Block websites or applications using SRx Firewall
Hi, everyone on today we are going discuss on how to block websites or applications now this is trending news that many officials social media accounts are hacked. We will see in juniper SRx Firewall.
Some of the websites are not easy to block using web filter because they used signature and dynamic IPs, but we can block through Application Firewall.
This example uses following zones and interfaces configuration.
The client system is connected to the ge-0/0/0.0 interface with IP address 4.0.0.254/24. It is part of the trust zone.
The server system is connected to the ge-0/0/1.0 interface with IP address 5.0.0.254/24. It is part of the untrust zone.
• Configuration
》CLI Quick Configuration
To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.
set security dynamic-application profile profile1 redirect-message type custom-text content "THIS APPLICATION IS BLOCKED"
set security policies from-zone trust to-zone untrust policy policy-1 match source-address any
set security policies from-zone trust to-zone untrust policy policy-1 match destination-address any
set security policies from-zone trust to-zone untrust policy policy-1 match application any
set security policies from-zone trust to-zone untrust policy policy-1 match dynamic-application junos:TWITTER-ACCESS
set security policies from-zone trust to-zone untrust policy policy-1 match dynamic-application junos:FACEBOOK-ACCESS
set security policies from-zone trust to-zone untrust policy policy-1 then reject profile profile1
set security policies default-policy permit-all
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust interfaces ge-0/0/0.0
set security zones security-zone untrust host-inbound-traffic system-services all
set security zones security-zone untrust interfaces ge-0/0/1.0
set interfaces ge-0/0/0 unit 0 family inet address 4.0.0.254/24
set interfaces ge-0/0/1 unit 0 family inet address 5.0.0.254/24
• To configure a unified policy using dynamic applications:
》Configure security zones and interfaces.
[edit]
user@host#set security zones security-zone trust host-inbound-traffic system-services all
user@host#set security zones security-zone trust interfaces ge-0/0/0.0
user@host#set security zones security-zone untrust host-inbound-traffic system-services all
user@host#set security zones security-zone untrust interfaces ge-0/0/1.0
user@host#set interfaces ge-0/0/0 unit 0 family inet address 4.0.0.254/24
user@host#set interfaces ge-0/0/1 unit 0 family inet address 5.0.0.254/24
》Create redirect profile
[edit]
user@host#set security dynamic-application profile profile1 redirect-message type custom-text content "THIS APPLICATION IS BLOCKED"
》Create a security policy with a dynamic application as the match criteria.
[edit]
user@host#set security policies from-zone trust to-zone untrust policy policy-1 match source-address any
user@host#set security policies from-zone trust to-zone untrust policy policy-1 match destination-address any
user@host#set security policies from-zone trust to-zone untrust policy policy-1 match application any
user@host#set security policies from-zone trust to-zone untrust policy policy-1 match dynamic-application junos:TWITTER-ACCESS
user@host#set security policies from-zone trust to-zone untrust policy policy-1 match dynamic-application junos:FACEBOOK-ACCESS
user@host#set security policies from-zone trust to-zone untrust policy policy-1 then reject profile profile1
》Create a default policy to permit the remaining traffic.
[edit]
user@host#set security policies default-policy permit-all
• Result :
From configuration mode, confirm your configuration by entering the show security policies command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.
[edit]
user@host# show security
dynamic-application {
profile profile1 {
redirect-message {
type {
custom-text {
content "THIS APPLICATION IS BLOCKED";
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy policy-1 {
match {
source-address any;
destination-address any;
application any;
dynamic-application [junos:Twitter-ACCESS junos:FACEBOOK-ACCESS ];
}
then {
reject {
profile profile1;
}
}
}
}
default-policy {
permit-all;
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
ping;
}
}
interfaces {
ge-0/0/0.0;
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
ping;
}
}
interfaces {
ge-0/0/1.0;
}
}
}
[edit]
user@host# show interfaces
ge-0/0/0 {
unit 0 {
family inet {
address 4.0.0.254/24;
}
}
}
ge-0/0/1 {
unit 0 {
family inet {
address 5.0.0.254/24;
}
}
}
fxp0 {
unit 0 {
family inet {
address 10.102.70.185/24;
}
}
}
If you are done configuring the device, enter commit from configuration mode.
Therefore we can check in browse r to check whether it is blocked or not.
Stay tuned for more juniper concepts and day to day life in networking will be shared.
Comments
Post a Comment