Untitled
unknown
plain_text
a year ago
32 kB
2
Indexable
Never
version 12.1X47-D15.4;
system {
host-name WLNR0001;
domain-name ewepl.local;
time-zone Europe/Warsaw;
root-authentication {
encrypted-password "$1$YKfgipIs$NVv3/Hcc8ewXLlqvfc7Iv/";
}
name-server {
172.22.41.142;
172.22.41.143;
}
login {
class config-view {
permissions [ access admin firewall interface routing security snmp system view view-configuration ];
allow-commands "(view)";
}
user bcc {
uid 2000;
class super-user;
authentication {
encrypted-password "$1$vFRZaYyw$qaez6GlJxXpUwkI2EpEra1";
}
}
user ewe {
uid 2001;
class config-view;
authentication {
encrypted-password "$1$GoB8y6lK$2IOtWdAmDlz6TRk6Hol4a.";
}
}
}
services {
ssh;
xnm-clear-text;
dns {
dns-proxy {
interface {
ae0.10;
ae0.11;
ae0.20;
ae0.30;
}
}
}
web-management {
https {
system-generated-certificate;
interface [ fe-0/0/2.0 ae1.0 ];
}
}
dhcp {
inactive: traceoptions {
file dhcp.dbg size 100000;
level all;
flag all;
}
pool 172.22.40.192/27 {
address-range low 172.22.40.194 high 172.22.40.222;
default-lease-time 28800;
domain-name ewepl.local;
name-server {
172.22.41.142;
172.22.41.143;
}
router {
172.22.40.193;
}
boot-file "SMSboot\x86\wdsnbp.com";
boot-server tftp://172.22.41.133;
next-server 172.22.41.133;
}
pool 172.22.43.192/27 {
address-range low 172.22.43.194 high 172.22.43.222;
default-lease-time 28800;
domain-name ewepl.local;
name-server {
172.22.41.142;
172.22.41.143;
}
router {
172.22.43.193;
}
boot-file "SMSboot\x86\wdsnbp.com";
boot-server tftp://172.22.41.133;
next-server 172.22.41.133;
}
pool 192.168.13.0/24 {
address-range low 192.168.13.11 high 192.168.13.250;
default-lease-time 36000;
name-server {
8.8.8.8;
8.8.4.4;
1.1.1.1;
}
router {
192.168.13.1;
}
}
pool 192.168.14.128/26 {
address-range low 192.168.14.130 high 192.168.14.189;
default-lease-time 1814400;
name-server {
8.8.8.8;
8.8.4.4;
1.1.1.1;
}
router {
192.168.14.129;
}
}
pool 172.22.42.240/28 {
address-range low 172.22.42.242 high 172.22.42.254;
default-lease-time 604800;
name-server {
8.8.8.8;
}
router {
172.22.42.241;
}
}
static-binding 00:c0:3d:09:64:0a {
fixed-address {
172.22.40.221;
}
}
static-binding 6c:1c:71:36:a2:3e {
fixed-address {
172.22.40.222;
}
}
static-binding 00:04:f2:ff:cd:2b {
fixed-address {
172.22.40.219;
}
}
static-binding 64:16:7f:2e:13:ce {
fixed-address {
172.22.40.220;
}
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
file traffic {
any any;
match RT_FLOW_SESSION;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
archival {
configuration {
transfer-on-commit;
archive-sites {
"scp://archive@10.95.68.68/home/archive/ewe-wlnr0001" password "$9$UQiH.5TF/9t24Q39CB1lKM8xdgoGkqf";
}
}
}
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
ntp {
server 172.22.41.142;
server 172.22.41.143;
}
}
chassis {
aggregated-devices {
ethernet {
device-count 2;
}
}
}
interfaces {
fe-0/0/0 {
fastether-options {
802.3ad ae1;
}
}
fe-0/0/1 {
fastether-options {
802.3ad ae1;
}
}
fe-0/0/2 {
unit 0 {
family inet {
address 80.54.10.242/30;
}
}
}
fe-0/0/4 {
fastether-options {
802.3ad ae0;
}
}
fe-0/0/5 {
