Initial commit (cf0d253c) · Commits · examples / Securing Enterprise LANs Using the Junos OS

README.md

0 → 100644

+15 −0

Changes for README.md: 15 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		## Example files for the title:

		# Securing Enterprise LANs Using the Junos OS, by Martin Brown

		[![Securing Enterprise LANs Using the Junos OS, by Martin Brown](http://akamaicovers.oreilly.com/images/9781491962497/cat.gif)](https://www.safaribooksonline.com/library/view/title/9781491962503//)

		The following applies to example files from material published by O’Reilly Media, Inc. Content from other publishers may include different rules of usage. Please refer to any additional usage rights explained in the actual example files or refer to the publisher’s website.

		O'Reilly books are here to help you get your job done. In general, you may use the code in O'Reilly books in your programs and documentation. You do not need to contact us for permission unless you're reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from our books does not require permission. Answering a question by citing our books and quoting example code does not require permission. On the other hand, selling or distributing a CD-ROM of examples from O'Reilly books does require permission. Incorporating a significant amount of example code from our books into your product's documentation does require permission.

		We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN.

		If you think your use of code examples falls outside fair use or the permission given here, feel free to contact us at <permissions@oreilly.com>.

		Please note that the examples are not production code and have not been carefully testing. They are provided "as-is" and come with no warranty of any kind.

Securing Enterprise LANs Using the Junos OS - Working Files/Chapter 1/No Work Files.rtf

0 → 100755

+7 −0

Changes for Securing Enterprise LANs Using the Junos OS - Working Files/Chapter 1/No Work Files.rtf: 7 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		{\rtf1\ansi\ansicpg1252\cocoartf1038\cocoasubrtf350
		{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
		{\colortbl;\red255\green255\blue255;}
		\margl1440\margr1440\vieww9000\viewh8400\viewkind0
		\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\ql\qnatural\pardirnatural

		\f0\fs24 \cf0 No work files for this lesson...}
		No newline at end of file

Securing Enterprise LANs Using the Junos OS - Working Files/Chapter 2/Initial Switch Configuration.txt

