! PermitANY — Juniper JunOS Security Hardening
! JunOS security hardening: SSH lockdown, AAA with RADIUS/TACACS+, management plane filter, login restrictions, unused service disablement, and firewall filter for loopback.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
set system host-name JNP-EDGE-01
!
# Authentication Order

set system authentication-order tacplus
set system tacplus-server 10.0.0.50 secret "TacacsKey2024!"
set system tacplus-server 10.0.0.50 timeout 5
set system tacplus-server 10.0.0.50 single-connection



{{/unless}}
!
# Login Classes
set system login class NETADMIN permissions all
set system login class READONLY permissions view view-configuration
!
# Login Settings

set system login message "AUTHORIZED ACCESS ONLY."

set system login retry-options tries-before-disconnect 3
set system login retry-options backoff-threshold 1
set system login retry-options backoff-factor 5
set system login retry-options maximum-time 40
!
# SSH Hardening
set system services ssh port 22
set system services ssh root-login deny
set system services ssh protocol-version v2
set system services ssh max-sessions-per-connection 1
set system services ssh client-alive-count-max 3
set system services ssh client-alive-interval 30
set system services ssh connection-limit 10
set system services ssh rate-limit 5
{{#if (eq ssh_key_type "ecdsa")}}
set system services ssh hostkey-algorithm ecdsa-sha2-nistp256
set system services ssh macs hmac-sha2-256
{{/if}}
{{#if (eq ssh_key_type "ed25519")}}
set system services ssh hostkey-algorithm ssh-ed25519
{{/if}}
!
# Disable Unnecessary Services

delete system services web-management


delete system services xnm-clear-text

delete system services ftp
delete system services telnet
delete system services rsh
!
# Session Idle Timeout
set system services ssh connection-timeout 10
!
# Loopback Firewall Filter (Management Plane Protection)

set firewall filter PROTECT-RE term ALLOW-MGMT from source-address 10.0.0.0/24

set firewall filter PROTECT-RE term ALLOW-MGMT from destination-port [ssh netconf]
set firewall filter PROTECT-RE term ALLOW-MGMT then accept
set firewall filter PROTECT-RE term ALLOW-ICMP from protocol icmp
set firewall filter PROTECT-RE term ALLOW-ICMP then accept
set firewall filter PROTECT-RE term ALLOW-BGP from protocol tcp
set firewall filter PROTECT-RE term ALLOW-BGP from destination-port bgp
set firewall filter PROTECT-RE term ALLOW-BGP then accept
set firewall filter PROTECT-RE term ALLOW-LDP from protocol [tcp udp]
set firewall filter PROTECT-RE term ALLOW-LDP from port 646
set firewall filter PROTECT-RE term ALLOW-LDP then accept
set firewall filter PROTECT-RE term ALLOW-OSPF from protocol [ospf]
set firewall filter PROTECT-RE term ALLOW-OSPF then accept
set firewall filter PROTECT-RE term DENY-REST then discard
set firewall filter PROTECT-RE term DENY-REST then count DROPPED-PACKETS
!
set interfaces lo0 unit 0 family inet filter input PROTECT-RE
!
# Disable IP Options
set system internet-options no-source-quench
set system internet-options no-tcp-reset drop-all-tcp
set system no-redirects