Description

SSH firewall filters not working when applied on IRB interface.

Symptoms

.Device was managed via irb interface IP.
.Correct firewall filter configuration.
.Check whether applied filter is active via "show firewall filter <filter name>"

Solution

In this scenario, the device is managed via an IRB (Integrated Routing and Bridging) interface. When an SSH-restricting firewall filter is applied to the logical interface (IRB), it will effectively block SSH access for users for the specific VLAN or subnet. However, this approach may not restrict SSH access requests originating from other VLANs or subnets.

 

To ensure comprehensive SSH access control, it is recommended to apply the firewall filter on the loopback (lo0) interface, similar to the Protect-RE implementation.

 

Filter over IRB interface:

set interface irb unit 255 family inet filter input SSH    >> When we apply filter over irb, it block the users only on that specific vlan

Filter over Loopback interface:

set interface lo0 unit 0 family inet filter input SSH

Firewall filter: 

set firewall family inet filter SSH term allow-mgmt from source-prefix-list mgmt-access
set firewall family inet filter SSH term allow-mgmt from destination-port ssh
set firewall family inet filter SSH term allow-mgmt from destination-port telnet
set firewall family inet filter SSH term allow-mgmt then accept
set firewall family inet filter SSH term deny-restricted-tcp from source-address 0.0.0.0/0
set firewall family inet filter SSH term deny-restricted-tcp from destination-port ssh
set firewall family inet filter SSH term deny-restricted-tcp from destination-port telnet
set firewall family inet filter SSH term deny-restricted-tcp then discard
set firewall family inet filter SSH term allow-rest then accept

 

Note: SSH traffic is classified as Routing Engine (RE) traffic, meaning it is best controlled at the loopback interface level for optimal security and access management.

Modification History

2025-02-20: Article visibility modified

2025-02-10 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/concept/firewall-filter-loopback-interface-acx-series.html