Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
Juniper ATP Cloud CLI Reference Guide
Table of Contents Expand all
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

show security dynamic-address

date_range 25-Jul-23

Syntax

content_copy zoom_out_map
show security dynamic-address
<summary>
<category-name (Blacklist | CC | GeoIP | IPFilter | Infected-Hosts | SecProfiling | Whitelist) > 
<family inet | inet6>
<feed-name (feed-name) > 
<address-name (address-name) > 
<ip-start (starting-IP-address) > 
<ip-end (ending-IP-address) > 
<instance (advanced-anti-malware | default | geoip) > 
<logical-system (logical-system-name | all)>
<tenant (tenant-name | all)>

Description

Displays information about dynamic addresses. Each dynamic address belongs to only one instance. Within that instance is a set of categories to which the dynamic address further belongs.

A dynamic address entry provides dynamic IP address information to security policies. A dynamic address entry is a group of IP addresses, not just a single IP prefix, that can be imported in from external sources. These IP addresses are for specific domains or for entities that have a common attribute such as a particular undesired location that poses a threat. The administrator can then configure security policies to use the DAE within a security policy.

Options

none

Display source category (feed) and dynamic address name for all nodes (primary and backup nodes in case of HA.) The same as the show security dynamic-address ip-start 1.0.0.0 ip-end 255.255.255.255 command.

summary

(Optional) Display basic information of dynamic-address including their name, feeds, properties and number of IPv4 and IPv6 entries.

category-name (category-name)

(Optional) Display the source category (feed) and dynamic address name for the specified threat type (category name). A category is basically a list of feeds of the same type. The type defines SRX Series enforcement point criteria for feed lookup and enforcement. Supported category names are:

  • Blocklist—A list of locations (IP addresses, URLs, etc.) that you do not trust. A blocklist allows everyone access except for the members on the blocklist.

  • CC—A list of known C&C servers that are able to send commands to members of a botnet.

  • GeoIP—A list giving you the ability to filter traffic to and from specific geographies in the world.

  • IPFilter—A list of addresses and ranges of malicious sites that can send junk data.

  • Infected-Hosts—A lists of hosts within your network that may have been compromised and require attention. This list is generated from ATP Cloud based on hosts that have downloaded malware.

  • SecProfiling—A security intelligence category. You configure the security policy or IDP rule to add the source IP or destination IP of the traffic to the secProfiling feed in the cloud. You can also configure the security policy or IDP to match the source IP or destination IP of the traffic against the secProfiling feed in the cloud.

  • Allowlist—A list of locations (IP addresses, URLs, etc.) that you trust. An allowlist denies everyone access except for the members on the allowlist.

family

(Optional) Show the dynamic-address for specified protocol-family. Both IPv4 and IPv6 are displayed if no family is specified. ‘inet’ and ‘inet6’ can be combined with other options of the show command. For example, show security dynamic-address family inet6 ip-start 1111::1 ip-end 3333::3.

feed-name

(Optional) User-defined name of the source feed.

address-name

(Optional) The dynamic address name. If you do not specify an address-name, then information related to all dynamic addresses downloaded to this SRX Series Firewall is displayed.

ip-start

(Optional) The numerical minimum IP address where you want to investigate. Specifying ip-start and optionally ip-end (it is not required to specify ip-end if you use ip-start) is helpful to filter the output to a specific range instead of having to review the entire list which can be very long.

ip-end

(Optional) The numerical maximum IP address where you want to investigate. Specifying ip-start and optionally ip-end is helpful to filter the output to a specific range instead of having to review the entire list which can be very long. If you specify ip-end, you must specify ip-start.

instance (instance-name)

(Optional) The physically separated database. Supported instance names are:

  • advanced-anti-malware—The IP-based allowlists and blocklists.

  • default—The default instance holds the following data: blocklist, allowlist, C&C, infected host, and IPfilter.

