Junos: Enforcement of web-authentication policy stops after deleting client-match statement

Products Affected	This issue can affect all SRX Series service gateways with web-authentication policies configured.
Platforms Affected	JUNOS 12.x Security JUNOS 11.x JUNOS 10.x SIRT Security Advisory

PSN Issue :
When modifying a web-authentication policy containing a client-match statement, removing the client-match statement causes the web-authentication policy to no longer be enforced. While the control plane configuration will still display as if web-authentication is required (the web-authentication login page still responds and the policies display still reflect the configuration), the actual effective policy that is pushed into the forwarding plane functions like a normal policy without web-authentication. This can cause open access to resources that are assumed to be protected by web-authentication.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

No other Juniper Networks products or platforms are affected by this issue.

Solution:
All Junos OS software releases built on or after 2012-07-12 have fixed this specific issue. Releases containing the fix specifically include: 10.0S27, 10.4S9, 10.4R10, 11.4R1, 12.1R1, and all subsequent releases (i.e. all releases built after 12.1R1).

Customers can confirm the build date of any Junos OS release by issuing the command 'show version detail'.

This issue is being tracked as PR 749129 and is visible on the Customer Support website.

KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.

Workarounds
Deactivate and re-activate the affected security policy. This will assign a new policy index number and add the correct fw-auth flags in the PFE.

Junos : Configuring Basic Settings for a Junos Space

You must configure basic network and machine information to make your appliance accessible to the network.

To configure the startup settings of the Junos Spec , follow these steps:

1. At the serial console login prompt, type the default user name and press Enter. The default user name for console access is admin.
2. At the login prompt, type the default password and press Enter. The default password for console access is abc123. Junos Space prompts you to change your default password.
3. Enter the default password, then enter your new password. All passwords are case sensitive. You see passwd: all authentication tokens updated successfully.
4. Enter a new IP address for interface ETH0 and press Enter.
5. Enter a new subnet mask for interface ETHO and press Enter.
6. Enter the default gateway as a dotted decimal IP address and press Enter.
7. Enter the nameserver address in dotted decimal notation for interface ETH0 and press Enter.
8. Specify whether the Junos Space system will be added to an existing cluster.
• If the appliance will be not be added to an existing node cluster or is the first node in the cluster:
• Enter n when prompted “Will this Junos Space system be added to an existing cluster?”
• Enter the IP address for Web access.

The IP address for Web access must be in the same subnet as the IP address for interface ETH0 but must be a different IP address.

• Enter the display name for this node.

This is the logical node name that Junos Space displays for the first node in a cluster.

• If the JA1500 Appliance will be added to an existing node cluster, enter y when prompted “Will this Junos Space system be added to an existing cluster?”
8. Enter the IP address for the Web GUI and press Enter.
9. Enter the display name for the node and press Enter.
10. Enter the password for the cluster maintenance mode.

This is the password a maintenance mode administrator must specify to access maintenance mode and shutdown all nodes.

12. Reenter the password to confirm it. You see the settings summary:

1> IP Change: eth0 is 1.1.1.1 / 1.1.1.1

2> Default Gateway = 1.1.1.1 on eth0

3> DNS add: 1.1.1.1

4> Create as first node or standalone

5> Web IP address is 1.1.1.1

6> Node display name is "space1"

7> Password for Junos Space maintenance mode is set.

A> Apply settings

C> Change settings

Q> Quit and set up later

R> Redraw menu

Choice [ACQR]:

13. If the settings are correct, type A to apply the setting by typing option and press Enter. You see the following:

Applying Changes...

Re-loading database

5280 semi-random bytes loaded

Generating RSA private key, 1024 bit long modulus

........................++++++

.....++++++

e is 65537 (0x10001)

grep: /etc/ha.d/haresources: No such file or directory

Stopping High-Availability services:

[  OK  ]

logd is already stopped

heartbeat is stopped. No process

Starting High-Availability services:

2009/11/04_11:34:50 INFO:  Resource is stopped

[  OK  ]

Done!

Adding password for user maintenance

httpd is stopped

Starting httpd: httpd: Could not reliably determine the server's fully qualified domain name, using 10.155.65.191 for ServerName

[  OK  ]

Starting MySQL.. SUCCESS!

Welcome to the Junos Space Network Settings Utility.

Initializing, please wait

Junos Space Appliance Settings Menu

1> Change Password

2> Set Routing

3> Set DNS Servers

4> Change Time Options

5> Retrieve Logs

6> Security

7> (Debug) run shell

Q> Quit

R> Redraw Menu

        Choice [1-7,QR]:

14. Type 7 to run the shell. You see the following:

Password:

[root@junos-space-0256122008000008 ~]# ls

anaconda-ks.cfg  install.log  install.log.syslog

[root@junos-space-0256122008000008 ~]# df -h

Filesystem            Size  Used Avail Use% Mounted on

/dev/sda1             3.8G  1.3G  2.4G  34% /

/dev/mapper/jmpvgnocf-lvvar

                      1.8T  316M  1.7T   1% /var

tmpfs                 4.0G     0  4.0G   0% /dev/shm

[root@junos-space-0256122008000008 ~]# jmp_setup

Welcome to the Junos Space Network Settings Utility.

