Juniper Firewall Training
Table of Contents
Juniper Juniper Initial Initial Configura Configuration tion..................................................................................................... ............................................................................................................... .......... 3 Destinati Destination on NAT (one to many) ................................................................... ......................................................................................................... ...................................... 9 Static Static NAT (one to one) ................................................................................................................... 11 Source Source NAT using IP pool............................................................................. ................................................................................................................. .................................... 14 Source Source NAT using Interface Interface IP .......................................................................................................... .......................................................................................................... 18 Security Security Policy Policy ................................................................................................................................. 21 Chassis Chassis cluster cluster Active/P Active/Passiv assive e .......................................................................................................... 22
Juniper Initial Configuration 1. Initial konsol Login Yang pertama kali di lakukan dalam mengkonfigurasi router Juniper adalah login sebagai user “root ” tanpa menggunakan password. Ketika masuk ke dalam device sebagai user root maka user akan berada dalam shell prompt yang di tandai dengan karakter “%”, JUNOS software command-line (CLI) harus di lakukan secara manual seperti contoh di bawah ini:
login: root Password: --- JUNOS 9.6R1.13 built 2009-08-01 09:02:46 UTC root@% cli root> Karakter “>” menandakan bahwa user berada dalam operational mode dan untuk kembali ke shell prompt format dapat mengikuti contoh di bawah ini: root> start shell root@%
2. Konfigurasi Out of Band (OoB) Manajemen Network Untuk dapat mengakses router Juniper secara remote maka interface management atau fxp0 dan telnet/ssh service perlu di aktifkan, lihat contoh di bawah ini:
root> configure [edit] root# [edit] root# set system host-name LAB [edit] root# set interfaces fxp0 unit 0 family inet address 192.168.1.1/24 [edit] root# set system services telnet [edit] root# set system services ssh
pada contoh di atas, tidak lupa untuk memberi nama yang unik untuk setiap perangkat atau hostname. Agar dapat melakukan perubahan/penambahan konfigurasi maka user harus berada dalam konfigurasi mode mode yang di tandai dengan karakter ”#” dengan mengetik perintah configure di mode oprational.
3. Membuat User Account User
Pasword
Class/Permission
Root
Root123
Superuser
Lab
Lab123
Superuser
Ops
Operator
Can view standard show
Juniper memiliki user default yaitu root,
[edit] root@LAB# set system root-authentication root-authentication plain-text-password New password: Retype new password: Perintah di bawah ini, membuat user lab dengan class/permission class/permission superuser: [edit] root@LAB# set system login user lab class super-user authentication plain-text-password New password: Retype new password:
Sekarang kita akan membuat sebuah user dengan authorisasi yang terbatas misal user hanya boleh melakukan perintah show.
root@LAB# set system login class ops permissions view [edit] root@LAB# set system login user ops class ops authentication aut hentication plain-text-password plain-text-password New password: Retype new password: Untuk memastikan bahwa user ops hanya memiliki keterbatasan keterbatasan permission, maka kita h arus login sebagai user ops dan melakukan verifikasi: verifikasi:
ops@LAB> ? Possible completions: completions: file fil e Perform file operations operatio ns help Provide help information op Invoke an operation script quit Exit the management session request Make system-level requests set Set CLI properties, properti es, date/time, craft interface interf ace message show Show system information start Start shell test Perform diagnostic debugging debuggin g ops@LAB> configure ^ unknown command. ops@LAB>
Case study
Intial sistem konfigurasi
Beri masing-masing router dengan hostname rn dimana n merupakan nomor dari router Konfigurasi Konfigurasi interface fxp0 sesuai d engan tabel 1.1. Buat user account dan permission berdasarkan tabel 1.2. Setiap device dapat di remote melalui p ort 23 dan 24
Hostname
Ipaddress
R1
192.168.x.1/24
R2
192.168.x.1/24
R3
192.168.x.1/24
R4
192.168.x.1/24
R5
192.168.x.1/24
R6
192.168.x.1/24
R7
192.168.x.1/24
R8
192.168.x.1/24
R9
192.168.x.1/24
R10
192.168.x.1/24
R11
192.168.x.1/24
Tabel 1.1
User
Pasword
Class/Permission
Root
Root123
Superuser
student
Student123
Superuser
noc
Operator Operat or
Ping only
Tabel 1.2
Appendix A Step by step initial configuration No
Activities
1
