JN0-105 Routing Policy and Firewall Filters

Routing Policy and Firewall Filters Detailed Explanation

Routing policies and firewall filters are essential tools in Junos OS for managing how traffic and routes are handled. This guide explains their purposes, configuration, and differences, providing clear examples to help you understand their roles in a network.

Routing Policies

Routing policies determine how routes are handled in the routing table. They allow you to control which routes are accepted, rejected, or modified based on specific criteria.

1. Default Policy Behavior

• In Junos OS:
  • Routes are implicitly discarded unless explicitly allowed by a routing policy.
  • This default behavior ensures that only intended routes are included in the routing table.

2. Configuring Routing Policies

Routing policies are defined using a series of terms, conditions, and actions.

• Syntax Overview:

  set policy-options policy-statement <policy-name> term <term-name> from <condition>
  set policy-options policy-statement <policy-name> term <term-name> then <action>
  

• Example: Configure a routing policy to accept only routes learned via BGP:

  set policy-options policy-statement IMPORT_POLICY term 1 from protocol bgp
  set policy-options policy-statement IMPORT_POLICY term 1 then accept
  

• Explanation:

  • policy-options policy-statement IMPORT_POLICY: Creates a policy named IMPORT_POLICY.
  • term 1: Defines the first rule within the policy.
  • from protocol bgp: Specifies the condition (only routes learned via BGP).
  • then accept: Specifies the action (accept the matching routes).

• Applying a Policy: Once a policy is created, it must be applied to a routing process:

  set protocols bgp group EXTERNAL import IMPORT_POLICY
  

Firewall Filters

Firewall filters operate at the packet level, allowing you to control traffic flow into or out of interfaces. They classify, restrict, or block traffic based on specified conditions.

1. Purpose

• Traffic Control:
  • Decide which packets are allowed or denied.
• Traffic Classification:
  • Group packets into classes based on characteristics (e.g., protocol, port, source IP).
• Traffic Restriction:
  • Limit access to sensitive resources or prevent unwanted traffic.

2. Configuring Firewall Filters

Firewall filters are composed of terms, each defining specific conditions and actions.

• Syntax Overview:

  set firewall family inet filter <filter-name> term <term-name> from <condition>
  set firewall family inet filter <filter-name> term <term-name> then <action>
  

• Example: Configure a firewall filter to allow HTTP traffic:

  set firewall family inet filter TEST_FILTER term ALLOW_HTTP from protocol tcp
  set firewall family inet filter TEST_FILTER term ALLOW_HTTP from destination-port 80
  set firewall family inet filter TEST_FILTER term ALLOW_HTTP then accept
  

• Explanation:

  • family inet: Specifies the IPv4 protocol family.
  • filter TEST_FILTER: Creates a filter named TEST_FILTER.
  • term ALLOW_HTTP: Defines a term named ALLOW_HTTP.
  • from protocol tcp: Matches only TCP traffic.
  • from destination-port 80: Matches packets destined for port 80 (HTTP).
  • then accept: Allows the matching packets.

• Applying a Filter: Filters must be applied to an interface for them to take effect:

  set interfaces ge-0/0/0 unit 0 family inet filter input TEST_FILTER
  

Differences Between Routing Policies and Firewall Filters

Feature	Routing Policies	Firewall Filters
Purpose	Control routes entering the routing table	Control packet flow at the interface
Scope	Operates at the control plane	Operates at the forwarding plane
Focus	Focuses on routing table entries	Focuses on traffic and data packets
Common Actions	Accept, reject, modify routing attributes	Accept, discard, count, log packets
Examples	Allowing BGP routes	Blocking all traffic except HTTP

Practical Examples

1. Routing Policy Workflow

• Scenario: You want to allow only OSPF routes into your routing table.

  • Create the policy:

    set policy-options policy-statement OSPF_POLICY term 1 from protocol ospf
    set policy-options policy-statement OSPF_POLICY term 1 then accept
    

  • Apply it to the OSPF process:

    set protocols ospf import OSPF_POLICY
    

2. Firewall Filter Workflow

• Scenario: You want to block all traffic except HTTP on a specific interface.