  • geoip—The geoip data.

logical-system (logical-system-name | all)

Perform this operation on all logical systems or on a particular logical system.

tenant (tenant-name | all)

Perform this operation on all tenant systems or on a particular tenant system.

Required Privilege Level

View

Output Fields

Table 1 describes the output fields for the show security dynamic-address command. Output fields are listed in the approximate order in which they appear.

Table 1: show security dynamic-address Output Fields

Field Name

Field Description

Address name

Dynamic address entry name.

Address ID

Internal ID used to uniquely identify the dynamic address entry.

IPv4 entries

The number of IPv4 entries in the specific dynamic address.

IPv6 entries

The number of IPv6 entries in the specific dynamic address.

Category/feed

The threat type associated with the dynamic address. See description of category-name and feed-name above.

Country code Two-letter code (alpha-2) ISO 3166 country code in capital ASCII letters; Example" US or CN

Total number of IPv4 entries

The number of IPv4 entries in the database.

Total number of IPv4 entries from feed

The number of IPv4 entries in the feed. An entry in a feed can correspond to multiple entries in the database.

Total number of IPv6 entries

The number of IPv6 entries in the database.

Total number of IPv6 entries from feed

The number of IPv6 entries in the feed. An entry in a feed can correspond to multiple entries in the database.

Instance default

Total number of default matching entries.

Instance geoip

Total number of geoip data matching entries.

Instance advanced-anti-malware

Total number of the IP-based allowlists and blocklists matching entries.

Session-scan

Status of the session scan.

Sample Output

show security dynamic-address summary

content_copy zoom_out_map
user@host> show security dynamic-address summary
Dynamic-address session scan status            : Disable
Hold-interval for dynamic-address session scan : 10 seconds

 


  Server Name                 : fd_svr1
    Hostname/IP               : https://192.208.132.20
    Update interval           : 1000
    Hold   interval           : 1200
    TLS Profile Name          : tls_profile_1
    User        Name          : ---

 


    Feed Name                             : fd1
        Mapped dynamic address name       : ad1
        URL                               : https://192.208.132.20/fd1.gz
        Feed update interval              : 1000     Feed hold interval :1200
        Total update                      : 3
        Total IPv4 entries                : 1
        Total IPv6 entries                : 1
        Total download   errors           : 0        Last occurence N/A
        Total db         errors           : 0        Last occurence N/A
        Total other      errors           : 0        Last occurence N/A
        Total ageout                      : 0        Last occurence N/A
        Next update time                  : Mon Aug 31 16:19:44 2020
        Next expire time                  : Mon Aug 31 16:53:04 2020
        Flags                             : 0x0
        Last update file size             : 47
        Last update IPv4 entries          : 1
        Last update IPv6 entries          : 1
        Last update   begin time          : Mon Aug 31 16:03:04 2020
        Last update   end   time          : Mon Aug 31 16:03:04 2020
        Last update   time cost(s)        : --
        Last download begin time          : Mon Aug 31 16:03:04 2020
        Last download end   time          : Mon Aug 31 16:03:04 2020
        Last update   status              : 255
        Last download time cost(s)        : --
    Feed Name                             : fd2
        Mapped dynamic address name       : ad2
        URL                               : https://192.208.132.20/fd2.gz
        Feed update interval              : 1000     Feed hold interval :1200
        Total update                      : 2
        Total IPv4 entries                : 1
        Total IPv6 entries                : 1
        Total download   errors           : 0        Last occurence N/A
        Total db         errors           : 0        Last occurence N/A
        Total other      errors           : 0        Last occurence N/A
        Total ageout                      : 0        Last occurence N/A
        Next update time                  : Mon Aug 31 16:19:44 2020
        Next expire time                  : Mon Aug 31 16:53:04 2020
        Flags                             : 0x0
        Last update file size             : 47
        Last update IPv4 entries          : 1
        Last update IPv6 entries          : 1
        Last update   begin time          : Mon Aug 31 16:03:04 2020
        Last update   end   time          : Mon Aug 31 16:03:04 2020
        Last update   time cost(s)        : --
        Last download begin time          : Mon Aug 31 16:03:04 2020
        Last download end   time          : Mon Aug 31 16:03:04 2020
        Last update   status              : 255
        Last download time cost(s)        : --

