Screenos: Anti-Spam: Adding custom SBL

The anti-spam portion uses a Spam Block List (SBL) which is more commonly known as a Relay Block List (RBL). The SBL/RBL that Juniper offers is updated and maintained by Symantec and contains the Top 100 known spammers.

G1S1-> set anti-spam profile ns-profile
G1S1(anti-spam:ns-profile)-> unset sbl msgsecurity.juniper.net
G1S1(anti-spam:ns-profile)-> set sbl sbl.spamhaus.org input-type ip
G1S1(anti-spam:ns-profile)-> set sbl dnsbl.sorbs.net input-type ip
G1S1(anti-spam:ns-profile)-> set sbl bl.spamcop.net input-type ip
G1S1(anti-spam:ns-profile)-> set sbl msgsecurity.juniper.net input-type ip

G1S1(anti-spam:ns-profile)-> get sbl
  *SBL Blacklist Server:
    sbl.spamhaus.org
    dnsbl.sorbs.net
    bl.spamcop.net
    msgsecurity.juniper.net
G1S1(anti-spam:ns-profile)-> exit

View the Status:

G1S1-> get anti-spam

  profile: ns-profile
  *Whitelists (0):
  *Blacklist (1): baddomain.com;
  *Blacklist[ip range] (0):
  *SBL Blacklist Server:
    sbl.spamhaus.org
  *Default setting:
    *Action: tag mail subject as ***SPAM***


DNS Server:
  Primary  :          10.1.75.111, Src Interface: Null
  Secondary:        172.16.165.22, Src Interface: Null
  Tertiary  :              0.0.0.0, Src Interface: Null


  Total connections:    8
  Total greetings:      8
  Total emails:         8

  Total permit emails:  1
  Total deny actions:   0
  Total tag emails:     7

  errors:               8
  timeouts:             8

  Statistics start time: 12/07/2010 09:43:21

With it with string:

G1S1-> exec anti-spam testscan baddomain.com
AS: anti spam result: action Tag email subject, reason: Match local blacklist

With IP:

G1S1-> exec anti-spam testscan 192.203.178.57
Please wait for a few seconds.
If the result does not display, please check the debug buffer with the "get dbuf stream" command.
G1S1->  anti spam result: action Pass, reason: Timeout
 

View the config:

JUNOS: vlan tagging

Junos: How to configure a tag for a L3 interface ?

<br />
So, you have a L3 interface an want to add an IEEE 802.1Q VLAN TAG,

here is how to do so:

root@s1> show configuration interfaces me0

description "MGMT INTERFACE - DO NOT DELETE";

vlan-tagging;

unit 101 {

    vlan-id 101;

    family inet {

        address 10.150.8.161/16;

    }

}

NETASQ: How to hanlde FTP PASSIVE connexion ?

ASQ handles FTP thanks to FTP plugin analysis of the command port,

Support for FTP in a REDIRECT rule for Passive connection to an internal server,
Handling passive connections for an internal FTP server is only handled through a REDIRECT
operation; a BIDIRECTIONNAL MAP operation won't work for this purpose.

So you have an Internal FTP server. You want to allow access from the Internet.

You must be aware of:

- plugin ftp must be in auto-attach,
- ftp support must be activated in the NAT rule (we discuss this part after)
- In the object, the ftp service must use the FTP plugin, explicitly.
- In the policy firewall filters you must to have an explicit allow for the ftp service,
- You doesn't have to allow ftp-data

So you have an extra public IP, used for the ftp service. Naturally you created a BIMAP nat rules.
these work fine only is your ftp server run in active mode !

If your ftp server run in Passive mode, you need to create an extra nat rule, a REDIR one ! unless you do so, your FTP PASSIVE SERVER won't be available from the Internet.

Let me resume:

            FTP option { MAP / BIMAP } : support CLIENT ACTIVE FTP

            FTP option { REDIR }: support SERVER PASSIVE FTP

Definition of different NAT used in NETASQ:

MAP    that is used for mapping one address or network to another in an
       unregulated round robin fashion;

       REDIR    that is used for redirecting packets to one IP address and  port
       pair to another;

       BIMAP  for  setting up bidirectional NAT between an external IP address
       and an internal IP address and

Junos: Config V9 sur junos v8

Compatibilité entre conf v8 et conf v9

security {
    zones {
        security-zone trust {
            interfaces {
                all {
                    host-inbound-traffic {
                        system-services {
                            all;
                        }
                        protocols {
                            all;
                        }
                    }
                }
            }
        }
    }
    policies {
        default-policy {
            permit-all;
        }
    }
}