Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Configure Networks for SRX Series Firewalls

Networks are sources of the request in your Juniper WAN Assurance design. On the Juniper® SRX Series Firewall, networks create Address books used as the source for Security Policies and Advanced Policy Based Routing (APBR) Policies.

Networks enable you to define groups of users. In a WAN design, you need to identify the sources accessing your applications over the LAN segment and set up the users. Users are source addresses, which you can use later in the application policies.

Once you have created networks in the Juniper Mist™ cloud portal, you can use networks across the entire organization in the portal. WAN Assurance design uses networks as the source in the application policy.

To configure networks:

  1. In the Juniper Mist cloud portal, click Organization > WAN > Networks.
    A list of existing networks, if any, appears.
  2. Click Add Networks in the upper right corner.
    The Add Network window appears. Table 1 summarizes the options you can set in a network.
    Table 1: Network Options
    Fields Description
    Name Enter a unique name for the network. The name can contain alphanumeric characters, underscores, and hyphens, and must be less than 32 characters long.
    Subnet IP Address Enter the network IP address. You can either use absolute values (example: or use variables (example:{{SPOKE_LAN1_PFX}}.0 ).
    Prefix Length Enter the length of the address prefix, from 0 through 32. You can also use variables for prefix length. Example: {{PFX1}}

    (Optional) Enter the VLAN ID that is associated with the network.

    If your device is using an untagged interface, you should use 1 as the VLAN ID instead of the variable.
    Source NAT Pool Prefix

    (Optional) Enter IPv4 prefix for source NAT. Source NAT translates the source IP address of the traffic (which is a private IP address), to a public IP address.

    Access to Mist Cloud

    Check the option to allow services on SRX Series Firewalls to access the Juniper Mist cloud.

    Advertised via Overlay

    Check the option to advertise the network to the hub devices through the overlay tunnels. This option announces the network through iBGP. The IP Address and Prefix Length fields below the option are filled in automatically.


    (Optional) Additional networks or users. Example: remote networks or users connected to the main network.

    Click the Add User option and

    enter the Name and IP Prefix of the additional user.

    Static NAT

    (Optional) Perform a one-to-one static mapping of the original private host source address to a public source address.

    Destination NAT

    (Optional) Translate the destination IP address of a packet.

  3. Complete the configuration according to the details available in Table 2.
    In this task, you use the variables for both the subnet IP address and prefix length fields to configure three networks: SPOKE-LAN1, HUB1-LAN1, and HUB2-LAN1.
    Table 2: Network Configuration Example
    Fields Network 1 Network 2 Network 3
    Subnet IP Address {{SPOKE_LAN1_PFX}}.0 {{HUB1_LAN1_PFX}}.0 {{HUB2_LAN1_PFX}}.0
    Prefix Length 24 24 24
    Access to Mist Cloud Checked Checked Checked
    Advertised via Overlay Checked Checked Checked
    • Name=All
    • IP-Prefixes=
    - -

    The user "All" with IP prefix serves as a wildcard for all the future LAN segments in the range. The SRX Series Firewall in hubs can use the same username (All) and IP prefix ( to identify all spoke LAN interfaces using a single rule.


    When you use variables, do not assume that the system imports all LAN segments on the hub site automatically. Sometimes, the system may apply an Any netmask, which has a wide scope and may generate security issues.

  4. Click Add.

    Figure 1 shows the list of newly created networks.

    Figure 1: Networks Summary Networks Summary

Site Variables

You can configure the site variables on a per-site basis. Site variables allow you to use the same network definition with different values for each site without having to define multiple networks. Variables have the format {{variable_name}}. Defining networks with variables is common practice in WAN edge template configuration.

Tip: When working on configuration screens, look for the VAR indicators. Fields with this indicator allow site variables.

The fields with this label also display the matching variables (if configured) as you start typing a specific variable in it. This field lists variables from all sites within the organization.

The organization-wide list of variables can be viewed using GET /api/v1/orgs/:org_id/vars/search?var=*. This list is populated as variables are added under site settings.

Figure 2 shows two samples of configuring a network using absolute values and site variables.

Figure 2: Configuring Networks with Absolute Values and Variables Configuring Networks with Absolute Values and Variables

You can define the site variables in the Organization > Admin> Site Configuration pane.

Figure 3: Site Variables Settings Pane Site Variables Settings Pane

This task uses variables for the VLAN ID and subnet IP address. Site variables that contain the first three octets substitute the subnet IP address variable values as shown in Figure 4.

Figure 4: Site Variables Displayed on the Site Configuration Page Site Variables Displayed on the Site Configuration Page