Appendix: Next-Generation Firewall JVD Configuration

Generic Workflows and Operations for Creating the Data Center Next-Generation Firewall Topology

This overview illustrates how to use the Juniper SRX Series Firewall CLI and Juniper Security Director Cloud console (the GUI) to provision the data center next-generation firewall architecture. Conceptually, the Juniper SRX Series Firewall is configured on the data center edge to provide visibility and control of traffic that is originating from the following:

• Traffic originating from trusted clients outbound to the Internet. (South-North Traffic)
• Traffic originating from untrusted environment reaching inbound to services configured in the data center. (North-South Traffic)
• Traffic originating from the trusted clients using services hosted with in the data center. (East-West Traffic)

Figure 1 illustrates the workflow for configuring the Juniper SRX Series Firewall using the Junos OS CLI and Juniper Security Director Cloud console.

The sequence of configuration tasks in this example is as follows:

1. Configure chassis cluster through CLI: Clustering enables high availability.
2. Load baseline configuration with interface, zones, addresses, services, firewall policies, NAT, and default routing: Baseline the configuration for the device to carry traffic and able to reach out to Internet.
3. Configuring logging to an external SIEM: You can have multiple log streams configured in SRX Series Firewall and point the SRX logging mechanisms to multiple SIEMs.
4. Enable web management: Enable web management so that you can access SRX Series Firewall using the on-box management solution through J-Web.
5. Discover the device and import baseline configuration to Juniper Security Director Cloud: Discover the device and import the baseline configuration to Juniper Security Director Cloud.
6. Enable logging for Juniper Security Director Cloud: Enable logging so that the traffic is logged to Juniper Security Director Cloud from SRX Series Firewall.
7. Enroll the device to Juniper ATP Cloud: Juniper ATP Cloud is the threat intelligence component of this solution and the source of SecIntel threat feeds. It also can provide advanced malware detection.
8. Create security policies with application specific environment.
9. Create IDP profiles that cover the security landscape of the data center environment.
10. Assign the created IDP profile in a security policy.
11. Create SecIntel Profile: SecIntel Profile contains options for DNS, Command and Control (C&C), and Infected hosts.
12. Assign SecIntel Profile to rule: Assigning SecIntel Profile to rule ensures all the traffic using the rule is verified against the SecIntel feeds.
13. Create AAMW Profile: The AAMW profile allows you to select the type of traffic to be inspected for malware. Traffic includes HTTP, IMAP, SNB, and SMTP.
14. Assign AAMW Profile to Rule: Assign the profile to rule so that all traffic using the rule is inspected for malware based on the profile.
15. Create DNS security Meta Data Profile: DNS security allows you to identify DNS related threats such as DGA and DNS tunnelling.
16. Assign the DNS Meta Data to Zone Context: All the traffic between the zone set is inspected for DNS security.
17. Configure screen options to protect the untrust zone against DDoS attacks.
18. Configure reverse SSL proxy to analyze and protect webserver traffic. The traffic is subjected to advances security services.

The configuration for each tested JVD feature is as follows:

Chassis Configuration (CLI)

Baseline Configuration (CLI)

System and Security Logging Configuration (CLI)

Management Configuration (CLI)

GUI driven feature configuration through Juniper Security Director Cloud:

• Discover device in Juniper Security Director Cloud and import baselined configuration.
• Onboard device in Juniper Security Director Cloud.

To onboard the SRX Series Firewall, follow the procedure below:

1. Go to SRX > Device Management > Device and then click +.
2. Select Adopt SRX Devices.
3. Select SRX Clusters.
4. Enter 1 in the Number of SRX clusters to be adopted field.
5. Click OK and then click Close.

The action above creates a temporary device and to complete the on-boarding process, click Adopt Cluster as seen in Figure 4 . Copy paste the CLI commands on to the node0 of the SRX Cluster.

Enroll Device to Juniper ATP Cloud After Device Discovery

1. Go to SRX > Device Management > Device.
2. Select Devices.
3. Click More and then select Enroll to ATP.
4. Log on to your SRX Series Firewall and paste the command into the Junos OS CLI.

