JUNOS software for SRX-series devices provides File Transfer Protocol (FTP) support for services and applications that transfer data using FTP, allowing legitimate FTP traffic to go through the device while blocking out malicious FTP packets. The FTP ALG monitors PORT, PASV, and 229 commands. It performs Network Address Translation (NAT) of the IP or port in the message and gate opening on the device as necessary.
To configure the FTP ALG, use the edit security alg ftp statement at the [edit security alg] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
JUNOS software for SRX-series devices provides Trivial File Transfer Protocol (TFTP) support for services and applications that transfer data using TFTP, allowing legitimate TFTP traffic to go through the device while blocking out malicious TFTP packets. The TFTP ALG processes the TFTP packets that initiate the request and opens a pinhole to allow return packets from the reverse direction to the port that sends the request.
To configure TFTP ALG, use the edit security alg tftp statement at the [edit security alg] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
For more information, see the JUNOS Software Security Configuration Guide.
![]() |
Note: In this release of JUNOS software for SRX-series devices, synchronization of IDP-specific runtime data does not occur across the cluster. As a result, IDP processing is not continued for sessions that fail over. (IDP processing resumes for sessions created after failover.) |
![]() |
Note: When configuring chassis clusters, you are automatically in configure private mode. As a result, you must commit changes from the top of the hierarchy. For information about the configure private mode, see the JUNOS CLI User Guide. |
![]() |
Note: This feature is applicable only for SRX 3400, SRX 3600, SRX 5600, and SRX 5800 devices. |
Packets for any given flow could traverse two NPUs and possibly more than one SPU (in the case of tunnels). Therefore, a distributed flow module is needed that can span multiple computing engines.
![]() |
Note: This feature is applicable only for SRX 3400, SRX 3600, SRX 5600, and SRX 5800 devices. |
To configure flow options, use the flow statement at the [set security] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
Security processing and inbound and outbound (I/O) data packets analysis are separated in JUNOS software and SRX-series devices. As a result, the line-card interface on the Input/Output Card (IOC) and the security processors on the Services Processing Card (SPC) are separated by a fabric. The security data plane is simultaneously performing multiprocessing (32-way MT per XLR SPU) and distributed processing (SRX 5600 and SRX 5800 devices distribute the processing over a maximum of 2 SPUs per SPC). For more information, see the JUNOS Software Interfaces and Routing Configuration Guide.
SRX-series devices also support the following additional routing functionality:
For more information, see the JUNOS Software Administration Guide.
![]() |
Note: This release of JUNOS software for the SRX-series devices does not support packet-based protocols such as MPLS, Connectionless Network Service (CLNS), and IP version 6 (IPV6). |
You can use an SRX-series devices to control traffic rate by applying classifiers and shapers. To configure CoS components, use the component you want to configure at the [edit class-of-service] hierarchy level of the configuration. For more information, see the JUNOS Software Interfaces and Routing Configuration Guide.
The following table lists CFM slots on SRX 3400 and SRX 3600 devices:
Table 2: CFM Slots on SRX 3400 and SRX 3600 Devices
The unique name of each network interface identifies its type and location and indicates whether it is a physical interface or an optional logical unit created on a physical interface. The name of each network interface has the following format to identify the physical device that corresponds to a single physical network connector:
type-slot/pic/port
For the SRX 3400 and 3600 devices:
![]() |
Note: This feature is applicable only for SRX 3400 and SRX 3600 devices. |
To configure screen options, use the screen statement at the [set security screen] hierarchy level.
To configure pass-through authentication, use the following statements:
set security policies from-zone zone-name to-zone zone-name policy policy-name then permit firewall-authentication pass-through
To configure Web authentication, use the following statements:
set security policies from-zone zone-name to-zone zone-name policy policy-name then permit firewall-authentication web-authentication
For more information, see the JUNOS Software Security Configuration Guide.
To configure NAT, use the nat statement at the [set security] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
Application signatures are available as part of the security package provided by Juniper Networks. You download predefined application signatures along with the security package updates. Application identification is enabled by default and is automatically turned on when you configure the default application in the IDP policy. For more information, see the JUNOS Software Security Configuration Guide.
You can configure DSCP value as an action in an IDP policy rule. Based on the DSCP value, behavior aggregate classifiers set the forwarding class and loss priority for the traffic, determining the forwarding treatment the traffic receives. For more information, see the JUNOS Software Security Configuration Guide.
