Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Screen Options for Tenant Systems

Screen options for Tenant Systems on SRX Series Firewalls prevent attacks as , such as IP address sweeps, port scans, denial of service (DOS) attacks, ICMP, UDP, and SYN floods as same as Logical Systems. For more information, see the following topics:

Understanding Tenant System Screen Options

Using screen options, the device secures a zone by inspecting, and then allowing or denying all connection attempts that require crossing an interface bound to that zone. Junos OS applies the firewall policies, which can contain the content filtering and the IDP components to the traffic that passes the screen filters. All screen options that are available on the device are also available in each tenant system.

Starting in Junos OS Release 18.3R1, the screen options that are supported for logical systems are extended to tenant systems.

Example: Configuring Screen Options for a Tenant System

This example shows how to configure screen options for a tenant system.


Before you begin:


Using screen options, the security device can protect against the different internal and external attacks for security zones. You can limit the number of concurrent sessions to the same destination IP address in a tenant system. Setting a destination based session limit can ensure that Junos OS allows only an acceptable number of concurrent connection requests—no matter what the source—to reach any one host. When the number of concurrent connection requests to an IP address surpasses the limit, Junos OS blocks further connection attempts to that IP address.



CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure destination-based session limits in a tenant system:

  1. Log in to the tenant system as the administrator and enter configuration mode.

  2. Define the tenant system name as TN1 and configure a screen option for a destination-based session limit.

  3. Configure the ICMP screening options.

  4. Configure the IP screening options.

  5. Configure the TCP screening options.

  6. Configure the UDP screening options.

  7. Attach the IDS profile to the zone.


From configuration mode, confirm your configuration by entering the show tenants TN1 security screen command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.


To confirm that the configuration is working properly, perform the below task:

Verifying security screen status


Verify that the IDS profile for multiple screening options is configured properly:


To verify the configuration is working properly, enter the show security screen ids-option jscreen tenant TN1 and show security zone tenant TN1command from operational mode.


The output displays the screen status in the tenant system.

Release History Table
Starting in Junos OS Release 18.3R1, the screen options that are supported for logical systems are extended to tenant systems.