firewall Archives

Posted April 1, 2018April 17, 2021Leave a commentPosted in JuniperJuniper

Juniper SRX Custom IDP Rule – WordPress XML RPC

Quite often people scan for WordPress installs by checking to see if a HTTP request can be made to /xmlrpc.php. Since I do not run WordPress at all it is low hanging fruit to block the source IP that makes a HTTP request for that to my web servers. The […]

Posted March 26, 2018April 17, 2021Leave a commentPosted in SRX/vSRXSRX/vSRX

Juniper SRX Cluster – Log into secondary node

Sometimes you need to execute commands on the secondary node. To do this you can open a session to the remote node from the primary using the command request routing-engine login node X where X is the node ID to login to. As an example: Transferring Files Files can also […]

Posted March 12, 2018April 17, 2021Leave a commentPosted in SRX/vSRXSRX/vSRX

Juniper SRX Active Directory User Firewall

These are the steps I used to get the Juniper SRX user firewall feature working with Active Directory. The end result is I can apply firewall policies based on the username of a user or the group of a user. NOTE: JunOS 17.4R1 or above is required for this feature […]

Posted March 5, 2018April 17, 2021Leave a commentPosted in SRX/vSRXSRX/vSRX

Juniper SRX IDP Packet Capture

My Juniper SRX devices are configured to send packet captures to a Linux server for further analysis. I have the Linux server exporting its share via NFS which I mount on my PC, that allows me to then browse through the packet captures of attacks using my PC directly and […]

Posted March 5, 2018April 17, 2021Leave a commentPosted in JuniperJuniper

Juniper SRX – IDP Rule – Block SSH Brute Force

The following IDP rule will block SSH brute force attacks. It will be triggered by more than 3 consecutive SSH connections in a row. After the rule has been triggered, the source IP will be banned for a period of 1 hour and the connection to both the client and […]