Firewall Policies Configuration Page Options

Select Configure>Security>Policy>Apply Policy.
The Security Policy configuration page appears. Table 164 explains the contents of this page.
Click one:
- Global Options—Configures global options for the firewall policy. Enter information as specified in Table 165.
- Add—Adds a new firewall or global policy configuration. Enter information as specified in Table 166.
- Edit—Edits the selected firewall policy configuration. Enter information as specified in Table 166.
- Delete—Deletes the selected firewall policy configuration.
- Clone—Clones or copies the selected firewall policy configuration. Enter information as specified in Table 166.
- Deactivate—Deactivates the selected security policy.
- Move—Organizes records. Select a policy and choose Move up, Move down, Move to top, or Move to bottom to reposition the policy.
Click one:
- OK—Saves the configuration and returns to the main configuration page.
- Commit Options>Commit—Commits the configuration and returns to the main configuration page.
- Cancel—Cancels your entries and returns to the main configuration page.

Table 255: Firewall Policy Configuration Page

Field	Function
Filter	Displays the grouped policies by common zone context (the from and to zones of each policy) to control the volume of data displayed at one time. By default, the Security Policy page displays all policies in the first From Zone and To Zone in the filter lists. To change the policies listed, select the desired from zone and to zone, and click Filter.
Show Global Policy	Displays the defined global policies. Unlike other security policies, global policies do not reference specific source and destination zones. If you select Show Global Policy to display policies, only global policies are displayed and the columns From Zone and To Zone are left blank (-). If you select All for From Zone and To Zone, global policies are shown after all normal policies.
From Zone	Displays the source zone for the policy.
To Zone	Displays the destination zone for the policy.
Name	Displays the name of the security policy.
Source Address	Displays the name of the source address or address set for the policy.
Destination Address	Displays the name of the destination address or address set for the policy.
Application	Displays the name of an application or application set to which the policy applies.
Dynamic Application
Action	Displays the actions that need to take place on the traffic as it passes through the firewall.
NW Services	Displays the network services settings (IDP, UTM, and WX) for the policy.
Log/Count	Displays the logging requirements for the policy.
Description	Displays a description of the policy.

Table 256: Global Options Firewall Policy Configuration Details

Field	Function	Action
Policy Options
Default policy action	Specifies that specific protocol actions are overridden. This action is also nonterminating. The options available are: permit-all deny-all	Select a value from the list.
Policy rematch	Specifies that a policy is added that has just been modified to a deferred action list for reevaluation. For every session associated with the policy, the device reevaluates the policy lookup. If the policy is different from the one associated with the session, the device drops the session. If the policy matches, the session continues.	Select the check box.
Flow - Main
Early ageout	Specifies the amount of time before the device aggressively ages out a session from its session table.	Enter a value from 1 through 65,535 seconds. The default value is 20 seconds.
High watermark	Specifies the percentage of session table capacity at which the aggressive aging-out process begins.	Enter a value from 0 through 100 percent. The default value is 100 percent.
Low watermark	Specifies the percentage of session table capacity at which the aggressive aging-out process ends.	Enter a value from 0 through 100 percent. The default value is 100 percent.
Allow DNS reply	Specifies that an incoming DNS reply packet without a matched request is allowed.	Select the check box.
Route change to nonexistent route timeout	Specifies the session timeout value on a route change to a nonexistent route.	Enter a value from 6 through 1800 seconds.
Enable SYN cookie protection	Enables SYN cookie defenses against SYN attacks.	Select the check box.
Enable SYN proxy protection	Enables SYN proxy defenses against SYN attacks.	Select the check box.
Flow - TCP MSS
Enable MSS override for all packets	Enables maximum segment size override for all TCP packets for network traffic.	Select the check box. Enter an maximum segment size value from 64 through 65,535.
Enable MSS override for all GRE packets coming out of an IPSec tunnel	Enables maximum segment size override for all generic routing encapsulation packets exiting an IPsec tunnel.	Select the check box. Enter a maximum segment size value from 64 through 65,535 bytes. The default value is 1320 bytes.
Enable MSS override for all GRE packets entering an IPsec tunnel	Enables maximum segment size override for all generic routing encapsulation packets entering an IPsec tunnel.	Select the check box. Enter a maximum segment size value from 64 through 65,535 bytes. The default value is 1320 bytes.
Enable MSS override for all packets entering IPSec tunnel	Enables maximum segment size override for all packets entering an IPsec tunnel.	Select the check box. Enter a maximum segment size value from 64 through 65,535 bytes. The default value is 1320 bytes.
Flow - TCP Session
Disable sequence-number checking	Disables checking of sequence numbers in TCP segments during stateful inspections. By default, the device monitors the sequence numbers in TCP segments.	Select the check box.
Strict SYN-flag check	Enables the strict three-way handshake check for the TCP session. This check enhances security by dropping data packets before the three-way handshake is done. By default, this check is disabled.	Select the check box.
Disable SYN-flag check	Disables the checking of the TCP SYN bit before creating a session. By default, the device checks that the SYN bit is set in the first packet of a session. If it is not set, the device drops the packet.	Select the check box.
Disable SYN-flag check (tunnel packets)	Disables the first packet check for the SYN flag when forming a TCP flow session.	Select the check box.
RST invalidate session	Specifies that a session is marked for immediate termination when it receives a TCP RST segment. By default, this statement is unset. When unset, the device applies the normal session timeout interval—for TCP, session timeout is 30 minutes; for HTTP, it is 5 minutes; and for UDP, it is 1 minute.	Select the check box.
RST sequence check	Specifies that the TCP sequence number in a TCP segment can be checked, with the RST bit enabled. This matches the previous sequence number for a packet in that session or is the next higher number incrementally.	Select the check box.
TCP Initial Timeout	Specifies the length of time (in seconds) that the device keeps an initial TCP session in the session table before dropping it, or until the device receives a FIN or RST packet.	Select the check box.

