Add Course Title Here

Device Security and Firewall

Filters

© 2010 Juniper Networks, Inc. All rights reserved. | [Link]

Traffic Storms

 Some traffic types, such as broadcast and unknown

unicast, can continuously propagate through a LAN
consuming resources and affecting performance
User A initiates traffic to a destination MAC
address not known or located in the network

User A User C
Switch-1 Switch-2
MAC: 00:26:88:02:74:86 MAC: 00:26:88:02:74:88

User B Traffic User D

Flood Flood
MAC: 00:26:88:02:74:87 Storm MAC: 00:26:88:02:74:89

Switch-3

Flood
User E User F
MAC: 00:26:88:02:74:90 MAC: 00:26:88:02:74:91

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 2

Chapter 1: Course Introduction 1

Add Course Title Here

Introducing Storm Control

 Storm control monitors traffic levels and drops traffic

when the threshold (storm control level) is exceeded
•Prevents traffic from proliferating and degrading the LAN
Switch-1

Traffic
Storm

The storm control feature ensures traffic storms do not degrade LAN performance

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 3

Storm Control Configuration

 Storm control is enabled by default on EX switches

•Default storm control level is 80 percent for all interfaces
•You can modify the default configuration settings at the
[edit ethernet-switching-options] hierarchy
{master:0}[edit]
user@Switch-1# load factory-default Switch-1
warning: activating factory configuration

{master:0}[edit]
user@Switch-1# show ethernet-switching-options
storm-control {
interface all;
}
Bandwidth … 100 … 10,000,000 kbps
No-broadcast;
No-unknow-unicast

Note: Using the default configuration, all broadcast and unknown unicast traffic in excess of 80 percent is dropped.

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 4

Chapter 1: Course Introduction 2

Add Course Title Here

Changing the Default Configuration

 Before modifying the default configuration, monitor

broadcast and unknown unicast traffic levels in LAN
under normal operating conditions
•Use benchmark data to determine acceptable traffic levels
•Configure storm control to set the level at which you want to
drop broadcast traffic, unknown unicast traffic, or both.

Is too high?

Default Storm Control Level Is acceptable?

Is too low?

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 5

Storm Control Actions

 When the storm control level is exceeded, the switch

can either drop offending traffic (default) or shut down
the interface through which the traffic is passing
{master:0}[edit ethernet-switching-options]
user@Switch-1# show
storm-control { Traffic is discarded
interface all;
}
Bit Bucket

{master:0}[edit ethernet-switching-options]
user@Switch-1# show
storm-control {
action-shutdown;
interface all;
} Interface is disabled
Use the action-shutdown
option to alter the default behavior

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 6

Chapter 1: Course Introduction 3

Add Course Title Here

Automatic Error Condition Recovery

 By default, when the action-shutdown option is

used and the storm control level is exceeded the
interface is shut down until it is manually re-enabled
 Alternatively, you can automate error condition recovery
using the port-error-disable option:
{master:0}[edit ethernet-switching-options]
user@Switch-1# show
port-error-disable {
Specify a disable timeout value
disable-timeout 300;
between 10 and 3600 seconds
}
storm-control {
action-shutdown;
interface all;
}

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 7

Monitoring Automatic Recovery

 You can monitor the automatic recovery process by:

•Using show ethernet-switching interfaces to
view interface state details:
{master:0}
user@Switch-1> show ethernet-switching interfaces
Interface State VLAN members Tag Tagging Blocking
ge-0/0/6.0 up v11 11 untagged unblocked
ge-0/0/8.0 up v11 11 tagged unblocked
ge-0/0/9.0 down v11 11 tagged Storm control in effect
(00:03:57) remaining
me0.0 up mgmt untagged unblocked

•Using show log messages to view violation details:

{master:0}
user@Switch-1> show log messages | match storm | match ge-0/0/9
Jul 29 09:38:23 Switch-1 eswd[856]: ESWD_ST_CTL_ERROR_DISABLED: ge-0/0/9.0: storm control
disabled port
Jul 29 09:43:23 Switch-1 eswd[856]: ESWD_ST_CTL_ERROR_ENABLED: ge-0/0/9.0: storm control
enabled port

