 3491 I, validation-state: unverified
> to 109.226.0.98 via ae8.14
show route 128.0.138.231 table inet
inet.0: 13344 destinations, 23399 routes (13336 active, 1 holddown, 13 hidden)
0.0.0.0/0 *[BGP/170] 6d 20:19:07, localpref 301, from 109.226.1.3
[BGP/170] 6d 20:28:11, localpref 300, from 109.226.1.1
Packets utilizing these IP addresses may leak configuration information such as heartbeats, kernel versions, etc. out to the Internet, leading to an information exposure vulnerability.
You can follow the below to block the access to the 128.0.0.x (x can be 1,2,4,5,16,17,18 etc) series of IPs
Configure a firewall filter to discard packets sourced from the internal network.
" Blocking *conventional* protocols should not have impact on internal communication " for the jsrv interface
Check for the pcap file for the host " 128.0.138.231 and 128.0.173.201 " during time when there is high packet being received
monitor traffic interface aeX.XX no-resolve matching "host 128.0.138.231"
monitor traffic interface aeX.XX no-resolve matching "host 128.0.138.231" write-file /var/tmp/JSRV.pcap
monitor traffic interface aeX.XX no-resolve matching "host 128.0.173.201"
monitor traffic interface aeX.XX no-resolve matching " host 128.0.173.201 " write-file /var/tmp/JSRV.pcap
Filter :
set firewall family inet filter RE_PROTECT term traffic from address 128.X.X.X
set firewall family inet filter RE_PROTECT term traffic from protocol <>
set firewall family inet filter RE_PROTECT term traffic from source-port <>
set firewall family inet filter RE_PROTECT term traffic then count packets
set firewall family inet filter RE_PROTECT term traffic then syslog
set firewall family inet filter RE_PROTECT term traffic then discard
Disabling the net.transit_re sysctl flag will also cause management traffic forwarded to the PFE ports to be dropped:
% sysctl -w net.transit_re=0
Note that sysctl flags do not survive a reboot.
Ref case - 2024-0911-256873