Table 257: Add Firewall Policy Configuration Details

Field	Function	Action
Policy
Policy Name	Specifies the name of the security policy.	Enter a name for the new policy.
Policy Action	Specifies the action taken when traffic matches the criteria. Available options are: Permit Deny Reject	Select an option. Permit —Allow packet to pass through the firewall. (Adds Permit Action, Application Services, and Application QoS tabs to the page.) Deny—Block and drop the packet, but do not send notification back to the source. Reject—Block and drop the packet and send a notice to the source host. For TCP traffic—Sends TCP RST. For UDP traffic—Sends ICMP destination unreachable, port unreachable message (type 3, code 3). For TCP and UDP traffic—Specifies action denied.
Policy Description	Specifies a description for the security policy.	Enter a description for the security policy.
From Zone	Specifies the source zone to be used as match criteria for the policy.	Select a value from the list.
To Zone	Specifies the destination zone to be used as match criteria for the policy.	Select a value from the list.
Global Policy	Specifies that the policy defined is a global policy and zones are not required.
Source Address	Specifies source addresses to be used as match criteria for the policy.	Add or remove source addresses to be used for match criteria: Select addresses or address sets in one list. (Use the Ctrl key to select more than one item.) Click the Right Arrow or Left Arrow key to move the selections to the opposite list. To add a new address, click Add new Source Address, enter the new name and address, and click Add. Do not use the following reserved prefixes: static_nat_ incoming_nat_ junos_
Destination Address	Specifies destination addresses to be used as match criteria for the policy.	Add or remove destination addresses to be used for match criteria: Select addresses or address sets in one list. (Use the Ctrl key to select more than one item.) Click the Right Arrow or Left Arrow key to move the selections to the opposite list. To add a new address, click Add new Destination Address, enter the new name and address, and click Add. Do not use the following reserved prefixes: static_nat_ incoming_nat_ junos_
Application	Specifies the predefined or custom application signatures to be used as match criteria for the policy.	Add or remove applications to be used for match criteria: Select applications in one list. (Use the Ctrl key to select more than one item.) Click the Right Arrow or Left Arrow key to move the selections to the opposite list.
Search	Specifies the search criteria for the policy.	Enter the search criteria of the policy.
Logging/Count
Enable Count	Specifies statistical counts and triggers alarms whenever traffic exceeds specified packet and byte thresholds. When this count is enabled, statistics are collected for the number of packets, bytes, and sessions that pass through the firewall with this policy.	Select the check box. Note: Alarm threshold fields are disabled if Enable Count is not enabled.
Per Minute Alarm Threshold	Specifies the byte threshold for the per-minute alarm.	Enter a value from 0 through 4,294,967,295 KB.
Per Second Alarm Threshold	Specifies the byte threshold for the per-second alarm.	Enter a value from 0 through 4,294,967,295 KB.
Log at Session Close Time	Specifies that an event is logged when the session closes.	Select the check box.
Log at Session Init Time	Specifies that an event is logged when the session is created.	Select the check box.
Scheduling
Scheduler Name	Specifies the scheduler that defines the time the policy will be activated.	Select the scheduler from the list.
Permit Action
IPsec VPN	Specifies the IPsec VPN tunnel.	Enter the IPsec VPN tunnel.
Pair Policy Name	Specifies the name of the policy with the same IPsec VPN in the opposite direction to create a pair policy.	Enter the name of the policy that specifies the criteria for the opposite tunnel direction.
NAT Translation	Enables NAT translation.
Options	Specifies the appropriate NAT translation feature. The options available are: None Drop packets with translated address Drop packets without translated address	Select an option.