Enable Logging on SRX Series Firewall to Log the Traffic to Juniper Security Director Cloud

Application Security

Configure firewall policy to implement application security in a data center environment. We’ll create a firewall policy to block any high bandwidth social media / shopping websites and apps (Facebook, Amazon) and video sharing websites such as YouTube, Vimeo, and so on.

Create an Application Group that you’ll use in the firewall policy:

1. Go to Shared Services > Applications.
2. Click Create drop-down and then select Signature group.
3. Enter a name for the Application Group.
4. Click + to add all the applications that needs to be blocked.
5. Click OK to save the Application Group.

Include the Application Group in a Security Policy for enforcement:

1. Go to SRX > Security Policy > SRX Policy.
2. Click + to add new firewall rule.
3. Enter Source Zone and Source Address.
4. Enter Destination Zone and Destination Address.
5. Select Services and Application Group that we created with apps that need to be blocked.
6. Select Action.
7. Enable Logging if needed from Options.

Intrusion Detection and Prevention (IDP)

When implementing IDP, you can consider the following settings when designing the IDP policy:

• Environment (Services running within the data center)
• Applications (Applications that are currently being served through the firewall)
• Exempt any services or protocols that are not be scanned (for example, SSH)

Based on the services implemented for this JVD, we choose to clone the client-to-server based protection and add a few rules that cater to the server-to-client based traffic.

The policy created considers the following settings:

• Services running in the data center (HTTP, HTTPS, MAIL, ICMP, DB, DNS, and so on)
• Signatures to detect malicious activity
• Signatures to detect network / services scanning
• Signatures to detect any DOS and DDOS based attacks

Workflow to create IDP policies and enforce the policies.

To clone predefined policy:

1. Go to SRX > Security Subscription > IPS > IPS Profiles.
2. Select the predefined policy to clone.
3. Click More and then select Clone.
4. Enter a new policy name.

In this JVD, we’ve named the policy CS-To-Web-Protection-Rules and added a few rules which caters to server-to-client protection.

Once new IPS rule is added, update the following:

1. Name of the IPS rule.
2. Add new IDP signatures.
3. Select action if a threat is detected.
4. Optional. Log detected attacks.
5. IPS rules also have advanced options to enable IP actions on detected attacks.

Note:

Each signature that is added comes with a recommended action to take if detected. You can set the action as Recommended. For more information on the signatures and the recommended action, see: https://threatlabs.juniper.net/home/search/#/list/ips?page_number=1&page_size=20

Once IPS profile and rules are created, enforce the IPS profile on a security policy:

1. Click on the firewall rule where IPS needs to be enabled.
2. Click Security Subscriptions.
3. Either use the global options and turn on just the IPS toggle or click Customize to select a new policy.

You can set the Global Options on the main SRX Policy page.

SecIntel Configuration

1. Go to SRX > Security Subscriptions > SecIntel > Profiles.
2. Click Create.
3. Configure the profiles for required services.

To create profile groups:

1. Go to SRX > Security Subscriptions > SecIntel > Profile Groups.
2. Click + to create a new profile group.

As a final step, let’s enable the SecIntel profile group in a security policy that enforces the detection and remediation for SecIntel profiles based on reputation.

To enable SecIntel profile group in a security policy:

1. Go to SRX > Security Policy > SRX Policy.
2. Select the policy you want to modify and click the pencil icon.
3. Edit policy to enable SecIntel profile group or click on Create New to select a different profile.

Advanced Anti-Malware

1. Go to SRX > Security Subscriptions > Anti-malware.
2. Click +.
3. Configure the protocols that you need to enable and click OK to save the AAMW profile.

Created AAMW profile is configured in a security policy.

DNS Security

DNS security is configured in two phases:

• Enabling SecIntel phase, which is covered under the SecIntel section.
• Enabling core DNS security features such as DNS DGA and DNS Tunneling, which are covered in this section.