0 → 100755

+542 −0

Changes for Securing Enterprise LANs Using the Junos OS - Working Files/Chapter 2/Initial Switch Configuration.txt: 542 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		## Last commit: 2016-05-10 20:15:06 UTC by admin
		version 12.3R11.2;
		system {
		host-name ACME-NYC-SW-20;
		authentication-order [ password radius ];
		root-authentication {
		encrypted-password "$1$/5oKRjUP$C5p885GeQlj1j4tc3O0fW1"; ## SECRET-DATA
		}
		radius-server {
		10.0.0.10 {
		secret "$9$WrM8NVws4ZDk246A0Irl24aJGik.P"; ## SECRET-DATA
		source-address 10.200.1.18;
		}
		}
		radius-options {
		password-protocol mschap-v2;
		}
		login {
		user acmeadmin {
		uid 2003;
		class super-user;
		authentication {
		encrypted-password "$1$Bfbg.Oox$Vc2yV07Uo4Hf.SA8BJCJ0."; ## SECRET-DATA
		}
		}
		user admin {
		uid 2002;
		class super-user;
		authentication {
		encrypted-password "$1$n415qwww$FeuPV5VNgUWo8EVt7cdLs."; ## SECRET-DATA
		}
		}
		user readonly {
		uid 2009;
		class read-only;
		}
		user superuser {
		uid 2010;
		class super-user;
		}
		}
		services {
		ssh {
		protocol-version v2;
		}
		web-management {
		https {
		system-generated-certificate;
		interface vlan.10;
		}
		}
		dhcp {
		traceoptions {
		file dhcp_logfile;
		level all;
		flag all;
		}
		}
		}
		syslog {
		user * {
		any emergency;
		}
		file messages {
		any notice;
		authorization info;
		}
		file interactive-commands {
		interactive-commands any;
		}
		}
		ntp {
		boot-server 10.10.0.25;
		authentication-key 6969 type md5 value "$9$kqT30ORyeW/COREcvM"; ## SECRET-DATA
		server 10.10.0.25 key 6969 prefer; ## SECRET-DATA
		trusted-key 6969;
		}
		}
		chassis {
		aggregated-devices {
		ethernet {
		device-count 1;
		}
		}
		auto-image-upgrade;
		}
		interfaces {
		interface-range UNUSED {
		member ge-0/1/2;
		member ge-1/1/2;
		member-range ge-0/0/0 to ge-0/0/2;
		member-range ge-1/0/0 to ge-1/0/2;
		member-range ge-0/0/4 to ge-0/0/9;
		member-range ge-1/0/4 to ge-1/0/5;
		member-range ge-1/0/7 to ge-1/0/10;
		member-range ge-0/0/11 to ge-0/0/23;
		member-range ge-1/0/12 to ge-1/0/23;
		disable;
		unit 0 {
		family ethernet-switching {
		port-mode access;
		vlan {
		members UNUSED;
		}
		}
		}
		}
		ge-0/0/0 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/1 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/3 {
		description INFOBLOX;
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/4 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/5 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/6 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/7 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/8 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/9 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/10 {
		description WORKSTATION9;
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/11 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/12 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/13 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/14 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/15 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/16 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/17 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/18 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/19 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/20 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/21 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/22 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/23 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/1/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/1/3 {
		description UPLINK_TO_ACME-NYC-DIST-5;
		ether-options {
		speed {
		100m;
		}
		802.3ad {
		lacp {
		force-up;
		}
		ae0;
		}
		}
		}
		ge-1/0/0 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/1 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/3 {
		description INFOBLOX;
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/4 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/5 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/6 {
		description FINANCE-LAPTOP4;
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/7 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/8 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/9 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/10 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/11 {
		description WORKSTATION20;
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/12 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/13 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/14 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/15 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/16 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/17 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/18 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/19 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/20 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/21 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/22 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/23 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/1/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/1/3 {
		description UPLINK_TO_ACME-NYC-DIST-6;
		ether-options {
		speed {
		100m;
		}
		802.3ad {
		lacp {
		force-up;
		}
		ae0;
		}
		}
		}
		ae0 {
		aggregated-ether-options {
		link-speed 100m;
		}
		unit 0 {
		family ethernet-switching;
		}
		}
		lo0 {
		unit 0 {
		family inet;
		}
		}
		me0 {
		unit 0 {
		family inet {
		dhcp {
		vendor-id Juniper-ex2200-24t-4g;
		}
		}
		}
		}
		vlan {
		unit 20 {
		family inet {
		address 10.240.0.2/24;
		}
		}
		unit 100 {
		family inet {
		address 10.200.2.1/24;
		}
		}
		unit 200 {
		family inet {
		address 10.200.3.1/24;
		}
		}
		unit 300 {
		family inet {
		address 10.200.4.1/24;
		}
		}
		}
		}
		snmp {
		interface vlan.10;
		community acmesnmp {
		authorization read-only;
		clients {
		10.0.0.20/32;
		}
		}
		trap-options {
		source-address 10.200.1.18;
		}
		trap-group ACME-MK {
		version v2;
		categories {
		authentication;
		chassis;
		link;
		routing;
		startup;
		configuration;
		services;
		}
		targets {
		10.0.0.20;
		}
		}
		}
		forwarding-options {
		helpers {
		bootp {
		server 10.200.2.12;
		interface {
		vlan.200;
		vlan.300;
		}
		}
		}
		}
		routing-options {
		static {
		route 0.0.0.0/0 next-hop 10.240.0.1;
		}
		}
		protocols {
		igmp-snooping {
		vlan all;
		}
		rstp;
		lldp {
		interface all;
		}
		lldp-med {
		interface all;
		}
		}
		ethernet-switching-options {
		storm-control {
		interface all;
		}
		}
		vlans {
		DISTRIBUTION_TO_ACCESS {
		vlan-id 20;
		interface {
		ae0.0;
		}
		l3-interface vlan.20;
		}
		ENGINEERING {
		vlan-id 200;
		interface {
		ge-0/0/10.0;
		ge-1/0/11.0;
		}
		l3-interface vlan.200;
		}
		FINANCE {
		vlan-id 300;
		interface {
		ge-1/0/6.0;
		}
		l3-interface vlan.300;
		}
		SERVICES {
		vlan-id 100;
		interface {
		ge-0/0/3.0;
		ge-1/0/3.0;
		}
		l3-interface vlan.100;
		}
		UNUSED {
		vlan-id 900;
		}
		}
		virtual-chassis {
		preprovisioned;
		no-split-detection;
		member 0 {
		role routing-engine;
		serial-number CW0210371072;
		}
		member 1 {
		role routing-engine;
		serial-number CW0210066838;
		}
		}

