Juniper Firewall Filter Precedence?
Happy Friday fellas.
I'm dealing with a vendor that has set of a test Juniper VSRX for evaluation. I am currently running into an issue where we are unable to poll the device via SNMP. My knowledge of JunOS is limited to what I've been able to glean from their documentation.
The vendor sent me the output from "show snmp" and it shows the ACL SNMP uses (which identifies my NMS), as well as the community, and RO/RW permissions. Best I can tell it is all correct and can be found below.
However, any snmpwalk I run is timing out and not returning any OIDs.
Upon some research, I determined I should probably check to see if there are firewall filters in place. My question is whether any extra configuration would be required if a firewall filter had been in place and whether if by default the implicit deny would be preventing the SNMP traffic if it wasn't explicitly allowed? I don't have access to the full configuration, but I am trying best as I can to help guide the vendor in the right direction.
If anyone with a bit more experience with JunOS could tell me whether or not my hypothesis is valid and whether there is anything else work checking, I would be most appreciative.
root@test-vsrx# show snap
client-list SNMP-ACL
{
MYSUBNET/24;
}
community public
{
authorization read-only;
client-list-name SNMP-ACL;
Posted Dec 9, 2016, 4:34 PM UTC
Considering you're talking about an SRX, there are 3 things to be considered.
Firewall filter for device protection. This would be applied to a unit of 'interface lo0'.
Security policies. This is the actual firewall function for production traffic going through the device. Depending on the zones of the traffic flow, there may need to be a policy explicitly allowing the traffic.
Security zone inbound traffic. Each interface needs to be in a security zone, and the traffic would have to be allowed to come in the desired interface. This would be in the 'security zones security-zone {zone-name} interfaces {interface-id} host-inbound-traffic system-services' stanza.
Having a fuller readout of the configuration would be helpful, but if you can't get it I would recommend checking for those things. Good luck.
I appreciate the input. I spent some time giving myself a JunOS primer, but priming to be able to understand vs being able to troubleshoot is a separate issue entirely on top of not having console access and filtering everything through a vendor.
Shortly after I posted this, I decided to try and poll one of the VLAN addresses instead, which worked. Our spec dictated SNMP and all management functions be done through lo0 (as this is our standard with Cisco devices). Why I didn't try this before... well it's Friday.
That's a start. Based on polling working to a vlan address but not lo0, that would probably rule out firewall filters. In Juniper, a firewall filter applied to lo0 affects all local addresses on the device.
I would probably look at which security zone the lo0 interface is in, and make sure it is assigned to the proper zone and is allowing the correct inbound traffic. It's very possible that lo0 isn't even assigned to a security zone. I've also seen where interfaces don't inherit the zone inbound traffic config properly, so you may have to specifically configure it for the interface.