SRX

 View Only
last person joined: 6 days ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.

  • 1.  SRX1500 Dynamic Application KRB5 and Windows PC's

    Posted 14 days ago

    I use this policy to allow users to authenticate in the Windows domain:

    policy MS_DYNAPP {
    match {
        source-address any;
        destination-address [ DC1 DC2 ];
        dynamic-application [ junos:LDAP junos:CLDAP junos:NBNS junos:MSRPC junos:SMB junos:KRB5 ];
    }
    then {
        permit;
    }
}

    policy last {
    match {
        source-address any;
        destination-address any;
        application any;
        dynamic-application any;
    }
    then {
        reject;
        log {
            session-close;
        }
    }
}

    But in the log i see that the traffic to port 88 is still blocked:

    May  2 07:26:59 myfw RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed Closed by junos-dynapp: 172.19.19.4/50000->172.16.105.4/88 0x0 None 172.19.19.4/50000->172.16.105.4/88 0x0 N/A N/A N/A N/A 6 last office-19 office-srv 64425124357 3(367) 1(52) 1 KRB5 UNKNOWN N/A(N/A) xe-0/0/19.19 No Infrastructure Encryption 1 Known Vulnerabilities; NA 0 0.0.0.0/0->0.0.0.0/0 NA NA N/A N/A Off root 0 N/A N/A
    May  2 07:27:00 myfw RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed Closed by junos-dynapp: 172.19.19.4/50080->172.16.105.4/88 0x0 None 172.19.19.4/50080->172.16.105.4/88 0x0 N/A N/A N/A N/A 6 last office-19 office-srv 64425105881 3(367) 1(52) 2 KRB5 UNKNOWN N/A(N/A) xe-0/0/19.19 No Infrastructure Encryption 1 Known Vulnerabilities; NA 0 0.0.0.0/0->0.0.0.0/0 NA NA N/A N/A Off root 0 N/A N/A
    May  2 07:27:00 myfw RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed Closed by junos-dynapp: 172.19.19.4/50093->172.16.105.4/88 0x0 None 172.19.19.4/50093->172.16.105.4/88 0x0 N/A N/A N/A N/A 6 last office-19 office-srv 64425115425 3(367) 1(52) 2 KRB5 UNKNOWN N/A(N/A) xe-0/0/19.19 No Infrastructure Encryption 1 Known Vulnerabilities; NA 0 0.0.0.0/0->0.0.0.0/0 NA NA N/A N/A Off root 0 N/A N/A
    May  2 07:27:00 myfw RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed Closed by junos-dynapp: 172.19.19.4/50108->172.16.105.4/88 0x0 None 172.19.19.4/50108->172.16.105.4/88 0x0 N/A N/A N/A N/A 6 last office-19 office-srv 64425104590 3(367) 1(52) 2 KRB5 UNKNOWN N/A(N/A) xe-0/0/19.19 No Infrastructure Encryption 1 Known Vulnerabilities; NA 0 0.0.0.0/0->0.0.0.0/0 NA NA N/A N/A Off root 0 N/A N/A

    Why is this happening? Did I miss something?



  • 2.  RE: SRX1500 Dynamic Application KRB5 and Windows PC's

    Posted 14 days ago

    You can also use show security match-policies to check what policies get applied.

    Reference: https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-security-match-policies.html



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 3.  RE: SRX1500 Dynamic Application KRB5 and Windows PC's

    Posted 14 days ago

    Policy: MS_DYNAPP, action-type: permit, services-offload:not-configured , State: enabled, Index: 25
    0
      Policy Type: Configured

    It seems that the KRB5 dynamic application only allows UDP. However, Kerberos can operate over both UDP and TCP.
    Looks like Juniper isn't aware of this :)


    Original Message


  • 4.  RE: SRX1500 Dynamic Application KRB5 and Windows PC's

    Posted 14 days ago

    Strange... Looks like your traffic is correctly identified as KRB5. Can you run a flow trace to see at what point exactly things are going sideways?

    And just to eliminate the simple things:
     * I'm pretty sure you still need an "application" statement in order for the MS_DYNAPP policy to be valid; it can be "application any"
     * 172.16.105.4 does match the definition for DC1 or DC2, yes?



    ------------------------------
    Nikolay Semov
    ------------------------------

    Original Message


  • 5.  RE: SRX1500 Dynamic Application KRB5 and Windows PC's

     
    Posted 13 days ago

    Hi,

    If possible, don't use dynamic-applications for service rules like this one. Just create a rule somewhere on top of the zone-context, use predefined or custom applications, and set the dynamic-application to "none". 



    ------------------------------
    M Gi
    ------------------------------

    Original Message


  • 6.  RE: SRX1500 Dynamic Application KRB5 and Windows PC's

    Posted 13 days ago

    Is there anywhere I can read about when to use simple\legacy versus "new" dynamic applications? By the way, I couldn't find any "legacy" applications definitions for Kerberos :( Yes, I understand that custom applications can be added :) I'm just curious why only the UDP protocol was allowed for Kerberos.


    Original Message


  • 7.  RE: SRX1500 Dynamic Application KRB5 and Windows PC's

     
    Posted 13 days ago

    The other great mystery of the universe: dynamic-applications ;)

    I just try to do rules for internal services (DNS, NTP, AD, or other known ones) as standard rules, and then use AppFW (mostly) for connections to Internet. Of course if the requirement is to implement some sort of application control on the internal network, you can't avoid using AppFW or IDP.

    I don't think there's any general rule or guide for this.



    ------------------------------
    M Gi
    ------------------------------

    Original Message