fastether-options {
802.3ad ae0;
}
}
fe-0/0/6 {
disable;
}
fe-0/0/7 {
disable;
}
ae0 {
vlan-tagging;
aggregated-ether-options {
minimum-links 1;
lacp {
active;
}
}
unit 10 {
description Brama_v10_Wielun_LAN;
vlan-id 10;
family inet {
address 172.22.40.193/27;
}
}
unit 11 {
description Brama_v11_Wielun_unauthorized_LAN;
vlan-id 11;
family inet {
address 172.22.43.193/27;
}
}
unit 12 {
description Brama_v12_WLAN_SSID_EWE;
vlan-id 12;
family inet {
filter {
input PBR-for_WLANs;
}
address 192.168.14.129/26;
}
}
unit 13 {
description Brama_v13_WLAN_SSID_EWE_guest;
vlan-id 13;
family inet {
filter {
input PBR-for_WLANs;
}
address 192.168.13.1/24;
}
}
unit 20 {
description Brama_v20_Wielun_Printers;
vlan-id 20;
family inet {
address 172.22.41.41/29;
}
}
unit 30 {
description Brama_v30_Wielun_MGMT;
vlan-id 30;
family inet {
address 172.22.41.217/29;
}
}
unit 31 {
description Brama_v31_Wielun_WLAN_MGMT;
vlan-id 31;
family inet {
address 172.22.42.241/28;
}
}
}
ae1 {
description "*** WAN ISP Netia v90u ***";
aggregated-ether-options {
minimum-links 1;
lacp {
active;
}
}
unit 0 {
family inet {
address 172.22.42.138/30;
}
}
}
st0 {
unit 0 {
family inet {
address 172.22.42.71/32;
}
}
unit 1 {
family inet {
address 172.22.42.73/30;
}
}
}
vlan {
disable;
}
}
snmp {
community su46qm20wb64jt81 {
authorization read-only;
clients {
10.95.68.68/32;
172.22.42.137/32;
10.95.227.227/32;
10.95.227.63/32;
10.95.227.60/32;
}
}
}
routing-options {
interface-routes {
rib-group inet Local-Internet-routing-instance;
}
static {
route 172.22.42.70/32 next-hop st0.0;
route 172.22.42.72/32 next-hop st0.1;
route 194.50.37.255/32 next-hop 80.54.10.241;
route 91.206.38.66/32 next-hop 80.54.10.241;
route 91.206.38.77/32 next-hop 80.54.10.241;
route 185.51.96.225/32 next-hop 80.54.10.241;
route 62.108.187.80/32 next-hop 80.54.10.241;
}
rib-groups {
Local-Internet-routing-instance {
import-rib [ inet.0 Local-Internet-routing-instance.inet.0 ];
}
}
}
protocols {
rip {
inactive: traceoptions {
file rip.log size 10k files 2 world-readable;
flag route;
flag update;
flag error;
flag all;
}
group EWE-RIP {
export advertise-routes-through-rip;
bfd-liveness-detection {
version 1;
minimum-interval 1000;
multiplier 5;
}
neighbor ae1.0 {
metric-in 1;
}
neighbor st0.1 {
metric-in 8;
}
}
}
rstp;
}
policy-options {
prefix-list DSL_WLN_pubIP {
80.54.10.240/30;
}
prefix-list BCC_LAN {
10.95.64.0/18;
}
prefix-list WLANs-prefix-list {
192.168.13.0/24;
192.168.14.128/26;
}
prefix-list WLAN_GUEST {
192.168.13.0/24;
}
policy-statement advertise-routes-through-rip {
term 0 {
from {
prefix-list DSL_WLN_pubIP;
prefix-list BCC_LAN;
prefix-list WLANs-prefix-list;
}
then reject;
}
term 1 {
from protocol [ direct rip ];
then accept;
}
}
}
security {
ssh-known-hosts {
host 10.95.68.68 {
rsa-key AAAAB3NzaC1yc2EAAAABIwAAAIEAwlUzWSZvQfbbhh+MZMYL3Xox4k0fkEL1kOBvX13yxbzHCu1lpkL7xExeQg8M9SPx5CLGqYIIFo/wls512XU4ydV+2S1QIyFuC4M350RqHTVnIpPDVNKb0qzkSnZVpw/RrTeEe9J6RHFkd7/CFZdpDbPiLNdqgMQaZyRkFwDRdQE=;
}
}
ike {
inactive: traceoptions {
file vpn.tr size 1m files 3 world-readable;
flag ike;
flag general;