To enable DNS security, follow the path to configure the settings on Juniper Security Director Cloud:

1. Go to SRX > Device Management > Devices.
2. Click the device we want to configure DNS security.
3. Click Junos Detailed Configurations.
4. Enter DNS filtering in the search section.
5. Select Services > Dns Filtering.
6. Enter the details.
7. Click Save once done.
8. Optional. Click Preview if you want to view saved configuration.
9. Click Deploy to deploy the configuration to the device.

Note:

You can always complete all the configuration sections and save before deploying the final configuration.

Also, this configuration is the same for implementing IoT Security as well.

Let’s configure the core DNS security features:

1. Enter metadata in the search section.
2. Select Services > Security Metadata Streaming.
3. Click to proceed to the configuration section.
4. Click + to enable DNS metadata configuration.
5. Click Save once done.
6. Optional. Click Preview if you want to view saved configuration.
7. Click Deploy to deploy the configuration to the device.

Note:

Ensure to save and deploy the configuration once its completed.

Let’s use CLI to configure the metadata streaming policy on a zone pair to enforce DNS security settings.

Ensure that the configuration is deployed before configuring the next steps through CLI.

Security Screens

To configure Security IDS Screen option on Juniper Security Director Cloud:

1. Go to SRX > Device Management > Devices.
2. Click on the device.
3. Click Junos Detailed Configurations.
4. Search for screens.
5. Select Security > Screen.
6. Click + to add a new profile.
   Figure 39: Juniper Security Director Cloud—Screens Configuration
   Figure 40: Juniper Security Director Cloud—Screens Flood Attack Options
7. Click OK to save the screen configuration once the desired configuration is completed.
8. Click Zones to enforce the screen on a specific zone.
   Figure 41: Juniper Security Director Cloud—Assign Screens Options to Zone
9. Click OK to save the configuration once the new screen configuration is applied to the zone.
10. Click Deploy to deploy the configuration to the device.

Reverse SSL Proxy

As the data center next-generation firewall use case focuses on protecting internal resources such as webservers, we can optionally implement SSL reverse proxy. SSL reverse proxy ensures advanced services are applied to decrypted webserver traffic and inspected before leaving the firewall to gain the webserver resources.

The creation of the webserver certificates is not covered in this section. You must import this certificate into Juniper Security Director Cloud. This certificate is used when creating the SSL proxy profile.

To create the SSL reverse proxy profile:

1. Import webserver certificates.
2. Create the SSL reverse proxy profile.
3. Go to SRX > Security Subscriptions > Decrypt Profiles.
4. Click + to add a new profile.

Include the profile in a firewall rule for enforcement:

1. Go to SRX > Security Policy > SRX Policy.
2. Click + to add new firewall rule.
3. Enter Source Zone and Source Address.
4. Enter Destination Zone and Destination Address.
5. Select Services and Applications.
6. Select Advanced Services under security subscriptions that must be enabled. In this example, IPS is selected.
7. Select the SSL Reverse proxy profile created in the previous step.

Data Center Next-Generation Firewall Solution Validation

The configuration provides advanced security services in data center environment using next-generation firewalls. In this section, we’ll focus on validating the solution that is implemented with this JVD.

Let’s start with the Juniper Security Director Cloud Dashboard, which is the landing page when logged in. The Dashboard page provides a landscape of what is happening in the environment through various readily available widgets.

The Monitor > Logs > Session page provides a snapshot of the traffic flow through the environment. Using Session page, you can filter information based on various options that’s provided on the page.

Table 1: Filter Options

Filter Options	Description
	Use Show advanced filter to search through the logs. All the event fields are used to run through the search.
	Use Group by to sort through the logs based on predefined field. Which is shown in the next screenshots.

All Security Events page provide details on all the security events received from the device.

Threats page focuses only on the threats identified in the environment.

Application Security Validation

Grouped applications provide a view on identified applications from the traffic where the firewall has processed.