- Login : root - Password : Blank (no password)
2
Start the CLI - Type following command
Root%cli root@> 3
Enter the configuration mode - Type following command
root@> configure root@# set system host-name
4
Create management console account - Type following command
root@# root@# set system login user root authentication plain-text-password new password: retype new password: 5
Configure Configu re the IP address and netmask for the router’s management interfaces interface s - Type following command
6
Commit the the configurati on to activate it on the router
root@# set interface fxp0 unit 0 family inet address
- Type following command
root@# root@# commit 7
Finished configuration the router. Exit configuration configuration - Type following command
root@#exit root@>exit
Case study answer
Konfigurasi anda akan mirip seperti contoh di bawah ini
## Last changed: 2011-10-05 20:51:40 WIT version 8.5R1.14; system { host-name r1; time-zone Asia/Jakarta; root-authentication root-authentication { encrypted-password encrypted-password "$1$o/4g69VL$ZPuY5HNg8B5fNUHfBqb/ "$1$o/4g69VL$ZPuY5HNg8B5fNUHfBqb/u."; u."; ## SECRET-DATA SECRET-DATA } login { class noc { permissions network; } user student { uid 2037; class super-user; authentication authentication { encrypted-password encrypted-password "$1$uKqtUVie$YMuJaaoHJxFJg1Jvoc5.p1"; "$1$uKqtUVie$YMuJaaoHJxFJg1Jvoc5.p1"; ## SECRET-DATA SECRET-DATA } } user noc { uid 2038; class noc; authentication authentication { encrypted-password encrypted-password "$1$03ax6dsu$mz/Nff6Zkt0gmjuPonL "$1$03ax6dsu$mz/Nff6Zkt0gmjuPonLxY/"; xY/"; ## SECRET-DATA SECRET-DATA } } services { ssh; telnet; } syslog { user * { any emergency; } file messages { any notice; authorization info; } file interactive-commands { interactive-commands interactive-commands any; } } } fxp0 { unit 0 { family inet { address 192.168.1.1/24; }
} }
Destination NAT (one to many)
Hanya satu IP destination yang akan digunakan, h asil translasi IP destination lebih dari satu. Dari host internet melakukan telnet ke 202.72.223.136 port 1, d itranslasikan ke telnet vr1 Dari host internet melakukan telnet ke 202.72.223.136 port 2, ditranslasikan ke telnet vr2 dan seterusnya
Buat Zone di SRX (zone untrust dan vr2-trust) set security zones security-zone untrust interfaces ge-1/1/15.0 host-inbound-traffic systemsystemservices all set security zones security-zone vr1-trust interfaces ge-1/1/8.1 host-inbound-traffic systemsystemservices all Buat address book di zone vr1-trust vr1-trust set security zones security-zone vr1-trust address-book address addr-vr1 192.168.201.0/24
Buat pool destination nat beserta rulenya set security nat destination pool vr1-pool address 192.168.201.2/32 set security nat destination pool vr1-pool address port 23 et security nat destination d estination rule-set rs-vr-trust from zone untrust set security nat destination rule-set rs-vr-trust rule vr1-trust match destination-address destination-address 202.72.223.136/32 set security nat destination rule-set rs-vr-trust rule vr1-trust match destination-port 1 set security nat destination rule-set rs-vr-trust rule vr1-trust then destination-nat pool vr1-pool
Buat proxy arp sebagai resolution IP d alam interface interface untrust set security nat proxy-arp interface i nterface ge-1/1/15.0 address 202.72.223.136/32 to 202.72.223.137/32
Buat security policy untuk mendefinisikan rule dari session nya set security policies f rom-zone rom-zone untrust to-zone to-zone vr1-trust policy 1 match source-address source-address any set security policies f rom-zone rom-zone untrust to-zone to-zone vr1-trust policy 1 match destination-address destination-address addrvr1 set security policies from-zone untrust to-zone vr1-trust policy 1 match application any set security policies from-zone untrust to-zone vr1-trust policy 1 then permit
Verifikasi telnet dari host 202.72.223.133 ke 202.72.223.136 port 1 telnet 202.72.223.136 1 hit translation lab@srx5800# run show security nat destination rule vr1-trust
Destination Destinati on NAT rule: vr1-trust Rule-set: Rule-se t: rs-vr-trust Rule-Id :3 Rule position :1 From zone : untrust Destination addresses : 202.72.223.136 202.72.223 .136 - 202.72.223.136 202.72.223 .136 Action : vr1-pool Destination Destination port :1 Translation hits :3 flow session lab@srx5800# run show security flow fl ow session destination-port destination-port 1 Flow Sessions on FPC0 PIC0: Total sessions: 0
Flow Sessions on FPC0 PIC1: Session ID: 10020597, Policy name: 1/4, Timeout: 1720, Valid In: 202.72.223.133/51201 202.72.223.133/51201 --> 202.72.223.136/1;tcp, 202.72.223.136/1;tcp, If: I f: ge-1/1/15.0, Pkts: 42, Bytes: 2349 Out: 192.168.201.2/23 192.168.201.2/23 --> 202.72.223.133/51201;tcp, 202.72.223.133/51201;tcp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 32, Bytes: 1986 Total sessions: 1 total session lab> show security flow cp-session cp-session summary Valid sessions: 7 Pending sessions: 0 Invalidated sessions: 7 Sessions in other states: 0 Total sessions: 14 Maximum sessions: 2359296 Maximum inet6 sessions: 1179648
Static NAT (one to one)
