Data Center Edge Firewall Use Case

Stateful Firewall

Stateful firewall configuration on these firewalls involves defining security zones, policies, and enabling flow-based processing. Here's a foundational CLI example for a data center edge setup with trust and untrust zones:

Security Zones and Policies

The SRX1600, SRX4120, and SRX4300 Firewalls ship with a factory-default configuration that includes two security zones (trust and untrust), a default outbound permit policy from trust to untrust, and source NAT configured on the trust zone.

• Security Zone
• Define Security Policies Between Zones

NAT

Source NAT allows internal servers (192.168.1.0/24) to access the Internet using the firewall’s public IP address. Use destination NAT when you want to expose internal or DMZ-hosted servers to the Internet (for example, a webserver).

• Use the firewall between private data center networks and the router.
• NAT ensures private IP addresses remain hidden and routable only internally.

Advanced Layer 7 Security Features

• IDP or IPS—The intrusion prevention system (IPS) on the SRX1600, SRX4120, and SRX4300 Firewalls, which is part of Junos OS security services, detects and prevents network attacks by inspecting traffic against signature databases, anomaly detection, and custom rules. Enable IPS in the security policy and then in actions. The configuration supports Layer 7 signature updates.

  • IDP security packages require dedicated security commands, not the general request system software add which is for Junos OS, firmware, or other system packages.

    • Download—Use the request security idp security-package download command to download the package.

    • Install—Use the request security idp security-package install command to install it.

    • Verify—Use the request security idp security-package install status command to verify the installation status.

  • Configure IDP policy (create a basic rulebase).

  • To configure match attacks predefined-attacks in an IDP policy on your firewall, use the predefined-attacks and predefined-attack-groups statements under the rulebase-ips match conditions.

    Basic Configuration Syntax

    Example: Matching Specific Predefined Attacks

    • Predefined attacks are included in the IDP signature database, which is regularly updated with new attack signatures and threat patterns.

    • Use ordered match for compound attacks requiring specific sequence.

    • Activate the policy after configuration using the set security idp active-policy <policy-name> command.

    • View available predefined attack signatures or groups using the [edit security idp idp-policy] command.

    • Requires IDP license and signature package installation

  • Commit and verify the configurations:

• HPE Networking ATP Cloud/ICAP: HPE Networking ATP Cloud integrates with SRX1600, SRX4120, and SRX4300 Firewalls to provide advanced malware detection and threat analysis at the data center edge. Use the HPE Networking ATP Cloud op script for automated enrollment, certificates, and connection setup.

  Prerequisites

  • Internet access from Routing Engine (control plane) and Packet Forwarding Engine (data plane).
  • Licenses for HPE Networking ATP Cloud using HPE Networking Security Director or the Junos OS CLI.
  • Onboard your firewall using HPE Networking Security Director Cloud or SZTP for simplified setup.

  1. Certificates and SSL profiles:

  2. Advanced anti-malware (AAMW) policy:

  3. HPE Networking Security Director Cloud integration: Enroll devices automatically and manage HPE Networking ATP Cloud settings through the portal (CLI not required post-enrollment).

  4. SSL proxy (Layer 7 decryption): For encrypted traffic inspection, use:

     1. SSL Proxy Profile Configuration:

     2. Apply to security policies:

For more information, see Juniper ATP Cloud Administrator Guide.

Multinode High Availability (MNHA)

Deploy dual SRX1600, SRX4120, or SRX4300 Firewalls with MNHA to ensure:

• High availability through failover

• Redundant control and data planes

• Continuous traffic flows during maintenance activities or device failures

Data center edge redundancy is critical because a firewall failure must not disrupt business operations.

Configure MNHA on both nodes. Use configuration groups for scalability if needed.

1. Enable configuration synchronization for shared MNHA configuration using Junos configuration groups:

   Verify your configuration using the following commands:

   • show system commit: Check sync status and history.
   • show system commit peers: List configured peers.
   • show | compare: View pending changes before sync.

2. Services Redundancy Groups (SRGs) are failover units in MNHA to manage security services. The services include IPsec VPN, NAT, and firewall policies in active/active (SRG0) or active/backup (SRG1+) modes. SRG0 provides stateful synchronization for L4 through L7 services (excluding IPsec VPN) in active/active mode. SRG1+ manages IPsec and virtual IPs with monitoring and failover options. Configure SRGs using a basic L3 MNHA example:

   1. Configure either node in a dual SRX1600, SRX4120, or SRX4300 Firewall deployment after enabling MNHA. Use configuration groups to synchronize settings between nodes, and apply changes using the commit peers and commit synchronize commands.

   2. SRG1 (data plane services, active/active with signal routes):
   3. SRG0 (control plane, active/backup):

   4. Integrate with zones, policies, NAT, and IPsec:

      • Assign interfaces and security zones.
      • Apply identical security policies, NAT rules, and IPsec configurations on both nodes.
      • Allow IKE/SSH on ICL zone for encryption/sync.

      • In L3 (Route Mode) deployments, use active/backup signal routes (install-on-failure-route) and optional BGP/static routes to direct traffic toward the active node.

      • Create a dedicated virtual router for signal routes. Active/backup signal routes are used in L3 (Route Mode) deployments to indicate node availability and influence routing decisions. These routes do not require virtual IP addresses unless the deployment uses Hybrid Mode.

3. Interfaces and zones (example for ICL and revenue ports): Assign revenue interfaces to security zones. For interchassis links (ICL), use Gigabit Ethernet (GbE) ports in a routing instance for segmentation.

   Note: The SRX1600 Firewall does not support the xe-0/0/0 interface.
4. Monitoring and failover options (SRG1) include; Activeness probing, BFD, and IP/interface monitoring:
5. Verify and commit:

For more information, see Multinode High Availability.

CGNAT for MNHA

To configure carrier-grade NAT (CGNAT) on your firewall, use the standard Junos OS NAT configuration hierarchy under [edit security nat]

1. Create a source NAT Pool:

2. Configure source NAT rule set:

3. Create security policies:

Verify your configuration using the show security nat source rule all, show security nat source pool, and show services carrier-nat statistics commands.

Zero Trust Security

The SRX1600, SRX4120, and SRX4300 Firewalls support built-in zero trust capabilities and microsegmentations. Integration with advanced security architectures enables granular policy enforcement and proactive threat prevention across enterprise networks and data centers.

Key features include:

• Trusted Platform Module (TPM) 2.0 and cryptographically signed IEEE 802.1AR device identification (DevID) for device trust and anti-spoofing.

• RFC-compliant secure zero-touch provisioning (SZTP) for secure, remote deployment.

• Wire-speed MACsec on supported interfaces to provide data integrity and confidentiality.

• AI-Predictive Threat Prevention using machine learning for custom signatures, line-rate anti-malware, and protection against known and zero-day threats.
• Integration with HPE Networking ATP Cloud for advanced threat mitigation, including zero-day detection without breaking encryption.

These features enable zero trust by verifying every connection, enforcing policies that follow users, devices, and applications providing network-wide visibility.

For more information, see Juniper Zero Trust Data Center Solution Brief.