Building blocks to improve Security for SRX devices.

• Check the juniper web page for the latest recommend JunOS version and install it
• Physical security - disable unused ports and features
• Network security - use Out-Of-Band interfaces only for management traffic, globally disable ICMP redirects, drop packets with SYN and FIN flag combination, disable ICMP timestamp & record route requests, disable ICMP source quench, configure LLDP only on required network ports.
• User authentication security - password complexity password(min password lenght, upper, lower and special character), root account should be protected with a strong password, password changes every 6 months, configure login classes to support different access levels( restrict commands by job function, idle timeout value for all login classes), limit access to ##SECRET-DATA, set authentication-order to meet your login security policy.
• Management services security - configure NTP authentication with more then one trusted server, confgure SNMP using the most secure method with more then one trusted server, configure read-only access, user write only when required, configure automated secure configuration backup to more then one trusted server.
• Access security - configure a warning banner, displayed prior to login, disable unnecessary access servies(telnet, J-Web, HTTP, etc), user ssh version 2. deny root-login, set connection-limit and rate-limit restriction, use HTTPS, limit access to only authorized interfaces, setup idle-time value.
• Routing Protocol security - configure routing protocol only for required interfaces,, configure route authentication with internal and external trusted sources.
• Firewall filter. - protect the routing engine using a default deny firewall filter, order terms with time sensitive protocols at the top, permit only required protocols from authrorized sources, rate-limit SYN packets to protect against SYN flood, rate-limit authrorized protocols using policers, ensure the last term, default-deny, includes the syslog option.