Juniper SRX – Interface Filters vs Firewall Rules

juniper-junosjuniper-srx

I'm trying to display all firewall rule associated with a specific interface. However, the best I can find is show interfaces filters. I'm assuming since these are called "filters", they're not the same as the "rules" from show security application-firewall rule-sets all…

Could someone enlighten me here?

Best Answer

You are correct, these are not the same thing.

"Interface Filters" / Firewall Filters

The show interfaces filters command is used to show what firewall filters are applied to each interface, and in which direction. Firewall filters are supported on just about every Juniper hardware platform.

jhead@MX-WS-ZT-1> show interfaces filters ge-0/0/0
Interface       Admin Link Proto Input Filter         Output Filter
ge-0/0/0        up    up
ge-0/0/0.0      up    up   inet  MGMT

In a general sense, firewall filters are far less robust than the application firewall feature. They cannot do deep packet inspection (they operate on Layers 3 and 4), they can see things like source/destination IP or source/destination port. The most common use for firewall filters is to protect your control/management plane on a Juniper device, here's a very basic example on how to only allow SSH.

NOTE: Firewall filters are generally called ACL's by other vendors and the industry.

NOTE: Firewall filters can also be used in CoS configuration.

jhead@SRX1> show configuration firewall
    family inet {
        filter MGMT {
            term SSH {
                from {
                    port 22;
                }
                then accept;
            }
        }
    }

jhead@SRX1> show configuration interfaces ge-0/0/0
unit 0 {
    family inet {
        filter {
            input MGMT;
        }
        address 172.16.67.2/24;
    }
}

If you want some good information, check out the Juniper Documentation.

Application Firewall

The other command you referenced, show security application-firewall rule-sets all relates to SRX's application firewall feature.

The full feature set of application firewalls can get pretty unwieldy, but in short they do a much more thorough analysis of the traffic. If you check out the Application Firewall Overview you'll see the following text:

Many dynamic applications use HTTP static ports to tunnel non-HTTP traffic through the network. Such applications can send traffic that might not be adequately controlled by standard network firewall policies, leading to a security threat. Standard policies function based on IP address and port and therefore are not effective with these dynamic applications.

The reference to "standard network firewall policies" is pretty much a direct comparison to the above mentioned "firewall filters". Let me know if this isn't clear, and I'll happily edit my answer.

Related Topic