Concepts & Examples ScreenOS Reference Guide

Transcription

1 Concepts & Examples ScreenOS Reference Guide Overview Release 6.3.0, Rev. 02 Published: Revision 02

2 Juniper Networks, Inc North Mathilda Avenue Sunnyvale, California USA Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. JunosE is a trademark of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312, 6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785. Copyright 2009, Juniper Networks, Inc. All rights reserved. Revision History December 2012 Revision 02 Content subject to change. The information in this document is current as of the date listed in the revision history. SOFTWARE LICENSE The terms and conditions for using this software are described in the software license contained in the acknowledgment to your purchase order or, to the extent applicable, to any reseller agreement or end-user purchase agreement executed between you and Juniper Networks. By using this software, you indicate that you understand and agree to be bound by those terms and conditions. Generally speaking, the software license restricts the manner in which you are permitted to use the software and may contain prohibitions against certain uses. The software license may state conditions under which the license is automatically terminated. You should consult the license for further details. For complete product documentation, please see the Juniper Networks Website at END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA. ii

3 Abbreviated Table of Contents Part 1 Overview Chapter 1 About the Concepts & Examples ScreenOS Reference Guide iii

4 Overview iv

5 Table of Contents Part 1 Overview Chapter 1 About the Concepts & Examples ScreenOS Reference Guide Part Organization Document Conventions Web User Interface Conventions Command Line Interface Conventions Naming Conventions and Character Types Illustration Conventions Requesting Technical Support Self-Help Online Tools and Resources Opening a Case with JTAC Document Feedback v

6 Overview vi

7 List of Figures Part 1 Overview Chapter 1 About the Concepts & Examples ScreenOS Reference Guide Figure 1: Key Features in ScreenOS Figure 2: Images in Illustrations vii

8 Overview viii

9 PART 1 Overview About the Concepts & Examples ScreenOS Reference Guide on page 3 1

10 Overview 2

11 CHAPTER 1 About the Concepts & Examples ScreenOS Reference Guide Juniper Networks security devices integrate the following firewall, virtual private network (VPN), and traffic-shaping features to provide flexible protection for security zones when connecting to the Internet: Firewall: A firewall screens traffic crossing the boundary between a private LAN and the public network, such as the Internet. Layered Security: The layered security solution is deployed at different locations to repel attacks. If one layer fails, the next one catches the attack. Some functions help protect remote locations with site-to-site VPNs. Devices deployed at the perimeter repel network-based attacks. Another layer, using Intrusion Detection Prevention (IDP) and Deep Inspection, automatically detects and prevents attacks from inflicting damages. Network segmentation, the final security layer (also known as virtualization), divides the network up into secure domains to protect critical resources from unauthorized roaming users and network attacks. Content Security: Protects users from malicious URLs and provides embedded antivirus scanning and Web filtering. In addition, works with third-party products to provide external antivirus scanning, antispam, and Web filtering. VPN: A VPN provides a secure communications channel between two or more remote network appliances. Integrated Networking Functions: Dynamic routing protocols learn reachability and advertise dynamically changing network topologies. In addition, traffic-shaping functionality allows administrative monitoring and control of traffic passing across the Juniper Networks firewall to maintain a network s quality-of-service (QoS) level. Centralized Management: The Network and Security Manager (NSM) tool simplifies configuration, deployment, and management of security devices. Redundancy: High availability of interfaces, routing paths, security devices, and on high-end Juniper Networks devices power supplies and fans, to avoid a single point of failure in any of these areas. 3

12 Overview NOTE: For information about Juniper Networks compliance with Federal Information Processing Standards (FIPS) and for instructions on setting a FIPS-compliant security device in FIPS mode, see the platform-specific Cryptographic Module Security Policy document on the documentation CD. Figure 1: Key Features in ScreenOS Part Organization The ScreenOS system provides all the features needed to set up and manage any security appliance or system. This document is a reference guide for configuring and managing a Juniper Networks security device through ScreenOS. Part Organization on page 4 Document Conventions on page 10 Requesting Technical Support on page 12 Document Feedback on page 13 The Concepts & Examples ScreenOS Reference Guide is a multi-part manual. The following information outlines and summarizes the material in each part: 4

