Information
Routing Engine Firewall Filter should restrict SSH sources
Rationale:
Firewall filters are built up of one or more terms, which are evaluated in order until either one is matched (at which point the terms then action is taken) or the final term has been evaluated, at which point the default action is to discard the packet.
SSH is one of the main services for remote administration of the router and, as a result, presents a tempting target for attackers. To protect the router, you should only allow authorized management hosts, ideally on an internal network segment, to connect using SSH.
Permitted SSH connections should be logged to the local routing engine and to SYSLOG, allowing a record of connections to be kept and potential attacks to be detected.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
To create a firewall filter term enter the following command from the [edit firewall family <family> filter <filter name>] hierarchy.
[edit firewall family inet filter <filter name>]
user@host#edit term <term name>
[edit firewall family inet filter <filter name> term <term name>]
user@host#set from source-address <authorized address or subnet>
user@host#set from source-address <authorized address or subnet 2>
user@host#set from protocol tcp
user@host#set from destination-port ssh
user@host#set then accept
user@host#set then syslog
user@host#set then log
Default Value:
No firewall filters are configured by default.