
<p class="wp-block-paragraph"> éåéå¸ï¼é 便çåçè¨ï¼è¥æé¯èª¤è«ä¸åææã </p>



<p class="wp-block-paragraph"> Junosåºæ¬æä½årootå¯ç¢¼è¨å®å¯åèæä¹åçæç« ï¼<a href="https://kerker.website/juniper-junos%E5%9F%BA%E6%9C%AC%E6%93%8D%E4%BD%9C%E3%80%81root%E5%AF%86%E7%A2%BC%E8%A8%AD%E5%AE%9A/">Juniper Junosåºæ¬æä½ãrootå¯ç¢¼è¨å®</a> </p>



<p class="wp-block-paragraph"> ææJuniperç¸éæç« å表ï¼<a href="https://kerker.website/juniper-junos-%E7%B3%BB%E5%88%97-%E6%96%87%E7%AB%A0%E5%88%97%E8%A1%A8/">Juniper JunOS ç³»åæç« å表</a> </p>



<!--more-->



<p class="wp-block-paragraph">ä¹åæå幫SwitchéåäºSSHåTelneté 端管ççåè½ï¼ä½æ¯å¦æ網é網路ä¸çææIPé½è½å¤ é 端管çï¼å°±æå¯è½é æè³å®ä¸ç風éªã</p>



<p class="wp-block-paragraph">Juniperçé 端管çåè½é輯ä¸é½æ¯ééLoopbackä»é¢é²è¡ååï¼å æ¤æåéè¦ééå¨Loopbackä»é¢(lo0)ä¸å¥ç¨filterä¾éå¶é 端管ççä¾æºIPã</p>



<p class="wp-block-paragraph">ééçè¨å®æå使ç¨ä¸æ¬¡vlanåºæ¬è¨å®çç¯ä¾ä¾é²è¡å¯¦ä½ï¼éå¶å vlan200(å³192.168.200.0/24網段)å¯å°sw1åtelnetãsshçé 端管çã</p>



<figure class="wp-block-image"><a href="https://lh3.googleusercontent.com/EKKqtqnq0qKqONp5ytk-owXiK5OFieZBcOlpMUUYP-DnU5K7hq4Tj0wc3Z3HU1GfRxTo61Z5HqjpxjLPDw-YPpLGbxQP9osnQtORJQgci0uMiGuP-DidSaLcpW4bsqTyr9H4ox56VjkbNMW_SoTV9ah8RkOrmyv1NFxKMXoXuubEI9Ve2vlGosi8bYzbTg2dSDbEZq-3TCl9GRJShkW79b7TlYClg1eI3R-Py7yUiNV7YfnWvkFGfG2oVzyQaXLJ7zfoYpkuE_7e3rLL8JYSz80EwXTR82u6mGVy71rZXp2JdfJGtIKTOelmQu4VbM1VsZJDSM4mjNLzWTEMXNYAn0w3NlgP7sa2_4UfwV4YvL3MkEtI-hOg1UyNXOb7JHbQgCwR-tZKi23hgObRlgKFTzxj88EH4sxxGQ8l7_oJKZC1ggifyMdCRJTN5IqwEjjPnQMZUGEizOxUDseghTccOW9rXRFr2MBv_K9Hc8zOGlw4KHs9NuR-1aGkUaYGXLBmv7oHYV1IUH9X7Yu8W1nmXPvCfpzntwNEe2-rEzgSMhS3onELgdD5uRIe4x58EKSKQkcZ2ivS8syRUq4SUM-lBHN9yo5JWIuU2VTURXsjShnZhyI4sGmrnKFclyyRl8oCCPXK6m5cMYmkc4-YnwAhI8a2J0fTgxB0QNvjPVcxoV4nVWvL0vYf0L6xmkNw0jD4X7tKCtv3KGTiF9HW-Ub81ar5FWC-HpdzXWDmZiwAgAYDp9mT=w471-h364-no"><img src="https://lh3.googleusercontent.com/EKKqtqnq0qKqONp5ytk-owXiK5OFieZBcOlpMUUYP-DnU5K7hq4Tj0wc3Z3HU1GfRxTo61Z5HqjpxjLPDw-YPpLGbxQP9osnQtORJQgci0uMiGuP-DidSaLcpW4bsqTyr9H4ox56VjkbNMW_SoTV9ah8RkOrmyv1NFxKMXoXuubEI9Ve2vlGosi8bYzbTg2dSDbEZq-3TCl9GRJShkW79b7TlYClg1eI3R-Py7yUiNV7YfnWvkFGfG2oVzyQaXLJ7zfoYpkuE_7e3rLL8JYSz80EwXTR82u6mGVy71rZXp2JdfJGtIKTOelmQu4VbM1VsZJDSM4mjNLzWTEMXNYAn0w3NlgP7sa2_4UfwV4YvL3MkEtI-hOg1UyNXOb7JHbQgCwR-tZKi23hgObRlgKFTzxj88EH4sxxGQ8l7_oJKZC1ggifyMdCRJTN5IqwEjjPnQMZUGEizOxUDseghTccOW9rXRFr2MBv_K9Hc8zOGlw4KHs9NuR-1aGkUaYGXLBmv7oHYV1IUH9X7Yu8W1nmXPvCfpzntwNEe2-rEzgSMhS3onELgdD5uRIe4x58EKSKQkcZ2ivS8syRUq4SUM-lBHN9yo5JWIuU2VTURXsjShnZhyI4sGmrnKFclyyRl8oCCPXK6m5cMYmkc4-YnwAhI8a2J0fTgxB0QNvjPVcxoV4nVWvL0vYf0L6xmkNw0jD4X7tKCtv3KGTiF9HW-Ub81ar5FWC-HpdzXWDmZiwAgAYDp9mT=w471-h364-no" alt=""/></a></figure>



