vSRX + K2 SaaS

Instructions for deploying vSRX with K2 SaaS Platform.

Goal

Deploy vSRX in a VPC and K2 Agents on EC2 Instances in that VPC via cloudformation template.

Prerequisites

Steps

Part 1: vSRX installation (This is a sample and you should use your own vSRX installation CFT)

  • STEP 1: vSRX Configuration :

    • Update the following parameters in the sample yml below

      • General Parameters

        • KeyName : Name of an existing EC2 KeyPair to enable SSH access to the instance.

        • AllowedSshIpAddress : Source IP address (CIDR notation) from which SSH to vSRXs is allowed.

        • AllowedAddress : Source IP address (CIDR notation) from which any access to vSRXs is allowed.

        • TerminationProtection: Enable termination protection on the VSRX EC2 instances to avoid accidential VSRX termination?.

      • vSRX Parameters

        • VpcCidr : CIDR block for vSRX VPC.

        • PubSubnet1 : Address range for vSRX VPC management subnet.

        • PubSubnet2 : Address range for vSRX VPC data subnet to be created in AZ1.

        • PriSubnet1 : Address range for vSRX VPC private subnet to be created in AZ1.

        • VSRXType : Virtual machine size required for VSRX instances.

      • AMIID Mappings

        • Mappings : Update the mappings and specify the AMI Id for vSRX.

          • The AMI-ID should be updated for the region in which you wish to deploy the vSRX controller.

    • Copy the sample yml below and update the parameters and use them in final yml

      •   KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Default: cft #Configurable Section1
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  AllowedSshIpAddress:
    Description: Source IP address (CIDR notation) from which SSH to vSRXs is allowed
    Type: String
    Default: 0.0.0.0/0
  AllowedAddress:
    Description: Source IP address (CIDR notation) from which any access to vSRXs is allowed
    Type: String
    Default: 0.0.0.0/0
############################ Juniper Configuration #1 Starts Here  ############################
  TerminationProtection:
    Description: >-
      Enable termination protection on the VSRX EC2 instances to avoid
      accidential VSRX termination?
    Type: String
    Default: 'No'
    AllowedValues:
      - 'Yes'
      - 'No'
  VpcCidr:
    Description: CIDR block for vSRX VPC.
    Type: String
    Default: 200.0.0.0/16
  PubSubnet1:
    Description: Address range for vSRX VPC management subnet.
    Type: String
    Default: 200.0.254.0/24
  PubSubnet2:
    Description: Address range for vSRX VPC data subnet to be created in AZ1.
    Type: String
    Default: 200.0.1.0/24
  PriSubnet1:
    Description: Address range for vSRX VPC private subnet to be created in AZ1.
    Type: String
    Default: 200.0.2.0/24
  VSRXType:
    Description: Virtual machine size required for VSRX instances.
    Type: String
    Default: C4.Xlarge
    AllowedValues:
      - C4.Xlarge
Mappings:
  JunipervSRXAMI: #Configurable Section7
    us-east-1:
      byol: ami-40058d3a
    us-east-2:
      byol: ami-e6a18983
    us-west-2:
      byol: ami-cddd71b5
    us-west-1:
      byol: ami-04283cf0a2bf7c17c
    ca-central-1:
      byol: ami-ab04bbcf
    eu-west-1:
      byol: ami-2117ff58
    eu-west-2:
      byol: ami-d76f7eb3
    eu-central-1:
      byol: ami-f8fd7f97
    ap-south-1:
      byol: ami-26f68e49
    ap-southeast-1:
      byol: ami-c5a331a6
    ap-southeast-2:
      byol: ami-14c1de77
    ap-northeast-1:
      byol: ami-02729164
    ap-northeast-2:
      byol: ami-2bbe6745
    sa-east-1:
      byol: ami-0656216a
  vSRXInstance:
    C4.Xlarge:
      Type: c4.xlarge
      Bandwidth: '500000'

  • Step 2: Installation of vSRX :

    • Following CFT yml will include :