Authentication Firewall Pass-through: Access Profile	Specifies the profile used to verify traffic as it attempts to pass through the firewall.	Select an access profile from the list.
Authentication Firewall Pass-through: Client name	Specifies the client name for the pass-through authentication.	Enter the client name.
Authentication Firewall Pass-through: Web Redirect	Specifies that pass-through traffic is redirected for Web authentication.	Enable or disable redirection for Web authentication.
Web-authentication: Client name	Specifies the client name for Web authentication.	Enter the Web authentication client name.
Services offload: Services offload	Enables services offloading.	Select or clear the check box to enable or disable services offloading. Note: If the services-offload license is not installed on the device, a warning message is displayed during commit.
Application Services
IDP: Enable IDP	Enables IDP for this policy.	Select the check box.
UAC Policy	Enables UAC enforcement for this policy.	Select the check box.
UAC Policy: Captive portal policy	Specifies a captive portal policy to redirect the traffic to IC for authentication.	Select an option.
Redirect: Options	Specifies the type of redirection. The options available are: Redirect-wx Reverse Redirect-wx	Select an option.
UTM Policy	Specifies the UTM policy to be associated with this policy.	Select an option from the list.
Application Firewall: Rule Set	Specifies the rule set for the application firewall	Select a rule set name.
Application QoS
Select existing rule set	Use an existing rule set.	Click Select existing rule set to activate the list of existing rule sets for selection.
Rule set	Lists all existing AppQoS rule sets.	Select the desired rule set for the policy. The rules in the rule set are displayed in the Application in rule-set pane.
Delete selected rule set	Delete the AppQoS rule set displayed in the Rule set list.	To remove an AppQoS rule set from the list, select the rule set and click Delete selected rule-set. Note: To remove the rule set for an existing policy, select the blank entry in the rule set list and click Select existing rule set.
Create new rule set	Create an AppQoS rule set for the policy.	To create an AppQoS rule set for this policy, click Create new rule set.
Rule set name	The name of the new AppQoS rule set.	Enter a name for the policy’s AppQoS rule set.
Application in rule-set	The existing rules for the specified AppQoS rule set. This display includes each new rule as it is created for the rule set.	To modify a rule in the Application in rule-set pane, do one of the following: Add—Add a new rule to a new or existing AppQoS rule set Edit—Edit the selected rule in the displayed AppQoS rule set. Delete—Delete the selected rule in the displayed AppQoS rule set. Enter information as specified in Table 258.
Match app-signature	The application signatures defined as match criteria for each rule.
Forwarding class	A keyword that groups matching packets with similar transmission priorities and that identifies any re-marking done by the AppQoS rewriter. A rewriter honors an existing DSCP value and does not overwrite it based on a packet’s forwarding class. IDP forwarding classes have priority over AppQoS forwarding classes which have priority over firewall forwarding classes.
Loss priority	Value that determines the likelihood that a packet would be dropped when congestion is encountered. Possible values are high, medium-high, medium-low, and low. A high loss priority means that there is an 80% chance of packet loss due to congestion. A low loss priority means that there is a 20% chance of packet loss due to congestion.
DSCP	The DSCP alias or bit map that establishes the matching packet’s output priority.
S2C rate limiter (bandwidth, burst)	The maximum limits for bandwidth and burst to be applied to matching server-to-client traffic.
C2S rate limiter (bandwidth, burst)	The maximum limits for bandwidth and burst to be applied to matching client-to-server traffic.
Log	Identifies whether AppQoS matching details are being logged.