<p class="wp-block-paragraph">é¦å æåè¦å¯¦åä¸åççè¦å¥ç¨çfilterï¼å¨è¨å®æ¨¡å¼ä¸ä½¿ç¨ä¸åæ令建ç«Filterï¼</p>



<pre class="wp-block-code"><code> KerKer@sw1# set firewall family inet filter Remote_ACL term 1 from source-address 192.168.200.0/24
 KerKer@sw1# set firewall family inet filter Remote_ACL term 1 from destination-port telnet
 KerKer@sw1# set firewall family inet filter Remote_ACL term 1 from destination-port ssh
 KerKer@sw1# set firewall family inet filter Remote_ACL term 1 then accept
 KerKer@sw1# set firewall family inet filter Remote_ACL term 2 from destination-port telnet
 KerKer@sw1# set firewall family inet filter Remote_ACL term 2 from destination-port ssh
 KerKer@sw1# set firewall family inet filter Remote_ACL term 2 then reject
 KerKer@sw1# set firewall family inet filter Remote_ACL term 3 then accept</code></pre>



<p class="wp-block-paragraph">Remote_ACLæ¯æå給éåfilterå®ç¾©çå稱ï¼ä¹å¯ä»¥ææä»»æå ¶ä»å稱ï¼æåå¯ä»¥å¨è¨å®æ¨¡å¼ä¸ç¨showæ令ä¾æ¥çFilterè¨å®ï¼</p>



<pre class="wp-block-code"><code> KerKer@sw1# show firewall family inet filter Remote_ACL 
 term 1 {
 from {
 source-address {
 192.168.200.0/24;
 }
 destination-port [ telnet ssh ];
 }
 then accept;
 }
 term 2 {
 from {
 destination-port [ telnet ssh ];
 }
 then {
 reject;
 }
 }
 term 3 {
 then accept;
 }</code></pre>



<p class="wp-block-paragraph">é¦å å¨ term 1 å å 許192.168.200.0/24çtelnetãsshè«æ±ï¼ä¸¦å¨ term 2 é»æä¾èªå ¶ä»ææIPçtelnetãsshè«æ±ï¼æå¾åç¨ term 3 å è¨±å ¶å®ételnetãsshå°å ã</p>



<p class="wp-block-paragraph">é裡æ¯è¼éè¦æ³¨æçæ¯termå¾é¢æ¥çæ¸åçºtermçå稱ï¼ä¹å¯ä»¥ä½¿ç¨ä»»æå串å½åã</p>



<p class="wp-block-paragraph">termçåªå åºä»¥æåé åºçºä¸»ï¼fromå¾é¢æ¥çæ¯æ¢ä»¶ï¼thenå¾é¢æ¥çæ¯åä½ã</p>



<p class="wp-block-paragraph">destination-portå¯ä»¥å¡«å¸¸ç¨çåå®ï¼ææå ¶å¯¦çåé填寫éäºåå®é è¨çportï¼æ以ééå¡« [ 22 23 ] ä¹è½èµ·å°ç¸åçææã</p>



<p class="wp-block-paragraph">è¥è¦æ¹è®æåé åºå¯ä»¥ä½¿å¨è¨å®æ¨¡å¼ä¸ç¨ insert term 2 before term 1 çæ令æ term 2 æå° term 1 åé¢ã</p>



<p class="wp-block-paragraph">å®æfilterè¨å®å¾æåé å°å ¶å¥ç¨è³ä»é¢ä¸ï¼å¥ç¨æ¹å¦ä¸ï¼</p>



