JNCIE-SP Notes: Initial Junos System Setup – Part 1, Mgmt Login, DNS, NTP, Syslog

set system host-name R1

Configure root password:

set system root-authentication plain-text-password

set system time-zone America/Los_Angeles

set system name-server 10.1.1.1
set system name-server 8.8.8.8
set system name-server 8.8.4.4

Configure NTP server:

set system ntp server 10.1.1.1
set system ntp server 0.pool.ntp.org prefer
set system ntp source-address 10.254.2.1

Verification:

show ntp associations
show ntp status

Configure management access:

set system ports console log-out-on-disconnect
set system services ssh connection-limit 2

Additional SSH hardening:

set system services ssh root-login deny
set system services ssh protocol-version v2
set system services ssh rate-limit 5
set system services ssh client-alive-interval 120
set system services telnet 
set system services ftp

Enable NETCONF for automation (required for the ansible playbooks):

set system services netconf ssh

Note: set system services telnet and set system services ftp should NOT be used in production environments (unencrypted).

Configure a static route for the management network and make sure it’s not being used in route advertisements:

set routing-options static route 10.1.1.0/24 next-hop 10.1.1.1 no-readvertise

Configure backup routing in case RPD is down:

set system backup-router 10.1.1.1 destination 10.1.1.0/24

Note: The backup-router destination should be equal to or more specific than the static route above (e.g., /25 or /32).

Configure login to try authentication to RADIUS first, then TACACS+, then revert to local password:

set system authentication-order [radius tacplus password]

Configure RADIUS server with secret and timeout/retry options:

set system radius-server 10.1.1.1 secret radius-password timeout 10 retry 3 source-address 10.1.1.1

Configure user “noc-super” and assign them to class (permissions group) with super-user access:

set system login user noc-super class super-user authentication plain-text-password

Configure user “noc-operator”, create a new operator class that additionally allows shell, but specifically doesn’t allow the “restart routing” command:

set system login class operator-plus-shell permissions [clear network reset trace view shell]
set system login class operator-plus-shell deny-commands "restart routing"
set system login user noc-operator class operator-plus-shell authentication plain-text-password

Additional permission examples:

# Read-only user
set system login class read-only-custom permissions [view view-configuration]
set system login user readonly class read-only-custom authentication plain-text-password

# NOC engineer (can't configure or reboot)
set system login class noc-engineer permissions [view view-configuration clear network reset]
set system login class noc-engineer deny-commands "(configure)|(request system (halt|reboot|power-off))"
set system login user noc1 class noc-engineer authentication plain-text-password

Verification:

show system users
show configuration system login

Configure idle timeout and session limits:

set system login idle-timeout 15
set system login retry-options tries-before-disconnect 3
set system login retry-options backoff-threshold 3
set system login retry-options backoff-factor 6
set system login retry-options minimum-time 60

Configure a noc-operator user to receive any log message on the screen:

set system syslog user noc-operator any any

Configure a syslog file for firewall messages:

set system syslog file firewall-log firewall any

Configure the syslog “messages” with a new name:

set system syslog file new-messages any info

Configure a syslog server that receives configuration changes:

set system syslog host 10.1.1.1 change-log any

Verification:

show log messages
show log messages | last 50
show log firewall-log

Configure SNMPv2 for read-only using the community “acme-corp” and lock it down to one SNMP server:

set snmp community acme-corp authorization read-only clients 10.1.1.1/32

Additional SNMP configuration:

# Multiple allowed clients
set snmp community acme-corp clients 10.1.1.0/24
set snmp community acme-corp clients 192.168.100.10/32

# Device information
set snmp description "Router R1 - Production"
set snmp location "DC1-Rack10-U20"
set snmp contact "noc@example.com"

Configure SNMP Trap to send on link falure:

set snmp trap-group trap-group1 categories link
set snmp trap-group trap-group1 targets 10.1.1.1

Verification:

show snmp statistics
show snmp mib walk system

Note: SNMPv3 configuration (more secure) will be covered in the Advanced System Configuration post.