      • vSRX Network Infrastructure Provisioning

      • vSRX EC2 Instance Provisioning

    • Conditions:
  EnableTerm: !Equals
    - !Ref TerminationProtection
    - 'Yes'
Metadata:
  'AWS::CloudFormation::Interface':
    ParameterGroups:
      - Label:
          default: Juniper VSRX Configuration
        Parameters:
          - VSRXType
          - KeyName
          - TerminationProtection
      - Label:
          default: Network Configuration
        Parameters:
          - VpcCidr
          - AllowedSshIpAddress
          - PubSubnet1
          - PubSubnet2
          - PriSubnet1
    ParameterLabels:
      AllowedSshIpAddress:
        default: Allowed IP Address to SSH from
      VpcCidr:
        default: vSRX VPC CIDR Block
      PubSubnet1:
        default: vSRX1- Management Subnet Network
      PubSubnet2:
        default: vSRX1- Data Subnet Network
      PriSubnet1:
        default: vSRX1- Private Subnet
      VSRXType:
        default: vSRX Instance Size
      KeyName:
        default: SSH Key to access VSRX
      TerminationProtection:
        default: Enable Termination Protection
Resources:
  vSRXVPC:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !Ref VpcCidr
      Tags:
        - Key: Name
          Value: vSRX VPC
  VPCPubSub11:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref vSRXVPC
      CidrBlock: !Ref PubSubnet1
      MapPublicIpOnLaunch: false #Can be removed not Necessary
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      Tags:
        - Key: Network
          Value: Public
        - Key: Name
          Value: vSRX VPC Management Subnet 1
  VPCPubSub12:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref vSRXVPC
      CidrBlock: !Ref PubSubnet2
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      Tags:
        - Key: Network
          Value: Public
        - Key: Name
          Value: vSRX VPC Data Subnet 1
  VPCPriSub11:
    Type: 'AWS::EC2::Subnet'
    Properties:
      VpcId: !Ref vSRXVPC
      CidrBlock: !Ref PriSubnet1
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      Tags:
        - Key: Network
          Value: Private
        - Key: Name
          Value: vSRX VPC Private Subnet 1
  IGW:
    Type: 'AWS::EC2::InternetGateway'
    Properties:
      Tags:
        - Key: Name
          Value: vSRX VPC IGW
  IGWToInternet:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref vSRXVPC
      InternetGatewayId: !Ref IGW
  VPCPublicRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref vSRXVPC
      Tags:
        - Key: Network
          Value: Public
        - Key: Name
          Value: vSRX VPC
  VPCPublicRoute:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref VPCPublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref IGW
  VPCPrivateRouteTable:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref vSRXVPC
      Tags:
        - Key: Network
          Value: Private
        - Key: Name
          Value: vSRX VPCPrivateRouteTable
  S3Endpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: '*'
            Action:
              - 's3:*'
            Resource:
              - '*'
      RouteTableIds:
        - !Ref VPCPublicRouteTable
        - !Ref VPCPrivateRouteTable
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .s3
      VpcId: !Ref vSRXVPC
  VPCPubSubnetRouteTableAssociation1:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref VPCPubSub11
      RouteTableId: !Ref VPCPublicRouteTable
  VPCPubSubnetRouteTableAssociation2:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref VPCPubSub12
      RouteTableId: !Ref VPCPublicRouteTable
  vSRXInterface11:
    Type: 'AWS::EC2::NetworkInterface'
    Properties:
      Description: vSRXManagementInterface1
      PrivateIpAddress: 200.0.254.154
      SourceDestCheck: false
      GroupSet:
        - !Ref VSRXSecurityGroup
      SubnetId: !Ref VPCPubSub11
  vSRXInterface12:
    Type: 'AWS::EC2::NetworkInterface'
    Properties:
      Description: vSRXRevenueInterface1
      PrivateIpAddress: 200.0.1.11
      SourceDestCheck: false
      GroupSet:
        - !Ref VSRXSecurityGroup
      SubnetId: !Ref VPCPubSub12
  vSRXInterface13:
    Type: 'AWS::EC2::NetworkInterface'
    Properties:
      Description: vSRXPrivateInterface1
      PrivateIpAddress: 200.0.2.22
      SourceDestCheck: false
      GroupSet:
        - !Ref VSRXSecurityGroup
      SubnetId: !Ref VPCPriSub11
  vSRXEip11:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: ManagementElasticIP
  vSRXEip12:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: RevenueDataElasticIP
  AssociateEIP11:
    Type: 'AWS::EC2::EIPAssociation'
    Properties:
      AllocationId: !GetAtt
        - vSRXEip11
        - AllocationId
      NetworkInterfaceId: !Ref vSRXInterface11
  AssociateEIP12:
    Type: 'AWS::EC2::EIPAssociation'
    Properties:
      AllocationId: !GetAtt
        - vSRXEip12
        - AllocationId
      NetworkInterfaceId: !Ref vSRXInterface12
  VpcvSRXEC2Instance1:
    Type: 'AWS::EC2::Instance'
    Metadata:
      Comment1: Launch Juniper VSRX1
    Properties:
      InstanceType: !FindInMap
        - vSRXInstance
        - !Ref VSRXType
        - Type
      KeyName: !Ref KeyName
      DisableApiTermination: !If
        - EnableTerm
        - true
        - false
      ImageId: !FindInMap
        - JunipervSRXAMI
        - !Ref 'AWS::Region'
        - byol
#https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-network-iface-embedded.html
      NetworkInterfaces:
        - NetworkInterfaceId: !Ref vSRXInterface11
          DeviceIndex: '0'
        - NetworkInterfaceId: !Ref vSRXInterface12
          DeviceIndex: '1'
        - NetworkInterfaceId: !Ref vSRXInterface13
          DeviceIndex: '2'
      Tags:
        - Key: Name
          Value: Juniper VSRX Instance
    DependsOn: IGW
  VPCPrivateRoute:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref VPCPrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NetworkInterfaceId: !Ref vSRXInterface13
  VPCPriSubnetRouteTableAssociation1:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref VPCPriSub11
      RouteTableId: !Ref VPCPrivateRouteTable
  VSRXSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: VSRX Security Group Rules
      VpcId: !Ref vSRXVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AllowedSshIpAddress
        - IpProtocol: icmp
          FromPort: 8
          ToPort: -1
          CidrIp: !Ref AllowedSshIpAddress
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: !Ref AllowedAddress
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: !Ref AllowedAddress
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !Ref AllowedAddress
      SecurityGroupEgress:
        - IpProtocol: '-1'
          FromPort: 0
          ToPort: 65535
          CidrIp: 0.0.0.0/0
Outputs:
  VSRXInstanceId:
    Description: The name of the VSRX Instance created
    Value: !Ref VpcvSRXEC2Instance1
  VPCId:
    Description: The name of the VPCID of VPC created
    Value: !Ref vSRXVPC
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'vSRXVPC' ] ]
  PublicSubnetId11:
    Description: The name of the SubnetId of VPC created
    Value: !Ref VPCPubSub11
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'VPCPubSub11' ] ]
  PublicSubnetId12:
    Description: The name of the SubnetId of VPC created
    Value: !Ref VPCPubSub12
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'VPCPubSub12' ] ]
  PrivateSubnetId11:
    Description: The name of the SubnetId of VPC created
    Value: !Ref VPCPriSub11
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'VPCPriSub11' ] ]
  VSRXSecurityGroup:
    Description: The name of the SubnetId of VPC created
    Value: !Ref VSRXSecurityGroup
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'VSRXSecurityGroup' ] ]
  VSRXIPAddress:
    Description: Management IP Address for VSRX
    Value: !GetAtt
      - VpcvSRXEC2Instance1
      - PublicIp
  ManagementIP:
    Description: The name of the VPCID of VPC created
    Value: !Ref vSRXEip11
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ManagementElasticIP' ] ]
  RevenueIP:
    Description: The name of the VPCID of VPC created
    Value: !Ref vSRXEip12
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'RevenueDataElasticIP' ] ]

  • Step 3: Once your template is ready and valid, Run it via EC2 console or AWS CLI

    • Commands to run

      • Using AWS Console

      • Using AWS Cli For e.g.

