Help Center User GuideWhat's New
 
X
User Guide
What's New
Contents  

Enrolling an SRX Series Device With Juniper Advanced Threat Prevention Cloud

Only devices enrolled with Juniper ATP Cloud can send files for malware inspection.

Before enrolling a device, check whether the device is already enrolled. To do this, use the Devices screen or the Device Lookup option in the Web UI (see Searching for SRX Series Devices Within Juniper Advanced Threat Prevention Cloud). If the device is already enrolled, disenroll it first before enrolling it again.

Note If a device is already enrolled in a realm and you enroll it in a new realm, none of the device data or configuration information is propagated to the new realm. This includes history, infected hosts feeds, logging, API tokens, and administrator accounts.

Note In the Enrolled Devices page, you can view the realm with which the device is associated. From the Realm Management page, you can change that realm association or attach new realms. See Realm Management for configuration details.

As of Junos Release 19.3R1, there is another way to enroll the SRX Series device without having to interact with the ATP Cloud Web Portal. You run the “enroll” command from the SRX and it performs all the necessary enrollment steps. See Enrolling an SRX Series Device without the Juniper ATP Cloud Web Portal

Juniper ATP Cloud uses a Junos OS operation (op) script to help you configure your SRX Series device to connect to the Juniper Advanced Threat Prevention Cloud service. This script performs the following tasks:

Note Juniper Advanced Threat Prevention Cloud requires that both your Routing Engine (control plane) and Packet Forwarding Engine (data plane) can connect to the Internet. Juniper Advanced Threat Prevention Cloud requires the following ports to be open on the SRX Series device: 80, 8080, and 443.

Warning If you are configuring explicit web proxy support for SRX Series services/Juniper ATP Cloud connections, you must enroll SRX Series devices to Juniper ATP Cloud using a slightly different process, see Explicit Web Proxy Support.

Procedure

To enroll a device in Juniper ATP Cloud using the Web Portal, do the following:

  1. Click the Enroll button on the Devices page.
  2. Copy the command to your clipboard and click OK.
  3. Paste the command into the Junos OS CLI of the SRX Series device you want to enroll with Juniper ATP Cloud and press Enter. (Note that this command must be run in operational mode.)

Note If the script fails, disenroll the device (see instructions for disenrolling devices) and then re-enroll it.

Note (Optional) Use the show services advanced-anti-malware status CLI command to verify that a connection is made to the cloud server from the SRX Series device.

Once configured, the SRX Series device communicates to the cloud through multiple persistent connections established over a secure channel (TLS 1.2) and the SRX Series device is authenticated using SSL client certificates.

In the Juniper ATP Cloud Web UI Enrolled Devices page, basic connection information for all enrolled devices is provided, including serial number, model number, tier level (free or not) enrollment status in Juniper ATP Cloud, last telemetry activity, and last activity seen. Click the serial number for more details. In addition to Enroll, the following buttons are available:

Table 7: Button Actions

Actions

Definition

Enroll

Use the Enroll button to obtain a enroll command to run on eligible SRX Series devices. This command enrolls them in Juniper ATP Cloud and is valid for 7 days. Once enrolled, SRX Series device appears in the Devices and Connections list.

Disenroll

Use the Disenroll button to obtain a disenroll command to run on SRX Series devices currently enrolled in Juniper ATP Cloud. This command removes those devices from Juniper ATP Cloud enrollment and is valid for 7 days.

Note: Running the Enroll or Disenroll command will commit any uncommitted configuration changes on the SRX Series device.

Note: Generating a new Enroll or Disenroll command invalidates any previously generated commands.

Device Lookup

Use the Device Lookup button to search for the device serial number(s) in the licensing database to determine the tier (premium, feed only, free) of the device. For this search, the device does not have to be currently enrolled in Juniper ATP Cloud.

Remove

Removing an SRX Series device is different than disenrolling it. Use the Remove option only when the associated SRX Series device is not responding (for example, hardware failure). Removing it, disassociates it from the cloud without running the Junos OS operation (op) script on the device (see Enrolling and Disenrolling Devices). You can later enroll it using the Enroll option when the device is again available.

For HA configurations, you only need to enroll the cluster primary. The cloud will detect that this is a cluster and will automatically enroll both the primary and backup as a pair. Both devices, however, must be licensed accordingly. For example, if you want premium features, both devices must be entitled with the premium license.

Note Juniper ATP Cloud supports both active-active and active-passive cluster configurations. The passive (non-active) node does not establish a connection to the cloud until it becomes the active node.

Note The License Expiration column contains the status of your current license, including expiration information. There is a 60 day grace period after the license expires before the SRX Series device is disenrolled from Juniper ATP Cloud.

Related Documentation

Ask questions in TechWiki

Check documentation in TechLibrary

Rating by you:      
X

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:
Email:

Need product assistance? Contact Juniper Support

Submit