Table 258: Add Rule Configuration Details

Field	Function	Action
Application Signature
Available application signatures	Displays the applications available on your device.	To include an application in the match criteria for the rule: Select one or more applications in the Available application signatures list. (Use the Ctrl key to select more than one item.) Click the right arrow to move the selections to the Matched list.
Matched	Displays the applications selected as match criteria for the rule.	To delete applications from the match criteria for the rule: Select one or more applications in the Matched list. (Use the Ctrl key to select more than one item.) Click the left arrow to return the selections to the Available application signature list.
Search	Redisplays the Available application signature list with the specified application at the top.	Enter an application name to position it at the top of the Available application signature list.
Available group app-signatures	Displays the application groups available on your device.	To add application groups to the match criteria for the rule: Select one or more application groups in the Available group app-signatures list. (Use the Ctrl key to select more than one item.) Click the right arrow to move the selections to the Matched list.
Matched	Displays the application groups selected as match criteria for the rule.	To delete application groups from the match criteria for the rule: Select one or more application groups in the Matched list. (Use the Ctrl key to select more than one item.) Click the left arrow to return the selections to the Available group app-signatures list.
Search	Redisplays the Available group app-signatures list with the specified application group at the top.	Enter an application group name to position it at the top of the Available group app-signatures list.
Traffic Control
Code point	The rule’s DSCP alias or bit map. The rewriter re-marks the DSCP field of a matching packet with this value if AppQoS has priority over a prior rewriter’s entry.	Enter one of the following aliases or bit mappings for this rule: Expedited Forwarding—ef or 01110 Assured Forwarding—af11 or 001010 Assured Forwarding—af12 or 001100 Assured Forwarding—af13 or 001110 Assured Forwarding—af21 or 010010 Assured Forwarding—af22 or 010100 Assured Forwarding—af23 or 010110 Assured Forwarding—af31 or 011010 Assured Forwarding—af32 or 011100 Assured Forwarding—af33 or 011110 Assured Forwarding—af41 or 100010 Assured Forwarding—af42 or 100100 Assured Forwarding—af43 or 100110 Best Effort—be or 000001 cs1 or 001000 cs2 or 010000 cs3 or 011000 cs4 or 100000 cs5 or 101000 Network Control—nc1, cs6, or 110000 Network Control—nc2, cs7, or 111000
Loss priority	Value that determines the likelihood that a matching packet will be dropped when congestion is encountered. A high loss priority means that there is an 80% chance of packet loss in congestion.	Enter one of the following values: High Medium-high Medium-low Low
Forwarding class	Keyword associated with AppQoS that identifies the output queue for a matching packet. Because you define unique forwarding classes for AppQoS, the keyword identifies both the queue assignment and the rewriter that marked the DSCP value. In this way, other rewriters can honor DSCP values set by a higher priority rewriter and will not overwrite them. IDP forwarding classes have priority over AppQoS forwarding classes which have priority over firewall forwarding classes.	Enter the appropriate AppQoS forwarding class for the rule. To define an AppQoS forwarding class, enter Configuring>Class of Service>Forwarding Class.
Enable log	Determines that logging is enabled.	Click to log AppQoS rule matches and associated actions.
Rate limiter	Maximum transfer rates for traffic from the client to the server or from the server to the client.	Click to display or set rate limiting specifications for the Client to server or Server to client directions..
Select existing rate limiter	Displays rate limiters already defined for this rule set. A rate limiter can be used for more than one rule within the same rule set.	Choose from the existing rate limiter list.
Delete selected rate limiter	Deletes the selected rate limiter.	Choose the rate limiter to delete, and click Delete selected rate limiter. Note: Deleting a rate limiter from this list also deletes it from any other rule where it is specified.
Create new rate limiter	Expands to provide bandwidth and burst size limits for this rule.	Click to enter the rate limiting specifications. Note: This rate limiter will be named automatically. The name is a combination of rule set and rule names, and it will be included in the rate limiter list.
Bandwidth limit	Determines the maximum transmission rate in Mbps.	Enter the maximum bandwidth in Mbps.
Burst size limit	Determines the maximum MB that can be transmitted in a single burst or transmission.	Enter the maximum burst size in MB.

Firewall Policies Configuration Page Options

Related Documentation