Description

The article explains the purpose of JSRV.1 interface using the public ip address of 128.0.x.x that are accessible from the world and to restrict attempts to brute force the router from these source ip ranges.

Symptoms

JSRV, which stands for Juniper Services Interface, is essential for the Captive Portal service on the EX/MX platform and is introduced by DOT1x (Port-Based Network Access Control).

This interface is a unique IFD associated with the "__juniper_services__.inet" routing table. 128.0.0.127/2 IP address is used by Juniper interface of jsrv.1

128.0.0.x (x can be 1,2,4,5,16,17,18 etc) series is used for internal communication for backplane management (TTP over IP) 

 

labroot@MX-RE0> show interfaces extensive jsrv.1

Logical interface jsrv.1 (Index 329) (SNMP ifIndex 502) (Generation 138)

Flags: Up 0x24004000 Encapsulation: unknown

Bandwidth: 1Gbps

Routing Instance: None Bridging Domain: None

Traffic statistics:

Input bytes :                   0

Output bytes :                  0

Input packets:                  0

Output packets:                 0

Local statistics:

Input bytes :                   0

Output bytes :                  0

Input packets:                  0

Output packets:                 0

Transit statistics:

Input bytes :                   0                   0 bps

Output bytes :                  0                   0 bps

Input packets:                  0                   0 pps

Output packets:                 0                   0 pps

Protocol inet, MTU: 1514

Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0

Generation: 165, Route table: 7

   Flags: Is-Primary

   Addresses, Flags: Primary Is-Default Is-Preferred Is-Primary

   Destination: 128/2, Local: 128.0.0.127, Broadcast: 191.255.255.255, Generation: 815

 

128.0.x.x are public ip address that are accessible from the world and allowing the range of 128.0.0.0/16 could attempts to brute force my router from these source ip ranges.

Some IPs can send high traffic from source such as 128.0.173.201 and 128.0.138.231 in this above cases as one of the IP address from /16 range

Below you can see the output of the "show route" :

 

The Sources are learn via default route from internet -- > 109.226.1.1 and 109.226.1.3 are Core routers that connected to upstream providers

 

show route 128.0.173.201 table inet

 

inet.0: 13345 destinations, 23402 routes (13338 active, 0 holddown, 13 hidden)

Restart Complete

+ = Active Route, - = Last Active, * = Both

 

0.0.0.0/0         *[BGP/170] 6d 20:18:25, localpref 301, from 109.226.1.3

                     AS path: 6762 I, validation-state: unverified

                   > to 109.226.0.97 via ae8.14

                   [BGP/170] 6d 20:27:29, localpref 300, from 109.226.1.1

                     AS path: 3491 I, validation-state: unverified

                   > to 109.226.0.98 via ae8.14

 

 

show route 128.0.138.231 table inet

 

inet.0: 13344 destinations, 23399 routes (13336 active, 1 holddown, 13 hidden)

Restart Complete

+ = Active Route, - = Last Active, * = Both

 

0.0.0.0/0         *[BGP/170] 6d 20:19:07, localpref 301, from 109.226.1.3

                     AS path: 6762 I, validation-state: unverified

                   > to 109.226.0.97 via ae8.14

                   [BGP/170] 6d 20:28:11, localpref 300, from 109.226.1.1

                     AS path: 3491 I, validation-state: unverified

                   > to 109.226.0.98 via ae8.14

 

Packets utilizing these IP addresses may leak configuration information such as heartbeats, kernel versions, etc. out to the Internet, leading to an information exposure vulnerability.

 

Solution

You can follow the below to block the access to the 128.0.0.x (x can be 1,2,4,5,16,17,18 etc) series of IPs

Configure a firewall filter to discard packets sourced from the internal network.

 

" Blocking *conventional* protocols should not have impact on internal communication " for the jsrv interface

 

Check for the pcap file for the host " 128.0.138.231 and 128.0.173.201 " during time when there is high packet being received

 

monitor traffic interface aeX.XX no-resolve matching "host 128.0.138.231"

monitor traffic interface aeX.XX no-resolve matching "host 128.0.138.231" write-file /var/tmp/JSRV.pcap

 

monitor traffic interface aeX.XX no-resolve matching "host 128.0.173.201"

monitor traffic interface aeX.XX no-resolve matching " host 128.0.173.201 " write-file /var/tmp/JSRV.pcap

 

Filter :

 

     set firewall family inet filter RE_PROTECT term traffic from address 128.X.X.X

     set firewall family inet filter RE_PROTECT term traffic from protocol <>

     set firewall family inet filter RE_PROTECT term traffic from source-port <>

     set firewall family inet filter RE_PROTECT term traffic then count packets

     set firewall family inet filter RE_PROTECT term traffic then syslog

     set firewall family inet filter RE_PROTECT term traffic then discard

 

Disabling the net.transit_re sysctl flag will also cause management traffic forwarded to the PFE ports to be dropped:

 

% sysctl -w net.transit_re=0

 

Note that sysctl flags do not survive a reboot.

 

 

Modification History

2024-10-16 : Article Created

Related Information

Ref case - 2024-0911-256873