  • Create the filter:

    set firewall family inet filter BLOCK_ALL_EXCEPT_HTTP term ALLOW_HTTP from protocol tcp
    set firewall family inet filter BLOCK_ALL_EXCEPT_HTTP term ALLOW_HTTP from destination-port 80
    set firewall family inet filter BLOCK_ALL_EXCEPT_HTTP term ALLOW_HTTP then accept
    set firewall family inet filter BLOCK_ALL_EXCEPT_HTTP term BLOCK_OTHER then discard
    

  • Apply it to the interface:

    set interfaces ge-0/0/0 unit 0 family inet filter input BLOCK_ALL_EXCEPT_HTTP
    

Summary

• Routing Policies:

  • Control how routes are managed in the routing table.
  • Operate at the control plane level.
  • Typically used to implement routing strategies and enforce specific routing behaviors.

• Firewall Filters:

  • Control the flow of traffic through device interfaces.
  • Operate at the forwarding plane level.
  • Typically used for security, traffic shaping, or traffic classification.

Routing Policy and Firewall Filters (Additional Content)

1. Routing Policies

Policy Priority and Multiple Conditions

• Priority and Policy Execution Order:
  In Junos OS, routing policies are applied based on priority and the sequence in which terms are configured. Policies are evaluated from top to bottom, and once a match is found, the corresponding action is applied, and the policy stops processing further terms. Therefore, the order of terms within a policy is crucial when multiple conditions exist.

  • Example:

    set policy-options policy-statement EXPORT_POLICY term 1 from protocol bgp
    set policy-options policy-statement EXPORT_POLICY term 2 from protocol ospf
    set policy-options policy-statement EXPORT_POLICY term 1 then accept
    set policy-options policy-statement EXPORT_POLICY term 2 then reject
    

  • Explanation:
    In this case, routes learned via BGP will be accepted, while those learned via OSPF will be rejected. The order of terms determines which protocol’s routes are processed first.

Modifying Routing Attributes

• Modifying Route Attributes:
  Routing policies not only allow the acceptance or rejection of routes but also enable the modification of routing attributes such as next-hop, preference, and metric.

  • Command Example:

    set policy-options policy-statement MODIFY_ROUTE term 1 from protocol ospf
    set policy-options policy-statement MODIFY_ROUTE term 1 then next-hop 192.168.1.254
    set policy-options policy-statement MODIFY_ROUTE term 1 then preference 10
    

  • Explanation:
    This example modifies the next-hop and preference for routes learned via OSPF. By setting a lower preference value, the route with this configuration will have higher priority over others.

Complex Condition Matching

• Combination of Conditions:
  Junos OS allows multiple conditions to be combined within a routing policy, enabling highly specific control over which routes are accepted. For example, you can define policies that match specific source addresses or protocols.

  • Command Example:

    set policy-options policy-statement CUSTOM_POLICY term 1 from source-address 192.168.1.0/24
    set policy-options policy-statement CUSTOM_POLICY term 1 then accept
    

  • Explanation:
    This policy accepts routes where the source address matches 192.168.1.0/24, allowing precise control over which routes are allowed based on their source address.

2. Firewall Filters

Stateful Packet Filtering

• Stateful Inspection:
  Juniper’s firewall filters support stateful inspection, which allows the filter to determine whether to accept or reject a packet based on the state of the connection. This is important for allowing return traffic for established connections while blocking new, potentially malicious connections.

  • Command Example:

    set firewall family inet filter STATEFUL_FILTER term ESTABLISHED then accept
    set firewall family inet filter STATEFUL_FILTER term ESTABLISHED from connection-state established
    

  • Explanation:
    This configuration ensures that only established connections can receive return traffic. It blocks new incoming connections that are not part of an already established session.

