SRX

 View Only
last person joined: 14 hours ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  show ntp associations not working with loopback filter

    Posted 03-06-2019 08:26

    I am having an issue with the 'show ntp associations' command not working. (I have a firewall filter applied to the loopback to restrict management access)

     

    I get the below output:

    user@srx> show ntp associations
    localhost: timed out, nothing received
    ***Request timed out

     

    I have seen the following article and followed it's advice:

    https://forums.juniper.net/t5/Day-One-Tips/TIP-not-able-to-check-NTP-status/m-p/64545#M140

     

    I have set my ntp source address to a specific address:
    set system ntp source-address 10.99.99.1

     

    Below is my loopback config:

    user@srx# show interfaces lo0
    unit 0 {
    family inet {
    filter {
    input MGMT_TRAFFIC;
    }
    }
    }

     

    Here is the last section of my firewall filter allowing that IP:

     

    term NTP-SERVERS {
    from {
    address {
    10.99.99.1/32;
    }
    protocol udp;
    destination-port ntp;
    }
    then accept;
    }
    term DENY_OTHER_TRAFFIC {
    then {
    log;
    discard;
    }
    }

     

    When I run a 'monitor traffic interface lo0'  I can see the ntp requests coming from the correct source address.

    18:13:16.183247 In IP 10.99.99.1.51295 > 10.99.99.1.ntp: NTPv2, Reserved, length 12
    18:13:16.185393 In IP 10.99.99.1.ntp > 10.99.99.1.51295: NTPv2, Reserved, length 20

     

    The command still fails though.. When I remove the firewall filter, it works. I even tried changing the filter to just allow udp but it still failed. 

     

    Any help appreciated.

     

    Thanks

     

     



  • 2.  RE: show ntp associations not working with loopback filter
    Best Answer

    Posted 03-06-2019 08:42

    ntp server address and source address should be allowed as source-address  in the filter and change the destination-port to "port ntp". Please refer this KB for more details:

    https://kb.juniper.net/InfoCenter/index?page=content&id=kb11436

     

     

     



  • 3.  RE: show ntp associations not working with loopback filter

    Posted 03-06-2019 08:59

    Thanks, I did see that article and followed that also but no luck.

     

    My loopback doesn't have an IP address configured on it so I believe it defaults to 127.0.0.1/32. I confirmed that by running 'monitor traffic interface lo0' and I could see the ntp connections coming from 127.0.0.1 as expected. I then put 127.0.0.1 into the filter but still no luck. (this was all before I added the ntp source ip command) 

     

    That's when  went down the path of trying the ntp source command and using the inside IP of the SRX and then putting that same IP address into the firewall filter. No luck with that either. 

     

    As mentioned above, when when I completely remove the source IPs so I just have 'from protocol udp port ntp' it still fails. 

     

    My loopback is not part of any zone but I don't think that matters.

     



  • 4.  RE: show ntp associations not working with loopback filter

    Posted 03-06-2019 09:44

    Do you have any other discard term before the term NTP-SERVERS ? If yes, try to move NTP-SERVERS term before the first term  by using "insert firewall family inet filter MGMT_TRAFFIC term NTP-SERVERS before term < First term> "

     

    please share the output of below mentioned commands if still not working :

    show interface filter

    show firewall

    show firewall log < execute after entering show ntp ... command

     

     

     

     



  • 5.  RE: show ntp associations not working with loopback filter

    Posted 03-06-2019 13:11

    Hi Nellikka

     

    Thanks a lot. It was changing of destination-port to "port" and that has done the trick for me. 

     

    Thanks again