Interface was re-enabled after disable timeout period (5 minutes)

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 8

Chapter 1: Course Introduction 4

Add Course Title Here

Clearing Violations Manually

 Use clear ethernet-switching port-error

interface to clear violations manually:
{master:0}
user@Switch-1> show ethernet-switching interfaces
Interface State VLAN members Tag Tagging Blocking
ge-0/0/6.0 up v11 11 untagged unblocked
ge-0/0/8.0 up v11 11 tagged unblocked
ge-0/0/9.0 down v11 11 tagged Storm control in effect
(00:04:17) remaining
me0.0 up mgmt untagged unblocked

{master:0}
user@Switch-1> clear ethernet-switching port-error interface ge-0/0/9

{master:0}
user@Switch-1> show ethernet-switching interfaces
Interface State VLAN members Tag Tagging Blocking
ge-0/0/6.0 up v11 11 untagged unblocked
ge-0/0/8.0 up v11 11 tagged unblocked
ge-0/0/9.0 up v11 11 tagged unblocked
me0.0 up mgmt untagged unblocked

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 9

Firewall Filters: A Review

 Firewall filters control the traffic entering and leaving

a networking device in a stateless fashion:
•Processes every packet independently
•Used to filter and monitor network traffic

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 10

Chapter 1: Course Introduction 5

Add Course Title Here

Firewall Filter Types

 Firewall filter types include:

Filter Type Application Description
Port-based Applied to Layer 2 switch ports in ingress and egress directions
VLAN-based Applied to Layer 2 VLANs in the ingress and egress directions
Router-based Applied to Layer 3 routed interfaces in ingress and egress
directions
{master:0}[edit firewall]
user@Switch-1# edit family ?
Possible completions:
> any Protocol-independent filter
> ethernet-switching Protocol family Ethernet Switching for firewall filter
> inet Protocol family IPv4 for firewall filter
> inet6 Protocol family IPv6 for firewall filter

Port-based and VLAN-based filters use family ethernet-switching option while router-
based filters use family inet or family inet6 depending on the traffic type

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 11

Processing Order of Firewall Filters

 Processing order considerations:

•Ingress processing order is port, VLAN, then router
•Egress processing is performed in the reverse order
•A router-based filter applied to an RVI does not apply to
switched packets in the same VLAN

Router Filter Router Filter

VLAN Filter VLAN Filter

Port Filter Port Filter

Rx Packet Tx Packet

Input Output

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 12

Chapter 1: Course Introduction 6

Add Course Title Here

Building Blocks of Firewall Filters

Firewall filters consist of one or

more terms; the software evaluates my-filter
terms sequentially until it reaches a User-defined filter
terminating action and term names

term firstterm
from then
match
no match
term secondterm
then statements describe the
from statements describe
from then actions to take if a match with
match conditions
match the from statement occurs
no match
term Default
Default action for packets
discard not explicitly allowed

Note: Ordering matters! If you must reorder terms within a filter, consider using the insert CLI command.

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 13

Common Match Criteria

 Can match based on most header fields:

 Match conditions categories include:

•Numeric range
•Address
•Bit field

term firstterm
The from statements
describe match conditions
from then
match

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 14

Chapter 1: Course Introduction 7

Add Course Title Here

Firewall Filter Actions

 Common actions in firewall filters:

•Terminating actions:
• accept
• discard
• reject
•Action modifiers:
• analyzer, count, log, and syslog
• forwarding-class and loss-priority
• policer
term firstterm
The then statements
from then describe actions to take
match

Note: The software discards all traffic not explicitly allowed!

