Configuration
CLI Quick Configuration
To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.
set interfaces ge-0/0/1 unit 0 family inet address 20.20.20.1/24 set interfaces ge-5/0/0 unit 0 family inet address 30.30.30.1/24 set access profile FWAUTH client FWClient1 firewall-user password pwd set access firewall-authentication pass-through default-profile FWAUTH
set access firewall-authentication pass-through telnet banner success "WELCOME TO JUNIPER TELNET SESSION"
set security zones security-zone UT-ZONE host-inbound-traffic system-services all
set security zones security-zone UT-ZONE interfaces ge-0/0/1.0 host-inbound-traffic protocols all
set security zones security-zone T-ZONE host-inbound-traffic system-services all
set security zones security-zone T-ZONE interfaces ge-5/0/0.0 host-inbound-traffic protocols all
set security policies from-zone UT-ZONE to-zone T-ZONE policy P1 match source-address any set security policies from-zone UT-ZONE to-zone T-ZONE policy P1 match destination-address any
set security policies from-zone UT-ZONE to-zone T-ZONE policy P1 match application junos-telnet set security policies from-zone UT-ZONE to-zone T-ZONE policy P1 then permit
firewall-authentication pass-through client-match FWClient1 Step-by-Step
Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.
To configure pass-through authentication:
1. Configure two interfaces and assign IP addresses to them.
NOTE: For this example, it is optional to assign two addresses to the interfaces.
[edit]
user@host# set interfaces ge-0/0/1 unit 0 family inet address 20.20.20.1/24
user@host# set interfaces ge-5/0/0 unit 0 family inet address 30.30.30.1/24 2. Create the FWAUTH access profile for the FWClient1 user, specify the user’s
password, and define a success banner for Telnet sessions.
[edit access]
user@host# set access profile FWAUTH client FWClient1 firewall-user password pwd
user@host# set firewall-authentication pass-through default-profile FWAUTH
user@host# set firewall-authentication pass-through telnet banner success
"WELCOME TO JUNIPER TELNET SESSION"
3. Configure security zones.
NOTE: For this example, it is optional to configure a second interface for a security zone.
[edit security zones]
user@host# set security-zone UT-ZONE host-inbound-traffic system-services all
user@host# set security-zone UT-ZONE interfaces ge-0/0/1.0 host-inbound-traffic protocols all
user@host# set security-zone T-ZONE host-inbound-traffic system-services all
user@host# set security-zone T-ZONE interfaces ge-5/0/0.0 host-inbound-traffic protocols all
4. Assign security policy P1 to the security zones.
[edit security policies]
user@host# set from-zone UT-ZONE to-zone T-ZONE policy P1 match source-address any
user@host# set from-zone UT-ZONE to-zone T-ZONE policy P1 match destination-address any
user@host# set from-zone UT-ZONE to-zone T-ZONE policy P1 match application junos-telnet
user@host# set from-zone UT-ZONE to-zone T-ZONE policy P1 then permit firewall-authentication pass-through client-match FWClient1
5. Use Telnet to authenticate the FWClient1 firewall user to host2.
regress@FWClient1# run telnet 30.30.30.2 Trying 30.30.30.2...
Connected to 30.30.30.2.
Escape character is '^]'.
Firewall User Authentication Username: FWClient1 Password:***
WELCOME TO JUNIPER TELNET SESSION Host1 (ttyp0)
login: regress Password:
--- JUNOS 10.1R1.1 built 2009-10-12 13:30:18 UTC
%
Results
Results From configuration mode, confirm your configuration by entering these commands:
• show interfaces
• show access
• show security zones
• show security policies
If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.
For brevity, this show output includes only the configuration that is relevant to this example. Any other configuration on the system has been replaced with ellipses (...).
user@host# show interfaces profile FWAUTH {
authentication-order password;
client FWClient1 {
user@host# show security zones
...
}
security-zone UT-ZONE { host-inbound-traffic { system-services {
security-zone T-ZONE { host-inbound-traffic { system-services {
user@host# show security policies ...
from-zone UT-ZONE to-zone T-ZONE { policy P1 {
If you are done configuring the device, enter commit from configuration mode.
Verification
To confirm that the configuration is working properly, perform this task:
• Verifying Firewall User Authentication and Monitoring Users and IP Addresses in the Authentication Table on page 26
Verifying Firewall User Authentication and Monitoring Users and IP Addresses in the Authentication Table
Purpose Display firewall authentication user history and verify the number of firewall users who successfully authenticated and firewall users who failed to log in.
Action From operational mode, enter these show commands:
user@host> show security firewall-authentication history
user@host> show security firewall-authentication history identifier 1 user@host> show security firewall-authentication users
user@host> show security firewall-authentication users identifier 3 For more information, see the Junos OS CLI Reference.
user@host> show security firewall-authentication history History of firewall authentication data:
Authentications: 2
Id Source Ip Date Time Duration Status User
1 20.20.20.2 2010-10-12 21:24:02 0:00:24 Failed FWClient1 2 20.20.20.2 2010-10-12 21:24:48 0:00:22 Success FWClient1
user@host> show security firewall-authentication history identifier 1 Username: FWClient1
Source IP: 20.20.20.2
Authentication state: Success
Authentication method: Pass-through using Telnet Access start date: 2010-10-12
Access start time: 21:24:02 Duration of user access: 0:00:24 Source zone: UT-ZONE
Destination zone: T-ZONE Access profile: FWAUTH Bytes sent by this user: 0 Bytes received by this user: 2660
user@host> show security firewall-authentication users Firewall authentication data:
Total users in table: 1
Id Source Ip Src zone Dst zone Profile Age Status User
4 20.20.20.2 UT-ZONE T-ZONE FWAUTH 1 Success FWClient1
user@host> show security firewall-authentication users identifier 3 Username: FWClient1
Source IP: 20.20.20.2
Authentication state: Success
Authentication method: Pass-through using Telnet Age: 3
Access time remaining: 9 Source zone: UT-ZONE Destination zone: T-ZONE Access profile: FWAUTH
Interface Name: ge-0/0/1.0 Bytes sent by this user: 0 Bytes received by this user: 1521
Related Documentation
Junos OS Feature Support Reference for SRX Series and J Series Devices
•
• Firewall User Authentication Overview on page 5
• Understanding Pass-Through Authentication on page 7