Hanya satu IP destination yang akan digunakan, h asil translasi IP destination lebih dari satu. Dari host internet melakukan telnet/ping telnet/ping ke 202.72.223.136, ditranslasikan telnet/ping ke vr1 Dari host internet melakukan telnet/ping telnet/ping ke 202.72.223.137, ditranslasikan telnet/ping vr2
Buat Zone di SRX (zone untrust dan vr2-trust) set security zones security-zone untrust interfaces ge-1/1/15.0 host-inbound-traffic systemsystemservices all set security zones security-zone vr1-trust interfaces ge-1/1/8.1 host-inbound-traffic systemsystemservices all Buat address book di zone vr1-trust vr1-trust set security zones security-zone vr1-trust address-book address addr-vr1 192.168.201.0/24
Buat static nat beserta rulenya set security nat static rule-set rs-vr1-trust from zone untrust set security nat static rule-set rs-vr1-trust rule vr1-trust match destination-address 202.72.223.136/32 set security nat static rule-set rs-vr1-trust rule vr1-trust then static-nat prefix 192.168.201.2/32 192.168.201.2/32 Buat proxy arp sebagai resolution IP d alam interface interface untrust set security nat proxy-arp interface i nterface ge-1/1/15.0 address 202.72.223.136/32 to 202.72.223.137/32 buat security policy untuk mendefinisikan rule dari session nya set security policies f rom-zone rom-zone untrust to-zone to-zone vr1-trust policy 1 match source-address source-address any set security policies f rom-zone rom-zone untrust to-zone to-zone vr1-trust policy 1 match destination-address destination-address addrvr1 set security policies from-zone untrust to-zone vr1-trust policy 1 match application any set security policies from-zone untrust to-zone vr1-trust policy 1 then permit
Verifikasi telnet/ping dari host 202.72.223.133/host luar ke 202.72.223.136 telnet 202.72.223.136 202.72.223.136 ping 202.72.223.136 telnet/ping dari host 202.72.223.133/host luar ke 202.72.223.137 telnet 202.72.223.137 202.72.223.137 ping 202.72.223.137 Hit translation translation lab@srx5800# run show security nat static rule vr1-trust
Static NAT rule: vr1-trust Rule-set: rs-vr1-trust Rule-Id :1 Rule position :1 From zone : untrust Destination addresses : 202.72.223.136 202.72.223 .136 Host addresses : 192.168.201.2 Netmask : 32 Host routing-instance routing-in stance : N/A Translation hits : 526 flow session lab@srx5800# run show security flow fl ow session Flow Sessions on FPC0 PIC0:
Session ID: 10443, Policy name: 1/4, Timeout: 2, Valid In: 202.72.223.133/5 --> 202.72.223.136/48651;icmp, 202.72.223.136/48651;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, Bytes: 84 Out: 192.168.201.2/48651 192.168.201.2/48651 --> 202.72.223.133/5;icmp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 1, Bytes: 84 Total sessions: 1 Flow Sessions on FPC0 PIC1: Session ID: 10020734, Policy name: 1/4, Timeout: 2, Valid In: 202.72.223.133/6 --> 202.72.223.136/48651;icmp, 202.72.223.136/48651;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, Bytes: 84 Out: 192.168.201.2/48651 192.168.201.2/48651 --> 202.72.223.133/6;icmp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 1, Bytes: 84 Session ID: 10020735, Policy name: 1/4, Timeout: 2, Valid In: 202.72.223.133/7 --> 202.72.223.136/48651;icmp, 202.72.223.136/48651;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, Bytes: 84 Out: 192.168.201.2/48651 192.168.201.2/48651 --> 202.72.223.133/7;icmp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 1, Bytes: 84 Session ID: 10020736, Policy name: 1/4, Timeout: 4, Valid In: 202.72.223.133/8 --> 202.72.223.136/48651;icmp, 202.72.223.136/48651;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, Bytes: 84 Out: 192.168.201.2/48651 192.168.201.2/48651 --> 202.72.223.133/8;icmp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 1, Bytes: 84 Total sessions: 3
total session lab> show security flow cp-session cp-session summary Valid sessions: 7
Pending sessions: 0 Invalidated sessions: 7 Sessions in other states: 0 Total sessions: 14 Maximum sessions: 2359296 Maximum inet6 sessions: 1179648
Source NAT using IP pool
Setiap virtual router harus bisa ping ke internet (yahoo.com, (yahoo.com, google.com dll), dimana IP pool yang akan digunakan adalah 202.72.223.136 dan 202.72.223.137
Hapus konfigurasi security Delete security Buat virtual router VR1 dan pasang routing static default ke IP gatewaynya. set interfaces ge-1/1/9 vlan-tagging set interfaces ge-0/2/0 unit 1 vlan-id 1 family inet address 192.168.201.2/24 set routing-options static route 0.0.0.0/0 next-hop 192.168.201.1 Buat koneksi antara SRX5800 dan vr1 set interfaces ge-1/1/8 vlan-tagging set interfaces ge-1/1/8 unit 1 vlan-id 1 family inet address 192.168.201.1/24 Buat Zone di SRX (zone untrust dan vr2-trust) set security zones security-zone untrust interfaces ge-1/1/15.0 host-inbound-traffic systemsystemservices all set security zones security-zone vr1-trust interfaces ge-1/1/8.1 host-inbound-traffic systemsystemservices all Buat nat source Pool 136-137 set security nat source pool 136-137 address 202.72.223.136/32 to 202.72.223.137/32 202.72.223.137/32 Buat nat source rule match 192.168.201.0/24 192.168.201.0/24 dengan source-nat pool 136-137 set security nat source rule-set rs-vr1-trust from zone vr1-trust set security nat source rule-set rs-vr1-trust rs-vr1-trust to zone untrust set security nat source rule-set rs-vr1-trust rs-vr1-trust rule r-vr1-trust match source-address source-address 192.168.201.0/24 set security nat source rule-set rs-vr1-trust rs-vr1-trust rule r-vr1-trust then source-nat pool 136-137