Initializing, please wait

Junos Space Appliance Settings Menu

1> Change Password

2> Set Routing

3> Set DNS Servers

4> Change Time Options

5> Retrieve Logs

6> Security

7> (Debug) run shell

Q> Quit

R> Redraw menu

Choice [1-7,QR]:

15. Type Q to quit.

The configuration of the Junos Spac Appliance is now complete.

Junos : SRX Series Services Gateway

The SRX Series Services Gateways are high-performance security, routing and network solutions for enterprise and service providers. SRX Series gateways pack high port-density, advanced security, and flexible connectivity, into a single, easily managed platform that supports fast, secure, and highly-available, data center and branch operations.
SRX Series Service Gateways are based on Junos, Juniper's proven operating system which delivers security and advanced protection services, the foundation of the world's largest networks. Junos also supports rich routing capabilities, and Junos' unique architecture provides reliable service operations and manageability, even under the highest loads.
The cost effectiveness and the versatility of the SRX Series platforms results in some of the best price-performance ratios in the industry. Hardware and OS consolidation, operational flexibility and unmatched performance simplify deployment and operations delivering an attractive low TCO.

SRX Series Services Gateways for the Data Center

These platforms deliver market-leading performance, scalability and service integration in a chassis-based form factor ideally suited for medium to large enterprise and service provider data centers and large campus environments where scalability, high performance and concurrent services, are essential.
Designed from the ground up to provide flexible processing and scalability, the SRX Series can meet the network and security requirements of data center hyper-consolidation, rapid managed services deployments, and aggregated security solutions. The SRX Series Services Gateways provide unrivaled performance and scalability, ensuring uninterrupted expansion and growth of your network infrastructure without sacrificing security.

SRX Series Services Gateways for the Branch

Branch SRX Series Gateways deliver secure and manageable networks of up to thousands of sites. A wide variety of product options efficiently support a range of performance, functionality, security, and budget requirements, connecting and protecting from a handful to thousands of users.
The consolidation of routing, WAN connectivity, switching, and Unified Threat Management (UTM) simplifies deployment and administration while delivering fast and consistent service quality regardless of user location. UTM services include best-in-class antivirus, antispam, URL filtering, firewall/VPN and AppSecure application level security that enable the branch SRX Series to be full-featured solution. The routing services include IPv4 and IPv6 unicast and multicast, extensive NAT, QoS, performance and SLA monitoring, and flow management features.

Junos : How to launch Junos Pulse (VPN) and perform a RDP from iPhone/iPad

The following procedure helps to configure Junos pulse on iPad/iPhone to launch VPN and perform RDP access:

• Go to the Apple App store to download the Junos Pulse client and RDP Lite app.


• Network Connect (Pre-7.2R1 code) or VPN Tunneling (from 7.2R1 IVE code) has to be configured on the IVE, which will help the user to connect to SSL-VPN using Junos pulse client from the iPad/iPhone.


• User Role, User Realm, and Sign-in Policy are required with Network Connect configured on the IVE.

1. On IVE go to Users > Users Role > New User Role > General > Enable Network Connect (Prior to 7.2R1 IVE OS) or VPN Tunneling (In IVE OS 7.2R1 and onwards) and then click Save Changes.
   
   


2. Go to the newly created role's Network Connect/VPN Tunneling tab and ensure that the Split Tunneling Options are set correctly and then click Save Changes.


3. If Enable split tunneling is configured, make sure that the Split tunneling Resource Policy is applied for that role on IVE under Users > Resource Policies > Network Connect > Split-tunneling Networks (specify the IP address of the Terminal service resource,which you need to access from Junos Pulse on iOS devices; by using any RDP app from the app store).
   
   If Disable Split Tunneling or Allow access to local subnet is selected, ensure that the ACL under the Access tab on IVE under Users > Resource Policies > Network Connect > Network Connect Access Control allows the specified RDP host IP address.


4. Configure the NC Connection Profile on IVE under Users > Resource Policies > Network Connect > NC Connection Profiles:
   
   
   1. Click New Profile:
      
      When the SA Series device receives a client request to start a session, it assigns an IP address to the client; based on the IP address policies defined either through DHCP or the IP address pool. Apply to the desired role as well and save changes.


5. On IVE under Users > Users Realm > New User realm > General:
   
   You can, by using the above procedure, launch the VPN connection on an iPhone or iPad and perform the RDP access.
   
   
   1. Select the Preferred Auth Server and save changes.
   
   
   2. Click the Role Mapping tab, create a New Rule, and apply it to the iPhone role as configured in step 1.
      
      
6. Now go to Authentication > Signing In > Sign-in Policies > New URL, create the new Sign-in URL and apply it to the iPhone realm only and save changes.
   


