Implement control plane protection by classifying traffic types based on importance and configure filters to restrict and rate limit the traffic directed to and processed by the RE according to each class. set firewall family inet filter term accept-tcp-initial from source-prefix-list management-networks-ipv4 set firewall family inet filter term accept-tcp-initial from destination-prefix-list router-addresses-ipv4 set firewall family inet filter term accept-tcp-initial from protocol tcp set firewall family inet filter term accept-tcp-initial from destination-port ssh set firewall family inet filter term accept-tcp-initial from tcp-initial set firewall family inet filter term accept-tcp-initial then policer policer-32k set firewall family inet filter term accept-tcp-initial then accept set firewall family inet filter term accept-ssh from source-prefix-list management-networks-ipv4 set firewall family inet filter term accept-ssh from destination-prefix-list router-addresses-ipv4 set firewall family inet filter term accept-ssh from protocol tcp set firewall family inet filter term accept-ssh from destination-port ssh set firewall family inet filter term accept-ssh then policer policer-1g set firewall family inet filter term accept-ssh then count accept-ssh set firewall family inet filter term accept-ssh then accept set firewall family inet filter term accept-snmp from source-prefix-list snmp-servers-ipv4 set firewall family inet filter term accept-snmp from destination-prefix-list router-addresses-ipv4 set firewall family inet filter term accept-snmp from protocol udp set firewall family inet filter term accept-snmp from destination-port snmp set firewall family inet filter term accept-snmp then policer policer-1m set firewall family inet filter term accept-snmp then count accept-snmp set firewall family inet filter term accept-snmp then accept set firewall family inet filter term default-deny then log set firewall family inet filter term default-deny then syslog set firewall family inet filter term default-deny then discard set firewall policer policer-1g if-exceeding bandwidth-limit 1g set firewall policer policer-1g burst-size-limit 100k set firewall policer policer-1g then discard set firewall policer policer-1m if-exceeding bandwidth-limit 1m set firewall policer policer-1m burst-size-limit 15k set firewall policer policer-1m then discard set firewall policer policer-32k if-exceeding bandwidth-limit 132k set firewall policer policer-32k burst-size-limit 1500 set firewall policer policer-32k then discard set interfaces lo0 unit family inet filter set interfaces lo0 unit family inet address /32 set interfaces lo0 unit family inet6 filter set interfaces lo0 unit family inet6 address /128

Detections

Analytics

Item Search