13 Chapter 1: About the Concepts & Examples ScreenOS Reference Guide Part 1: Overview Provides a high level description of the contents for Concepts and Examples Combined Reference Guide. Part 2: Fundamentals ScreenOS Architecture presents the fundamental elements of the architecture in ScreenOS and concludes with a four-part example illustrating an enterprise-based configuration incorporating most of those elements. In this and all subsequent chapters, each concept is accompanied by illustrative examples. Zones explains security zones, tunnel zones, and function zones. Interfaces describes the various physical, logical, and virtual interfaces on security devices. Interface Modes explains the concepts behind transparent, Network Address Translation (NAT), and route interface operational modes. Building Blocks for Policies discusses the elements used for creating policies and virtual private networks (VPNs): addresses (including VIP addresses), services, and DIP pools. It also presents several example configurations that support the H.323 protocol. Policies explores the components and functions of policies and offers guidance on their creation and application. Traffic Shaping explains how you can prioritize services and manage bandwidth at the interface and policy levels. System Parameters presents the concepts behind Domain Name System (DNS) addressing, using Dynamic Host Configuration Protocol (DHCP) to assign or relay TCP/IP settings, downloading and uploading system configurations and software, and setting the system clock. Part 3: Administration Administration explains the different means available for managing a security device both locally and remotely. This chapter also explains the privileges pertaining to each of the four levels of network administrators that can be defined. Monitoring Security Devices explains various monitoring methods and provides guidance in interpreting monitoring output. 5

14 Overview Part 4: Attack Detection and Defense Mechanisms Protecting a Network outlines the basic stages of an attack and the firewall options available to combat the attacker at each stage. Reconnaissance Deterrence describes the options available for blocking IP address sweeps, port scans, and attempts to discover the type of operating system (OS) of a targeted system. Denial of Service Attack Defenses explains firewall, network, and OS-specific DoS attacks and how ScreenOS mitigates such attacks. Content Monitoring and Filtering describes how to protect users from malicious uniform resource locators (URLs) and how to configure the security device to work with third party products to provide antivirus scanning, antispam, and Web filtering. Deep Inspection describes how to configure the Juniper Networks security device to obtain Deep Inspection (DI) attack object updates, how to create user-defined attack objects and attack object groups, and how to apply DI at the policy level. Intrusion Detection and Prevention describes Juniper Networks Intrusion Detection and Prevention (IDP) technology, which can both detect and stop attacks when deployed inline to your network. The chapter describes how to apply IDP at the policy level to drop malicious packets or connections before the attacks can enter your network. Suspicious Packet Attributes presents several SCREEN options that protect network resources from potential attacks indicated by unusual IP and ICMP packet attributes. Contexts for User Defined Signatures, provides descriptions of contexts that you can specify when defining a stateful signature attack object. Part 5: Virtual Private Networks Internet Protocol Security provides background information about IPsec, presents a flow sequence for Phase 1 in IKE negotiations in aggressive and main modes, and concludes with information about IKE and IPsec packet encapsulation. Public Key Cryptography provides an introduction to public key cryptography, certificate use, and certificate revocation list (CRL) use within the context of Public Key Infrastructure (PKI). Virtual Private Network Guidelines offers some useful information to help in the selection of the available VPN options. It also presents a packet flow chart to demystify VPN packet processing. Site-to-Site Virtual Private Networks provides extensive examples of VPN configurations connecting two private networks. Dialup Virtual Private Networks provides extensive examples of client-to-lan communication using AutoKey IKE. It also details group IKE ID and shared IKE ID configurations. Layer 2 Tunneling Protocol explains Layer 2 Tunneling Protocol (L2TP) and provides configuration examples for L2TP and L2TP-over-IPsec. 6

15 Chapter 1: About the Concepts & Examples ScreenOS Reference Guide Advanced Virtual Private Network Features contains information and examples for the more advanced VPN configurations, such as NAT-Traversal, VPN monitoring, binding multiple tunnels to a single tunnel interface, and hub-and-spoke and back-to-back tunnel designs. AutoConnect-Virtual Private Networks describes how ScreenOS uses Next Hop Resolution Protocol (NHRP) messages to enable security devices to set up AutoConnect VPNs as needed. The chapter provides an example of a typical scenario in which AC-VPN might be used. Part 6: Voice-over-Internet Protocol H.323 Application Layer Gateway describes the H.323 protocol and provides examples of typical scenarios. Session Initiation Protocol Application Layer Gateway describes the Session Initiation Protocol (SIP) and shows how the SIP ALG processes calls in route and Network Address Translation (NAT) modes. Examples of typical scenarios follow a summary of the SIP architecture. Media Gateway Control Protocol Application Layer Gateway presents an overview of the Media Gateway Control Protocol (MGCP) ALG and lists the firewall security features of the implementation. Examples of typical scenarios follow a summary of the MGCP architecture. Skinny Client Control Protocol Application Layer Gateway presents an overview of the Skinny Client Control Protocol (SCCP) ALG and lists the firewall security features of the implementation. Examples of typical scenarios follow a summary of the SCCP architecture. Apple ichat Application Layer Gateway presents an overview of the AppleiChat ALG and lists the firewall security features of the implementation. Examples of typical scenarios follow a summary of the AppleiChat architecture. Part 7: Routing Static Routing describes the ScreenOS routing table, the basic routing process on the security device, and how to configure static routes on security devices. Routing explains how to configure virtual routers on security devices and how to redistribute routing table entries between protocols or between virtual routers. Open Shortest Path First describes how to configure the OSPF Routing Information Protocol describes how to configure the RIP dynamic routing protocol on security devices. Border Gateway Protocol describes how to configure the BGP Policy Based Routing describes policy based routing (PBR). PBR provides a flexible routing mechanism for data forwarding over networks that rely on Application Layer support such as for antivirus (AV), deep inspection (DI), or Web filtering. Multicast Routing introduces basic multicast routing concepts. 7

