Routing

Expand all | Collapse all

Juniper ssg5 routing not working as expected

Jump to Best Answer
  • 1.  Juniper ssg5 routing not working as expected

    Posted 01-22-2014 14:44

    I am new to Juniper SSG5 and cant seem to get this figured out.  I can ping from a wks in the untrusted zone to the trusted zone, but can't ping the opposite way.  Thanks for any help in advance.

     

     

    set clock timezone -8
    set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00
    set vrouter trust-vr sharable
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    unset auto-route-export
    exit
    set alg appleichat enable
    unset alg appleichat re-assembly enable
    set alg sctp enable
    set auth-server "Local" id 0
    set auth-server "Local" server-name "Local"
    set auth default auth server "Local"
    set auth radius accounting port 1646
    set admin name "username"
    set admin password "password"
    set admin auth web timeout 10
    set admin auth dial-in timeout 3
    set admin auth server "Local"
    set admin format dos
    set zone "Trust" vrouter "trust-vr"
    set zone "Untrust" vrouter "trust-vr"
    set zone "DMZ" vrouter "trust-vr"
    set zone "VLAN" vrouter "trust-vr"
    set zone "Untrust-Tun" vrouter "trust-vr"
    set zone "Trust" tcp-rst
    set zone "Untrust" block
    unset zone "Untrust" tcp-rst
    set zone "MGT" block
    set zone "DMZ" tcp-rst
    set zone "VLAN" block
    unset zone "VLAN" tcp-rst
    set zone "Untrust" screen icmp-flood
    set zone "Untrust" screen port-scan
    set zone "Untrust" screen tear-drop
    set zone "Untrust" screen syn-flood
    set zone "Untrust" screen ip-spoofing
    set zone "Untrust" screen ping-death
    set zone "Untrust" screen ip-filter-src
    set zone "Untrust" screen land
    set zone "V1-Untrust" screen tear-drop
    set zone "V1-Untrust" screen syn-flood
    set zone "V1-Untrust" screen ping-death
    set zone "V1-Untrust" screen ip-filter-src
    set zone "V1-Untrust" screen land
    set interface "ethernet0/0" zone "Null"
    set interface "ethernet0/1" zone "Null"
    set interface "ethernet0/5" zone "Trust"
    set interface "ethernet0/6" zone "Untrust"
    set interface "bgroup0" zone "Trust"
    unset interface vlan1 ip
    set interface ethernet0/5 ip 10.2.5.253/24
    set interface ethernet0/5 route
    set interface ethernet0/6 ip 172.0.19.253/24
    set interface ethernet0/6 route
    unset interface vlan1 bypass-others-ipsec
    unset interface vlan1 bypass-non-ip
    set interface ethernet0/5 ip manageable
    unset interface ethernet0/6 ip manageable
    set interface ethernet0/6 manage ping
    set interface "serial0/0" modem settings "USR" init "AT&F"
    set interface "serial0/0" modem settings "USR" active
    set interface "serial0/0" modem speed 115200
    set interface "serial0/0" modem retry 3
    set interface "serial0/0" modem interval 10
    set interface "serial0/0" modem idle-time 10
    set flow tcp-mss
    unset flow no-tcp-seq-check
    set flow tcp-syn-check
    unset flow tcp-syn-bit-check
    set flow reverse-route clear-text prefer
    set flow reverse-route tunnel always
    set hostname GTIC-WASH
    set pki authority default scep mode "auto"
    set pki x509 default cert-path partial
    set address "Trust" "Advantage Class 3" 10.2.5.0 255.255.255.0
    set address "Trust" "NTP Server" 10.2.5.10 255.255.255.255 "ADV SVR Class 3"
    set address "Trust" "R5-advABS 10.2.5.32" 10.2.5.32 255.255.255.255 "ADV SVR Class 3"
    set address "Trust" "R5-advADI 10.2.5.13" 10.2.5.13 255.255.255.255 "ADV SVR Class 3"
    set address "Trust" "R5-advApps 10.2.5.31" 10.2.5.31 255.255.255.255 "ADV Client Class 3"
    set address "Trust" "R5-advDC 10.2.5.10" 10.2.5.10 255.255.255.255 "ADV SVR Class 3"
    set address "Trust" "R5-advSQL 10.2.5.28" 10.2.5.28 255.255.255.255 "ADV SVR Class 3"
    set address "Trust" "R5-advSQL2 10.2.5.27" 10.2.5.27 255.255.255.255 "ADV SVR Class 3"
    set address "Untrust" "PM Network" 172.0.19.0 255.255.255.0 "PM Net 172.0.19.0/24"
    set address "Untrust" "R5P-PMDB 172.0.19.53" 172.0.19.53 255.255.255.255 "PMDB"
    set address "Untrust" "R5P-PMWKS 172.0.19.43" 172.0.19.43 255.255.255.255 "PMWKS"
    set group address "Trust" "ADV Clients Class 3"
    set group address "Trust" "ADV Clients Class 3" add "R5-advApps 10.2.5.31"
    set group address "Trust" "ADV SVR Class 3"
    set group address "Trust" "ADV SVR Class 3" add "R5-advABS 10.2.5.32"
    set group address "Trust" "ADV SVR Class 3" add "R5-advADI 10.2.5.13"
    set group address "Trust" "ADV SVR Class 3" add "R5-advDC 10.2.5.10"
    set group address "Trust" "ADV SVR Class 3" add "R5-advSQL 10.2.5.28"
    set group address "Trust" "ADV SVR Class 3" add "R5-advSQL2 10.2.5.27"
    set group address "Untrust" "Patron Class 3 Clients Group"
    set group address "Untrust" "Patron Class 3 Clients Group" add "R5P-PMDB 172.0.19.53"
    set group address "Untrust" "Patron Class 3 Clients Group" add "R5P-PMWKS 172.0.19.43"
    set ike respond-bad-spi 1
    set ike ikev2 ike-sa-soft-lifetime 60
    unset ike ikeid-enumeration
    unset ike dos-protection
    unset ipsec access-session enable
    set ipsec access-session maximum 5000
    set ipsec access-session upper-threshold 0
    set ipsec access-session lower-threshold 0
    set ipsec access-session dead-p2-sa-timeout 0
    unset ipsec access-session log-error
    unset ipsec access-session info-exch-connected
    unset ipsec access-session use-error-log
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    exit
    set url protocol websense
    exit
    set policy id 5 from "Untrust" to "Trust"  "Patron Class 3 Clients Group" "ADV Clients Class 3" "ANY" permit log
    set policy id 5
    set dst-address "ADV SVR Class 3"
    exit
    set policy id 4 from "Trust" to "Untrust"  "ADV Clients Class 3" "Patron Class 3 Clients Group" "ANY" permit log
    set policy id 4
    set src-address "ADV SVR Class 3"
    exit
    set policy global id 3 from "Global" to "Global"  "Any" "Any" "ANY" deny log
    set policy id 3
    exit
    set nsmgmt bulkcli reboot-timeout 60
    set ssh version v2
    set config lock timeout 5
    unset license-key auto-update
    set ntp server "10.2.5.10"
    set ntp server src-interface "ethernet0/6"
    unset snmp auth-trap enable
    set snmp port listen 161
    set snmp port trap 162
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    unset add-default-route
    exit
    set vrouter "untrust-vr"
    exit
    set vrouter "trust-vr"
    exit



