Fryguy's Blog
Home About Fryguy JNCIE-ENT Workbook Published Workbooks Cisco Live Hats Network Tools Financial Tools RSVLTS Search
Fryguy's Blog

Juniper Protect-RE Filter Generator

← Back to Tools

Generate a Junos Routing Engine protection filter — the lo0 input firewall filter that every RE-bound packet passes through regardless of which interface or destination address it actually arrived on. Applied via unit <*> so it automatically covers every configured loopback unit — the default instance and any routing-instances/virtual-routers — not just lo0.0. Check the protocols you run, list trusted sources per protocol where it matters, and get a complete, correctly-ordered set command block ending in a logged catch-all discard. Runs entirely in your browser — nothing is sent anywhere.

Filter Name
Protocols
Discards obviously-bogus source addresses (RFC 1918-adjacent specials, loopback, link-local, documentation, multicast-as-source) before they consume any other term.
Non-initial fragments destined to the RE are almost never legitimate control-plane traffic — discarded early.
TCP/179, restricted via an apply-path prefix-list that dynamically pulls every configured protocols bgp group <*> neighbor <*> address — including inside routing-instances/virtual-routers — so the neighbor list can never drift out of sync with your actual BGP config. No manual address entry needed.
Protocol 89. OSPF adjacencies are link-local, so this is a straight protocol match with no source-address list.
⚠ IS-IS runs directly over CLNS/OSI framing, not IP — no family inet firewall filter can see it, so checking this only adds an explanatory comment to the output, not a real filter term. Protect IS-IS via interface-level authentication instead (set protocols isis interface <if> level 2 authentication ...).
Protocol 112, link-local by nature — no source-address list needed.
UDP/3784 (single-hop) and UDP/4784 (multihop) — only relevant if you're running BFD for fast failure detection with BGP/OSPF/static routes.
UDP/123, restricted via an apply-path prefix-list pulled from system ntp server <*> — no manual address entry needed.
UDP/161, restricted via an apply-path prefix-list pulled from snmp client-list <*> — your SNMP-layer poller restriction usually is the source list. Add any polling-only hosts below that aren't in a client-list.
The router is a RADIUS client, so this matches return traffic — UDP source-port 1812/1813, restricted via an apply-path prefix-list pulled from system radius-server <*>. Not a destination-port match, and no manual address entry needed.
SSH (and optionally HTTPS/J-Web), restricted to your management networks.
Rate-limits connection-churn TCP packets (SYN-without-ACK, FIN, RST) across every TCP-based service at once — a blanket policer layered ahead of the per-service accept terms, not tied to any one protocol.
Restricted to specific legitimate types (echo, time-exceeded, unreachable, parameter-problem, source-quench, router-advertisement) rather than any ICMP type, and rate-limited on top — keeps ping/PMTUD working with a smaller attack surface than a blanket ICMP allow.
Covers both traceroute styles — UDP high-ports (Linux/macOS) and ICMP echo (Windows tracert.exe) — each requiring ttl 1 so only packets that are actually topologically arriving as a hop-probe match, plus a policer on both.
Source = destination = 127.0.0.1 — needed on some platforms for internal daemon-to-daemon communication on the RE itself.
1. Anti-spoof / fragmentsReject obviously-bogus traffic before it wastes evaluation time on later terms.
2. NTP / RADIUS / SNMPNarrow UDP services with known, small source lists.
3. BGP / OSPF / VRRPRouting protocols — BGP is source-restricted since peers are known; OSPF/VRRP rely on link-local adjacency instead.
4. Management (SSH/HTTPS)Restricted to your management networks — never leave this open to any source.
5. ICMP (policed) / tracerouteKept working but rate-limited, so a flood can't consume RE CPU.
6. Catch-allEverything else is counted, logged, and discarded — visibility into what's hitting the RE without letting any of it through.
lo0, not per-interfaceThe loopback input filter catches all RE-bound traffic regardless of ingress interface or destination IP — that's the whole mechanism. Applied via unit <*>, so it covers every configured loopback unit, not just lo0.0.
IS-IS is invisible hereNo IP header means no IP firewall filter can match it — use interface-level authentication instead.
RADIUS is reply trafficMatch source-port 1812/1813 from your servers, not a destination-port rule — the router initiates the request.
apply-path prefix-listsBGP/NTP/RADIUS/SNMP pull their allow-lists live from the actual config (protocols bgp, system ntp/radius-server, snmp client-list) at commit time — add or remove a peer there and this filter updates itself on the next commit, nothing to maintain twice.
groups need apply-groupsThe whole filter is wrapped in a configuration group for reuse/clarity, bound to any lo0 unit via unit <*> — a group does nothing on its own until the trailing apply-groups line activates it.
Test before you commitAlways use commit confirmed when applying a new RE filter remotely — a mistake here can lock you out of the box entirely.
IPv4 onlyThis generates family inet only. A dual-stack box needs an equivalent family inet6 filter applied separately.

Provided as-is, with no warranty of any kind. This generates a starting point, not a certified or vendor-validated configuration — exact syntax and defaults can vary by Junos version and platform. Always read through the generated config line by line, verify it against current Juniper documentation and your own environment, and test in a lab before applying to production. A mistake in a Routing Engine protection filter can lock you out of the device entirely — always use commit confirmed when applying changes remotely. See the full disclaimer.