Start Using Unified Policies Post Upgrade

Unified Policies on SRX Series Devices Managed by Security Director

Security Director offers an easy migration tool which converts a traditional firewall policy to a unified policy. We recommend using Security Director Release 20.3 or later to convert a traditional security policy to a unified policy.

Figure 1 shows the option available in Security Director that you can use to convert a security policy to a unified policy.

Example:

For more information about using the Security Director to aid with policy migration, see [Security Director] Managing IDP, AppFW and UTM on SRX 18.2 and above with Security Director and In Focus Security Director.

You can use Security Director to quickly and accurately create policies as shown in the following examples:

To configure a unified policy, navigate to Configure>Firewall Policy>Unified Policies page.

To configure an IPS policy, navigate to Configure>IPS Policy>Policies page.

To configure a UTM policy, navigate to Configure>UTM Policy page.

Unified Policies on SRX Series Devices

The following sections provide details about unsupported configurations in the older release and how you can enable them with the new release.

• Application Security
• IDP Policies
• UTM
• What's Next

Junos OS Release 15.1X49	Unified Policies (Post Junos OS Release 18.2)
Configure individual application firewall rules to allow or reject traffic based on applications. Configure rules and rule sets at the set security application-firewall hierarchy level. Apply application firewall functionality set security policies from-zone <zone> to-zone <zone> policy <policy> then permit application-services application-firewall rule-set.	Create security policies with dynamic applications as match criteria to get the same functionality as application firewall. set security policies from-zone <zone> to-zone <zone> policy <policy> match dynamic-application <application-name>

Example: The following samples show the difference in application firewall configuration with 15.1X49 and configuration in 19.4R3-S1 in unified policies. We're using an example of setting up application firewall rules to block Facebook applications.

Junos OS Release 15.1X49	Unified Policies (Post Junos OS Release 18.2)
Assign an IDP policy as the active IDP policy and use it as match criteria in a security policy to perform intrusion detection and prevention.	Configure multiple IDP policies and apply them to the security policy. You can even define one of the IDP policies as the default policy.
Specify an active IDP policy: set security idp active-policy <IDP policy name> Apply IDP policy in the security policy: set security policies from-zone <zone> to-zone <zone> policy <policy> then permit application-services idp	Specify multiple IDP policies per firewall rule: set security policies from-zone <zone> to-zone <zone> policy <policy-1> then permit application-services <IDP-policy-name-1> set security policies from-zone <zone> to-zone <zone> policy <policy-2> then permit application-services <IDP-policy-name-2> set security idp default-policy <IDP-policy name>

Example: The following samples show the difference in IDP configuration with 15.1X49 and configuration in 19.4R3 in unified policies. Note that, in unified policies, you have the flexibility to configure multiple IDP policies.

Junos OS Release 15.1X49	Unified Policies (Post Junos OS Release 18.2)
Configure unified threat management (UTM) feature parameters under each feature profile. set security utm feature-profile anti-virus set security utm feature-profile anti-spam set security utm feature-profile web-filtering set security utm feature-profile content-filtering	Configure UTM features under the default configuration. UTM default configuration applies parameters that you might have missed configuring for a specific UTM feature. set security utm default-configuration anti-virus set security utm default-configuration anti-spam set security utm default-configuration web-filtering set security utm default-configuration content-filtering

Example: The following samples show the difference in UTM configuration with 15.1X49 and configuration in 19.4R3-S1 in unified policies. We're using an example of configuration of Sophos antivirus on your security device.

For more information on configuring security features on your device, see Product Documentation and Day One+.