We can’t imagine a network without a firewall, they are the staple of almost every network in the IT landscape. The firewalls provide protection to nearly every network-based transaction. Over a decade the underlying technology has changed rapidly as the way firewalls and technology have undergone a major shift from stateful inspection firewalls to firewall devices as a service gateway. Deep inspection from service gateway firewalls is the new firewall of the future.
Today we look more in detail about Juniper SRX Next generation firewalls, a true service gateway firewall and understand how to configure them.
Steps to Configure Juniper SRX Firewall
In this topic we are covering how to configure NGFW and set up a new SRX device to connect to the Internet.
When we login to a new SRX box there is no password for root.
1. Press enter.
login: root
Password:
— JUNOS 12.1X47-D20.7 built 2017-03-03 21:53:50 UTC
root@%
2. Use CLI to enter Operational mode
root@% cli
root>
3. Use configure command to enter configuration mode
root> configure
Entering configuration mode
[edit]
root#
Now we will configure Juniper SRX as gateway. Use commit command to apply as active configuration
4. Configuring root password
root# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root#
5. Create new user
[edit]
root# set system login user mad1 class super-user authentication plain-text-password
New password:
Retype new password:
6. Provide host name
[edit]
root# set system host-name letsconfig-SRX
[edit]
root# commit
commit complete
[edit]
root@letsconfig-SRX#
8. DNS server setup on Juniper SRX
[edit]
root@letsconfig-SRX# set system name-server 8.8.8.8
9. Enable SSH on SRX
[edit]
root@letsconfig-SRX# set system services ssh
10. Setup NTP and time zone
[edit]
root@letsconfig-SRX#set system time-zone Asia/India
[edit]
root@letsconfig-SRX# set system ntp server time.google.com
11. Assign IP address
set interfaces ge-0/0/1 unit 0 family inet address 192.168.1.100/24
set interfaces ge-0/0/2 unit 0 family inet address 10.1.1.1/24
*Family inet means IPv4 and inet6 means IPv6
12. Establish zone configuration
user@hostj#set security zones security-zone un-trust interfaces ge-0/0/1.0
user@hostj#set security zones security-zone un-trust host-inbound-traffic system-services all
user@hostj#set security zones security-zone un-trust host-inbound-traffic protocols all
user@hostj#set security zones security-zone trust1 interfaces ge-0/0/2.0
user@hostj#set security zones security-zone trust1 host-inbound-traffic system-services all
user@hostj#set security zones security-zone trust1 host-inbound-traffic protocols all
13. Establish security policy for zone
edit security policies from-zone trust1 to-zone un-trust policy our-internet-policy
set match source-address any
set match destination-address any
set match application any
set then permit
exit
edit security policies from-zone un-trust to-zone trust1 policy our-deny-policy
set match source-address any
set match destination-address any
set match application any
set then deny
exit
commit
** everything is allowed in the outgoing path and deny everything in the incoming path.
14. Configure static route as routing protocol
set routing-options static route 0.0.0.0/0 next-hop 192.168.3.1
15. NAT/PAT configuration
set security nat source rule-set ourr-nat-rule-set from zone trust
set security nat source rule-set ourr-nat-rule-set to zone untrust
set security nat source rule-set ourr-nat-rule-set rule ourr-nat-rule match source-address 10.1.1.1/24
set security nat source rule-set ourr-nat-rule-set rule ourr-nat-rule match destination-address 0.0.0.0/0
set security nat source rule-set ourr-nat-rule-set rule ourr-nat-rule then source-nat interface
16. Enable Intrusion detection prevention(IDP) in SRX firewall
set security idp idp-policy recommended
set security idp idp-policy idpengine
17. Configuring one of the IDP policy as default policy
set security idp default-policy recommended
18. Check to confirm if default policy configured on device
show security idp default-policy
Continue Reading:
Introduction to Juniper SRX Firewall
NAT vs PAT: IP Address Translation Explained