16 Overview Internet Group Management Protocol describes how to configure the Internet Group Management Protocol (IGMP) on security devices. Protocol Independent Multicast explains how to configure Protocol Independent Multicast - Sparse Mode (PIM-SM) and Protocol Independent Multicast - Source Specific Multicast (PIM-SSM) on Juniper Networks security devices. ICMP Router Discovery Protocol explains how to set up an Internet Control Messages Protocol (ICMP) message exchange between a host and a router. Part 8: Address Translation Address Translation gives an overview of the various translation options, which are covered in detail in subsequent chapters. Source Network Address Translation describes NAT-src, the translation of the source IP address in a packet header, with and without Port Address Translation (PAT). Destination Network Address Translation describes NAT-dst, the translation of the destination IP address in a packet header, with and without destination port address mapping. This section also includes information about the packet flow when doing NAT-src, routing considerations, and address shifting. Mapped and Virtual Addresses describes the mapping of one destination IP address to another based on IP address alone (mapped IP) or based on destination IP address and destination port number (virtual IP). Part 9: User Authentication Authentication details the various authentication methods and uses that ScreenOS supports. Authentication Servers presents the options of using one of four possible types of external authentication server RADIUS, SecurID, TACACS+, or LDAP or the internal database and shows how to configure the security device to work with each type. Infranet Authentication details how the security device is deployed in a unified access control (UAC) solution. Juniper Networks unified access control solution (UAC) secures and assures the delivery of applications and services across an enterprise infranet. Authentication Users explains how to define profiles for authentication users and how to add them to user groups stored either locally or on an external RADIUS authentication server. IKE, XAuth, and L2TP Users explains how to define IKE, XAuth, and L2TP users. Although the XAuth section focuses primarily on using the security device as an XAuth server, it also includes a subsection on configuring select security devices to act as an XAuth client. Extensible Authentication for Wireless and Ethernet Interfaces explains the options available for and examples of how to use the Extensible Authentication Protocol to provide authentication for Ethernet and wireless interfaces. Part 10: Virtual Systems 8

17 Chapter 1: About the Concepts & Examples ScreenOS Reference Guide Virtual Systems discusses virtual systems and profiles, objects, and administrative tasks. Traffic Sorting explains how ScreenOS sorts traffic. VLAN-Based Traffic Classification describes VLAN-based traffic classification for virtual systems, and VLAN retagging. IP-Based Traffic Classification explains IP-based traffic classification for virtual systems. Part 11: High Availability NetScreen Redundancy Protocol explains how to cable, configure, and manage Juniper Networks security devices in a redundant group to provide high availability (HA) using NetScreen Redundancy Protocol (NSRP). Interface Redundancy and Failover describes the various ways in which Juniper Networks security devices provide interface redundancy. Part 12: WAN, DSL, Dial, and Wireless Wide Area Networks describes how to configure a wide area network (WAN). Digital Subscriber Line describes the asymmetric digital subscriber line (ADSL) and G.symmetrical digital subscriber line (G.SHDSL) interfaces. ISP Failover and Dial Recovery describes how to set priority and define conditions for ISP failover and how to configure a dialup recovery solution. Wireless Local Area Network describes the wireless interfaces on Juniper Networks wireless devices and provides example configurations. Wireless Information lists available channels, frequencies, and regulatory domains and lists the channels that are available on wireless devices for each country. Part 13: General Packet Radio Service GPRS describes the GPRS Tunneling Protocol (GTP) features in ScreenOS and demonstrates how to configure GTP functionality on a Juniper Networks security device. Part 14: Dual-Stack Architecture with IPv6 Internet Protocol Version6 Introduction explains IPv6 headers, concepts, and tunneling guidelines. IPv6 Configuration explains how to configure an interface for operation as an IPv6 router or host. Connection and Network Services explains how to configure Dynamic Host Configuration protocol version 6 (DHCPv6), Domain Name Services (DNS), Point-to-Point Protocol over Ethernet (PPPoE), and fragmentation. Static and Dynamic Routing explains how to set up static and dynamic routing. This chapter explains ScreenOS support for Routing Information Protocol-Next Generation (RIPng). 9