Outbound Traffic Control

• Outbound Traffic Control:
  In addition to filtering incoming traffic, firewall filters can also control outbound traffic. This is useful for preventing devices from sending unauthorized traffic to the internet or other networks.

  • Command Example:

    set interfaces ge-0/0/0 unit 0 family inet filter output MY_OUTPUT_FILTER
    

  • Explanation:
    This configuration applies the MY_OUTPUT_FILTER filter to outgoing traffic on interface ge-0/0/0, controlling which traffic is allowed to leave the device.

Application Layer Filtering

• Application Layer Filtering:
  Junos OS firewall filters support filtering traffic at the application layer, which allows blocking specific types of traffic, such as DNS or HTTP. This helps secure the network by preventing undesired application-level traffic.

  • Command Example:

    set firewall family inet filter BLOCK_APPS term BLOCK_DNS from protocol udp
    set firewall family inet filter BLOCK_APPS term BLOCK_DNS from destination-port 53
    set firewall family inet filter BLOCK_APPS term BLOCK_DNS then discard
    

  • Explanation:
    This configuration blocks DNS traffic (UDP packets destined for port 53), preventing DNS queries from passing through the device.

Firewall Logging

• Logging Filtered Traffic:
  Firewall filters can log traffic that is accepted, discarded, or counted. Logging is important for security monitoring and troubleshooting, as it provides insight into blocked or allowed traffic.

  • Command Example:

    set firewall family inet filter LOG_FILTER term BLOCK_DNS then log
    

  • Explanation:
    This configuration logs all packets that are discarded by the BLOCK_DNS term, helping administrators identify any attempted DNS requests that are blocked.

Traffic Counting

• Counting Traffic:
  Firewall filters can also count the number of packets that match specific terms. This can be useful for traffic analysis, monitoring, and generating statistics.

  • Command Example:

    set firewall family inet filter COUNT_FILTER term ALLOW_HTTP then count
    

  • Explanation:
    This configuration counts the number of packets matching the ALLOW_HTTP term. This could be useful for analyzing HTTP traffic volume.

3. Using Routing Policies and Firewall Filters Together

Integrating Firewall Filters into Routing Policies

• In some scenarios, it might be beneficial to combine firewall filters with routing policies to control both routing and traffic flow. For example, you can use a firewall filter to block specific types of traffic and a routing policy to control how those routes are advertised or imported.

  • Command Example:

    set policy-options policy-statement EXPORT_POLICY term 1 from protocol bgp
    set policy-options policy-statement EXPORT_POLICY term 1 then accept
    set firewall family inet filter MY_FILTER term BLOCK_OTHER then discard
    set protocols bgp group EXTERNAL import EXPORT_POLICY
    set interfaces ge-0/0/0 unit 0 family inet filter input MY_FILTER
    

  • Explanation:
    This configuration integrates a firewall filter (MY_FILTER) with a routing policy (EXPORT_POLICY). The BGP routes are accepted based on the policy, while traffic on ge-0/0/0 is filtered by the firewall. This ensures that both routing decisions and traffic filtering are applied appropriately.

4. Summary and Best Practices

Routing Policies

• Selective Routing Control: Routing policies provide fine-grained control over which routes are accepted, modified, or rejected.
• Policy Order: The order of terms in a routing policy is important; the first matching term is executed, and subsequent terms are ignored.
• Modifying Route Attributes: Routing policies allow for the modification of attributes such as next-hop, preference, and metric, in addition to accepting or rejecting routes.

Firewall Filters

• Fine-Grained Traffic Control: Firewall filters allow for detailed control over traffic based on IP addresses, ports, protocols, and even application layer protocols.
• Stateful Inspection and Logging: Firewall filters support stateful inspection, allowing return traffic from established connections. They also provide logging capabilities to track filtered traffic.
• Application Layer Filtering: Junos OS supports filtering based on higher-layer protocols like HTTP and DNS, allowing for more specific traffic management.

By leveraging routing policies and firewall filters together, administrators can achieve a highly secure and efficient network configuration that aligns with both routing and traffic filtering requirements.