Securing Enterprise LANs Using the Junos OS - Working Files/Chapter 3/VLAN Hopping Allowed Config.txt

0 → 100755

+436 −0

Changes for Securing Enterprise LANs Using the Junos OS - Working Files/Chapter 3/VLAN Hopping Allowed Config.txt: 436 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		## Last commit: 2016-05-22 16:17:08 UTC by admin
		version 12.3R11.2;
		system {
		host-name ACME-NYC-SW-20;
		root-authentication {
		encrypted-password "$1$lpLAOXAX$.1VpfC3bFQx6gOXVcMq1q1"; ## SECRET-DATA
		}
		login {
		user admin {
		uid 2000;
		class super-user;
		authentication {
		encrypted-password "$1$Kr74eCw3$yciR25SH3UCqtn/1nR0Im."; ## SECRET-DATA
		}
		}
		}
		services {
		ssh {
		protocol-version v2;
		}
		dhcp {
		traceoptions {
		file dhcp_logfile;
		level all;
		flag all;
		}
		}
		}
		syslog {
		user * {
		any emergency;
		}
		file messages {
		any notice;
		authorization info;
		}
		file interactive-commands {
		interactive-commands any;
		}
		}
		}
		chassis {
		aggregated-devices {
		ethernet {
		device-count 1;
		}
		}
		auto-image-upgrade;
		}
		interfaces {
		ge-0/0/0 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/1 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/3 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/4 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/5 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/6 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/7 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/8 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/9 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/10 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/11 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/12 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/13 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/14 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/15 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/16 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/17 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/18 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/19 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/20 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/21 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/22 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/0/23 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/1/0 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/1/1 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/1/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-0/1/3 {
		ether-options {
		speed {
		100m;
		}
		802.3ad {
		lacp {
		force-up;
		}
		ae0;
		}
		}
		}
		ge-1/0/0 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/1 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/3 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/4 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/5 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/6 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/7 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/8 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/9 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/10 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/11 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/12 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/13 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/14 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/15 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/16 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/17 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/18 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/19 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/20 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/21 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/22 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/0/23 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/1/2 {
		unit 0 {
		family ethernet-switching;
		}
		}
		ge-1/1/3 {
		ether-options {
		speed {
		100m;
		}
		802.3ad {
		lacp {
		force-up;
		}
		ae0;
		}
		}
		}
		ae0 {
		aggregated-ether-options {
		link-speed 100m;
		}
		unit 0 {
		family ethernet-switching;
		}
		}
		me0 {
		unit 0 {
		family inet {
		dhcp {
		vendor-id Juniper-ex2200-24t-4g;
		}
		}
		}
		}
		vlan {
		unit 0 {
		family inet {
		address 10.200.1.1/24;
		}
		}
		unit 20 {
		family inet {
		address 10.240.0.2/24;
		}
		}
		unit 200 {
		family inet {
		address 10.200.3.1/24;
		}
		}
		}
		}
		routing-options {
		static {
		route 0.0.0.0/0 next-hop 10.240.0.1;
		}
		}
		protocols {
		igmp-snooping {
		vlan all;
		}
		rstp;
		lldp {
		interface all;
		}
		lldp-med {
		interface all;
		}
		}
		ethernet-switching-options {
		analyzer DOUBLETAG {
		input {
		ingress {
		interface ge-1/0/11.0;
		}
		}
		output {
		interface {
		ge-0/0/11.0;
		}
		}
		}
		storm-control {
		interface all;
		}
		}
		vlans {
		DISTRIBUTION_TO_ACCESS {
		vlan-id 20;
		interface {
		ae0.0;
		}
		l3-interface vlan.20;
		}
		ENGINEERING {
		vlan-id 200;
		interface {
		ge-0/0/10.0;
		}
		l3-interface vlan.200;
		}
		default {
		l3-interface vlan.0;
		}
		}
		virtual-chassis {
		preprovisioned;
		no-split-detection;
		member 0 {
		role routing-engine;
		serial-number CW0210371072;
		}
		member 1 {
		role routing-engine;
		serial-number CW0210066838;
		}
		}

Securing Enterprise LANs Using the Junos OS - Working Files/Chapter 3/VLAN Hopping Prevented Config.txt

0 → 100755

+502 −0

File added.

Preview size limit exceeded, changes collapsed.