JuniperConfig423 downloads

Juniper JunOS Security Hardening

JunOS security hardening: SSH lockdown, AAA with RADIUS/TACACS+, management plane filter, login restrictions, unused service disablement, and firewall filter for loopback.

↓ example.txt

What is it?

Juniper hardening centers on Routing Engine (RE) protection — the RE is the control plane, and protecting it is critical. The primary tool is a firewall filter applied to the loopback (lo0) interface, which acts as a Control Plane Policing (CoPP) equivalent. This filter allows only legitimate management and routing protocol traffic to reach the RE while discarding everything else. JunOS's 'commit confirmed' feature is invaluable during hardening — it auto-reverts if you lose access, preventing permanent lockout. TACACS+ or RADIUS integration centralizes authentication for audit trails.

When to use

·Before any production deployment — RE protection is mandatory for internet-facing routers
·After a security audit — loopback filter, SSH hardening, and TACACS+ are common findings
·For compliance (PCI-DSS, NERC CIP) — CIP-007 requires management plane access control
·After deploying a new JunOS device — default config has minimal security hardening

When NOT to use

·Lab environments — strict firewall filters and lockout settings impede testing. Use a separate lab policy.

How it compares

vs Cisco IOS HardeningCisco CoPP uses policy-maps applied with 'control-plane' command. Juniper uses a firewall filter on lo0. Both achieve the same RE/control-plane protection. JunOS firewall filters are more readable and easier to audit.

vs Palo Alto HardeningPalo Alto protects the management plane with 'permitted-ip' and zone protection profiles. Juniper uses lo0 firewall filters for RE protection and 'login retry-options' for lockout. Both are robust; different architectures.

Prerequisites

→Know all management source IPs/subnets before applying the lo0 filter — wrong entries cause lockout
→Use 'commit confirmed 5' when applying hardening changes — auto-reverts after 5 minutes if you lose access
→TACACS+ or RADIUS server must be reachable before setting 'authentication-order tacplus' — otherwise all logins fail
→BGP, OSPF, and other routing protocol source IPs must be accounted for in the PROTECT-RE filter

Config Generator

Hostname *

TACACS+ Server IP

TACACS+ Secret

RADIUS Server IP

RADIUS Secret

Allowed Management Prefixes

Idle Timeout (minutes)

SSH Port

SSH Key Algorithm

Disable J-Web (HTTP)?

Disable XNM (clear-text)?

NTP Authentication Key

Verification commands

show firewall filter PROTECT-RE

Show RE protection filter statistics — packets matched per term

ExpectedALLOW-MGMT and ALLOW-BGP counters should be non-zero. DENY-REST counter shows dropped packets.

show system login

Verify login class and user configuration

ExpectedLists all users with their login class. Verify no unauthorized users exist.

show system services

Verify only required services are enabled

ExpectedShould show SSH and optionally NETCONF. Telnet, FTP, and HTTP should not appear.

Debug commands

show log messages | match UI_LOGIN

Show authentication success and failure events

Common mistakes & fixes

SymptomLocked out after applying lo0 firewall filter

CauseManagement workstation IP not in ALLOW-MGMT term source-address

FixUse console access. Edit the filter: 'set firewall filter PROTECT-RE term ALLOW-MGMT from source-address <your-ip/mask>'. Commit with 'commit confirmed 2' as safety net.

SymptomTACACS+ authentication failing for all users

CauseTACACS+ server unreachable or wrong secret, with 'authentication-order tacplus' set

FixFrom console: 'set system authentication-order password' to re-enable local auth. Fix TACACS+ connectivity, then restore authentication-order.

SymptomOSPF or BGP adjacencies dropping after applying PROTECT-RE filter

CauseRouting protocol traffic not permitted in the loopback filter

FixAdd terms for the required protocol: OSPF uses protocol 'ospf', BGP uses TCP port 179. Check which term counter is incrementing for the dropped protocol traffic.

Further learning

Recommended books to go deeper on this topic.

Network Security Architectures

Sean Convery · Cisco Press · Defense-in-depth, CoPP, control plane hardening, AAA design

Hardcover ↗

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · AAA, RADIUS, TACACS+, device hardening best practices

Kindle ↗Hardcover ↗