}
proposal p1-pre-g2-aes256-sha {
authentication-method pre-shared-keys;
dh-group group2;
authentication-algorithm sha1;
encryption-algorithm aes-256-cbc;
}
policy p1-EWE-policy {
mode main;
proposals p1-pre-g2-aes256-sha;
}
gateway DC_EWE_BCC_gw {
ike-policy p1-EWE-policy;
address 172.22.42.137;
external-interface ae1.0;
}
gateway DC_EWE_WLN_gw {
ike-policy p1-EWE-policy;
address 185.51.96.225;
external-interface fe-0/0/2.0;
}
}
ipsec {
inactive: traceoptions {
flag security-associations;
flag packet-drops;
flag packet-processing;
}
proposal p2-esp-aes256-sha {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm aes-256-cbc;
}
proposal p2-esp-3des-sha {
protocol esp;
authentication-algorithm hmac-sha1-96;
encryption-algorithm 3des-cbc;
}
policy p2-policy-g2 {
perfect-forward-secrecy {
keys group2;
}
proposals [ p2-esp-3des-sha p2-esp-aes256-sha ];
}
vpn DC_EWE_BCC_vpn {
bind-interface st0.0;
vpn-monitor {
source-interface st0.0;
destination-ip 172.22.42.70;
}
ike {
gateway DC_EWE_BCC_gw;
proxy-identity {
local 0.0.0.0/0;
remote 0.0.0.0/0;
service any;
}
ipsec-policy p2-policy-g2;
}
}
vpn DC_EWE_WLN_vpn {
bind-interface st0.1;
vpn-monitor {
source-interface st0.1;
destination-ip 172.22.42.72;
}
ike {
gateway DC_EWE_WLN_gw;
proxy-identity {
local 0.0.0.0/0;
remote 0.0.0.0/0;
service any;
}
ipsec-policy p2-policy-g2;
}
}
}
address-book {
trust-book {
address EWE_Test_LAN 10.255.255.0/24;
address GBCC_LAN 10.95.64.0/18;
address DC_EWE_LAN 172.22.41.128/27;
address DC_EWE_EDDINGTON 172.22.41.130/32;
address EWE_Wielun_LAN 172.22.40.192/27;
address DC_EWE_LAN_OLD 10.206.41.64/28;
address GBCC_LAN_RAVON {
description "serwer logow oraz do backupu configuracji";
10.95.68.68/32;
}
address EWE_Poznan_LAN 172.22.40.128/26;
address EWE_Zachod_LAN 172.22.40.0/25;
address BCC-Aurora 10.95.220.24/32;
address EWE_SSLVPN_FG 172.22.46.0/25;
address DC_EWE_AZURE_EWE011 172.22.41.164/32;
address DC_Observium 10.95.227.227/32;
address DC_EWE_AZURE_CSAT 172.22.41.165/32;
address MGMT.A_A41_ZBX_DEV_SNP2082 10.95.227.60/32;
address MGMT.A_A41_ZBX_DEV_SNP2077 10.95.227.63/32;
address-set DC_EWE_LAN_ALL {
address DC_EWE_LAN;
address DC_EWE_LAN_OLD;
}
address-set MGMT.A_A41_ZBX_SRV {
address MGMT.A_A41_ZBX_DEV_SNP2082;
address MGMT.A_A41_ZBX_DEV_SNP2077;
}
attach {
zone trust;
}
}
unauthorized-book {
address EWE_Wielun_unauthorized_LAN 172.22.43.192/27;
attach {
zone unauthorized;
}
}
printers-book {
address EWE_Wielun_Printers 172.22.41.40/29;
attach {
zone printers;
}
}
mgmt-book {
address EWE_Wielun_MGMT 172.22.41.216/29;
address EWE_MGMT_WLNC0001 172.22.41.218/32;
address EWE_Wielun_WLAN_MGMT 172.22.42.240/28;
attach {
zone mgmt;
}
}
wlan-book {
address WLAN_SSID_EWE 192.168.14.128/26;
address WLAN_SSID_EWE_guest 192.168.13.0/24;
attach {
zone wlan;
}
}
}
flow {
tcp-mss {
ipsec-vpn {
mss 1350;
}
}
}
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set wlan-to-untrust {
from zone wlan;
to zone untrust;
rule WLAN_SSID_EWE-to-Internet {
match {
source-address 192.168.14.128/26;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