Karena IP pool satu subnet dengan interface untrust maka IP pool harus dipasang sebagai IP proxyarp. set security nat proxy-arp interface i nterface ge-1/1/15.0 address 202.72.223.136/32 set security nat proxy-arp interface i nterface ge-1/1/15.0 address 202.72.223.137/32 Buat security policy antar zone vr1-trust dan untrust set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match source-address source-address any set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match destination-address destination-address any set security policies from-zone vr1-trust to-zone untrust policy 1 match application any set security policies from-zone vr1-trust to-zone untrust policy 1 then permit
Verifikasi: Ping dari SRX5800 ke vr1 lab# run ping 192.168.201.2 PING 192.168.201.2 (192.168.201.2): 56 data bytes 64 bytes from 192.168.201.2: icmp_seq=0 ttl=64 time=2.932 ms 64 bytes from 192.168.201.2: icmp_seq=1 ttl=64 time=1.660 ms ^C --- 192.168.201.2 ping statistics --2 packets transmitted, 2 packets received, 0% packet loss round-trip min/avg/max/stddev = 1.660/2.296/2.932/0.636 1.660/2.296/2.932/0.636 ms telnet dari SRX5800 ke vr1 lab# run telnet vr1 Verifikasi route di vr1 vr1@lab:vr1> show route
inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 0.0.0.0/0
*[Static/5] *[Static/5] 03:13:06 > to 192.168.201.1 via ge-0/2/0.1 192.168.201.0/24 *[Direct/0] 03:13:06 > via ge-0/2/0.1 192.168.201.2/32 *[Local/0] 03:13:06 Local via ge-0/2/0.1 Verifikasi ping vr1 ke internet vr1@lab:vr1> ping yahoo.com PING yahoo.com (67.195.160.76): 56 data bytes 64 bytes from 67.195.160.76: icmp_seq=0 ttl=44 time=335.267 ms ^C --- yahoo.com ping statistics --2 packets transmitted, 1 packets received, 50% packet loss round-trip min/avg/max/stddev = 335.267/335.267/335.267/0.000 335.267/335.267/335.267/0.000 ms
Verifikasi summary source nat lab@srx5800# run show security nat source summary Total pools: 1 Pool Address Routing PAT Total Name Range Instance Address 136-137 202.72.223.136-202.72.223.137 202.72.223.136-202.72.223.137 default yes 2
Total rules: 12 Rule name Rule set From To r-vr2-trust r-vr2-tr ust rs-vr2-trust vr2-trust untrust r-vr3-trust r-vr3-tr ust rs-vr3-trust vr3-trust untrust r-vr4-trust r-vr4-tr ust rs-vr4-trust vr4-trust untrust r-vr5-trust r-vr5-tr ust rs-vr5-trust vr5-trust untrust r-vr6-trust r-vr6-tr ust rs-vr6-trust vr6-trust untrust r-vr7-trust r-vr7-tr ust rs-vr7-trust vr7-trust untrust r-vr8-trust r-vr8-tr ust rs-vr8-trust vr8-trust untrust r-vr9-trust r-vr9-tr ust rs-vr9-trust vr9-trust untrust r-vr10-trust r-vr10-tr ust rs-vr10-trust rs-vr10-tr ust vr10-trust vr10-trus t untrust r-vr11-trust r-vr11-tr ust rs-vr11-trust rs-vr11-tr ust vr11-trust vr11-trus t untrust r-vr12-trust r-vr12-tr ust rs-vr12-trust rs-vr12-tr ust vr12-trust vr12-trus t untrust r-vr1-trust r-vr1-tr ust rs-vr1-trust vr1-trust untrust
Action 136-137 136-137 136-137 136-137 136-137 136-137 136-137 136-137 136-137 136-137 136-137 136-137
verifikasi translation hit per pool lab@srx5800# run show security nat source rule r-vr1-trust
source NAT rule: r-vr1-trust Rule-set: rs-vr1-trust rs-vr1-trust Rule-Id : 13 Rule position :1 From zone : vr1-trust To zone : untrust Match Source addresses : 192.168.201.0 192.168.201.0 - 192.168.201.255 Destination port :0 -0 Action : 136-137 Persistent NAT type : N/A Persistent Persistent NAT mapping type : address-port-mapping Inactivity timeout :0 Max session number :0 Translation hits : 236 Verifikasi flow session lab> show security fl ow session source-prefix 192.168.201/24 Flow Sessions on FPC0 PIC0:
Session ID: 3945, Policy name: name: 1/4, Timeout: 2, Valid In: 192.168.201.2/7 --> 98.137.149.56/37651;icmp, If: ge-1/1/8.1, Pkts: 1, Bytes: 84 Out: 98.137.149.56/37651 98.137.149.56/37651 --> 202.72.223.136/21197;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, 1 , Bytes: 84 Total sessions: 1 Flow Sessions on FPC0 PIC1:
Session ID: 10007793, Policy name: 1/4, Timeout: 2, Valid In: 192.168.201.2/6 --> 98.137.149.56/37651;icmp, If: ge-1/1/8.1, Pkts: 1, Bytes: 84 Out: 98.137.149.56/37651 98.137.149.56/37651 --> 202.72.223.137/16193;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, 1 , Bytes: 84 Session ID: 10007794, Policy name: self-traffic-policy/1, Timeout: Timeout: 4, Valid In: 192.168.201.2/7 192.168.201.2/7 --> 98.137.149.56/37651;icmp, If: .local..5, Pkts: 1, Bytes: 84 Out: 98.137.149.56/37651 98.137.149.56/37651 --> 192.168.201.2/7;icmp, If: ge-1/1/9.1, ge-1/1/9.1, Pkts: 1, Bytes: 84 Session ID: 10007795, Policy name: self-traffic-policy/1, Timeout: Timeout: 4, Valid In: 192.168.201.2/8 192.168.201.2/8 --> 98.137.149.56/37651;icmp, If: .local..5, Pkts: 1, Bytes: 84 Out: 98.137.149.56/37651 98.137.149.56/37651 --> 192.168.201.2/8;icmp, If: ge-1/1/9.1, ge-1/1/9.1, Pkts: 1, Bytes: 84 Session ID: 10007796, Policy name: 1/4, Timeout: 4, Valid In: 192.168.201.2/8 --> 98.137.149.56/37651;icmp, If: ge-1/1/8.1, Pkts: 1, Bytes: 84 Out: 98.137.149.56/37651 98.137.149.56/37651 --> 202.72.223.137/19964;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, 1 , Bytes: 84 Session ID: 10007797, Policy name: 1/4, Timeout: 60, Valid In: 192.168.201.2/9 --> 98.137.149.56/37651;icmp, If: ge-1/1/8.1, Pkts: 1, Bytes: 84 Out: 98.137.149.56/37651 98.137.149.56/37651 --> 202.72.223.136/29099;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 0, 0 , Bytes: 0 Total sessions: 5 Tampilan total session lab> show security flow cp-session cp-session summary Valid sessions: 7 Pending sessions: 0 Invalidated sessions: 7 Sessions in other states: 0 Total sessions: 14 Maximum sessions: 2359296 Maximum inet6 sessions: 1179648
