Unified Policies for SSL Proxy
Overview
On Juniper SRX devices, SSL proxy works with Unified Policies by enabling SSL decryption and inspection as an application service within security policies that use the unified policy framework. This integration allows for deep inspection of encrypted traffic while maintaining dynamic application awareness. Here’s how it functions and key points to understand:
- Default SSL Proxy Profile: When using unified policies, the SRX Series Firewall applies a default SSL proxy profile during the initial policy lookup phase—before the final application is identified. This helps avoid conflicts when multiple matching policies specify different SSL proxy profiles. If no default profile is configured in such cases, the session is dropped. Therefore, it’s recommended to configure a default SSL proxy profile to ensure smooth SSL proxy handling during early policy evaluation
- Policy Matching and SSL Proxy Application:
Initial Policy Lookup Phase
Before a dynamic application is identified, the firewall performs an initial policy lookup. If multiple policies match and specify different SSL proxy profiles, the firewall applies the default SSL proxy profile temporarily.This ensures SSL inspection begins immediately, even before the final application is known.
Role of Default SSL Proxy Profile
The default SSL proxy profile acts as a fallback during policy conflicts.
If no default profile is configured and conflicting policies exist, the session is dropped, and a system log message is generated.
It is strongly recommended to configure a default SSL proxy profile to avoid session termination.
- Final Application Identification: After the final application is identified by the
unified policy engine, the security policy matching that application is applied. Once the
dynamic application is identified, the firewall re-evaluates the policy. If the matching
policy has:
Same SSL proxy profile as the default → the default profile remains applied.
No SSL proxy profile → the default profile remains applied.
Different SSL proxy profile → the default continues to be applied; it is not replaced.
Proxy Type Handling
A security policy can include either an SSL forward proxy profile or an SSL reverse proxy profile—not both.
If different policies use different types, the firewall applies the default profile (forward or reverse) during initial evaluation.
Note:
Once a default SSL proxy profile is enabled, it cannot be disabled even if the final policy does not specify SSL proxy. Switching from the default SSL proxy profile to another SSL proxy profile in the final policy is not supported. If there is a conflict and no default SSL proxy profile is configured, sessions may be dropped.
This mechanism allows SRX to decrypt, inspect, and enforce security on SSL/TLS traffic dynamically as applications are identified, providing granular control and protection in encrypted traffic flows.
A security policy can include either an SSL forward proxy profile or an SSL reverse proxy profile—not both. If different policies use different types, the firewall applies the default SSL proxy profile (forward or reverse) during initial evaluation.
We recommend configuring a default SSL proxy profile to prevent session drops during policy conflicts. If no default profile is available, the session is terminated and a system log message is generated
Example of the system log message:
"<14>1 2018-03-07T03:18:33.374-08:00 4.0.0.254 kurinji junos-ssl-proxy - SSL_PROXY_SSL_SESSION_DROP [junos@2636.1.1.1.2.105 logical-system-name="root-logical-system" session-id="15" source-address="4.0.0.1" source-port="37010" destination-address="5.0.0.1" destination-port="443" nat-source-address="4.0.0.1" nat-source-port="37010" nat-destination-address="5.0.0.1" nat-destination-port="443" profile-name="(null)" source-zone-name="untrust" source-interface-name="xe-2/2/1.0" destination-zone-name="trust" destination-interface-name="xe-2/2/2.0" message="default ssl-proxy profile is not configured"]
Application of Default SSL Proxy Profiles in Different Scenarios
Thie following tables show simplified examples of how different policies are configured with SSL proxy profiles and dynamic applications.
| Policy | Dynamic Application | SSL Proxy Profile |
|---|---|---|
| P1 | SSL-1 | |
| P2 | SSL-1 | |
| P3 | YouTube | None |
| P4 | Dropbox | SSL-2 (Default Profile) |
| Scenario | Policy Setup | SSL Proxy Behavior | Example |
|---|---|---|---|
| No Conflict – All Policies Have Same SSL Proxy Profile | All matching policies have the same SSL proxy profile. | That profile is applied. Default profile is ignored. | Policies P1 and P2 both use SSL-1. SSL-1 is
applied. Default SSL-2 is ignored. |
| No Conflict – Final Policy Has No SSL Proxy Profile | Initial matching policies have same SSL proxy profile. Final matched policy has none. | Initially applied profile remains active. | P1 and P2 use SSL-1. Final match P3 has no profile.
SSL-1 remains applied. |
| Conflict – Final Policy Has No SSL Proxy Profile | Initial policies have different SSL proxy profiles. Final matched policy has none. | Default profile is applied during conflict. It remains applied. | P1 uses SSL-1, P4 uses SSL-2. Default is
SSL-2. Final match P3 has no profile. SSL-2
remains applied. |
| Conflict – Final Policy Has Different SSL Proxy Profile | Initial policies have different profiles. Final matched policy has a different profile. | Default profile is applied and remains. Switching of profiles is not supported. | P1 uses SSL-1, P4 uses SSL-2. Default is
SSL-2. Final match P3 uses SSL-3.
SSL-2 remains applied. |
| Conflict – No Default SSL Proxy Profile Configured | Initial policies have different profiles. No default profile is configured. | Session is dropped. | P1 uses SSL-1, P4 uses SSL-2. No default
profile. Session is terminated. |
Limitations of SSL Proxy with Unified Policies
-
When a default SSL proxy profile is enabled, it cannot be disabled even if the final security policy does not have SSL proxy configured.