rule WLAN_SSID_EWE_guest-to-Internet {
match {
source-address 192.168.13.0/24;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
}
policies {
from-zone trust to-zone trust {
policy EWE_BCC-to-EWE_Wielun_LAN {
match {
source-address [ GBCC_LAN DC_EWE_LAN_ALL EWE_Poznan_LAN EWE_Zachod_LAN EWE_SSLVPN_FG DC_EWE_AZURE_EWE011 DC_EWE_AZURE_CSAT ];
destination-address EWE_Wielun_LAN;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
policy EWE_Wielun_LAN-to-Internet {
match {
source-address EWE_Wielun_LAN;
destination-address any;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone trust to-zone mgmt {
policy EWE_BCC-to-EWE_Wielun_mgmt {
match {
source-address [ GBCC_LAN DC_EWE_LAN_ALL EWE_Poznan_LAN BCC-Aurora EWE_SSLVPN_FG DC_Observium MGMT.A_A41_ZBX_SRV ];
destination-address EWE_Wielun_MGMT;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone trust to-zone unauthorized {
policy EWE_BCC-to-EWE_Wielun_unauthorized {
match {
source-address [ GBCC_LAN DC_EWE_LAN_ALL ];
destination-address EWE_Wielun_unauthorized_LAN;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone trust to-zone printers {
policy EWE_BCC-to-EWE_Wielun_printers {
match {
source-address [ GBCC_LAN DC_EWE_LAN_ALL DC_EWE_AZURE_EWE011 ];
destination-address EWE_Wielun_Printers;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
policy EWE_Wielun_LAN-to-EWE_Wielun_printers {
match {
source-address [ EWE_Wielun_LAN EWE_Poznan_LAN ];
destination-address EWE_Wielun_Printers;
application [ junos-ping junos-http junos-https ];
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone mgmt to-zone trust {
policy WLNC0001-to-radius {
match {
source-address EWE_Wielun_MGMT;
destination-address [ DC_EWE_LAN_ALL GBCC_LAN_RAVON ];
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
policy EWE_Wielun_MGMT-to-Internet {
match {
source-address EWE_Wielun_MGMT;
destination-address any;
application [ junos-ping junos-ntp junos-http junos-https junos-dns-tcp junos-dns-udp ];
}
then {
permit;
log {
session-close;
}
}
}
policy EWE_Wielun_WLAN_MGMT-to-DC_EWE_EWE011 {
match {
source-address EWE_Wielun_WLAN_MGMT;
destination-address DC_EWE_AZURE_EWE011;
application any;
}
then {
permit;
log {
session-close;
}
}
}
policy EWE_Wielun_WLAN_MGMT-to-Internet {
match {
source-address EWE_Wielun_WLAN_MGMT;
destination-address any;
application any;
}
then {
permit;
log {
session-close;
}
}
}
}
from-zone unauthorized to-zone trust {
policy unauthorized-to-Internet {
match {
source-address EWE_Wielun_unauthorized_LAN;
destination-address any;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone printers to-zone trust {
policy printers-to-Internet {
match {
source-address EWE_Wielun_Printers;
destination-address any;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
from-zone wlan to-zone untrust {
policy WLAN_SSID_EWE_guest-to-Internet {
match {
source-address WLAN_SSID_EWE_guest;
destination-address any;
application any;
}
then {
permit;
log {
session-close;
}
}
}
policy WLAN_SSID_EWE-to-Internet {
match {
source-address WLAN_SSID_EWE;
destination-address any;
application any;