Source NAT using Interface IP
Setiap virtual router harus bisa ping ke internet (yahoo.com, (yahoo.com, google.com dll), source IP akan di translasikan dengan interface IP egress (untrust)
Hapus konfigurasi security Delete security Buat Zone di SRX (zone untrust dan vr2-trust) set security zones security-zone untrust interfaces ge-1/1/15.0 host-inbound-traffic systemsystemservices all set security zones security-zone vr1-trust interfaces ge-1/1/8.1 host-inbound-traffic systemsystemservices all
Buat souce nat dengan translasi IP interface untrust untrust set security nat source rule-set rs-vr1-trust from zone vr1-trust set security nat source rule-set rs-vr1-trust rs-vr1-trust to zone untrust set security nat source rule-set rs-vr1-trust rs-vr1-trust rule r-vr1-trust match source-address source-address 192.168.201.0/24 set security nat source rule-set rs-vr1-trust rs-vr1-trust rule r-vr1-trust then source-nat interface Buat security policy antar zone vr1-trust dan untrust set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match source-address source-address any set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match destination-address destination-address any set security policies from-zone vr1-trust to-zone untrust policy 1 match application any set security policies from-zone vr1-trust to-zone untrust policy 1 then permit Verifikasi ping vr1 ke internet vr1@lab:vr1> ping yahoo.com PING yahoo.com (67.195.160.76): 56 data bytes 64 bytes from 67.195.160.76: icmp_seq=0 ttl=44 time=335.267 ms
^C --- yahoo.com ping statistics --2 packets transmitted, 1 packets received, 50% packet loss round-trip min/avg/max/stddev = 335.267/335.267/335.267/0.000 335.267/335.267/335.267/0.000 ms
hit translation lab@srx5800# run show security nat source rule r-vr1-trust
source NAT rule: r-vr1-trust Rule-set: rs-vr1-trust rs-vr1-trust Rule-Id : 13 Rule position :1 From zone : vr1-trust To zone : untrust Match Source addresses : 192.168.201.0 192.168.201.0 - 192.168.201.255 Destination port :0 -0 Action : interface Persistent NAT type : N/A Persistent Persistent NAT mapping type : address-port-mapping Inactivity timeout :0 Max session number :0 Translation hits : 236 flow session lab@srx5800# run show security flow session source-prefix 192.168.201/24 Flow Sessions on FPC0 PIC0:
Session ID: 9394, Policy name: name: 1/5, Timeout: 4, Valid In: 192.168.201.2/15 --> 98.137.149.56/30750;icmp, 98.137.149.56/30750;icmp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 1, Bytes: 84 Out: 98.137.149.56/30750 98.137.149.56/30750 --> 202.72.223.135/63094;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, 1 , Bytes: 84 Total sessions: 1 Flow Sessions on FPC0 PIC1: Session ID: 10018639, Policy name: 1/5, Timeout: 2, Valid In: 192.168.201.2/14 --> 98.137.149.56/30750;icmp, 98.137.149.56/30750;icmp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 1, Bytes: 84 Out: 98.137.149.56/30750 98.137.149.56/30750 --> 202.72.223.135/30681;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, 1 , Bytes: 84 Session ID: 10018640, Policy name: 1/5, Timeout: 4, Valid In: 192.168.201.2/16 --> 98.137.149.56/30750;icmp, 98.137.149.56/30750;icmp, If: ge-1/1/8.1, ge-1/1/8.1, Pkts: 1, Bytes: 84 Out: 98.137.149.56/30750 98.137.149.56/30750 --> 202.72.223.135/54361;icmp, If: ge-1/1/15.0, ge-1/1/15.0, Pkts: 1, 1 , Bytes: 84 Total sessions: 2 total session lab> show security flow cp-session cp-session summary Valid sessions: 7 Pending sessions: 0 Invalidated sessions: 7 Sessions in other states: 0
Total sessions: 14 Maximum sessions: 2359296 Maximum inet6 sessions: 1179648
Security Policy
Flow session antar zone harus didefinisikan dengan security policy, antar vr hanya diperbolehkan aplikasi telnet saja (vr1-vr2, (vr1-vr2, vr3-vr4………vr11-vr12) vr3-vr4………vr11-vr12)
Security policy dengan aplikasi telnet d efault set security policies f rom-zone rom-zone vr1-trust to-zone vr2-trust policy p olicy 1 match source-address source-address any set security policies f rom-zone rom-zone vr1-trust to-zone vr2-trust policy p olicy 1 match destination-address destination-address any set security policies f rom-zone rom-zone vr1-trust to-zone vr2-trust policy p olicy 1 match application junos-telnet junos-telnet set security policies from-zone vr1-trust to-zone vr2-trust policy 1 then permit