        • aws cloudformation create-stack --region ${REGION_NAME} --stack-name ${PROVIDE_STACKNAME_HERE} --template-body file://${PROVIDE_TEMPLATE_NAME}

        • Example Command is below

        • aws cloudformation create-stack --region us-west-1 --stack-name k2-vSRX --template-body file

  • Step 4: Create policy shell script as per your use case and apply them on vSRX instance, for more details checkout the Complete Example.

  • Step 5: (As per the current vSRX configuration support) Enable password based SSH on the vSRX instance using the following commands.

    • SSH to vSRX instance.

      ssh -i <pem-file> ec2-user@<ManagementElasticIP>

    • Enter the configure mode.

      configure

    • Delete existing no-passwords rule.

      delete groups aws-default system services ssh no-passwords

    • Enable ssh using password.

      set groups aws-default system services ssh

    • Set plain-text-password for the SSH login user and set its class to super-user .

      set system login user ec2-user class super-user authentication plain-text-password

    • Commit the changes.

      commit

    • Exit from the vSRX controller instance.

      exit

Part 2: Installation of K2 agents on EC2 instances

  • Step 1: K2-SaaS Setup on EC2 instance where Web application runs:

    • Update the following parameters from the sample yml below

      • General Parameters

        • ParentStackName : Name of the parent CloudFormation stack using which the vSRX controller is deployed.

        • KeyName : Name of an existing EC2 KeyPair to enable SSH access to the Ec2 instance.

        • InstanceType : WebServer EC2 instance type.

      • K2 Parameters

        • k2IsDocker : Set docker or non docker install of K2 agents, true for docker install and vice versa.

        • k2IsPrivileged : Set privileged mode installation of K2 agents, true for privileged mode and vice versa.

        • k2VersionNumber : Set the K2 agents version for download for e.g. 1.10.10

        • k2CustomerId : Set your K2 customer Id for e.g. 1101

        • k2TempToken : Set the temp token for K2 agents tarball download, You can get it from K2 Manager UI.

      • AMIID Mappings

        • Mappings : Update the mappings and specify the AMI Id for K2 Demo Instance.

          • The AMI-ID should be updated for the region in which you wish to deploy the K2 agent.

  • Step 2: Installation of K2 Agents on the EC2 instances

    • Following CFT yml will include :

      • CFN Helper Scripts provisioning

      • K2 Agents Installation

      • K2 Demo application installation (this should be replaced by installation of your own application)

  • Step 3: Once your template is ready and valid, Run it via EC2 console or AWS CLI

    • Commands to run

      • Using AWS Console

      • Using AWS Cli For e.g.

        • Example Command is below

  • Step 4: Verification

    • Two EIPs will be attached to vSRX Instance

      • Revenue Data EIP : A Revenue port is used for traffic processing. You can access the vulnerable app through revenue data elastic ip of vsrx instance (http://${REVENUE_DATA_IP}:8080).

        • SSH to secondary instance behind vSRX instance using revenue data ip.

      • Management EIP : The management interface is preconfigured with the AWS Elastic IP and default route. You can login to vSRX instance using Management IP and verify all the vSRX policies are set fine.

        • Login to vSRX instance

        • Go to configuration mode

        • Check all the security policies applied to vSRX instance

  • Step 5: Attack Detection

    • On the Vulnerable Application, there is broad category of attacks availible, you can launch one of the attacks like File based, Remote code, SQL Injection etc.

    • Access K2 SaaS portal (https://k2io.net/centralmanager ) and sign in with your username and password.

    • Attack detected would be shown in the attacks tab of K2 SaaS portal.

