> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-firewall-filters/6-protecting-the-control-plane.md).
# 6) Protecting the Control Plane
### Pre-Work
Load the config called **ospf.configured.cfg** using the **load\_config\_on\_nodes.py** script.
```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename ospf.configured.cfg
```
### Lab
On R2, configure a firewall filter for IPv4 that permits OSPFv2 and SSH and drops everything else. Apply this to the router's control plane so that any packets hitting the RE will pass through this filter. All dropped packets should be logged.
**NOTE**: Make sure you look at the "Post-Work" section before continuning on to the next lab.
### Answer
Expand to reveal
```
edit firewall family inet filter control_plane_v4
set term allow_ospf from protocol ospf
set term allow_ospf then accept
set term allow_ssh from protocol tcp
set term allow_ssh from destination-port ssh
set term allow_ssh then accept
set term deny_all then log
set term deny_all then discard
top
set interfaces lo0.0 family inet filter input control_plane_v4
```
### Explanation
Expand to reveal
You are already familiar with filter configuration from the previous labs. This lab tests your understanding of how to apply a filter to the RE. You do so by applying the filter to the lo0.0 interface. Even traffic which hits a physical interface, for example 10.1.2.2 on ge-0/0/0.0, will be inspected by this filter. Notice that pings are now dropped:
```
admin@R1> ping 10.1.2.2
PING 10.1.2.2 (10.1.2.2): 56 data bytes
^C
--- 10.1.2.2 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss
```
\
We can see these drops in the logs:
```
admin@R2# run show firewall log
Log :
Time Filter Action Interface Protocol Src Addr Dest Addr
19:34:05 pfe D ge-0/0/0.0 ICMP 10.1.2.1 10.1.2.2
19:34:04 pfe D ge-0/0/0.0 ICMP 10.1.2.1 10.1.2.2
```
\
Of course be careful with using this in the real world, as it is easy to overlook protocols which are in use. Be sure to use a confirmed commit to prevent locking yourself out.
### Post-Work
Rollback the changes on R2 to allow subsequent labs to work properly. (Without this, you can't load configs via HTTP from the python script).
```
rollback 1
commit
```
### Further Reading
> To filter packets transiting the device, apply the firewall filter to any non-Routing Engine interface. To filter packets originating from, or destined for, the Routing Engine, apply the firewall filter to the loopback (lo0) interface.