Introduction to SRX-series Services Gateways
4-1
Copyright 2005 Juniper Networks, Inc. Proprietary and Confidential [Link]
Routers
Traditionally, a router is used to forward packets based on a Layer 3 IP address
Uses some type of path determination mechanism
Packet processing is stateless and promiscuous Routers separate broadcast domains and provide WAN connectivity
2009 Juniper Networks, Inc. All rights reserved.
Layer 3 Packet Forwarding (Routing)
IP packets forwarded based on destination address
Maintain routing table entries
Static routes Dynamic routes (RIP, OSPF, BGP)
Longest prefix match
[ge-0/0/1] [Link]/24 [Link]
RTR A
[ge-0/0/0] [Link]/24
[Link]/24
[Link]
Routing Table
Network [Link]/24 [Link]/24 [Link]/24 [Link]/32 [Link]/24
2009 Juniper Networks, Inc. All rights reserved.
Interface ge-0/0/1 ge-0/0/0 ge-0/0/0 ge-0/0/2 ge-0/0/2
Gateway direct direct [Link] [Link] direct
3
Traditional Routing Is Promiscuous
A traditional router is designed to provide stateless connectivity
Forwards all traffic by default Operates at Layer 3cannot detect security threats in higher-layer protocols Operates on each packet individuallycannot detect malformed sessions The network is immediately vulnerable
[Link]
[Link]
Typically, security is treated as a luxury add-on item
2009 Juniper Networks, Inc. All rights reserved.
Router Positioning in the Enterprise
Enterprise Branch 1
Service Provider Network
Core
M-series Router
J-series Router
M-series and T-series Platforms
Enterprise Branch 2
Enterprise Head Office
Typical enterprise applications:
M-series platform at the edge for large customers or at an enterprise head office for smaller customers J-series router at the edge for small-sized and medium-sized customers or at the branch of a larger customer
2009 Juniper Networks, Inc. All rights reserved.
Firewalls
Traditionally, a standalone firewall adds enhanced security in the enterprise network Firewall must perform:
Stateful packet processing
Keeps a session or state table based on IP header and higher-level information (TCP/UDP and Application layers)
NAT and PAT
Private-to-public and public-to-private translation
VPN establishment
Encapsulation, authentication, and encryption
Can also implement other security elements such as SSL, IDP, ALGs, and so forth
2009 Juniper Networks, Inc. All rights reserved.
Stateful Packet Processing
Private Zone External Zone Web Server
Internet
[Link]
ge-1/0/1.0
[Link]
ge-0/0/0.0
Outgoing packet header information
SRC-IP [Link]
DST-IP [Link]
Protocol 6
SRC-Port 29218
DST-Port 80
+ session token = flow
Session table entry includes expected return flow
Outgoing flow initiates a session table entry
Source Address [Link] . [Link]
Source Port
Session Table Destination Destination Protocol Interface Address Port [Link] [Link] 80 29218 6 6 ge-1/0/1.0 ge-0/0/0.0
29218
80
Session table is used by outgoing and incoming packets for bidirectional communication
2009 Juniper Networks, Inc. All rights reserved.
NAT and PAT
NAT and PAT:
NAT converts IP addresses PAT converts TCP or UDP port numbers Typically used at the boundary between private and public addressing
Private [Link]
Protocol SRC-Port DST-Port
[Link]
SRC-IP DST-IP
Public [Link]
SRC-IP DST-IP
Internet
Protocol SRC-Port DST-Port
[Link]
[Link]
36033
80
[Link]
[Link]
1025
80
NAT and PAT
2009 Juniper Networks, Inc. All rights reserved.
Virtual Private Networks
Provide secure tunnels across the Internet
Encapsulation Encryption Authentication
Public [Link]
IPsec VPN
[Link]
Private [Link]
[Link]
Public [Link]
IP Packet
Encrypted Packet
Private [Link] [Link] [Link]
IP Packet
2009 Juniper Networks, Inc. All rights reserved.
Firewall Positioning
Typical firewall positioning:
Network edge for a small office
Marketing Zone Administrative Zone
Branch office
IPsec VPN
Internet
IPsec VPN
Engineering Zone
Home Office/Retail Site
2009 Juniper Networks, Inc. All rights reserved.
10
Current Trends
The current trends:
As boundaries of networks are virtualized, so are the requirements of network edge devices The functions of a router and a firewall are collapsing More protection required at the network edge
2009 Juniper Networks, Inc. All rights reserved.
11
A New Perspective
SRX-series Services Gateways
Integrated security and network features with robust Dynamic Services Architecture
Marketing Zone Administrative Zone
Branch Office
IPsec VPN
Internet
IPsec VPN
Engineering Zone
Home Office/Retail Site
12
2009 Juniper Networks, Inc. All rights reserved.
SRX 5600 Overview
Horizontal modular chassis
Redundant Routing Engine and SCB 6 interchangeable slots AC/DC power: 4 slots, hotswappable
4x10 GigE IOC
Craft Interface
Performance and capacities
Firewall: 60 Gbps IDP: 15 Gbps Concurrent sessions: 4M New sessions per second: 350K
2009 Juniper Networks, Inc. All rights reserved.
8 RU
SPC 40x1 GigE IOC
SCB/RE
13
SRX 5800 Overview
Craft Interface
4x10 GigE IOC
Vertical modular chassis
Redundant Routing Engine and SCB 12 interchangeable slots AC/DC power: 4 slots, hotswappable
16 RU
Performance and capacities
Firewall: 120 Gbps IDP: 30 Gpbs Concurrent sessions: 4M New sessions per second: 40x1 GigE IOC 350K
