Errata

This section lists outstanding issues with the documentation.

ALGs

• The JUNOS Software Security Configuration Guide and JUNOS Software CLI Reference incorrectly state that MGCP ALGs are supported on SRX-series services gateways. This functionality will be supported in a future release of the product.

Authentication

• The JUNOS Software Administration Guide incorrectly states that local authentication is not supported on SRX-series services gateways. This error has been corrected in subsequent revisions.

Chassis Cluster

• The JUNOS Software Security Configuration Guide states that although services routers or services gateways connected in a chassis cluster must be the same kind, they can contain different Physical Interface Modules (PIMs). This is true for J-series chassis clusters, but not for SRX-series chassis clusters. For SRX-series chassis clusters, the SPCs must be identical and in identical slots on the two boxes, but the IOCs need not be in identical slots.

Flow

• The JUNOS Software CLI Reference and JUNOS Software Security Configuration Guide states that the following aggressive aging statements are supported on SRX-series devices when in fact they are not:
  • [edit security flow aging early-ageout]
  • [edit security flow aging high-watermark]
  • [edit security flow aging low-watermark]

IDP

• The JUNOS Software Security Configuration Guide incorrectly states that the Dynamic Attack Groups field described in the “Adding an IPS Rulebase Quick Configuration Page Summary” and the “Adding an Exempt Rulebase Quick Configuration Page Summary” sections are supported in the JUNOS software with enhanced services Release 9.2. [JUNOS Software Security Configuration Guide]

• The commands listed under the “Monitoring IDP” section of JUNOS Software Administration Guide are incorrect. The correct commands are:
  • show security idp status
  • show security idp memory

  [JUNOS Software Administration Guide]

• The JUNOS Software CLI Reference incorrectly states that the following IDP output fields are in use:

  show security idp counters application-identification

  • AI-disabled sessions due to Aux/Dynamic/Encap/Mgmt flows
  • AI-disabled sessions due to no AI signatures

  show security idp counters flow

  • ICMP-error packets
  • Session construction failed
  • Not a new session
  • Invalid index at ageout
  • Busy packets
  • BAD-UDP-Checksum packets
  • Gate matches
  • Session aged-out
  • Sessions in use while ageout

  show security idp counters ips

  • IDS cache hits
  • IDS cache misses
  • No Peer MAc

  show security idp counters log

  • Logs waiting for post-window packets
  • Logs ready to be sent
  • Logs in suppression list
  • Logs ready to be sent high watermark
  • Log receive buffer full
  • Packet log too big
  • Reads per second
  • Logs in read buffer high watermark
  • Packets lost
  • Packet copied
  • Packets held
  • IP Action Messages
  • IP Action Drops
  • IP Action Exits
  • NWaits
  • Kpacket too big

  show security idp counters packet

  • Dropped Sessions
  • GRE decapsulations
  • PPP decapsulations
  • GTP decapsulations
  • GTP Flows
  • TCP decompression uncompressed IP
  • TCP decompression compressed IP
  • Deferred send Packets
  • Ip-in-ip packets
  • TTL errors
  • Routing Loops
  • STP Drops
  • No route packets
  • Flood Ip
  • Invalid Ethernet headers

  show security idp counters tcp-reassembler

  • Bad TCP checksums
  • Copied packets

  [JUNOS Software CLI Reference]

Interfaces

• The JUNOS Software CLI Reference incorrectly states request wan-acceleration-pim login fpc slot instead of request wan-acceleration login fpc slot. [JUNOS Software CLI Reference]

Screens

• The following guides contain incorrect screen configuration instructions:

  • JUNOS Software Security Configuration Guide, “Attack Detection and Prevention” chapter
  • JUNOS Software Design and Implementation Guide, “Implementing Firewall Deployments for Branch Offices” chapter
  Examples throughout both of these guides describe how to configure screen options using the [set security screen screen-name] CLI statements. Instead, you should use the [set security screen ids-option screen-name] CLI statements. All screen configuration options are located in the [set security screen ids-option screen-name] level of the configuration hierarchy.