CloudLabBox
Try the free demo

JNCIA-Junos lab 11 of 15

Firewall filters and unicast RPF

Protect HQ's routing engine with a loopback filter, rate-limit ICMP with a policer, block selected transit traffic between the depot and the warehouse, and switch on unicast reverse-path forwarding, first strict, then loose when asymmetric routing makes strict mode drop good traffic.

Run this lab

It needs Standard: its 3 nodes are set to 12 vCPU and 15,360 MB in total.

In your workspace: Shared, then JNCIA-Junos JN0-106 guided labs, then 11 - Firewall filters and unicast RPF

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 12 vCPU and 15,360 MB together. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 65 minutes
Nodes need
12 vCPU, 15,360 MB
Smallest plan
Standard

The scenario

An audit of HQ found that anyone who can reach the router can try to log in, and that nothing limits how hard the routing engine can be flooded with pings. Operations also want two transit rules: the depot LAN may not ping the warehouse LAN, and traceroute through HQ should not reveal the warehouse. Finally, HQ must drop packets with forged source addresses.

OSPF runs everywhere (see the canvas). The WH-DEPOT radio link has metric 100 on both ends, so traffic between DEPOT and WH normally goes through HQ.

RuleDetail
ManagementSSH to HQ only from the HQ LAN 10.1.0.0/24
RoutingOSPF must keep working
ICMP to HQAllowed, policed to 1 Mbps
Traceroute to HQAllowed
Anything else to HQDropped, counted and logged
Depot LAN to warehouse LANNo ping (reject, so the sender knows)
Traceroute through HQ to WHDropped silently

What you’ll practise

  • Tell transit traffic from exception (host-bound) traffic and say where each is filtered
  • Write stateless firewall filters with ordered terms, match conditions, actions and action modifiers
  • Protect the routing engine with an input filter on lo0 without breaking OSPF
  • Police ICMP to the routing engine and read the counters
  • Compare reject and discard, and TCP, UDP and ICMP matches, on transit traffic
  • Configure unicast RPF and explain strict and loose mode with asymmetric routing

The tasks

  1. Transit and exception traffic
  2. Protect the routing engine
  3. See the policer work
  4. Filter transit traffic
  5. Unicast reverse-path forwarding

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Firewall filters and unicast RPF3 nodes and 3 networks, 6 links. Every link is listed as text below the diagram.HQWHDEPOTHQ-LANWH-LANDEPOT-LANge-0/0/2ge-0/0/2ge-0/0/2ge-0/0/0ge-0/0/0ge-0/0/1ge-0/0/0ge-0/0/1ge-0/0/1
3 nodes and 3 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ ge-0/0/0 to DEPOT ge-0/0/0
  • HQ ge-0/0/1 to WH ge-0/0/0
  • WH ge-0/0/1 to DEPOT ge-0/0/1
  • HQ ge-0/0/2 to HQ-LAN (network)
  • WH ge-0/0/2 to WH-LAN (network)
  • DEPOT ge-0/0/2 to DEPOT-LAN (network)
Nodes in Firewall filters and unicast RPF, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQJuniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB
WHJuniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB
DEPOTJuniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIA-Junos JN0-106 guided labs.

  3. Open 11 - Firewall filters and unicast RPF and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More JNCIA-Junos labs

All JNCIA-Junos labs

Related labs in other courses

CloudLabBox is independent of Juniper Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.