Junos OS

Good Morning,

I am having an issue with my management ACL on an MX204. This is the same configuration I used on the 104s that I currently have. This is still allowing ssh connections from any IP. I also would like to limit this down to just the management interface.

set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options policy-statement export-routes term export-statics from protocol static
set policy-options policy-statement export-routes term export-statics then accept
set policy-options policy-statement export-routes term export-direct then accept
set firewall family inet filter MGMT term T1 from source-address 0.0.0.0/0
set firewall family inet filter MGMT term T1 from source-prefix-list MGMT_Net except
set firewall family inet filter MGMT term T1 from destination-port ssh
set firewall family inet filter MGMT term T1 from destination-port https
set firewall family inet filter MGMT term T1 from destination-port telnet
set firewall family inet filter MGMT term T1 from destination-port http
set firewall family inet filter MGMT term T1 from destination-port ntp
set firewall family inet filter MGMT term T1 then discard
set firewall family inet filter MGMT term accept_everything_else then accept


Any help is appreciated.

Thanks,

Matt

Do you have the FWF applied to the lo0.0 interface as an input??
Original Message:
Sent: 03-24-2022 08:43
From: Unknown User
Subject: MX 204 Management ACL

Good Morning,

I am having an issue with my management ACL on an MX204. This is the same configuration I used on the 104s that I currently have. This is still allowing ssh connections from any IP. I also would like to limit this down to just the management interface.

set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options policy-statement export-routes term export-statics from protocol static
set policy-options policy-statement export-routes term export-statics then accept
set policy-options policy-statement export-routes term export-direct then accept
set firewall family inet filter MGMT term T1 from source-address 0.0.0.0/0
set firewall family inet filter MGMT term T1 from source-prefix-list MGMT_Net except
set firewall family inet filter MGMT term T1 from destination-port ssh
set firewall family inet filter MGMT term T1 from destination-port https
set firewall family inet filter MGMT term T1 from destination-port telnet
set firewall family inet filter MGMT term T1 from destination-port http
set firewall family inet filter MGMT term T1 from destination-port ntp
set firewall family inet filter MGMT term T1 then discard
set firewall family inet filter MGMT term accept_everything_else then accept


Any help is appreciated.

Thanks,

Matt

Yes. I have this.

set interfaces lo0 unit 0 family inet filter input MGMT_Net

Thanks,

Matt
Original Message:
Sent: 03-25-2022 09:18
From: Unknown User
Subject: MX 204 Management ACL

Do you have the FWF applied to the lo0.0 interface as an input??
Original Message:
Sent: 03-24-2022 08:43
From: Unknown User
Subject: MX 204 Management ACL

Good Morning,

I am having an issue with my management ACL on an MX204. This is the same configuration I used on the 104s that I currently have. This is still allowing ssh connections from any IP. I also would like to limit this down to just the management interface.

set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options policy-statement export-routes term export-statics from protocol static
set policy-options policy-statement export-routes term export-statics then accept
set policy-options policy-statement export-routes term export-direct then accept
set firewall family inet filter MGMT term T1 from source-address 0.0.0.0/0
set firewall family inet filter MGMT term T1 from source-prefix-list MGMT_Net except
set firewall family inet filter MGMT term T1 from destination-port ssh
set firewall family inet filter MGMT term T1 from destination-port https
set firewall family inet filter MGMT term T1 from destination-port telnet
set firewall family inet filter MGMT term T1 from destination-port http
set firewall family inet filter MGMT term T1 from destination-port ntp
set firewall family inet filter MGMT term T1 then discard
set firewall family inet filter MGMT term accept_everything_else then accept


Any help is appreciated.

Thanks,

Matt

Good Morning,

I wanted to revisit this discussion to see if anyone else had any ideas on this. This is still being detected as openssh from external vulnerability scans.

Thanks,

Matt

Original Message:
Sent: 03-24-2022 08:43
From: Juniper_Idiot
Subject: MX 204 Management ACL

Good Morning,

I am having an issue with my management ACL on an MX204. This is the same configuration I used on the 104s that I currently have. This is still allowing ssh connections from any IP. I also would like to limit this down to just the management interface.

set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options policy-statement export-routes term export-statics from protocol static
set policy-options policy-statement export-routes term export-statics then accept
set policy-options policy-statement export-routes term export-direct then accept
set firewall family inet filter MGMT term T1 from source-address 0.0.0.0/0
set firewall family inet filter MGMT term T1 from source-prefix-list MGMT_Net except
set firewall family inet filter MGMT term T1 from destination-port ssh
set firewall family inet filter MGMT term T1 from destination-port https
set firewall family inet filter MGMT term T1 from destination-port telnet
set firewall family inet filter MGMT term T1 from destination-port http
set firewall family inet filter MGMT term T1 from destination-port ntp
set firewall family inet filter MGMT term T1 then discard
set firewall family inet filter MGMT term accept_everything_else then accept


Any help is appreciated.

Thanks,

Matt

Maybe you could try this (basically, replacing the mix of matching source-address and source-prefix-list with only prefix-list):

set policy-options prefix-list all_v4 0.0.0.0/0
delete firewall family inet filter MGMT term T1 from source-address 0.0.0.0/0
set firewall family inet filter MGMT term T1 from source-prefix-list all_v4

------------------------------
Olivier Benghozi
------------------------------

Original Message:
Sent: 08-04-2023 08:16
From: Juniper_Idiot
Subject: MX 204 Management ACL

Good Morning,

I wanted to revisit this discussion to see if anyone else had any ideas on this. This is still being detected as openssh from external vulnerability scans.

Thanks,

Matt

Original Message:
Sent: 03-24-2022 08:43
From: Juniper_Idiot
Subject: MX 204 Management ACL

Good Morning,

I am having an issue with my management ACL on an MX204. This is the same configuration I used on the 104s that I currently have. This is still allowing ssh connections from any IP. I also would like to limit this down to just the management interface.

set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options prefix-list MGMT_Net x.x.x.0/24
set policy-options policy-statement export-routes term export-statics from protocol static
set policy-options policy-statement export-routes term export-statics then accept
set policy-options policy-statement export-routes term export-direct then accept
set firewall family inet filter MGMT term T1 from source-address 0.0.0.0/0
set firewall family inet filter MGMT term T1 from source-prefix-list MGMT_Net except
set firewall family inet filter MGMT term T1 from destination-port ssh
set firewall family inet filter MGMT term T1 from destination-port https
set firewall family inet filter MGMT term T1 from destination-port telnet
set firewall family inet filter MGMT term T1 from destination-port http
set firewall family inet filter MGMT term T1 from destination-port ntp
set firewall family inet filter MGMT term T1 then discard
set firewall family inet filter MGMT term accept_everything_else then accept


Any help is appreciated.

Thanks,

Matt