 


    Address name                : ad1
      Address id                : 11
      IPv4 entries              : 1
      IPv6 entries              : 1
      Session-scan              : Disable
      Mapping Feed        : fd1
      Category/feed       : ---     / ---
            property name : feed
                    value : fd1

 


    Address name                : ad2
      Address id                : 12
      IPv4 entries              : 1
      IPv6 entries              : 1
      Session-scan              : Disable
      Mapping Feed        : fd2
      Category/feed       : ---     / ---
            property name : feed
                    value : fd2

 

 

Instance Name                              : default
    Total number of IPv4 entries           : 3
    Total number of IPv4 entries from feed : 2
    Total number of IPv6 entries           : 3
    Total number of IPv6 entries from feed : 2

 

Instance Name                              : geoip
    Total number of IPv4 entries           : 0
    Total number of IPv6 entries           : 0

 

Instance Name                              : advanced-anti-malware
    Total number of IPv4 entries           : 0
    Total number of IPv6 entries           : 0

show security dynamic-address summary

content_copy zoom_out_map
user@host> show security dynamic-address summary
node1:
--------------------------------------------------------------------------


    Address name          : a1
    Address id            : 11
      IPv4 entries        : 13778
      IPv6 entries        : 0
      Category/feed       : GeoIP   / ---
            property name : country
                    value : AU
                    value : CN


    Address name          : a2
    Address id            : 12
      IPv4 entries        : 0
      IPv6 entries        : 0
      Category/feed       : IPFilter / ---
            property name : test
                    value : test


Total number of IPv4 entries           : 13778
Total number of IPv4 entries from feed : 0
Total number of IPv4 except entries    : 0
Total number of IPv6 entries           : 0
Total number of IPv6 entries from feed : 0

show security dynamic-address (Junos OS Release 23.2R1)

content_copy zoom_out_map
user@host> show security dynamic-address
node0:
--------------------------------------------------------------------------

Instance default Total number of matching entries: 0
No.      IP-start       IP-end        Feed             Address      CountryCode
1        1.0.0.0        1.0.0.255     geoip_country    my-geoip1    AU
2        1.0.0.0        1.0.0.255     geoip_country    my-geoip2    AU
3        1.0.1.0        1.0.1.255     geoip_country    my-geoip1    CN
4        1.0.1.0        1.0.1.255     geoip_country    my-geoip2    CN
5        1.0.2.0        1.0.3.255     geoip_country    my-geoip1    CN

show security dynamic-address summary (Junos OS Release 23.2R1)

content_copy zoom_out_map
user@host> show security dynamic-address summary
 node0:
--------------------------------------------------------------------------


Dynamic-address session scan status : Disable
Hold-interval for dynamic-address session scan : 10 seconds



Instance Name : default
Total number of IPv4 entries : 0
Total number of IPv4 entries from feed : 0
Total number of IPv6 entries : 0
Total number of IPv6 entries from feed : 0


Address name : my-geoip1
Address id : 11
IPv4 entries : 17820
IPv6 entries : 6398
Session-scan : Disable
Category/feed : GeoIP / ---
property name : country
value : AU
value : CN


Address name : my-geoip2
Address id : 12
IPv4 entries : 17820
IPv6 entries : 6398
Session-scan : Disable
Category/feed : GeoIP / ---
property name : country
value : AU
value : CN



Instance Name : geoip
Total number of IPv4 entries : 35640
Total number of IPv6 entries : 12796