Part 3 : Configure vSRX policies using K2Manager

Step 1 : Open Firewall Integration

Go to Settings tab and go to Firewall Integration in dropdown list of Settings.

​Firewall | K2 Portal

Step 2 : Add a new Firewall Configuration Rule

Add a new Firewall Configuration Rule

  • Click on + on right side of the Firewall Integration view to add new firewall configuration

  • Configure the following attributes:

    • Firewall IP : vSRX controller IP

    • Username: SSH user (Used to SSH to vSRX controller instance)

    • Password: SSH password (Used to SSH to vSRX controller instance)

    • Update Interval: Periodic interval at which the xSRX controller pulls the information from K2

    • SNAT Enabled: True (For static NAT)​

Step 3 : Add Blocking List Configurations

Step 4 : Add Allowed List Configurations​

Complete Template Example

Following steps will show how to deploy vSRX in a VPC and K2 Agents on EC2 Instances in that VPC via cloudformation template.

Cloudformation Template :

Setup and Configure parameters in below template as per you environment :

  • KeyName : Name of an existing EC2 KeyPair to enable SSH access to the instance.

  • AllowedSshIpAddress : Source IP address (CIDR notation) from which SSH to vSRXs is allowed.

  • AllowedAddress : Source IP address (CIDR notation) from which any access to vSRXs is allowed.

  • TerminationProtection: Enable termination protection on the VSRX EC2 instances to avoid accidential VSRX termination?.

  • VpcCidr : CIDR block for vSRX VPC.

  • PubSubnet1 : Address range for vSRX VPC management subnet.

  • PubSubnet2 : Address range for vSRX VPC data subnet to be created in AZ1.

  • PriSubnet1 : Address range for vSRX VPC private subnet to be created in AZ1.

  • VSRXType : Virtual machine size required for VSRX instances.

  • K2DemoInstanceType : WebServer EC2 instance type.

  • k2IsDocker : Set docker or non docker install of K2 agents, true for docker install and vice versa.

  • k2IsPrivileged : Set privileged mode installation of K2 agents, true for privileged mode and vice versa.

  • k2VersionNumber : Set the K2 agents version for download for e.g. 1.10.10

  • k2CustomerId : Set your K2 customer Id for e.g. 1101

  • k2TempToken : Set the temp token for K2 agents tarball download, You can get it from K2 Manager UI.

  • Mappings : Update the mappings and specify the AMI Id for vSRX and k2demo machine respectively

VSRX.yml

vsrx-policies.sh

K2-SAAS.yml

  • Go through all the parameters and define their default values as per your setup or pass them in cloudformation command in VSRX.yml and K2-SAAS.yml

  • Provide AMIID in Mappings section as per region, you can only change one region also for your deployment.

  • Save the file as mentioned names.

  • Run them in below sequence

    • VSRX.yml

    • vsrx-policies.sh

    • K2-SAAS.yml

  • Commands to run

    • Using AWS Console

    • Using AWS Cli For e.g.

      • Example Command is below

  • Access the Vulnerable app through revenue data elastic ip of vsrx instance

End to End Verification

Generate an attack from the Vulnerable Application.

Link: http://<REVENUE_ELASTIC_IP>:8080

K2 Vulnerable Applications UI

K2M Firewall Blocked List On K2 UI: Settings → Firewall Integration → Blocked List Link: https://www.k2io.net/centralmanager/#!/app/settings/firewall

The attacker IP is detected and added to the blocked list, which can be viewed on K2 UI.

This IP list is regularly pulled by vSRX which enables the firewall to block any further requests to the application.

  1. Link: Settings → Firewall Integration → Blocked List (https://www.k2io.net/centralmanager/#!/app/settings/firewall )

  1. Visit the Vulnerable Application and it should not be accessible.

    1. Note: The IP will be removed from the blocked list after 2 hours and if you wish you can remove it yourself.

PreviousNode/VM/EC2NextvSRX + K2 On-Premises

Last updated

Was this helpful?