Security policy dengan aplikasi telnet modifikasi set applications application vr1-telnet-app term 1 protocol tcp set applications application vr1-telnet-app term 1 destination-port 23 set security policies f rom-zone rom-zone vr1-trust to-zone vr2-trust policy p olicy 1 match source-address source-address any set security policies f rom-zone rom-zone vr1-trust to-zone vr2-trust policy p olicy 1 match destination-address destination-address any set security policies f rom-zone rom-zone vr1-trust to-zone vr2-trust policy p olicy 1 match application vr1-telnetvr1-telnetapp set security policies from-zone vr1-trust to-zone vr2-trust policy 1 then permit Verifikasi Vr1 melakukan telnet ke vr2 vr1@lab:vr1> telnet 192.168.202.2
Chassis cluster Active/Passive
Koneksikan kedua SRX seperti p ada topologi Port fe-0/0/1 sebagai data plane Port fe-0/0/7 sebagai control link Optional fe-0/0/6 sebagai management port (fxp0) Konfigur kedua SRX dalam mode cluster, cluster-id 1, SRX pertama sebagai node 0 dan yang kedua sebagai node 1 set chassis cluster cluster-id <0-15> node <0-1> reboot Pasang IP management kedua SRX dalam makro konfigurasi kemudian di load makro tersebut dengan apply-groups set groups node0 system host-name node0 set groups node0 interfaces fxp0 unit 0 family inet address 100.100.100.1/24 set groups node1 system host-name node1 set groups node1 interfaces fxp0 unit 0 family inet address 100.100.100.2/24 set apply-groups "${node}" set system backup-router 100.100.100.1 destination 100.100.100.1 Buat FAB links secara konfigurasi hanya dilakukan pada SRX pertama set interfaces fab0 fabric-options member-interfaces member-interfaces fe-0/0/1 set interfaces fab1 fabric-options member-interfaces member-interfaces fe-1/0/1 Buat redudancy group sebagai fungsi routing engine yang dil akukan pada SRX pertama set chassis cluster redundancy-group 0 node 0 priority 100 set chassis cluster node 0 set chassis cluster redundancy-group 0 node 1 priority 1 set chassis cluster node 1 set chassis cluster redundancy-group 1 node 0 priority 100 set chassis cluster node 0 set chassis cluster redundancy-group 1 node 1 priority 1
set chassis cluster node 1 Buat interface Reth dengan jumlah batasan tertentu misal 2 interface yang dilakukan pada SRX pertama set chassis cluster reth-count 2 set interfaces fe-0/0/2 fastether-options redundant-parent reth0 set interfaces fe-1/0/2 fastether-options redundant-parent reth0 set interfaces reth0 r edundant-ether-options edundant-ether-options redundancy-group 1 set interfaces reth0 unit 0 family i net address address 202.72.223.136/28 set interfaces fe-0/0/3 fastether-options redundant-parent reth1 set interfaces fe-1/0/3 fastether-options redundant-parent reth1 set interfaces reth1 r edundant-ether-options edundant-ether-options redundancy-group 2 set interfaces reth1 reth1 unit 0 family inet address address 192.168.201.1/24 Commit Maka konfigurasi dieksekusi pada SRX pertama dan SRX kedua Selanjutnya dibuat aplikasi source nat interface Buat Zone di SRX (zone untrust dan vr2-trust) set security zones security-zone untrust interfaces reth0.0 host-inboundh ost-inbound-traffic traffic system-services system-services all set security zones security-zone vr1-trust interfaces reth1.0 host-inbound-traffic system-services all
Buat souce nat dengan translasi IP interface untrust untrust set security nat source rule-set rs-vr1-trust from zone vr1-trust set security nat source rule-set rs-vr1-trust rs-vr1-trust to zone untrust set security nat source rule-set rs-vr1-trust rs-vr1-trust rule r-vr1-trust match source-address source-address 192.168.201.0/24 set security nat source rule-set rs-vr1-trust rs-vr1-trust rule r-vr1-trust then source-nat interface Buat security policy antar zone vr1-trust dan untrust set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match source-address source-address any set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match destination-address destination-address any set security policies from-zone vr1-trust to-zone untrust policy 1 match application any set security policies from-zone vr1-trust to-zone untrust policy 1 then permit Verifikasi: status chassis cluster show chassis cluster status failover cluster secara manual dari node 0 ke node 1 didalam redudancy group 1: request chassis cluster failover node 1 redundancy-group 1 Setelah melakukan failover manual, maka untuk melakukan failover failover lagi state failover harus direset request chassis cluster failover reset redundancy-group 1 failover secara alami, tidak perlu dilakukan reset seperti cara failover manual set interfaces fe-0/0/2 disable cek kondisi trafik ping dari vr1 pastikan lewat lewat di fab nya yaitu interface fe-0/0/1 fe-0/0/1 dan fe-1/0/1 set interfaces fe-0/0/3 disable cek kondisi trafik pastikan link fab tidak dilewati trafik
Route Based VPN IPSEC Konsep route based VPN IPSEC menggunakan interface interface secure tunnel (st0) untuk establishment VPN IPSEC. Sehingga setiap r outer terlebih dahulu d ikonfig interface interface st0. Dari topology menggunakan SRX5800 yang membawahi VR1 sampai dengan VR12 sedangkan SRX100 membawahi VRA sampai dengan VRL. Pada Lab kali ini dibuat establishmen VPN IPSEC untuk mengkoneksikan VR1 dengan VRA, VR2 dengan VRB dan seterusnya.