Instance Name : advanced-anti-malware
Total number of IPv4 entries : 2
Total number of IPv6 entries : 0

show security dynamic-address instance geoip (Junos OS Release 23.2R1)

content_copy zoom_out_map
user@host> show security dynamic-address instance geoip
 No.     IP-start             IP-end               Feed                             Address                       CountryCode
1       1.0.0.0              1.0.0.255            geoip_country                    my-geoip1                        AU                      
2       1.0.0.0              1.0.0.255            geoip_country                    my-geoip2                        AU                      
3       1.0.1.0              1.0.1.255            geoip_country                    my-geoip1                        CN                      
4       1.0.1.0              1.0.1.255            geoip_country                    my-geoip2                        CN                      
5       1.0.2.0              1.0.3.255            geoip_country                    my-geoip1                        CN                      
6       1.0.2.0              1.0.3.255            geoip_country                    my-geoip2                        CN                      
7       1.0.4.0              1.0.7.255            geoip_country                    my-geoip1                        AU                      
8       1.0.4.0              1.0.7.255            geoip_country                    my-geoip2                        AU                      
9       1.0.8.0              1.0.15.255           geoip_country                    my-geoip1                        CN                      
10      1.0.8.0              1.0.15.255           geoip_country                    my-geoip2                        CN                      
11      1.0.32.0             1.0.63.255           geoip_country                    my-geoip1                        CN                      
12      1.0.32.0             1.0.63.255           geoip_country                    my-geoip2                        CN                      
13      1.1.0.0              1.1.0.255            geoip_country                    my-geoip1                        CN                      
14      1.1.0.0              1.1.0.255            geoip_country                    my-geoip2                        CN                      
15      1.1.1.1              1.1.1.1              geoip_country                    my-geoip1                        AU                      
16      1.1.1.1              1.1.1.1              geoip_country                    my-geoip2                        AU                      
17      1.1.1.4              1.1.1.7              geoip_country                    my-geoip1                        AU                      
18      1.1.1.4              1.1.1.7              geoip_country                    my-geoip2                        AU                      
19      1.1.1.8              1.1.1.15             geoip_country                    my-geoip1                        AU                      
20      1.1.1.8              1.1.1.15             geoip_country                    my-geoip2                        AU                      
21      1.1.1.16             1.1.1.31             geoip_country                    my-geoip1                        AU                      
22      1.1.1.16             1.1.1.31             geoip_country                    my-geoip2                        AU                      
23      1.1.1.32             1.1.1.63             geoip_country                    my-geoip1                        AU                      
24      1.1.1.32             1.1.1.63             geoip_country                    my-geoip2                        AU                      
25      1.1.1.64             1.1.1.127            geoip_country                    my-geoip1                        AU                      
26      1.1.1.64             1.1.1.127            geoip_country                    my-geoip2                        AU                      
27      1.1.1.128            1.1.1.255            geoip_country                    my-geoip1                        AU                      
28      1.1.1.128            1.1.1.255            geoip_country                    my-geoip2                        AU                      
29      1.1.2.0              1.1.3.255            geoip_country                    my-geoip1                        CN                      
30      1.1.2.0              1.1.3.255            geoip_country                    my-geoip2                        CN                      
31      1.1.4.0              1.1.7.255            geoip_country                    my-geoip1                        CN                      
32      1.1.4.0              1.1.7.255            geoip_country                    my-geoip2                        CN                      
33      1.1.8.0              1.1.15.255           geoip_country                    my-geoip1                        CN                      
34      1.1.8.0              1.1.15.255           geoip_country                    my-geoip2                        CN                      
35      1.1.16.0             1.1.31.255           geoip_country                    my-geoip1                        CN                      
36      1.1.16.0             1.1.31.255           geoip_country                    my-geoip2                        CN                      
37      1.1.32.0             1.1.63.255           geoip_country                    my-geoip1                        CN                      

show security dynamic-address instance advanced-anti-malware

content_copy zoom_out_map
user@host> show security dynamic-address instance advanced-anti-malware
node1:
--------------------------------------------------------------------------
No.      IP-start        IP-end          Feed             Address
1        5.5.0.0         5.5.0.10        global_whitelist ID-00000003      
2        11.11.0.0       11.11.0.10      global_blacklist ID-00000004  

