filter (Identity Management Advanced Query)
Syntax
filter {
domain name;
exclude-ip {
address-book book-name;
address-set address-set;
}
include-ip {
address-book book-name;
address-set address-set;
}
}
Hierarchy Level
[edit services user-identification identity-management]
Description
The advanced user identity query feature enables the SRX Series Firewall to communicate with the Juniper Identity Management Service (JIMS) server to obtain user identity information for an individual user (ip-query) or a group of users (batch query).
Optionally, you can configure filters to convey to the JIMS server at a more granular level the users for whom you want information, based on their IP addresses. The filter statement gives you the flexibility to specify a range of IP addresses to be excluded from the record that the JIMS server sends in response or a range of IP addresses to be included in it. You can also constrain the query target to users in one or more specific active directory domains. Only IPv4 addresses are supported.
You can configure a filter that includes all three specifications: include-ip, exclude-ip, and domain.
Filters are contextual. That is, you can use a different filter configuration for different requests. If you change the filter configuration, the new filter applies to subsequent user identity requests exclusively. It has no bearing on prior query requests
Use of the JIMS allows you to provision users locally and have their authentication information made available to other sites in your network for policy enforcement and reporting.
Before you use this feature, you must disable active-directory-access and authentication-source options under the user-identification hierarchy. You cannot commit this configuration if active directory authentication or the ClearPass query and webapi functions are configured and committed.
Options
| include-ip | address-book book-name address-set address-set-name. Optionally, configure a filter that directs the SRX Series Firewall to issue a query to the JIMS server to include in its response record user identity information for users based on IP addresses in certain address-ranges. The following are the two behaviors when an
A filter can include up to twenty IP address ranges. Therefore, an address set that contains more than twenty ranges will cause the filter configuration to fail. To specify the ranges, specify the name of a predefined address set which includes them and which is included in an existing address book. The filter for IP addresses does not support nested address sets in an address book. If an address book contains nested address sets, it is ignored. Here is an include-ip address configuration: user@host# set security address-book mybook address addr1 range-address 198.51.100.0 to 198.51.120.0 user@host# set security address-book mybook address-set myset address addr1 user@host# set service user-identification identity-management filter include-ip address-book mybook address-set myset |
| exclude-ip | address-book book-name address-set address-set-name. Optionally, configure a filter that directs the SRX Series Firewall to issue a query to the JIMS server to exclude from its response record user identity information for users based on the specified address-ranges. The following are the two behaviors when an
To specify the ranges, specify the name of a predefined address
set which includes them and which is included in an existing address
book. The address set must not include more than twenty IP addresses,
otherwise the user@host# set security address-book mybook address addr1 range-address 198.51.100.0/24 to 198.51.120.0/24 user@host# set security address-book mybook address-set myset address addr1 user@host# set service user-identification identity-management filter exclude-ip address-book mybook address-set myset Starting in Junos OS Release 18.3R1, you can include or exclude IPv6 addresses for filtering the IP addresses, in addition to IPv4 addresses. |
| domain | One or more active directory domains of interest to the SRX Series Firewall. You can specify up to twenty domain names for the filter. |
Required Privilege Level
services—To view this statement in the configuration.
services-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 15.1X49-D100.