Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Creating Firewall Policy Rules

 

Use the Create Rule page to configure firewall rules that control transit traffic within a context (source zone to destination zone). The traffic is classified by matching its source and destination zones, the source and destination addresses, and the application that the traffic carries in its protocol headers with the policy database.

Security Director allows a device to have a device-specific policy and to be part of multiple group policies. Rules for a device are updated in this order:

  • Rules within Policies Applied Before 'Device Specific Policies'

  • Rules within Device-Specific Policies

  • Rules within Policies Applied After 'Device Specific Policies'

Rules within Policies Applied Before 'Device Specific Policies' take priority and cannot be overridden. However, you can override rules within Policies Applied After 'Device Specific Policies' by adding an overriding rule in the Device-Specific Policies. In an enterprise scenario, “common-must-enforce” rules can be assigned to a device from the Policies Applied Before ‘Device Specific Policies’, and “common-nice-to-have” rules can be assigned to a device from the Policies Applied After ‘Device Specific Policies’.

Note

An exception can be added on a per device basis in “Device-Specific Policies” . For a complete list of rules applied to a device, select Configure > Firewall Policy > Devices. Select a device to view rules associated with that device.

Before You Begin

  • Read the Overview Firewall Policies topic.

  • Review the Firewall Rules main page for an understanding of your current data set. See Firewall Policy Rules Main Page Fields for field descriptions.

To configure a firewall policy rule:

  1. Select Configure > Firewall Policy.
  2. Select the policy for which you want to define rules and click the + icon.

    The Create Rules page appears.

    Note

    To edit and create rules inline, click the policy to make the fields editable.

  3. Complete the configuration according to the guidelines provided in Table 1.
  4. Click OK.

    The rules you configured are associated with the selected policy.

Table 1: Firewall Policy Rules Setting

Setting

Guideline

General Information

Rule Name

Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores. No spaces are allowed and the; maximum length is 63 characters.

Description

Enter a description for the policy rules; maximum length is 1024 characters. Comments entered in this field are sent to the device.

Identify the traffic that the rule applies to

(Source) Zone

For SRX Series devices, specify a source zone (from-zone) to define the context for the policy. Zone policies are applied on traffic entering one security zone (source zone) to another security zone (destination zone). This combination of a source zone and a destination zone is called a context.

Starting in Junos Space Security Director Release 16.2, for MX Series routers, the source zone field acts as an ingress interface from where the packet enters. The match direction is input, if the packet is entering the interface. The match direction is output, if the packet is leaving the interface. Configure the ingress key by selecting the aggregated multiservices (AMS) value.

Starting in Junos Space Security Director Release 16.2, polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy.

(Source) Address(es)

Enter one or more address names or address set names. Click Select to add source addresses.

On the Source Address page:

  • Select the Include option to add the selected source addresses or any address to the rule.

  • Select the Exclude option to exempt the selected source addresses from the rule.

  • Select the By Metadata Filter option to choose the matching address of a user-defined metadata as the source address.

    • Metadata Filter—Click the field to select the required metadata from the list. The matching addresses are filtered and listed in the Matched Address field.

    • Matched Addresses—Lists the addresses matching the selected metadata. This address is used as a source address.

      For every metadata expression, a unique dynamic address group(DAG) is created. This DAG has the feed server URL pointing to the feed server URL of Security Director.

      Configure the feed server URL by using the following CLI command to each SRX Series device or vSRX that acts on the metadata based policies.

      set security dynamic-address feed-server <SD IP Address> hostname <SD IP Address>

See Creating Addresses and Address Groups.

(Source) Src. ID

Specify the source identity (users and roles) to be used as match criteria for the policy. You can have different policy rules based on user roles and user groups. Click Select to specify source identities to permit or deny. On the Source ID page, you can select a source identity from the available list or you can make a new identify by clicking Add New Source ID.

(Source) End User Profile

Select an end user profile from the list. The firewall policy rule is applied to it.

When traffic from device A arrives at an SRX Series device, the SRX Series obtains the IP address of device A from the first traffic packet and uses it to search the device identity authentication table for a matching device identity entry. Then it matches that device identity profile with a security policy whose End User Profile field specifies the device identity profile name. If a match is found, the security policy is applied to traffic issuing from device A.

(Destination) Zone

For SRX Series devices, specify a destination zone (to-zone) to define the context for the policy. Zone policies are applied on traffic entering one security zone (source zone) to another security zone (destination zone). This combination of a source zone and a destination zone is called a context.

Starting in Junos Space Security Director Release 16.2, for MX Series routers, this field acts as an egress interface from where the packet enters. The match direction is input, if the packet is entering the interface. The match direction is output, if the packet is leaving the interface. Configure the egress key by selecting the aggregated multiservices (AMS) value.

Polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy.

(Destination) Address(es)

Select one or more address names or address sets. Click Select to add destination addresses.

On the Destination Address page:

  • Select the Include option to add the selected destination addresses or any address to the rule.

  • Select the Exclude option to exempt the selected destination addresses from the rule.

  • Select the By Metadata Filter option to choose the matching address of a user-defined metadata as the destination address.

    • Metadata Filter—Click the field to select the required metadata from the list. The matching addresses are filtered and listed in the Matched Address field.

    • Matched Addresses—Lists the addresses matching the selected metadata. This address is used as a destination address.

      For every metadata expression, a unique dynamic address group(DAG) is created. This DAG has the feed server URL pointing to the feed server URL of Security Director.

      Configure the feed server URL by using the following CLI command to each SRX Series device or vSRX that acts on the metadata based policies.

      set security dynamic-address feed-server <SD IP Address> hostname <SD IP Address>

See Creating Addresses and Address Groups.

(Service Protocols) Services

Select one or more service (application) names. Select the Include, Any Service to disable the any option in the services list builder. Clear the Any Service check box to permit or deny services from the services list builder available column. Click Add New Service to create a service. See Creating Services and Service Groups.

Application Signatures

Click the + icon to add the application signatures. You can add both predefined and custom application signatures.

Advanced Security

Rule Action

  • Action applies to all traffic that matches the specified criteria.Deny—Device silently drops all packets for the session and does not send any active control messages such as TCP Resets or ICMP unreachable.

  • Reject—Device sends a TCP reset if the protocol is TCP, and device sends an ICMP reset if the protocols are UDP, ICMP, or any other IP protocol. This option is useful when facing trusted resources so that the applications do not waste time waiting for timeouts and instead get the active message.

  • Permit—Device permits traffic using the type of firewall authentication you applied to the policy.

  • Tunnel—Device permits traffic using the type of VPN tunneling options you applied to the policy.

Advanced Security

Firewall policies provide a core layer of security that ensures that network traffic is restricted to only that which a policy dictates through its match criteria.

Firewall policies provide a core layer of security that ensures that network traffic is restricted to only that which a policy dictates through its match criteria. When the traditional policy is not enough, select application identification components to create an advanced security profile for the policy:

  • App Firewall—Select this option to enforce traditional firewall controls on the traffic while layering application firewall to ensure that applications conform not only to the port information but also to what is transmitted between a client and a server. You can permit, deny, and reject applications. There is also a special redirect feature for HTTP and HTTPS.

    Click the Add New link to create application firewall policy and click Add New APPFW Rule to create rules. See Creating Application Firewall Policies.

  • SSL Forward Proxy—Select this option to enable an application-level protocol that provides encryption technology for the Internet.

    Click Add Forward Proxy to create SSL Forward Proxy Profiles. See Creating SSL Forward Proxy Profiles.

    Click Add Reverse Proxy to create SSL Reverse Proxy Profiles. See Creating SSL Reverse Proxy Profiles.

  • IPS—Select this option to scrutinize all of the bits contained within packets to look for both known and unknown attacks.

  • UTM—Select this option to define Layer 7 protection against client-side threats.

    Click Add New to create UTM policies. See Creating UTM Policies.

Note: For creating inline application firewall policy, SSL proxy profiles, and UTM, the rule action must be permit.

Rule Options

Profile

Select a default profile or a custom profile, or you can inherit a policy profile from another policy. Policy profile specifies the basic settings of a security policy. See Creating Firewall Policy Profiles.

Schedule

Policy schedules allow you to define when a policy is active, and thus are an implicit match criterion. You can define the day of the week and the time of the day when the policy is active. For instance, you can define a security policy that opens or closes access based on business hours. Multiple schedulers can be applied to different policies, but only one scheduler can be active per policy. Select a pre-saved schedule and the schedule options are populated with the selected schedule’s data. Click New to create another schedule.

Rule Analysis

New Rule, Perform Analysis

Select this option if you want to analyze your rules to avoid any anomalies.

Rule Placement

Location/Sequence

Displays the sequence number and the order in which the rule is placed.

Release History Table
Release
Description
Starting in Junos Space Security Director Release 16.2, for MX Series routers, the source zone field acts as an ingress interface from where the packet enters.
Starting in Junos Space Security Director Release 16.2, polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy.
Starting in Junos Space Security Director Release 16.2, for MX Series routers, this field acts as an egress interface from where the packet enters.