2009 Juniper Networks, Inc. All rights reserved.
SCB/RE
SPC
14
Physical Packet FlowFirst Packet
Because no session exists, packet is sent to SPC serving as CP
2
SPC - CP
1
IOC checks incoming packet to see if there is existing session
IOC
6
3 Session
create
Session 4 install
Install 5 Ack
7
IOC
Outgoing packet
Terms:
CP notifies IOCs of new session
SPC
FWD to egress IOC
IOC: Media connection to networks SPC: Contains flow module CP: Performs first path processing and load-balances sessions across SPCs
2009 Juniper Networks, Inc. All rights reserved.
15
Physical Packet FlowSubsequent Packet
SPC - CP
1 4
IOC checks incoming packet to see if there is existing session
IOC
3
IOC SPC
2
Outgoing packet
Because there is an existing session, packet is sent directly to SPC
FWD to egress IOC
2009 Juniper Networks, Inc. All rights reserved.
16
JUNOS Software Security Platforms Versus a Traditional Router
JUNOS software for SRX-series services gateways starts off as completely secure No Traffic Permitted
Add Rules to Allow Traffic
Restrictive
Ideal
Add Security to Block Traffic
Vulnerable
Traditional router starts off as completely vulnerable All Traffic Permitted
2009 Juniper Networks, Inc. All rights reserved.
17
JUNOS Software for SRX-series Services Gateways
JUNOS software for SRX-series services gateways provides routing and security
Best-in-class high-performance firewall derived from ScreenOS software, including security policies and zones IPsec VPNs IDP Integration ScreenOS
SRX 5600 services gateway
SRX 5800 services gateway
2009 Juniper Networks, Inc. All rights reserved.
18
JUNOS Software Features (1 of 2)
JUNOS software for SRX-series services gateways includes the following elements:
JUNOS software as the base operating system Session-based forwarding Some ScreenOS-like security features
Packet-based features:
Control plane OS Routing protocols Forwarding features:
Per-packet stateless filters Policers CoS
J-Web
2009 Juniper Networks, Inc. All rights reserved.
19
JUNOS Software Features (2 of 2)
Session-based features:
Implements some ScreenOS features and functionality through the use of new daemons First packet of flow triggers session creation based on:
Source and destination IP address Source and destination port Protocol Session token
Zone-based security features
Packet on the incoming interface is associated with the incoming zone Packet on the outgoing interface is associated with the outgoing zone
Core security features:
Firewall, VPN, NAT, ALGs, IDP, and SCREEN options
2009 Juniper Networks, Inc. All rights reserved.
20
Control Plane Versus Data Plane
Control Plane:
Implemented on the Routing Engine JUNOS software kernel, daemons, chassis management, user interface, routing protocols, system monitoring, clustering control
Data Plane:
Implemented on the IOCs and SPCs Forwarding packets, session setup and maintenance, load-balancing, security policy, screen options, IDP, VPN
2009 Juniper Networks, Inc. All rights reserved.
21
Logical Packet Flow
Forwarding Lookup Flow Module
SCREEN D-NAT Route Zones Policy S-NAT Services Session Options ALG No Match Session ?
First Path
Yes SCREEN TCP Options NAT Services ALG
Fast Path
Per Packet Filters
Per-Packet Policers / Shapers Event Scheduler
2009 Juniper Networks, Inc. All rights reserved.
22
Session Management
Sessions are maintained in the session hash table for packet matching and processing When no traffic matches the session during the service timeout, the session is aged out Run-time changes during the lifetime of the session might be propagated into the session
Routing changes are always propagated into the session Security policy changes are propagated based on configuration
2009 Juniper Networks, Inc. All rights reserved.
23
Packet Flow Example (1 of 3)
[Link]/24
.1 .254
Private Zone
External Zone
.254
Web Server
Internet
[Link]
[Link]/24
[Link]
[Link]/24
[Link]/24 Host-B
.1
[Link]/24
[Link]/24
.254
[Link]/24
.1 B
.254
[Link]
Public Zone
[Link]
2009 Juniper Networks, Inc. All rights reserved.
24
Packet Flow Example (2 of 3)
Example:
SRC-IP
[Link]
DST-IP
[Link]
Protocol SRC-Port DST-Port
6 29218 80
1. Existing session?
No
Source Address
Source Port
Session Table Destination Destination Address Port
Protocol
Int
2. Destination reachable?
Yes
3. Interzone traffic?
Yes
Routing Table Network Interface [Link]/24 ge-0/0/0 [Link]/24 ge-0/0/1 [Link]/24 ge-0/0/0 [Link]/24 ge-0/0/1 [Link]/0 ge-1/0/0
Next-hop (connected) (connected) [Link] [Link] [Link]
...
Zone Table Interface Zone ge-0/0/1 ge-0/0/0 ge-0/0/3 ge-1/0/0 Private Private Public External
2009 Juniper Networks, Inc. All rights reserved.
25
Packet Flow Example (3 of 3)
Example:
4. Permitted by policy?
Yes
From Private to External SA [Link]/16 [Link]/16 [Link]/16 any DA any any any any Service FTP HTTP ping any Action permit permit permit deny
5. Action: add to session table 6. Action: forward packet
Source Address [Link] [Link]
Source Port 29218 80
Session Table Destination Destination Protocol Interface Address Port [Link] [Link] 80 29218 6 6 ge-1/0/0.0 ge-0/0/1.0
SRC-IP
[Link]
DST-IP
[Link]
Protocol SRC-Port DST-Port
6 29218 80
2009 Juniper Networks, Inc. All rights reserved.
26