Juniper srx650 protection firewall public IP address attacked method 1

 

The Intranet accesses the Internet through the NAT of the source address. Generally, this public IP address is the firewall IP address, that is, the Intranet public IP address. By default, the Administrator opens http, https, ssh, and other ports for ease of management. In this way, the password is easily guessed by people on the Internet. The following measures are taken:

Services related to open systems:

Set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh

Set system services ssh

Set system services telnet

Set system services web-management http interfaces ge-0/0/3.0

Set system services web-management https system-generated-certificate

Set system services web-management https interface ge-0/0/1.0

Set security zones security-zone trust host-inbound-traffic system-services all

Set security zones security-zone trust host-inbound-traffic protocols all

Set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services dhcp

Set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ping

Set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services http

Set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services https

Set security zones security-zone trust interfaces ge-0/0/1.0 host-inbound-traffic system-services ssh

The idea is as follows:

Disable the service of the public ip address, and map the Management port of the internal IP address of the firewall to a port of another public network.

Delete security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services ssh

/*/Create Element

Set security zones security-zone trust address-book address juniper2541 192.168.254.1/32

# Create a NAT

Set security nat destination pool 2541 address 192.168.254.1/32

Set security nat destination pool 2541 address port 22

Set security nat destination rule-set 1 rule 2541 match source-address 0.0.0.0/0

Set security nat destination rule-set 1 rule 2541 match destination-address 113.106.95.x/32

Set security nat destination rule-set 1 rule 2541 match destination-port 1055

Set security nat destination rule-set 1 rule 2541 then destination-nat pool 2541

# Creating a policy

Set security policies ies from-zone untrust to-zone trust policy yc2541 match source-address any

Set security policies ies from-zone untrust to-zone trust policy yc2541 match destination-address juniper2541

Set security policies ies from-zone untrust to-zone trust policy yc2541 match application juniper1055

Set security policies ies from-zone untrust to-zone trust policy yc2541 then permit

 

 

 

This article is from the "third-party" blog