7. On the iPhone:
   
   
   1. Launch the Junos Pulse App, which was downloaded from the Apple App store.
   
   
   2. Configure the Junos Pulse App with the IVE Sign-in URL and a user-friendly name. Save changes.
   
   
   3. Click the Connect button on the Junos Pulse App; this will start the connection.
   
   
   4. Provide the credentials to authenticate; once authenticated, you will be able to see the VPN icon, as shown in the following image (this confirms that the VPN tunnel is connected):
      
      


8. Perform the RDP Access:
   
   
   1. Click the Home button on the iPhone/iPad to exit the Junos Pulse app user interface. Launch the RDP app downloaded from the Apple App store (for example - RDP lite is one application, which can be used for RDP access and is a free download from the Apple App store).
   
   
   2. Click Configure on the RDP lite App and then click New.
   
   
   3. Specify the Host address for the remote computer; for which the RDP is being performed (ACL for this Host IP address should be specified as described in step-3) and click the back button.
   
   
   4. Now you will be able to see the configured Host IP address; click the profile.
   
   
   5. This will initiate the RDP access and you will get connected to the RDP device.

Junos : Sending IDP and traffic logs to a syslog server in SRX

If you want to forward your IDP and traffic session logs to a syslog server, here is how we can do it;

1) First inside the security policy we should set that we want to log session initiations e.g;

{primary:node0}[edit]
root@srx210-1# top show security policies 
from-zone downlink to-zone wan {
    policy net-access {
        match {
            source-address net_210;
            destination-address any;
            application any;
        }
        then {
            permit {
                application-services {
                    idp;
                }
            }
            log {
 session-init;
            }
        }
    }
}

2) Then syslog server configuration;

root@srx210-1# show system syslog        
host 192.168.103.20 {
    any any;
    match "RT_IDP|RT_FLOW_SESSION";
    structured-data;
}

After this we should be able to log our traffic logs to the syslog server 192.168.103.20
As you might see there is RT_IDP regular expression string for IDP logs as well. If you set the following configuration under
IDP rule base, you will also log IDP notifications.

3)  IDP notifications

{primary:node0}[edit]
root@srx210-1# show security idp idp-policy Recommended_1 
rulebase-ips {
    rule 1 {
        match {
            source-address any;
            destination-address any;
            application default;
            attacks {
                predefined-attacks ICMP:INFO:ECHO-REQUEST;
            }
        }
        then {
            action {
                drop-packet;
            }
            notification {
 log-attacks;
            }
        }
    }
}

Junos : Software Installation/Upgrade

Install Software via CLI (Method: from Junos software copied to SRX)

Refer to the following steps for copying the software to the SRX and then performing the software installation via the CLI:

1. Copy software to SRX via SCP or FTP to /var/tmp: 
   

   For example:
   user@srx>  scp  junos-srxsme-11.4R4.4-domestic.tgz  user@srx:/var/tmp/junos-srxsme-11.4R4.4-domestic.tgz
   
   OR
   
   user@srx>  ftp <ip address of local ftp server>  (and login)
user@srx>  lcd /var/tmp
user@srx>  bin
user@srx>  get junos-srxsme-11.4R4.4-domestic.tgz
user@srx>  bye

2. Install software with the commands below. 

   For example:
   From the local file in /var/tmp
   user@srx>  request system software add no-copy /var/tmp/junos-srxsme-11.4R4.4-domestic.tgz
user@srx>  request system reboot

Junos : Routing Policy

Overview

A routing policy is the method that you can use to control what routes from dynamic routing policies (OSPF, BGP, RIP, etc) get imported into your routing table and or advertised to other peers or neighbors.

Import Policy

The import policy is responsible for changing or modifying any routes that are advertised to you by other neighbors or peers. Import policies are most commonly seen changing route metrics or preferences or filtering certain routes from being put into your routing table. The Import policy effects how your router views the world.

Export Policy

The export policy is responsible for filtering or modifying routes that you are adverting to other peers or neighbors. Export policies are most commonly seen changing metrics or preferences of routes or re advertising routes from other routing protocols into the protocol that has the export policy tied to it.

Default Routing Policies

Each routing protocol has a default routing policy associated with it that is not specifically defined in the configuration and each one is different.

RIP

By default (without a routing policy) a JunOS device will accept all RIP routes advertised to it by its explicitly configured neighbors but will not advertise those routes at all.

OSPF

Just like RIP, by default (without a routing policy) a JunOS device will accept all OSPF LSA's and exports all routes learned by OSPF but no other protocols. Link State Protocols depend on all routers having the exact same picture of the network so import and export policies on OSPF are pretty limited.

BGP

By default (without a routing policy) a JunOS device will import and export all BGP routes to and from the routing table.