家向けSRXコンフィグ¶
基本設定¶
# これは最初に必要
set system root-authentication set system host-name srx-home
# タイムゾーン設定
set system time-zone Asia/Tokyo
# タイムアウトを設定するユーザ向け
set system login class super-user-local idle-timeout 1800
set system login class super-user-local permissions all
# ユーザを作る
set system login user kanai uid 1000
set system login user kanai class super-user-local
set system login user kanai authentication plain
# このあたりはご自由に(特にtelnet)
set system services ssh
set system services telnet
set system services netconf ssh
# 主にlocal向けのsyslog設定
set system syslog archive size 10m
set system syslog archive files 5
set system syslog user * any emergency
set system syslog user * authorization info
set system syslog file messages any notice
set system syslog file messages authorization info
set system syslog file interactive-commands interactive-commands any
set system syslog time-format
# syslogを外部に出すときのsource addr
set system syslog source-address 192.168.100.253
# rollbackできるConfigの数
set system max-configurations-on-flash 49
set system max-configuration-rollbacks 49
# NTP
set system ntp server 210.173.160.57
set system ntp server 210.173.160.27
set system ntp server 210.173.160.87
set system ntp source-address 192.168.101.252
# netflow向け
set forwarding-options sampling input rate 8192
# SNMP
set snmp community public authorization read-only
set snmp community public clients 192.168.100.0/24
set snmp trap-options source-address lo0
ブロードバンドルータ設定¶
ここでは、port0をpppoeにつかい、port7をmgmtに使います。
# ユーザセグメント
set interfaces fe-0/0/2 unit 0 family ethernet-switching port-mode access
set interfaces fe-0/0/2 unit 0 family ethernet-switching vlan members v100
set interfaces fe-0/0/3 unit 0 family ethernet-switching vlan members v100
set interfaces fe-0/0/4 unit 0 family ethernet-switching vlan members v100
set interfaces fe-0/0/5 unit 0 family ethernet-switching vlan members v100
set interfaces fe-0/0/6 unit 0 family ethernet-switching vlan members v100
# ユーザ向けセグメント設定
set vlans v100 vlan-id 100
set vlans v100 l3-interface vlan.100
set interfaces vlan unit 100 family inet address 192.168.1.1/24
# mgmtセグメント
set interfaces fe-0/0/7 description mgmt
set interfaces fe-0/0/7 unit 0 family inet address 192.168.101.252/24
# ここをunderlayI/Fとして指定する。
set interfaces fe-0/0/0 description "pppoe uplink"
set interfaces fe-0/0/0 unit 0 encapsulation ppp-over-ether
# overlayのPPの設定
set interfaces pp0 unit 0 ppp-options chap default-chap-secret ""
set interfaces pp0 unit 0 ppp-options chap local-name "a@ocn.ne.jp"
set interfaces pp0 unit 0 ppp-options chap passive
set interfaces pp0 unit 0 pppoe-options underlying-interface fe-0/0/0.0
set interfaces pp0 unit 0 pppoe-options auto-reconnect 10
set interfaces pp0 unit 0 pppoe-options client
set interfaces pp0 unit 0 family inet mtu 1454
set interfaces pp0 unit 0 family inet negotiate-address
ルータとしての基本設定¶
set interfaces lo0 unit 0 family inet address 127.0.0.1/32
set interfaces lo0 unit 0 family inet address 192.168.255.253/32
set interfaces lo0 unit 0 family inet6 address fd00::253/128
# router用の設定
set routing-options router-id 192.168.255.253
set routing-options autonomous-system 65000
# RA用の設定
set protocols router-advertisement traceoptions file ra.log
set protocols router-advertisement traceoptions flag all
# BGP用の基本設定
set protocols bgp traceoptions file bgp.log
set protocols bgp traceoptions flag open
set protocols bgp hold-time 180
set protocols bgp group iBGP type internal
set protocols bgp group iBGP family inet unicast prefix-limit maximum 100
# route limitのteardown設定
set protocols bgp group iBGP family inet unicast prefix-limit teardown idle-timeout forever
set protocols bgp group iBGP local-as 65000
# ospfv2,v3,lldp周りの最低限の設定
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface lo0.0 metric 1
set protocols ospf3 area 0.0.0.0 interface lo0.0 passive
set protocols ospf3 area 0.0.0.0 interface lo0.0 metric 1
# 以下は経路はくときのテスト用
set routing-options rib inet6.0 static route fd00::ffff/128 discard
set routing-options static route 255.0.0.0/32 discard
# lldp
set protocols lldp interface all
set protocols lldp-med interface all
ホストフィルタ¶
これは、SRX自身へのアクセスを制限するものです。
# telnetはアドレス制限にしています
set firewall family inet filter telnet-access term telnet-permit from source-address 192.168.100.0/24
set firewall family inet filter telnet-access term telnet-permit from source-address 192.168.200.0/24
set firewall family inet filter telnet-access term telnet-permit from protocol tcp
set firewall family inet filter telnet-access term telnet-permit from destination-port telnet
set firewall family inet filter telnet-access term telnet-permit from destination-port ssh
set firewall family inet filter telnet-access term telnet-permit then accept
set firewall family inet filter telnet-access term telnet-deny from protocol tcp
set firewall family inet filter telnet-access term telnet-deny from destination-port telnet
set firewall family inet filter telnet-access term telnet-deny from destination-port ssh
set firewall family inet filter telnet-access term telnet-deny then discard