Step by step
Buat inteface untrust, st0 di SRX5800 set interfaces ge-1/1/9 vlan-tagging set interfaces ge-1/1/9 speed 100m set interfaces ge-1/1/9 unit 1 vlan-id 1 family inet address 110.72.10.2/30
Buat interface vr1 dan pasang static route default telnet terlebih dahulu ke 192.168.100.45 user vr1 set interfaces ge-0/2/0 unit 1 vlan-id 1 family inet address 192.168.201.2/24 set routing-options static route 0.0.0.0/0 next-hop 192.168.201.1 Buat static route destination VRA di SRX5800 melalui inteface st0.1 set routing-options static route 172.168.201.0/24 next-hop st0.1 Konfigur Zone vr1-trust, untrust dan vpn1 set security zones security-zone vr1-trust host-inbound-traffic system-services all set security zones security-zone vr1-trust interfaces ge-1/1/8.1 set security zones security-zone vpn1 interfaces st0.1 set security zones security-zone vpn1 host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic system-services system-services all
set security zones security-zone untrust interface i nterfacess ge-1/1/9.1 Konfigur parameter IKE, meliputi proposal, policy dan gateway set security ike i ke proposal ike-proposal-1 authentication-method pre-shared-keys pre-shared-keys set security ike proposal ike-proposal-1 dh-group group2 set security ike i ke proposal ike-proposal-1 authentication-algorithm md5 set security ike proposal pr oposal ike-proposal-1 encryption-algorithm encryption-algorithm 3des-cbc set security ike proposal pr oposal ike-proposal-1 lifetime-seconds lifetime-seconds 86400 set security ike policy ike-policy-1 mode main set security ike policy pol icy ike-policy-1 proposals ike-proposal-1 set security ike policy pol icy ike-policy-1 pre-shared-key ascii-text rahasia rahasia set security ike gateway g ateway ike-gate-1 ike-policy ike-policy-1 set security ike gateway g ateway ike-gate-1 address 110.72.10.1 set security ike i ke gateway ike-gate-1 external-interface ge-1/1/9.1
Konfigur parameter IPSEC meliputi, p roposal, roposal, policy dan gateway set security ipsec proposal i ke-proposal-1 ke-proposal-1 protocol esp set security ipsec i psec proposal ike-proposal-1 authentication-algorithm hmac-md5-96 hmac-md5-96 set security ipsec proposal i ke-proposal-1 ke-proposal-1 encryption-algorithm 3des-cbc set security ipsec i psec proposal ike-proposal-1 lifetime-seconds 3600 set security ipsec i psec proposal ike-proposal-1 lifetime-kilobytes 1048576 set security ipsec policy ipsec-policy-1 ipsec-policy-1 perfect-forward-secrecy keys group2 set security ipsec policy ipsec-policy-1 ipsec-policy-1 proposals ike-proposa ik e-proposal-1 l-1 set security ipsec vpn ike-vpn-1 bind-interface st0.1 set security ipsec vpn ike-vpn-1 ike gateway gateway ike-gate-1 set security ipsec vpn ike-vpn-1 ike ipsec-policy ipsec-policy-1 set security ipsec i psec vpn ike-vpn-1 ik e-vpn-1 establish-tunnels establish-tunnels immediately immediately Konfigur security policy set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match source-address source-address any set security policies f rom-zone rom-zone vr1-trust to-zone untrust policy 1 match destination-address destination-address any set security policies from-zone vr1-trust to-zone untrust policy 1 match application any set security policies from-zone vr1-trust to-zone untrust policy 1 then permit set security policies from-zone vpn1 to-zone vr1-trust policy 1 match source-address any set security policies from-zone vpn1 to-zone vr1-trust policy 1 match destination-address any set security policies from-zone vpn1 to-zone vr1-trust policy 1 match application any set security policies from-zone vpn1 to-zone vr1-trust policy 1 then permit set security policies from-zone vr1-trust to-zone vpn1 policy 1 match source-address source-address any set security policies from-zone vr1-trust to-zone vpn1 policy 1 match destination-address destination-address any set security policies from-zone vr1-trust to-zone vpn1 policy 1 match application any set security policies from-zone vr1-trust to-zone vpn1 policy 1 then permit Konfigur tcp-mss tcp-mss (maximum segment size), dengan pemilihan yang yang tepat maka dapat menghindari menghindari packet loss dilevel fragmentasi packet. Direkomendasikan nilai 1350 set security flow tcp-mss ipsec-vpn mss 1350