-
When a default SSL proxy profile is enabled and applied on the traffic and the final security policy has a different SSL proxy profile configured other than default profile, switching from the default SSL proxy profile to the SSL proxy profile in the security policy is not supported.
Configuration Steps
Steps for configuring SSL proxy in a unified security policy:
- Create security policies and define match criteria for the traffic that requires SSL inspection.
- Specify the SSL proxy profile to be applied to that traffic.
- When using unified policies, follow these steps:
- Define SSL proxy profiles (forward or reverse proxy) in
[edit services ssl proxy]hierarchy level. - Configure a default SSL proxy profile under global options in unified policies (
[edit security ngfw]hierarchy level). This configuration does not impact the existing SSL service configuration. - Reference the profile in the relevant security policy.
- Define SSL proxy profiles (forward or reverse proxy) in
- Apply the SSL proxy profile as an application service in the security policy.
This setup ensures SSL decryption and inspection are applied consistently, especially during the initial policy evaluation phase before dynamic applications are fully identified.
- Configure Default Profile for SSL Forward Proxy
- Configure Default Profile for SSL Reverse Proxy
- Configure Default Profile for Logical Systems
- Sample Configuration
Configure Default Profile for SSL Forward Proxy
In the steps below, you will define an SSL forward proxy profile named
profile-1 and specify it as the default SSL proxy profile.
- Create an SSL profile and attach the CA profile group to the SSL proxy profile.
user@host# set services ssl proxy profile profle-1e trusted-ca all
- Apply the signing certificate as root-ca in the SSL proxy profile.
user@host# set services ssl proxy profile profle-1 root-ca ssl-inspect-ca
- Define the SSL proxy profile as the default profile.
user@host# set security ngfw default-profile ssl-proxy profle-1
Configure Default Profile for SSL Reverse Proxy
In the steps below, you will define an SSL reverse proxy profile named
profile-1 and specify it as the default SSL proxy profile.
- Create an SSL profile and attach the CA profile group to the SSL proxy profile.
user@host# set services ssl proxy profile server-protection-profile server-certificate server1_certificate-id
- Define the SSL reverse proxy profile as the default profile.
user@host# set security ngfw default-profile ssl-proxy profile-name server-protection-profile
Configure Default Profile for Logical Systems
In the steps below, you assign either an SSL forward proxy profile or an SSL reverse proxy profile as the default within a logical system configuration. Only one profile type—forward or reverse—can be set as the default at a time.
Define the SSL forward proxy profile as the default profile.
user@host# set logical-systems LSYS1 security ngfw default-profile ssl-proxy profle-name
Define the SSL reverse proxy profile as the default profile.
user@host# set logical-systems LSYS1 security ngfw default-profile ssl-proxy profle-name
Sample Configuration
In this example, you configure an SSL forward proxy profile by specifying the root CA certificate. Next, configure the profile as default SSL proxy profile. Now, you create a unified policy and invoke the SSL proxy as application services on the permitted traffic.
Create an SSL profile and attach the CA profile group to the SSL proxy profile.
user@host#set services ssl proxy profile SSL-FP-PROFILE-1 trusted-ca allApply the signing certificate as root-ca in the SSL proxy profile.
user@host#set services ssl proxy profile SSL-FP-PROFILE-1 root-ca ssl-inspect-caDefine the SSL proxy profile as the default profile.
user@host#set security ngfw default-profile ssl-proxy profile-name SSL-FP-PROFILE-1Create a unified policy and specify the dynamic application as the match criteria.
user@host#set security policies from-zone untrust to-zone trust policy from_internet match source-address anyuser@host#set security policies from-zone untrust to-zone trust policy from_internet match destination-address anyuser@host#set security policies from-zone untrust to-zone trust policy from_internet match application anyuser@host#set security policies from-zone untrust to-zone trust policy from_internet match dynamic-application junos:webApply the SSL proxy profile to the permitted traffic in the security policy.
user@host#set security policies from-zone untrust to-zone trust policy from_internet then permit application-services ssl-proxy profile-name SSL-FP-PROFILE-1Confirm that the configuration is working after commit by displaying the SSL proxy statistics using the
show services ssl proxy statisticscommand.user@host> show services ssl proxy statisticsPIC:fwdd0 fpc[0] pic[0] sessions matched 448 sessions bypassed:non-ssl 0 sessions bypassed:mem overflow 0 sessions bypassed:low memory 0 sessions created 448 sessions ignored 7 sessions active 0 sessions dropped 440 sessions whitelisted 1 whitelisted url category match 1 default profile hit 0 session dropped no default profile 0 policy hit no profile configured 0Details about the sessions matched for the SSL proxy, sessions where the default profile is applied, and the sessions that are dropped due to the absence of the default profile.
SNI-Based Dynamic Application Information for SSL Proxy Profile
We’ve enhanced SSL proxy profile selection mechanism by utilizing Server name Indication(SNI) TLS extensions to identify dynamic applications.
SSL proxy module defers SSL profile selection until the dynamic application is detected in a client hello message based on the SNI. After detecting dynamic application, SSL proxy module does a firewall rule lookup based on the identified application and selects an appropriate SSL proxy profile.
Utilizing the SNI-based dynamic application information for SSL proxy profile results in more accurate SSL proxy profile selection for the session. By default, the SNI-based dynamic application information for SSL proxy profile is enabled on the SRX Series Firewall. See show services ssl proxy counters to check counters for SSL proxy.
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.