show security dynamic-address instance geoip

content_copy zoom_out_map
user@host> show security dynamic-address instance geoip
node1:
--------------------------------------------------------------------------
No.      IP-start        IP-end          Feed             Address
1        1.0.0.0         1.0.0.255       geoip_country    a1
2        1.0.1.0         1.0.1.255       geoip_country    a1
3        1.0.2.0         1.0.3.255       geoip_country    a1
4        1.0.4.0         1.0.7.255       geoip_country    a1
5        1.0.8.0         1.0.15.255      geoip_country    a1
6        1.0.32.0        1.0.63.255      geoip_country    a1
7        1.1.0.0         1.1.0.255       geoip_country    a1
8        1.1.1.0         1.1.1.255       geoip_country    a1
9        1.1.2.0         1.1.3.255       geoip_country    a1
10       1.1.4.0         1.1.7.255       geoip_country    a1
11       1.1.8.0         1.1.15.255      geoip_country    a1
12       1.1.16.0        1.1.31.255      geoip_country    a1
13       1.1.32.0        1.1.63.255      geoip_country    a1
14       1.2.0.0         1.2.1.255       geoip_country    a1

show security dynamic-address category-name Infected-Hosts

content_copy zoom_out_map
user@host> show security dynamic-address category-name Infected-Hosts

node1:
--------------------------------------------------------------------------
No.      	IP-start        	IP-end      	Feed             		Address
1 		  	1.0.0.7 				1.0.0.7 		  	Infected-Hosts/1 		ID-21500011
2 			1.0.0.10 			1.0.0.10 		Infected-Hosts/1 		ID-21500011
3 			1.0.0.21 			1.0.0.21 		Infected-Hosts/1 		ID-21500011
4 			1.0.0.11 			1.0.0.11 		Infected-Hosts/1 		ID-21500012
5 			1.0.0.12 			1.0.0.12 		Infected-Hosts/1 		ID-21500012
6 			1.0.0.22 			1.0.0.22 		Infected-Hosts/1 		ID-21500012
7 			1.0.0.6 				1.0.0.6 			Infected-Hosts/1 		ID-21500013
8 			1.0.0.9 				1.0.0.9 			Infected-Hosts/1 		ID-21500013
9 			1.0.0.13 			1.0.0.13 		Infected-Hosts/1 		ID-21500013
10 			1.0.0.23 			1.0.0.23 		Infected-Hosts/1 		ID-21500013

show security dynamic-address logical-system LSYS1

content_copy zoom_out_map
user@host> show security dynamic-address logical-system LSYS1

Instance default Total number of matching entries: 0
Instance geoip   Total number of matching entries: 0
Instance advanced-anti-malware Total number of matching entries: 0

show security dynamic-address logical-system all

content_copy zoom_out_map
user@host> show security dynamic-address logical-system all

Instance default Total number of matching entries: 0
Instance geoip   Total number of matching entries: 0
Instance advanced-anti-malware Total number of matching entries: 0

show security dynamic-address tenant TSYS1

content_copy zoom_out_map
user@host> show security dynamic-address tenant TSYS1

Instance default Total number of matching entries: 0
Instance geoip   Total number of matching entries: 0
Instance advanced-anti-malware Total number of matching entries: 0

show security dynamic-address tenant all

content_copy zoom_out_map
user@host> show security dynamic-address tenant all

Instance default Total number of matching entries: 0
Instance geoip   Total number of matching entries: 0
Instance advanced-anti-malware Total number of matching entries: 0

Release Information

Command introduced in Junos OS Release 12.1X46-D25.

Command <family inet | inet6> introduced in Junos OS Release 18.1.

The logical-system and tenant options are introduced in Junos OS Release 18.4R1.

footer-navigation