}
then {
permit;
log {
session-init;
session-close;
}
}
}
}
global {
policy DENY_ALL_LOG {
match {
source-address any;
destination-address any;
application any;
}
then {
deny;
log {
session-init;
session-close;
}
}
}
}
}
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ae0.10;
st0.0;
st0.1;
ae1.0;
}
}
security-zone untrust {
screen untrust-screen;
interfaces {
fe-0/0/2.0 {
host-inbound-traffic {
system-services {
ssh;
ping;
ike;
https;
}
}
}
}
}
security-zone printers {
interfaces {
ae0.20 {
host-inbound-traffic {
system-services {
ping;
ntp;
dns;
}
}
}
}
}
security-zone mgmt {
interfaces {
ae0.30 {
host-inbound-traffic {
system-services {
ping;
ntp;
dns;
}
}
}
ae0.31 {
host-inbound-traffic {
system-services {
ping;
ntp;
dns;
dhcp;
}
}
}
}
}
security-zone unauthorized {
interfaces {
ae0.11 {
host-inbound-traffic {
system-services {
ping;
ntp;
dns;
dhcp;
}
}
}
}
}
security-zone wlan {
interfaces {
ae0.13 {
host-inbound-traffic {
system-services {
ping;
ntp;
dns;
dhcp;
}
}
}
ae0.12 {
host-inbound-traffic {
system-services {
ping;
ntp;
dns;
dhcp;
}
}
}
}
}
}
}
firewall {
family inet {
filter bandwidth-limit {
term 0 {
from {
source-address {
213.186.79.128/26;
}
}
then {
policer policer-50mb;
count vidyo_counter_from_Vidyo;
accept;
}
}
term 1 {
from {
destination-address {
213.186.79.128/26;
}
}
then {
policer policer-50mb;
count vidyo_counter_to_Vidyo;
accept;
}
}
inactive: term 2 {
from {
address {
213.186.79.133/32;
}
}
then {
policer policer-50mb;
count vidyo_counter;
accept;
}
}
term 10 {
from {
source-address {
0.0.0.0/0;
}
}
then {
policer policer-20mb;
count non-vidyo_counter;
accept;
}
}
}
filter PBR-for_WLANs {
term 1 {
from {
source-prefix-list {
WLANs-prefix-list;
}
}
then {
routing-instance Local-Internet-routing-instance;
}
}
term 2 {
from {
source-address {
192.168.13.0/24;
}
}
then {
routing-instance Local-Internet-routing-instance;
}
}
term 3 {
then accept;
}
}
}
policer policer-20mb {
if-exceeding {
bandwidth-limit 20m;
burst-size-limit 1m;
}
then discard;
}
policer policer-50mb {
if-exceeding {
bandwidth-limit 50m;
burst-size-limit 2m;
}
then discard;
}
filter GoToMeeting_QoS {
term GoToMeeting_Audio {
from {
protocol [ tcp udp ];
port 8200;
}
then forwarding-class assured-forwarding;
}
term GoToMeeting_Video {
from {
protocol [ udp tcp ];
port 1853;
}
then forwarding-class expedited-forwarding;
}
term WWW_smal_packets {
from {
packet-length 0-512;
protocol tcp;
port [ http https ];
}
then forwarding-class expedited-forwarding;
}
term accept_rest {
then accept;
}
}
}
routing-instances {
Local-Internet-routing-instance {
instance-type forwarding;
routing-options {
static {
route 0.0.0.0/0 next-hop 80.54.10.241;
}
}
}
}
inactive: services {
rpm {
probe DC_EWE_BCC_vpn {
test BCC_st0.4_address {
target address 172.22.42.70;
probe-count 5;
probe-interval 2;
test-interval 5;
thresholds {
successive-loss 5;
total-loss 5;
}
}
}
}
ip-monitoring {
policy DC_EWE_BCC_vpn_down {
match {
rpm-probe DC_EWE_BCC_vpn;
}
}
}
}
applications {
application RDP_TCP_DST_3389 {
protocol tcp;
destination-port 3389;
}
}