SNMP V3 authentication for device EX4300-MP was failing on Paessler tool due to incorrect Firewall filters

• Configured a firewall filter to see if traffic hitting on the switch egress interface or not:- 

root@s1#set firewall family inet filter protect-re term accept-snmp then count counter_not_working
root@s1#set firewall family inet filter protect-re term accept-snmp then accept

• In the above output, we can see that there is no increment in the Firewall counter. 

• Sample config with wrong placement of reject Term:- 

firewall {

  family inet {

    filter protect-re {

      term synflood-protect {

        from {

          protocol tcp;

          tcp-flags "(syn &! ack) | fin | rst";

        }

        then {

          policer tcp-conn-policer;

          accept;

    }

      term accept-icmp {

        from {

          protocol icmp;

          icmp-type [ echo-reply echo-request time-exceeded unreachable source-quench router-advertisement parameter-problem ];

        }

        then {

          policer management-5m;

          accept;

        }

         term accept-ssh {

        from {

          destination-prefix-list {

            router-ipv4;

          }

          protocol tcp;

             port ssh;

        }

        then {

          policer management-5m;

          accept;

        }

      }  

      }

      term reject-all { <<<<<<<<<<<<<<< Wrong Placement of Reject term due to which next terms are not checked

        then {

          reject;

        }

      }

      term accept-snmp { <<<<<<<<<<<<<<< SNMP filter to allow connections from specific source.

        from {

          destination-prefix-list {

            router-ipv4;

          }

          protocol udp;

          destination-port snmp;

        }

        then {

          policer management-5m;

          accept;

        }

      }

    }

• Issue can be fixed with the correct placement of firewall filter:-

}

      term accept-snmp {                 <<<<<<<<<<<<<<< Correct Placement of SNMP terms to allow the connections

        from {

          destination-prefix-list {

            router-ipv4;

          }

          protocol udp;

          destination-port snmp;

        }

        then {

          policer management-5m;

          accept;

  }

      term reject-all {    <<<<<<<<<<<<<<< Correct Placement of Reject term to implicit deny every other non matching traffic

        then {

          reject;

        }

      }

        }

      }

• After correct placement of the reject term, SNMP polling issue was resolved and the counters started incrementing as shown above. 

2024-11-25 : Article Created

2024-11-26 : Article validated

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/task/firewall-filter-qfx-series-cli.html