<p class="wp-block-paragraph"><code> KerKer@sw1# set interfaces lo0 unit 0 family inet filter input Remote_ACL</code></p>



<p class="wp-block-paragraph">é樣就å®æææçè¨å®äºï¼ è¨å®å®æè¨å¾è¦commitææçæï¼æ´å¤éæ¼commitæ令çå §å®¹å¯ä»¥åèï¼<a href="https://kerker.website/juniper-junos%E6%8F%90%E4%BA%A4%E8%A8%AD%E5%AE%9Acommit/">Juniper Junosæ交è¨å®(commit)</a> </p>



<p class="wp-block-paragraph">æååå¥å¨vlan100åvlan200ä¸æ¥é»è ¦å°sw1é²è¡pingåtelnet/ssh測試ã</p>



<p class="wp-block-paragraph">ç¶æå使ç¨192.168.100.1æå¯æ£å¸¸pingå°sw1ä½ç¡æ³sshãtelnetã</p>



<pre class="wp-block-code"><code> [C:\~]$ ipconfig

 Windows IP è¨å®

 ä¹å¤ªç¶²è·¯å¡ ä¹å¤ªç¶²è·¯ 9:

 é£ç·ç¹å® DNS 尾碼 . . . . . . . . : 
 IPv4 ä½å . . . . . . . . . . . . : 192.168.100.1
 å網路é®ç½© . . . . . . . . . . . .: 255.255.255.0
 é è¨éé . . . . . . . . . . . . .: 192.168.100.254

 [C:\~]$ ping 10.0.0.1

 Ping 10.0.0.1 (ä½¿ç¨ 32 ä½å çµçè³æ):
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=3ms TTL=64
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=5ms TTL=64
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=4ms TTL=64
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=10ms TTL=64

 10.0.0.1 ç Ping çµ±è¨è³æ:
 å°å : å·²å³é = 4ï¼å·²æ¶å° = 4, å·²éºå¤± = 0 (0% éºå¤±)ï¼
 大ç´çä¾åæé (毫ç§):
 æå°å¼ = 3msï¼æå¤§å¼ = 10msï¼å¹³å = 5ms

 [C:\~]$ telnet 10.0.0.1

 Connecting to 10.0.0.1:23...
 Could not connect to '10.0.0.1' (port 23): Connection failed.

 [C:\~]$ ssh 10.0.0.1

 Connecting to 10.0.0.1:22...
 Could not connect to '10.0.0.1' (port 22): Connection failed.</code></pre>



<p class="wp-block-paragraph">ç¶æåæ¹ä½¿ç¨192.168.200.1æåpingãsshãtelneté½å¯ä»¥æ£å¸¸ååã</p>



<pre class="wp-block-code"><code> &#91;C:\~]$ ipconfig

 Windows IP è¨å®

 ä¹å¤ªç¶²è·¯å¡ ä¹å¤ªç¶²è·¯ 9:

 é£ç·ç¹å® DNS 尾碼 . . . . . . . . : 
 IPv4 ä½å . . . . . . . . . . . . : 192.168.200.1
 å網路é®ç½© . . . . . . . . . . . .: 255.255.255.0
 é è¨éé . . . . . . . . . . . . .: 192.168.200.254

 &#91;C:\~]$ ping 10.0.0.1

 Ping 10.0.0.1 (ä½¿ç¨ 32 ä½å çµçè³æ):
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=12ms TTL=64
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=12ms TTL=64
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=7ms TTL=64
 åè¦èª 10.0.0.1: ä½å çµ=32 æé=10ms TTL=64

 10.0.0.1 ç Ping çµ±è¨è³æ:
 å°å : å·²å³é = 4ï¼å·²æ¶å° = 4, å·²éºå¤± = 0 (0% éºå¤±)ï¼
 大ç´çä¾åæé (毫ç§):
 æå°å¼ = 7msï¼æå¤§å¼ = 12msï¼å¹³å = 10ms

 &#91;C:\~]$ telnet 10.0.0.1

 Connecting to 10.0.0.1:23...
 Connection established.
 To escape to local shell, press 'Ctrl+Alt+]'.

 &#91;C:\~]$ ssh 10.0.0.1

 Connecting to 10.0.0.1:22...
 Connection established.
 To escape to local shell, press 'Ctrl+Alt+]'. </code></pre>



<p class="wp-block-paragraph">å¦æ¤ä¸ä¾å°±è½å¤ 確èªææè¨å®é½å·²çæï¼å·²ç¶è½å¤ éå¶ç¹å®ä¾æºå°Switché²è¡ååäºï¼</p>

[Juniper] Junos限制遠端存取SSH、Telnet權限(ACL)