Verifikasi Pastikan status level IKE (internet key exchange) phase 1 establish lab@srx5800> show security ike security-associations security-associations
Index Remote Address State Initiator cookie Responder cookie Mode 8070186 110.72.10.17 UP 54e17446c730cde2 54e17446c730cde2 43973b81c7d861a7 43973b81c7d861a7 Main 41624618 110.72.10.21 UP 5dbcfe50fb361945 5dbcfe50fb361945 4047b2b9582d732 4047b2b9582d7320 0 Main Main 58401869 110.72.10.5 UP 930646d8ee4e84e2 930646d8ee4e84e2 b32f89337531f0cc Main 108733483 110.72.10.9 UP 27f1bbde075442a9 27f1bbde075442a9 091bee95ea230a08 091bee95ea230a08 Main 108733484 110.72.10.13 UP ba6d1c8fb60a2b30 ba6d1c8fb60a2b30 4343e8a7df4a8f10 4343e8a7df4a8f10 Main Main 125510800 110.72.10.1 UP 0a8da148d9787692 0a8da148d9787692 bcfd682d9f161063 bcfd682d9f161063 Main lab@srx5800> show security ike security-associations security-associations index 8070186 detail IKE peer 110.72.10.17, Index 8070186, Location: FPC 0, PIC 0, KMD-Instance 1 Role: Responder, Responder, State: UP Initiator Initiator cookie: 54e17446c730cde2, Responder cooki e: 43973b81c7d861a7 Exchange Exchange type: Main, Authentication method: Pre-shared-keys Local: 110.72.10.18:500, Remote: 110.72.10.17:500 Lifetime: Expires in 68279 seconds Peer ike-id: 110.72.10.17 Xauth user-name: not available Xauth assigned IP: 0.0.0.0 Algorithms: Authentication Authenticati on : md5 Encryption : 3des-cbc Traffic statistics: statistics: Input bytes : 1032 Output bytes : 956 Input packets: 5 Output packets: 4 IPSec security associations: 1 created, 0 deleted del eted Phase Phase 2 negotiations in progress: 0 Konfirmasi IPSEC (phase 2) lab@srx5800> show security ipsec security-associations Total active tunnels: 2 ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys <131074 110.72.10.1 110.72. 10.1 500 ESP:3des/md5 ESP:3d es/md5 798c310 915/ 838856 83885 6 - root >131074 110.72.10.1 110.72. 10.1 500 ESP:3des/md5 ES P:3des/md5 11daa936 915/ 838856 - root <131073 110.72.10.5 110.72. 10.5 500 ESP:3des/md5 ES P:3des/md5 3ca603d 2206/ 943713 - root r oot >131073 110.72.10.5 110.72. 10.5 500 ESP:3des/md5 cc2da2f7 2206/ 943713 - root
lab@srx5800> show security ipsec security-associations index 131074 detail Virtual-system: root Local Gateway: Gateway: 110.72.10.2, Remote Gateway: 110.72.10.1 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) ipv4_subnet(any:0,[0..7]=0.0.0.0/0) DF-bit: clear Location: FPC 0, PIC 1, KMD-Instance 4 Direction: inbound, inbound, SPI: 798c310, AUX-SPI: 0 , VPN Monitoring: Hard lifetime: Expires in 868 seconds Lifesize Remaining: Remaining: 838856 kilobytes kilobytes Soft lifetime: Expires in 228 22 8 seconds Mode: tunnel, Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-md5-96, Encryption: 3des-cbc Anti-replay service: service: counter-based counter-based enabled, Replay window size: 64 Location: FPC 0, PIC 1, KMD-Instance 4 Direction: outbound, SPI: 11daa936, AUX-SPI: 0 , VPN Monitoring: Hard lifetime: Expires in 868 seconds Lifesize Remaining: Remaining: 838856 kilobytes kilobytes Soft lifetime: Expires in 228 seconds Mode: tunnel, Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-md5-96, Encryption: 3des-cbc Anti-replay service: service: counter-based counter-based enabled, Replay window size: 64 lab@srx5800> show security ipsec statistics index 131074 ESP Statistics: Encrypted bytes: 136408 Decrypted bytes: 84252 Encrypted packets: 1003 Decrypted packets: 1003 AH Statistics: Input bytes: 0 Output bytes: 0 Input packets: 0 Output packets: 0 Errors: AH authentication authentication failures: 0, Replay errors: 0 ESP authentication authentication failures: 0, ESP decryption failures: 0 Bad headers: 0, Bad trailers: 0 Ping end to end,dari VR1 ping ke 172.168.201.2 Ping 172.168.201.2