Grouping using Nested Applications provides information on the actual applications using the applications that is shown in Figure 49.

IDP Feature Validation

Threats page provides information on the detected IDP attacks in the environment. You can also view the detailed information of the following:

• Source and destination zone
• Source and destination IP addresses
• IDP policy and rule that triggered the detection
• Detected attack and its severity
• Action taken on the detected attack

IDP Detailed Information

SecIntel Feature Validation

SecIntel feeds applied on the firewall policy generates logs when the traffic matches the configured risk level.

Detailed view shows information on the category and SecIntel policy that enforced the action including the source, destination, and corresponding zones.

Advanced Threat Prevention dashboard also provides details on the client that initiated the traffic and the history of when the event occurred.

Advanced Anti-Malware Feature Validation

Configured AAMW policy might result in several logs depending on what protocol is identified. Few key logs provide information on the action enforced by AAMW.

Table 2: Advanced Anti-Malware Logs

Log Information	Description
AAMW_ACTION_LOG	Action taken based on the verdict delivered based on the sandboxing result by Juniper ATP Cloud and defined risk profile on the SRX Series Firewall.
AAMW_HOST_INFECTED_EVENT_LOG	If the verdict found is malicious, the host infected event log is generated.
AAMW_MALWARE_EVENT_LOG	If the verdict as a result of the sandboxing is malicious, the malware event log is generated.

ATP Infected host view provides the following details:

• Indicators of compromise (IOC).
• Static analysis of the identified malicious file.
• Behavior analysis to identify key behaviors based on the assigned threat level to derive how malicious is the identified file.
• Network activity provides details on the malware activity identified during sandboxing.
• Behavior details outline the behavioural steps identified during sandboxing.

DNS Security Feature Validation

DNS security logs are generated based on each DNS security features such as DGA and DNS tunneling, if any identified DNS traffic is found to be malicious appropriate logs are generated.

Table 3: DNS Security Logs

Log Information	Description
SMS_STREAMING	Log is generated for DNS REQ when ‘notification log’ is configured under any detections (dga, tunneling, and all).
SMS_CLEAN_VERDICT	Log is generated when the cloud verdict is ‘clean’ and ‘notification log-detection’ is configured under any detections (dga and all).
SMS_MALICIOUS_VERDICT	Log is generated when the cloud verdict is malicious or tunneling is detected and ‘notification log-detection’ is configured under any detections (dga, tunneling and all).
SMS_FALLBACK_EVENT	Log is generated when the cloud verdict is not received in verdict-timeout interval. Log is generated only when ‘fallback-options notification log’ is configured under any detection (dga, tunneling and all).

Apart from generated logs, you can also view the offense details from Advanced Threat Prevention section, which provides information on the following:

• Client which generated the offense.
• Offense details if its DGA or DNS Tunneling.
• Information on the IOC and exfiltration attempts.

.

Screens Feature Validation

IP Spoofing

SYN Flood—(Apply Source and Destination Limits)

.

Reverse SSL Proxy Validation

Reverse SSL proxy enables to decrypt specific traffic destined to a webserver for subjecting the traffic through advanced security services.

Once applied on a security policy, you’ll notice several logs that might define the action that SSL proxy takes.

Table 4: Reverse SSL Proxy Logs

Log Information	Description
SSL_PROXY_SSL_SESSION_DROP	Log is generated when SSL proxy drop a session.
SSL_PROXY_SSL_SESSION_ALLOW	Log is generated when SSL session is processed by SSL proxy even after encountering minor errors.
SSL_PROXY_SESSION_IGNORE	Log is generated after detection of non-SSL sessions which are initially mistaken as SSL sessions.
SSL_PROXY_SESSION_WHITELIST	Log is generated when a SSL proxy session is whitelisted.
SSL_PROXY_ERROR	Log is generated for reporting errors during SSL proxy.
SSL_PROXY_WARNING	Log is generated for reporting warnings during SSL proxy.
SSL_PROXY_INFO	Log is generated for reporting general information during SSL proxy.