Enabling log suppression ensures that minimal numbers of logs are generated for the same event or attack that occurs multiple times. To configure log suppression, use the suppression statement at the [edit security idp sensor-configuration log] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
A policy is made up of rulebases, and each rulebase contains a set of rules. You define rule parameters, such as traffic match conditions, action, and logging requirements and then add the rules to rulebases. You can create new IDP policies from scratch, or start with a predefined template provided by Juniper Networks. Juniper Networks also provides custom application objects and attack objects that you can configure as match conditions in policies.
To configure an IDP policy, use the idp-policy statement at the [edit security idp] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
IDP supports 52 protocol decoders or services. Protocol decoders scan protocol headers and message body to identify individual fields in the protocols to determine if data conforms to the RFC. You configure protocol decoders in IDP policy rules to specify the protocol that an attack uses to access your network. For more information, see the JUNOS Software Security Configuration Guide.
To protect your network from new threats, you can download signature database updates manually or configure your device to download them automatically at a specified interval. For more information, see the JUNOS Software Security Configuration Guide.
The Chassis View appears on the Dashboard page by default when you log in to the services gateway.
![]() |
Note: The Chassis View option can be enabled or disabled in the Dashboard Preference dialog box. To access the Dashboard Preference dialog box, click the icon on the upper-right corner of the Dashboard page and select Chassis View from the Dashboard Preference dialog box. You can also enable Chassis View by clearing the Internet Explorer cookies. |
![]() |
Note: To use the Chassis View, a recent version of Adobe Flash that supports ActionScript and AJAX (version 9 must be installed). |
For more details about how to use the J-Web Chassis View, see the JUNOS Software Administration Guide.
To bring chassis components online and offline, use the chassis statement at the [request] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
![]() |
Note: In SRX-series devices, the offline, online, and restart commands are supported only on IOCs and are not supported on SPCs. |
The chassis control daemon (chassisd) comprises the following major components:
To view chassis details, use the show chassis statement.
![]() |
Note: This feature is applicable only for SRX 3400, and SRX 3600 devices. |
The data plane logs primarily include a list of security events that the system has handled directly inside the data plane. Because the system has already handled these events, it does not send them on to the Routing Engine. Instead, the system streams the logs directly to external log servers, bypassing the Routing Engine. To view the data plane logs, use the log statement at the [security] hierarchy level.
![]() |
Note: In SRX-series, data plane logs and control plane logs have to be configured separately only for SRX 3400, SRX 3600, SRX 5600, and SRX 5800. |
For all other SRX-series devices, the system sends this list of control plane events and the security events that the system has handled directly inside the data plane on to the eventd process on the Routing Engine, which then handles the events by using JUNOS event policies and/or by generating system log messages. You can choose to send control plane logs to a file, user terminal, routing platform console, or remote machine.
To generate control plane and security event generated within the data plane, use the syslog statement at the [system] hierarchy level. For more information, see the JUNOS Software Administration Guide.
To configure trace options, use the traceoptions statement at the [set security] hierarchy level. For more information, see the JUNOS Software Security Configuration Guide.
These metrics provide information that can be used to prevent unexpected outages and look for trends for capacity planning. To monitor the Flexible PIC Concentrator (FPC) card by using the SPU unit’s CPU and memory utilization, use the show security monitoring fpc statement.
The SNMP agent exchanges network management information with SNMP manager software running on a network management system (NMS), or host. The agent responds to requests for information and actions from the manager. The agent also controls access to the agent’s Management Information Base (MIB), the collection of objects that can be viewed or changed by the SNMP manager. The SNMP manager collects information on network connectivity, activity, and events by polling managed devices.
A MIB is a hierarchy of information used to define managed objects in a network device. The MIB structure is based on a tree structure, which defines a grouping of objects into related sets. Each object in the MIB is associated with an object identifier (OID), which names the object. The “leaf” in the tree structure is the actual managed object instance, which represents a resource, event, or activity that occurs in your network device. MIBs are either standard or enterprise-specific. Standard MIBs are created by the Internet Engineering Task Force (IETF) and documented in various RFCs. Depending on the vendor, many standard MIBs are delivered with the Network Management System (NMS) software. You can also download the standard MIBs from the IETF Web site, http://www.ietf.org, and compile them into your NMS, if necessary.
Enterprise-specific MIBs are developed and supported by a specific equipment manufacturer. If your network contains devices that have enterprise-specific MIBs, you must obtain them from the manufacturer and compile them into your network management software. For a list of Juniper Networks enterprise-specific supported MIBs, see “Juniper Networks Enterprise-Specific MIBs” in the JUNOS Network Management Configuration Guide.