18 Overview Address Translation explains how to use Network Address Translation (NAT) with dynamic IP (DIP) and mapped-ip (MIP) addresses to traverse IPv4/IPv6 boundaries. IPv6 in an IPv4 Environment explains manual and dynamic tunneling. IPSec Tunneling explains how to configure IPsec tunneling to connect dissimilar hosts. IPv6 XAuth User Authentication explains how to configure Remote Authentication Dial In User Service (RADIUS) and IPsec Access Session (IAS) management. Switching lists options for using the security device as a switch to pass IPv6 traffic. Document Conventions This document uses the conventions described in the following sections: Web User Interface Conventions on page 10 Command Line Interface Conventions on page 10 Naming Conventions and Character Types on page 11 Illustration Conventions on page 12 Web User Interface Conventions The Web user interface (WebUI) contains a navigational path and configuration settings. To enter configuration settings, begin by clicking a menu item in the navigation tree on the left side of the screen. As you proceed, your navigation path appears at the top of the screen, with each page separated by angle brackets. The following example shows the WebUI path and parameters for defining an address: Policy > Policy Elements > Addresses > List > New: Enter the following, then click OK: Address Name: addr_1 IP Address/Domain Name: IP/Netmask: (select), /32 Zone: Untrust To open Online Help for configuration settings, click the question mark (?) in the upper right of the screen. The navigation tree also provides a Help > Config Guide configuration page to help you configure security policies and Internet Protocol Security (IPsec). Select an option from the list, and follow the instructions on the page. Click the? character in the upper right for Online Help on the Config Guide. Command Line Interface Conventions The following conventions are used to present the syntax of command line interface (CLI) commands in text and examples. In text, commands are in boldface type and variables are in italic type. In examples: 10

19 Chapter 1: About the Concepts & Examples ScreenOS Reference Guide Variables are in italic type. Anything inside square brackets [ ] is optional. Anything inside braces { } is required. If there is more than one choice, each choice is separated by a pipe ( ). For example, the following command means set the management options for the ethernet1, the ethernet2, or the ethernet3 interface : NOTE: When entering a keyword, you only have to type enough letters to identify the word uniquely. Typing set adm u whee j12fmt54 will enter the command set admin user wheezer j12fmt54. However, all the commands documented in this guide are presented in their entirety. Naming Conventions and Character Types ScreenOS employs the following conventions regarding the names of objects such as addresses, admin users, auth servers, IKE gateways, virtual systems, VPN tunnels, and zones defined in ScreenOS configurations: If a name string includes one or more spaces, the entire string must be enclosed within double quotes; for example: set address trust local LAN /24 Any leading spaces or trailing text within a set of double quotes are trimmed; for example, local LAN becomes local LAN. Multiple consecutive spaces are treated as a single space. Name strings are case-sensitive, although many CLI keywords are case-insensitive. For example, local LAN is different from local lan. ScreenOS supports the following character types: Single-byte character sets (SBCS) and multiple-byte character sets (MBCS). Examples of SBCS are ASCII, European, and Hebrew. Examples of MBCS also referred to as double-byte character sets (DBCS) are Chinese, Korean, and Japanese. ASCII characters from 32 (0x20 in hexadecimals) to 255 (0xff), except double quotes ( ), which have special significance as an indicator of the beginning or end of a name string that includes spaces. NOTE: A console connection only supports SBCS. The WebUI supports both SBCS and MBCS, depending on the character sets that your browser supports. 11

20 Overview Illustration Conventions Figure 2 on page 12 shows the basic set of images used in illustrations throughout this guide. Figure 2: Images in Illustrations Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need postsales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. 12

21 Chapter 1: About the Concepts & Examples ScreenOS Reference Guide Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings Search for known bugs Find product documentation Find solutions and answer questions using our Knowledge Base Download the latest versions of software and review your release notes Search technical bulletins for relevant hardware and software notifications Join and participate in the Juniper Networks Community Forum Open a case online in the CSC Case Manager To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Manager tool in the CSC at Call JTAC ( toll free in USA, Canada, and Mexico). Document Feedback For international or direct-dial options in countries without toll-free numbers, visit us at If you find any errors or omissions in this document, contact Juniper Networks at techpubs-comments@juniper.net. 13

22 Overview 14