# BGPに関しては定義されているneighbor単位でのacceptにします
# これによって、bgpを用いたtcp syn attackを防ぎます
set policy-options prefix-list bgp-peers apply-path "protocols bgp group <*> neighbor <*>;"
set firewall family inet filter bgp-access term bgp-permit from prefix-list bgp-peers
set firewall family inet filter bgp-access term bgp-permit from protocol tcp
set firewall family inet filter bgp-access term bgp-permit from port 179
set firewall family inet filter bgp-access term bgp-permit then accept
set firewall family inet filter bgp-access term bgp-deny from protocol tcp
set firewall family inet filter bgp-access term bgp-deny from port 179
set firewall family inet filter bgp-access term bgp-deny then discard
# それ以外に関しては一度すべてをpassするようにしています
set firewall family any filter permit-all term permit-all then accept
ルーティングインスタンス¶
このネットワークでは、mgmtとlanのセグメントは完全に分離します。 mgmtをRIできる方法もありますが、ntpやDNSなどがRI上にあると、JUNOS 17以下ではうまく動かないので、 ユーザセグメントをRIとして切ることにします。
set routing-instances lan instance-type virtual-router
set routing-instances lan interface fe-0/0/0.0
# pppoeはlanの出口なので、同じVLANに入れておきます
set routing-instances lan interface pp0.0
# vlan100はユーザ用VLAN
set routing-instances lan interface vlan.100
# default gateはpppoeに向けます
set routing-instances lan routing-options static route 0.0.0.0/0 next-hop pp0.0
ユーザ向けRIのDHCPd¶
RI上でDHCPを上げるには、system dhcpではなく、access poolで設定しないといけません（多分）
set routing-instances lan system services dhcp-local-server group pool_vlan_100 interface vlan.100
set routing-instances lan access address-assignment pool pool_vlan_100 family inet network 192.168.1.0/24
set routing-instances lan access address-assignment pool pool_vlan_100 family inet range dhcp low 192.168.1.100
set routing-instances lan access address-assignment pool pool_vlan_100 family inet range dhcp high 192.168.1.199
set routing-instances lan access address-assignment pool pool_vlan_100 family inet dhcp-attributes maximum-lease-time 300
set routing-instances lan access address-assignment pool pool_vlan_100 family inet dhcp-attributes name-server 192.168.1.1
set routing-instances lan access address-assignment pool pool_vlan_100 family inet dhcp-attributes router 192.168.1.1
mgmt向けrouting¶
mgmtで必要な経路を書きます。 基本的にMGMTはこのSRXで外部にroutingしません。
# mgmt内のntp routing
set routing-options rib inet.0 static route 210.173.160.57/32 next-hop 192.168.101.1
set routing-options rib inet.0 static route 210.173.160.27/32 next-hop 192.168.101.1
set routing-options rib inet.0 static route 210.173.160.87/32 next-hop 192.168.101.1
set routing-options rib inet.0 static route 8.8.8.8/32 next-hop 192.168.101.1
DHCP on VRF¶
# 以下は古い試行なので無視
set system services dhcp router 192.168.1.1
set system services dhcp pool 192.168.1.0/24 address-range low 192.168.1.2
set system services dhcp pool 192.168.1.0/24 address-range high 192.168.1.254
set system services dhcp propagate-settings fe-0/0/0.0
NAT¶
普通のNAT設定です
set security nat source rule-set trust-to-untrust from zone trust
set security nat source rule-set trust-to-untrust to zone untrust
set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 0.0.0.0/0
set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface
zone間ポリシ¶
明示的なpermit
set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any
set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any
set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit
set security policies default-policy deny-all
zone設定¶
# 家では便利性からTrustからのすべて受け取る
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces vlan.100
set security zones security-zone untrust screen untrust-screen
set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services dhcp
set security zones security-zone untrust interfaces fe-0/0/1.0 host-inbound-traffic system-services dhcpv6
set security zones security-zone untrust interfaces pp0.0
# mgmt
set security zones security-zone mgmt host-inbound-traffic system-services all
set security zones security-zone mgmt host-inbound-traffic protocols all
set security zones security-zone mgmt interfaces fe-0/0/7.0
SRX de MAC RADIUS認証¶
インストール¶
sudo apt-get instll freeradius
clients.conf
client 192.168.101.0/24{
secret = secret
}
service freeradius reload
"radiusd.conf"
auth = yes
auth_badpass = yes
auth_goodpass = yes
eap.conf
peap {
use_tunneled_reply = yes
00247ffffff Auth-type:=EAP, User-Password := "00247effffff"
Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "v200"
のように書く。
SRX側の設定¶
https://www.juniper.net/documentation/en_US/junos/topics/example/802-1x-pnac-ex-series-connecting-server-configuring.html
# radiusサーバの設定
set access radius-server 192.168.101.22 secret public
set access profile raspi-radius authentication-order radius
set access profile raspi-radius radius authentication-server 192.168.101.22
# インタフェースにそのプロファイルでの認証を紐づける
set protocols dot1x authenticator interface fe-0/0/6.0 mac-radius restrict
set protocols dot1x authenticator authentication-profile-name raspi-radius
set protocols dot1x traceoptions flag all
set protocols dot1x traceoptions file _dot1x
認証の確認¶
show vlans
show dot1x interface
> fe-0/0/6.0 Authenticator Authenticated 00:24:7E:16:31:1E 00247e16311e
注意¶
set interfaces fe-0/0/6 unit 0 family ethernet-switching vlan members v100
とあってもRADIUSからの応答で上書きしてしまうので注意！