  • 2.  RE: Juniper ssg5 routing not working as expected

     
    Posted 01-22-2014 17:51

    Your configuation looks good.  The interfaces are in route mode to avoid automatic nat.  And the two policies do appear to allow the traffic from either direction.

     

    Do you see the trust  to untrust ping attempt correctly appearing in the policy log

    Can you confirm the default gateway for the two hosts involved is the firewall interface

     

    You can also try to capture the ping attempt using debug flow basic.  This will outline all the packet processing on the SSG.

     

    Expand for debug flow steps.

    Spoiler

    DEBUG FLOW BASIC :

    ==================

     

    Prepare the tool

    1. undebug all - we are assuring that the debug utility is not already running. 

    2. get ffilter - we would expect to get no response. This tells us we have not set up any flow filters as of yet. If you should see filters listed you can delete them with unset ffilter. 

     

    Setup the capture

    3. set ffilter src-ip x.x.x.x(computer A) dst-ip x.x.x.x(computer B) 

      set ffilter src-ip x.x.x.x(Computer B) dst-ip x.x.x.x(computer A) by doing this we can observe the packets flowing in each direction and where any possible problems may be. Basically we want to define the end points of communication.

     

    Capture the traffic

    5. clear db - this will clear the debugging cache. 

    6. debug flow basic - this turns the debugging utility on. 

    7. initiate the traffic you are interested in capturing. 

     

    Pull the data

    8. undebug all - turns the utility back off.  

    9. get db stream - this is the actual packet capture output that we want. 

     

    Remove the setup

    10.unset ffilter 0 - this will need to be done twice, once for each filter that we set up earlier. 

    11.clear db - this will clear the cache.

     

     

    You should also edit the post and remove the encrypted user password.  Edit is in your upper right corner of your post.



  • 3.  RE: Juniper ssg5 routing not working as expected

    Posted 01-23-2014 09:37
      |   view attached

    yes eth5 and 6 are gateways that are configured on both of the clients and ping work to each respective gw.  attached is the debug.  I am see pack drop type unkown for eth5

     

    Thanks for your help with this

    Attachment(s)

    txt
    juniper.debug.log.txt   51 KB 1 version


  • 4.  RE: Juniper ssg5 routing not working as expected

    Posted 01-23-2014 15:36
      |   view attached

    On a whim...I turned off MAC address caching and connected another wks to the setup.  The untrust network wks can only ping one of the trusted network wks.

     

    Now I am totally confused but I figured the additional info may help someone identify the issue for me.

    Thanks

     

    see attachment for debug.

    Attachment(s)

    txt
    juniper.debug_2.txt   16 KB 1 version


  • 5.  RE: Juniper ssg5 routing not working as expected
    Best Answer

     
    Posted 01-23-2014 18:25

    The unknown packet type messages were new to me.  They are explained in kb25491 and essentially don't have any bearing on our traffic.

     

    http://kb.juniper.net/InfoCenter/index?page=content&id=KB25491

     

    The flows all show that the traffic is accepted as allowed by your policy and forwarded without any nat being applied which is what we want.

     

    Is there any operating system firewall turned on the servers?



  • 6.  RE: Juniper ssg5 routing not working as expected

    Posted 01-27-2014 11:49

    You were right one of the wks had downloaded the corp firewall policy.  Routing seems to be working ok.  Thanks for reviewing the info and your responses.