Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Wed Aug 23, 2017 8:54 am


Author Message
admin
Post  Post subject: Junos - How to use loopback IP address as source for local originated packets (ssh/telnet)  |  Posted: Tue Jun 19, 2012 8:08 am
Site Admin

Joined: Mon Aug 03, 2009 8:43 am
Posts: 95

Offline
 

Junos - How to use loopback IP address as source for local originated packets (ssh/telnet)

This article mainly applies to branch and MX devices.

Configuring in Junos the Source Address for Locally Generated TCP/IP Packets

Code:
> show configuration system default-address-selection | display set
set system default-address-selection



Junos doc quote:
Quote:
Configuring the Source Address for Locally Generated TCP/IP Packets

By default, the source address included in locally generated Transmission
Control Protocol/IP (TCP/IP) packets, such as FTP traffic, and in User
Datagram Protocol (UDP) and IP packets, such as Network Time Protocol
(NTP) requests, is chosen as the local address for the interface on which
the traffic is transmitted. This means that the local address chosen for
packets to a particular destination might change from connection to
connection based on the interface that the routing protocol has chosen to
reach the destination when the connection is established. If multiple
equal-cost next hops are present for a destination, locally generated
packets use the lo0 address as a source.

To configure the software to select a fixed address to use as the source
for locally generated IP packets, include the default-address-selection
statement at the [edit system] hierarchy level:

[edit system]

default-address-selection;

If you include the default-address-selection statement in the
configuration, the software chooses the system default address as the
source for most locally generated IP packets. The default address is
usually an address configured on the lo0 loopback interface. For example,
if you specified that SSH and telnet use a particular address, but you
also have default-address selection configured, the system default address
is used. For more information about how the default address is chosen, see
the JUNOS Network Interfaces Configuration Guide.

For IP packets sent by IP routing protocols--including Open Shortest Path
First (OSPF), Routing Information Protocol (RIP), Resource Reservation
Protocol (RSVP), and the multicast protocols, but not including
Intermediate System-to-Intermediate System (IS-IS)--the local address
selection is often constrained by the protocol specification so that the
protocol operates correctly. When this constraint exists in the routing
protocol, the packet's source address is unaffected by the presence of the
default-address-selection statement in the configuration. For protocols in
which the local address is unconstrained by the protocol specification,
for example, internal Border Gateway Protocol (IBGP) and multihop external
BGP (EBGP), if you do not configure a specific local address when
configuring the protocol, the local address is chosen using the same
method as other locally generated IP packets.


This will require a special nat for junos-host originator security zone if device will send packets to internet (or areas of the network where loopback IP is not routed):
Code:
> show configuration security nat source rule-set self-internet
from zone junos-host;
to zone untrust;
rule RE-untrust {
    match {
        source-address 0.0.0.0/0;
    }
    then {
        source-nat {
            interface;
        }
    }
}



Testing:

Code:
> show interfaces lo0.0 
  Logical interface lo0.0 (Index 67) (SNMP ifIndex 16)
    Flags: SNMP-Traps Encapsulation: Unspecified
    Input packets : 0
    Output packets: 0
    Security: Zone: routing_engine
    Allowed host-inbound traffic : ping ssh
    Protocol inet, MTU: Unlimited
      Flags: Sendbcast-pkt-to-re
      Addresses, Flags: Is-Default Is-Primary
        Local: 172.17.1.1


All ssh/telent Junos initiated sessions will have as source IP 172.17.1.1 ( unless NAT is used).





Top
Harespok
Post  Post subject: Re: Junos - How to use loopback IP address as source for local originated packets (ssh/telnet)  |  Posted: Mon Jul 16, 2012 4:29 am
When you learn all about different physical interfaces for your CCNA exam - serial, Ethernet and BRI, among others - there is a logical interface that you need to know about, and that is - you guessed it! - The loopback interface.


Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "Junos - How to use loopback IP address as source for local originated packets (ssh/telnet)"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. Junos: User 'remote' authenticated successfully but no local login-id configured

mandrei99

0

2376

Mon Jan 26, 2015 12:04 pm

mandrei99 View the latest post

There are no new unread posts for this topic. MTR / My traceroute in Junos

mandrei99

1

3276

Mon Oct 10, 2016 5:54 am

barrel View the latest post

There are no new unread posts for this topic. Juniper - Junos 11.4R8 based Olive

mandrei99

1

2683

Tue Jun 18, 2013 5:36 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: How to show uncommitted changes and cancel them

mandrei99

1

17621

Wed Sep 25, 2013 7:31 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: How to list routing table IDs

admin

0

1050

Sat Jan 17, 2015 3:53 pm

admin View the latest post

There are no new unread posts for this topic. Juniper SRX / Junos rescue configuration is not set

mandrei99

0

3368

Mon Feb 16, 2015 11:42 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos - How to limit arguments to ping CLI command

mandrei99

1

874

Thu Jun 27, 2013 4:04 am

admin View the latest post

There are no new unread posts for this topic. Junos: ping: invalid routing instance `RI0'

mandrei99

0

1790

Fri Jan 03, 2014 10:11 am

mandrei99 View the latest post

There are no new unread posts for this topic. How to search junos configuration option within cli help apropos

mandrei99

0

837

Mon Jan 12, 2015 12:34 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Junos system configuration archival is not working over scp

mandrei99

0

2948

Thu Jan 01, 2015 4:06 am

mandrei99 View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO