Question 1

Logs

Accepted Answer

The log analytics data might not be available on the Dashboard, Event Viewer, and Application Visibility page if logging is not configured or the logging configuration failed to apply. This issue might occur because the required certificates were not deployed during the device discovery.

To verify the log configuration, do the following:

Use the device ILP pages to verify that the security log configuration is pushed to the device.
Do the following to enable security logging for the device:
1. Click
  Inventory
  Devices
  .
2. Click
  Enable Security Logs
  to open the Enable Security Logs page.
3. Select the device interface, and click
  OK
  to create a Deploy job.
Use the following commands to check the status of the deploy—ca-certificate and deploy-ca-local-certificate jobs in Juniper Security Director Cloud:
CA certificate—show security pki ca-certificate
Local certificate—show security pki local-certificate

The Enable Security Logs page displays only devices that are managed by Juniper Security Director Cloud and have the In Sync status. By default, the page also displays a filtered list of only configured devices.

Do the following:

Check whether the device status is In Sync. The Enable Security Logs page displays only synchronized devices.
If all the devices are synchronized, check whether the device list is filtered. Select
All
from the Group by dropdown list to view the complete list of devices.
If you still do not see the complete device list, resynchronize the device with Juniper Security Director Cloud.

The log analytics data might be missing if the Juniper Security Director Cloud load balancer is not reachable.

To verify that Juniper Security Director Cloud is reachable for security logging over TLS, do the following:

Connect to the device using CLI.
Use the following command to check whether port 6514 on the device is open—telnet srx.sdcloud.juniperclouds.net 6514
Use the following command to check the flow of security session data through port 6514—show security flow session destination-port 6514
The security session contains data and the bytes count of the data flow increases every time new session logs are sent over TLS to Juniper Security Director Cloud.
Ensure that the correct interface is selected for the device in the Secure CRT configuration.
Ensure that the security log, security PKI, and SSL services are not deactivated from the device.
Ensure log session-init and session-close is enabled on the firewall rule to see the RT_FLOW logs.
If you still cannot see the log analytics data, use the following command to restart the security logging from the device—restart security-log gracefully

Question 2

Data Management

Accepted Answer

Juniper Security Director Cloud provides the following storage space to users:

Trial subscription—10GB free storage space with a maximum limit of 5 devices.
Paid subscription—10GB free storage space for each device based on device subscription entitlements with an option to purchase multiple storage subscriptions worth 1TB each. For example, if you purchase 10 storage subscriptions, you get 10TB storage space.

Question 3

Device Details

Accepted Answer

The chassis details are displayed on the device-specific page.

To view the chassis details of your device, do the following:

Click
Inventory
Devices
to open the Device page.
Click the device name in the Host Name column to open the device-specific page that displays the details of the device.

The bandwidth speed is displayed on the device-specific page.

To view the bandwidth speed of your device, do the following:

Click
Inventory
Devices
to open the Device page.
Click the device name in the Host Name column to open the device-specific page that displays the details of the device.
Click the Inventory > Interfaces tab that displays the bandwidth speed in the Speed column.

There is no specific minimum bandwidth required for Juniper Security Director Cloud.

The bandwidth requirement varies based on the tasks performed and processes in progress. For example, processes such as device synchronization depends on the device configuration and the number of session logs sent over the syslog channel. However, some processes, such as Signature bundle installation and image management require minimum 500 Kbps bandwidth.

Question 4

Device Configuration

Accepted Answer

The device name is displayed as "Not configured" when the hostname of the device is not configured. The Adopt Devices method does not provide an option to configure the hostname of devices.

Use the HOSTNAME template at

Inventory

Configuration Templates

to configure the hostname of your device.

The device name is correctly displayed after you configure the hostname and deploy the device.

The device name is displayed as "srxXXXXXXXX" when the hostname of the device is not configured. The Adopt Devices method does provide an option to configure the hostname of devices, and the firewall policies cannot be deployed without the hostname.

Use one of the following methods to configure the hostname:

Use the HOSTNAME template at
Inventory
Configuration Templates
to configure the host name of your device.
Configure the host name directly on your device using CLI.

The device name is correctly displayed after you configure the hostname and deploy the device and firewall policies.

The device configuration might not be deleted if the configuration changes are not committed or the configuration changes have been modified directly on the device.

To manually delete the device configuration, log in to the device using CLI in edit mode and commit the following configuration:

Delete services user-identification active-directory-access

The device deployment fails because of multiple reasons, such as if the device configuration is not synchronized with Juniper Security Director Cloud.

To ensure a successful device deployment, do the following:

If the configuration was changed directly on the device and not synchronized with Juniper Security Director Cloud, resynchronize the device.
If multiple policies assigned to the device contain similar rules, remove the rules with identical names.

The device deployment job might appear to fail if the configuration involves SSH service changes, but the deployment succeeds and the updates are committed.

Question 5

Device Management

Accepted Answer

The discovery of devices added manually or through Zero Touch Provisioning (ZTP) might not be triggered because of multiple reasons, such as if the management interface is down, if the Juniper Security Director Cloud FQDN fails to resolve in your network, or if the required ports are closed.

To ensure that the device is successfully discovery, check the following:

The in-band management interface is up and is configured with a route to reach the Juniper Security Director Cloud FQDN.
The source IP in the data packet being sent to Juniper Security Director Cloud is correct.
The Google DNS or your own DNS is configured in the device to resolve the Juniper Security Director Cloud FQDN and is reachable from the device.
The firewall filters are configured correctly.
The required ports are open. See thePrerequisitesfor more details.

Devices configured using CLI through the Adopt Device method might not be discovered for multiple reasons.

To ensure that the device configured using CLI is successfully discovered, do the following:

Check that the source IP in the data packet being sent to Juniper Security Director Cloud is correct.
Check that the firewall filters are configured correctly.
Remove the CLI configuration allowing users to log in without a password. For example, the following CLI configuration in a vSRX Series device deployed on AWS must be removed:
set groups aws-default system services ssh no-passwords
Check if any ssh rate limit is configured in your SRX Series Firewall device. Use the following commands to delete the existing rate limit or set the rate limit number to more than 32.
- delete system services ssh rate-limit
- set system services ssh rate-limit 40
Check if the FQDN is reachable through any specific routing instance. If yes, add the routing instance in outbound services using the
set system services outbound-ssh routing-instance
<>
command and commit the configuration in device.

A device can be deleted from the Device page only if the status of the device is Up or In Sync.

To delete a device whose status is Down or Out of Sync, change the status of the device to Up with the same configuration version, and delete the device.

If you can't change the status of the device to Up, contact JTAC for help with deleting the device using API. You can create a service request with JTAC on the Web or by telephone.

Visit.
Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

For international or direct-dial options in countries without toll-free numbers, see.

The Device page displays the health status of only devices with subscriptions.

To ensure that the Device page displays the correct health status of your device, ensure that you assign a trial or a paid subscription to the device. The correct health status is displayed a few minutes after associating subscriptions.

The Device page displays the status of only devices with subscriptions.

To ensure that the Device page displays the correct health status of your device, ensure that you assign a trial or a paid subscription to the device. The correct device status is displayed a few minutes after associating subscriptions.

The health status device on the Device page is updated every 15 minutes. Juniper Security Director Cloud polls all devices with subscriptions in an organization for the CPU, memory usage, and storage usage data.

Question 6

Software Images

Accepted Answer

The image upgrade job might be slow if you use Junos images in Juniper Security Director Cloud because the images are copied to the device for the upgrade job. The time taken depends on the bandwidth capacity of the network connection between Juniper Security Director Cloud and the device.

To ensure quick upgrade jobs of Junos images, create a download Junos image URL from support.juniper.net and use the URL to upgrade the images.

The image management jobs, such as stage, deploy, and upgrade, might fail when the network download speed to Juniper Security Director Cloud is lower than 500 Kbps.

Use the Images page at the Organization level to add images and to perform other image management operations.

Question 7

Security Subscriptions

Accepted Answer

When you do not save the IPS policy rules and select No to navigate away from the window, the Save (✓) and Close (x) buttons might not be visible.

To ensure that the Save and Close buttons are always visible, close the left navigation pane by clicking the Close button.

The global settings of firewall policies are applied at the organization level. Modifications to these settings impact all the device policies that have firewall rules enabled with IPS, Content Security, and SSL profiles, so the default conflict resolution option is set to Keep Existing to prevent conflicts during the auto import operation. The default Keep Existing setting of the OCR action might prevent the import of the default configuration of IPS, Content Security, SSL profiles during the auto import operation of device configuration.

To ensure that the default configuration of IPS, Content Security, and SSL profiles is successfully imported during the auto import operation, do one of the following:

Change the OCR action in the default IPS, Content Security, and SSL profiles using the global settings to Overwrite with the Imported value and deploy the policies again.

Manually import the device configuration. The manual import operation triggers a conflict resolution option where you can change the OCR action to Overwrite with the Imported value.

The device deployment fails after the dynamic IPS signature group is configured when none of the available IPS signatures match the filter criteria.

To ensure a successful device deployment, do the following:

Ensure that the IPS signatures are downloaded in the device.
Use the Preview Filtered Signatures option in the bottom of the page to check the filters in the dynamic IPS signature group and ensure that the filter criteria matches the available IPS signatures.

The IPS, Content Security, application signature bundle Installation on a device might fail when the network download speed to Juniper Security Director Cloud is lower than 500 Kbps.

Try the IPS, Content Security, application signature bundle installation again after some time.
If the signature installation still fails, connect to the device using CLI, and use the following command to manually install the signature—request security utm web-filtering category download-install

There are multiple reasons for the Content Security profile deployment failure, such as if the Content Security license is not installed.

To ensure a successful Content Security profile deployment, do the following:

Connect to the device using CLI.
Use the following command to check whether the Content Security license is installed on the device—show system license detail
Use the following command to check whether the traffic is processed through the policy that is configured with the Content Security profile—how security policies hit-count
Use the following command to check whether the Content Security objects, such as Webfiltering, Antivirus, Antispam, and content filtering, hits that help to determine the allowlist, blocklist, custom category, virus, and spam mail hits—show security statistics

There are multiple reasons for the SSL proxy profile deployment failure.

To ensure a successful SSL proxy profile deployment, before deploying the profile, do the following to check whether the root certificates and trusted CA certificate selected in Juniper Security Director Cloud is imported in the device:

View the certificates on Juniper Security Director Cloud.
1. Click
  Inventory
  Devices
  .
2. Click the device to open the device page.
3. Click
  Inventory
  Certificates
  .
View the certificates on the device.
1. Connect to the device using CLI.
2. Use the following CLI command to view the root on the device—show security local-certificate
3. Use the following CLI command to view the trusted CA certificate on the device—show security pki ca-certificate

Question 8

IPsec VPN

Accepted Answer

The Top Unstable Tunnels section on the IPsec VPN monitoring page displays the filtered list of the tunnels that are down based on the selected time span. If a tunnel is not included in the list, the tunnel might be down for longer than the selected time span.

To display a complete list of the tunnels that are down, select a longer time span in the Top Unstable Tunnels section.

There are multiple reasons why devices might be imported as extranet devices along with the imported IPsec VPNs.

To ensure that all devices are imported correctly with the imported IPsec VPNs, check the following:

All relevant devices were selected while importing the IPsec VPN.
There is no mismatch in the configuration of the device profile in Juniper Security Director Cloud and on the device.
Juniper Security Director Cloud supports the device topology.

The Import VPNs page displays only devices with the Up and In Sync status.

To ensure that the Import VPNs page displays all your devices, ensure that the devices are in the Up and In Sync status.

The IPsec VPN monitoring page does not support the following VPNs:

Hub-and-Spoke Auto Discovery VPN
Remote Access VPN—Juniper Secure Connect
Auto VPNs

To verify why the IPsec VPN monitoring page does not display your VPN, check whether the VPN type is supported for monitoring.

There are multiple reasons why the status of some VPNs is not displayed in the Tunnels Status section of the IPsec VPN monitoring page.

To ensure that the Tunnels Status section displays the status of all your VPNs, check that:

Subscriptions are associated with all your devices
VPNs are deployed on all devices.
The status of all devices is Up and In Sync.

The Tunnels Status section of the IPsec VPN monitoring page displays the status of the VPN tunnels based on a status poll conducted at regular intervals, so if the status of a VPN tunnel is incorrect, the tunnel might have failed after the poll was conducted.

To verify that the correct status of all the VPN tunnels is displays, wait for the poll to be conducted. The status poll is conducted every 10 minutes by default.

Question 9

Certificate Management

Accepted Answer

The installed certificates are only visible after you resynchronize the device.

To ensure that the imported local certificate is immediately visible, resynchronize the device with Juniper Security Director Cloud.

The import of CA certificates during the device discovery operation might fail for multiple reasons.

To ensure that the CA certificate is successfully imported, do the following:

Ensure the original device configuration is not modified.
Ensure that the device does not have a conflicting CA profile or an existing certificate with the "sd_cloud_ca" certificate name.
Ensure that the CLI configuration on the device does not display any Commit warning while committing the CLI mode change or while assigning Ethernet switches to the interfaces.
Ensure that the device is not configured in another Organization of Juniper Security Director Cloud.
Delete the following security PKI configuration for the digital certificates on the device:
- set security pki ca-profile sd_cloud_ca ca-identity sd_cloud_ca
- set security pki ca-profile sd_cloud_ca ca-identity sd_cloud_local

PKI certificate corruption on the SRX1600 Firewall can occur during normal operation or RMA processes. When PKI becomes invalid or desynchronized, the firewall can't authenticate with Juniper Security Director Cloud or Juniper ATP Cloud services. This leads to symptoms such as:

Security Director Cloud or ATP Cloud health status displays disconnected or degraded.
Log forwarding to the cloud platform or services fails.
Security intelligence feeds do not update.
Cloud management console displays stale or incorrect data.

To restore connectivity, refresh PKI certificates by re-enrolling the firewalls:

Disenroll firewalls from the ATP Cloud portal. See.
Disenroll firewalls from the Juniper Security Director Cloud portal. See.
Re-enroll firewalls in the ATP Cloud portal. See.
Re-enroll firewalls in the Juniper Security Director Cloud portal. See

The enrollment process exchanges new PKI certificates that restore cloud connectivity.

Question 10

Licenses

Accepted Answer

The installed licenses are only visible after you resynchronize the device.

To ensure that the installed license is immediately visible, resynchronize the device with Juniper Security Director Cloud.

Question 11

Shared Services

Accepted Answer

The applications must be downloaded in Juniper Security Director Cloud. The SRE administrators will download the applications when new applications versions are available.

The URL category installation to a device might fail because of issues with DNS resolution.

To ensure a successful installation of the URL category, use the following predefined or default path for the installation:

Question 12

Administration

Accepted Answer

The invalid request message is displayed because the activation link expires in 24 hours.

If you do not activate your Juniper Security Director Cloud account within 24 hours, Juniper Security Director Cloud purges the users who do not activate their accounts.

The user activity logs are available at

Admin

Audit Logs

.

New users might not receive the activation e-mail when e-mails from Juniper Security Director Cloud are blocked by their organization network.

To ensure that users in your organization receive the activation e-mail, verify that the Juniper Security Director Cloud e-mails are not blocked by your organization network.

You can create multiple users with different roles for your organization as an Organization Administrator at

Admin

Users

.

このページの内容

FAQ

ログ

監視ログ分析データが利用できないのはなぜですか?