Configure a firewall filter that allows only the RFC1918 addresses to the routing engine, then counts, logs, and discards anything else:

set firewall family inet filter allow-1918-ff term 1 from source-address 10.0.0.0/8
set firewall family inet filter allow-1918-ff term 1 from source-address 172.16.0.0/12
set firewall family inet filter allow-1918-ff term 1 from source-address 192.168.0.0/16
set firewall family inet filter allow-1918-ff term 1 then accept
set firewall family inet filter allow-1918-ff term 2 then count dropped-packets
set firewall family inet filter allow-1918-ff term 2 then syslog
set firewall family inet filter allow-1918-ff term 2 then discard
set interfaces lo0.0 family inet filter input allow-1918-ff

Then for a more complete control and protection for the route engine:

# Accept established connections
set firewall family inet filter protect-re term accept-established from protocol tcp
set firewall family inet filter protect-re term accept-established from tcp-established
set firewall family inet filter protect-re term accept-established then accept

# Accept SSH from management network
set firewall family inet filter protect-re term accept-ssh from protocol tcp
set firewall family inet filter protect-re term accept-ssh from destination-port 22
set firewall family inet filter protect-re term accept-ssh from source-address 10.1.1.0/24
set firewall family inet filter protect-re term accept-ssh then accept

# Accept SNMP
set firewall family inet filter protect-re term accept-snmp from protocol udp
set firewall family inet filter protect-re term accept-snmp from destination-port 161
set firewall family inet filter protect-re term accept-snmp from source-address 10.1.1.1/32
set firewall family inet filter protect-re term accept-snmp then accept

# Accept NTP
set firewall family inet filter protect-re term accept-ntp from protocol udp
set firewall family inet filter protect-re term accept-ntp from destination-port 123
set firewall family inet filter protect-re term accept-ntp then accept

# Accept BGP
set firewall family inet filter protect-re term accept-bgp from protocol tcp
set firewall family inet filter protect-re term accept-bgp from destination-port 179
set firewall family inet filter protect-re term accept-bgp then accept

# Accept OSPF
set firewall family inet filter protect-re term accept-ospf from protocol ospf
set firewall family inet filter protect-re term accept-ospf then accept

# Accept ISIS
set firewall family inet filter protect-re term accept-isis from protocol isis
set firewall family inet filter protect-re term accept-isis then accept

# Accept limited ICMP
set firewall family inet filter protect-re term accept-icmp from protocol icmp
set firewall family inet filter protect-re term accept-icmp from icmp-type [echo-request echo-reply unreachable time-exceeded]
set firewall family inet filter protect-re term accept-icmp then accept

# Default deny
set firewall family inet filter protect-re term default-deny then log
set firewall family inet filter protect-re term default-deny then discard

# Apply to loopback
set interfaces lo0.0 family inet filter input protect-re

Rate limiting (policers):

# ICMP rate limit
set firewall policer icmp-1m if-exceeding bandwidth-limit 1m
set firewall policer icmp-1m if-exceeding burst-size-limit 15k
set firewall policer icmp-1m then discard

# Apply policer to ICMP term
set firewall family inet filter protect-re term accept-icmp then policer icmp-1m
set firewall family inet filter protect-re term accept-icmp then accept

Verification:

show firewall filter allow-1918-ff
show firewall log
show interfaces lo0 extensive | match filter

Configure devices to backup their configuration to a FTP server every 24hrs:

set system archival configuration transfer-interval 1440
set system archival configuration archive-sites ftp://ftp-user:ftp-pass@10.1.1.1

Alternative: Backup on every commit with SCP (more secure):

set system archival configuration transfer-on-commit
set system archival configuration archive-sites "scp://backup@10.1.1.1:/configs/$hostname_$date"

Verification:

show configuration system archival
show log messages | match archive

Configure groups to apply interface family to all interfaces:

set groups mpls-iso-inet6 interfaces <*> unit <*> family iso
set groups mpls-iso-inet6 interfaces <*> unit <*> family mpls
set groups mpls-iso-inet6 interfaces <*> unit <*> family inet6
set interfaces apply-groups mpls-iso-inet6
set interfaces fxp0 apply-groups-except mpls-iso-inet6

Validation – use the “display inheritance” option to show the configuration applied to the interfaces:

show configuration interfaces ge-0/0/0 | display inheritance

Configure login message:

set system login message "###########################\nUnauthorized access is prohibited!!!\nAll sessions are logged and monitored!!!\n###########################"

Check system health:

show system alarms
show chassis alarms
show chassis environment
show chassis routing-engine
show chassis fpc
show system storage
show system uptime
show system processes extensive
show system memory