You are asked to secure the routing engine of all Junos devices in your design. The design should not affect transit traffic. Which action will accomplish this task?

Question

Options

• AUse a firewall filter on a revenue port.
• BUse a firewall filter on the loopback interface.
• CUse a firewall filter on the fxp0 interfaces.
• DUse a firewall filter on the management interface.

• A
  5% (1)
• B
  81% (17)
• C
  10% (2)
• D
  5% (1)

Explanation

Applying a firewall filter to the loopback interface (lo0) in Junos protects the Routing Engine (RE) because all traffic destined to the RE - such as routing protocol updates, SSH, SNMP, and telnet - must pass through lo0, making it the ideal choke point without touching transit traffic flowing through revenue ports.

Why the distractors are wrong:

• A (revenue port): Filters on revenue ports affect transit traffic passing through the device, which violates the design requirement.
• C (fxp0): The fxp0 interface is the out-of-band management interface on some Junos platforms; filtering here only protects management-plane access via that specific interface, not all RE-destined traffic.
• D (management interface): Same limitation as fxp0 - it only covers one access path to the RE and leaves other RE-destined traffic unprotected.

Memory tip: Think of lo0 as the RE's "front door" - every packet trying to talk to the router must knock on lo0 first, so a filter there is a universal RE bodyguard that never touches traffic just passing through.

No community discussion yet for this question.