[セキュリティログを有効にする]ページにすべてのデバイスが表示されないのはなぜですか?

セキュリティ ログを構成した後でもログ分析データが欠落するのはなぜですか?

データ管理

Juniper Security Director Cloudはどのくらいのストレージ容量を提供しますか?

デバイスの詳細

デバイスのシャーシの詳細を確認するにはどうすればよいですか?

デバイスの帯域幅速度を確認するにはどうすればよいですか?

Juniper Security Director Cloudに必要な最小帯域幅はどれくらいですか?

デバイス構成

デバイスの名前に「未構成」と表示されるのはなぜですか?

デバイスの名前に「srxXXXXXX」と表示されるのはなぜですか?

Active Directoryプロファイルを削除してもデバイスの設定が削除されないのはなぜですか?

デバイスの導入に失敗し、「ステートメントの作成に失敗しました」というメッセージが表示されたのはなぜですか?

SSHサービスに変更を加えた後、デバイス設定の導入に失敗するのはなぜですか?

デバイス管理

追加したデバイスが検出されないのはなぜですか?

CLIを使用して設定したデバイスが検出されないのはなぜですか?

デバイス削除ジョブが失敗するのはなぜですか?

デバイスの健全性ステータスが不明なのはなぜですか?

デバイスの健全性ステータスが「利用可能なデータがありません」と表示されるのはなぜですか?

デバイスページのデバイスの健全性ステータスはどのくらいの頻度で更新されますか?

ソフトウェアイメージ

イメージのアップグレードジョブが非常に遅いのはなぜですか?

イメージ管理ジョブが失敗するのはなぜですか?

セキュリティサブスクリプション

IPSポリシールールウィンドウに保存と閉じるボタンが表示されないのはなぜですか?

IPS、コンテンツセキュリティ、SSLプロファイルのデフォルト設定がインポートされないのはなぜですか?

デバイスの導入が「一致するメンバーが見つかりません」と表示されて失敗するのはなぜですか。グループは空です。」IPSというメッセージが送信されますか?

IPS、コンテンツセキュリティ、アプリケーションシグネチャバンドルのインストールに失敗するのはなぜですか?

デバイスへのコンテンツセキュリティプロファイルの導入に失敗するのはなぜですか?

デバイスへのSSLプロキシプロファイルの導入に失敗するのはなぜですか?

IPsec VPN

IPsec VPN監視ページにダウンしているトンネルが表示されないのはなぜですか?

IPsec VPNのインポート中に一部のデバイスがエクストラネットデバイスとしてインポートされるのはなぜですか?

IPsec VPNのインポート中にVPNのインポートページにデバイスが表示されないのはなぜですか?

IPsec VPN監視ページにVPNが表示されないのはなぜですか?

IPsec VPN監視ページに一部のVPNのステータスが表示されないのはなぜですか?

IPsec VPN監視ページに、ダウンしているVPNの稼働ステータスが表示されるのはなぜですか?

証明書管理

インポートしたローカル証明書がすぐに表示されないのはなぜですか?

デバイス検出操作中にCA証明書がインポートされないのはなぜですか?

PKI証明書の破損後に、Juniper Security DirectorクラウドおよびATPクラウドとのSRX1600ファイアウォールの接続をジュニパー戻すにはどうすればよいですか?

ライセンス

インストールしたライセンスがすぐに表示されないのはなぜですか?

共有サービス

アプリケーションがアプリケーションページに表示されないのはなぜですか?

URLカテゴリのインストールに失敗し、「カテゴリファイルが見つかりません」というメッセージが表示されるのはなぜですか?

管理

アカウントアクティベーションリンクをクリックすると、無効なリクエストメッセージが生成されるのはなぜですか?

ユーザーアクティビティログはどこで確認できますか?

新規ユーザーにアクティベーションメールが届かないのはなぜですか?

組織の複数のユーザーを作成するにはどうすればよいですか?

セキュリティログを構成した後でもログ分析データが欠落するのはなぜですか?