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 15

Case Study: Topology and Objectives

 Objectives:
•Implement filters on the access ports so that only frames
using the expected source MAC addresses are permitted
• Discard and count frames sourced from any other MAC addresses
•Implement a filter on both VLANs to block frames destined
to MAC address 01:80:c2:00:00:00
• Discard and count frames destined to the referenced MAC address

User A - (VLAN: v11)

[Link]/24
MAC: 00:26:88:02:74:86 Switch-1

Access ports

User B - (VLAN: v12)

[Link]/24
MAC: 00:26:88:02:74:87

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 16

Chapter 1: Course Introduction 8

Add Course Title Here

Case Study: Configuring the Filters (1 of 2)

{master:0}[edit firewall family ethernet-switching] {master:0}[edit firewall family ethernet-switching]
user@Switch-1# show filter limit-MAC-ge006 user@Switch-1# show filter limit-MAC-ge007
term 1 { term 1 {
from { from {
source-mac-address { source-mac-address {
00:26:88:02:74:86; 00:26:88:02:74:87;
} }
} }
then accept; then accept;
} }
term 2 { term 2 {
then { then {
discard; discard;
count ge006-invalid-MAC; count ge007-invalid-MAC;
} }
} }

User A - (VLAN: v11)

[Link]/24
MAC: 00:26:88:02:74:86 Switch-1

Access ports

User B - (VLAN: v12)

[Link]/24
MAC: 00:26:88:02:74:87

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 17

Case Study: Configuring the Filters (2 of 2)

{master:0}[edit firewall family ethernet-switching]
user@Switch-1# show filter block-dest-MAC-01:80:c2:00:00:00
term 1 {
from {
destination-mac-address {
01:80:c2:00:00:00;
}
}
then {
discard;
count block-stp-bpdus;
}
}
term 2 {
then accept;
}

User A - (VLAN: v11)

[Link]/24
MAC: 00:26:88:02:74:86 Switch-1

Access ports

User B - (VLAN: v12)

[Link]/24
MAC: 00:26:88:02:74:87

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 18

Chapter 1: Course Introduction 9

Add Course Title Here

Case Study: Applying the Filters (1 of 2)

{master:0}[edit interfaces] {master:0}[edit interfaces]
user@Switch-1# show ge-0/0/6 user@Switch-1# show ge-0/0/7
unit 0 { unit 0 {
family ethernet-switching { family ethernet-switching {
vlan { vlan {
members v11; members v12;
} }
filter { filter {
input limit-MAC-ge006; input limit-MAC-ge007;
} }
} }
} }

User A - (VLAN: v11)

[Link]/24
MAC: 00:26:88:02:74:86 Switch-1

Access ports

User B - (VLAN: v12)

[Link]/24
MAC: 00:26:88:02:74:87

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 19

Case Study: Applying the Filters (2 of 2)

{master:0}[edit vlans]
user@Switch-1# show
v11 {
vlan-id 11;
filter {
input block-dest-MAC-01:80:c2:00:00:00;
}
l3-interface vlan.11;
}
v12 {
vlan-id 12;
filter {
input block-dest-MAC-01:80:c2:00:00:00;
}
l3-interface vlan.12;
}

User A - (VLAN: v11)

[Link]/24
MAC: 00:26:88:02:74:86 Switch-1

Access ports

User B - (VLAN: v12)

[Link]/24
MAC: 00:26:88:02:74:87

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 20

Chapter 1: Course Introduction 10

Add Course Title Here

Case Study: Monitoring Firewall Filters

{master:0}
user@Switch-1> show firewall

Filter: block-dest-MAC-01:80:c2:00:00:00
Counters:
Name Bytes Packets
block-stp-bpdus 472 7

Filter: limit-MAC-ge006
Counters:
Name Bytes Packets
ge006-invalid-MAC 1148 12

Filter: limit-MAC-ge007
Counters:
Name Bytes Packets
ge007-invalid-MAC 842 9

User A - (VLAN: v11)

[Link]/24
MAC: 00:26:88:02:74:86 Switch-1

Access ports

User B - (VLAN: v12)

[Link]/24
MAC: 00:26:88:02:74:87

© 2010 Juniper Networks, Inc. All rights reserved. [Link] | 21

Chapter 1: Course Introduction 11