Security Policies
Learn about security policy behavior on SRX1600, SRX4120, and SRX4300 Firewalls, including policy configuration synchronization, feed server support for dynamic address groups (DAGs), and supported policy and object counts.
Security policies control traffic flow between zones by matching traffic based on source IP address, destination IP address, application type, and services, and applying an action such as permit or deny. The firewall evaluates policies based on the source zone and destination zone and processes the policies sequentially until a policy matches the traffic.
set security policies from-zone trust to-zone untrust policy permit-all match source-address any set security policies from-zone trust to-zone untrust policy permit-all match destination-address any set security policies from-zone trust to-zone untrust policy permit-all match application any set security policies from-zone trust to-zone untrust policy permit-all then permit
Security Policy Configuration Synchronization Behavior
The SRX1600, SRX4120, and SRX4300 Firewalls use file-based serialization to propagate security policy changes from the Routing Engine to the Packet Forwarding Engine.
-
The firewall serializes the effective policy configuration into files.
-
These files are sent to the Packet Forwarding Engine in a controlled manner.
-
The Packet Forwarding Engine applies the policy snapshot as a unified unit.
-
The firewall automatically deletes the serialized files after successful application.
By default, the firewall enables this behavior, which reduces the risk of policy mismatches and improves reliability during simultaneous policy changes.
SRX4120 Firewall also supports lookup-intact-on-commit behavior. You must
explicitly configure this option as follows:
set security policies lookup-intact-on-commit
After you commit this configuration, the system restarts the forwarding plane to activate the functionality. Once active, committing policy changes results in the following:
-
The system maintains existing flows based on the policy decision matched before the commit.
-
The system applies the updated policy set to new flows.
-
Existing sessions remain intact despite policy additions, deletions, reordering, or match-condition changes.
Before you enable lookup-intact-on-commit, verify the current status using the show
security policies lookup-intact-on-commit command.
Feed Server Configuration and Support
The SRX1600, SRX4120, and SRX4300 Firewalls support dynamic address groups (DAGs) using feed servers. These firewalls support the same basic feed server behavior:
-
Periodic downloads from HTTP/HTTPS sources.
-
Mapping downloaded prefixes to dynamic address objects.
-
Using dynamic address objects in security policies and NAT rules.
You configure a feed-server at the [edit security
dynamic-address] hierarchy to periodically download IPv4 and IPv6 prefixes from
external sources. The device maps these prefixes to dynamic address objects that you can use
in security policies.
Security Policy and Object Scale
| Platform | Maximum Number of Security Policies | Maximum Policy Contexts |
|---|---|---|
| SRX1600 | 8000 | 2048 |
| SRX4120 | 40000 | 4096 |
| SRX4300 | 40000 | 4096 |
Policy Object Type and Supported Numbers
The SRX1600, SRX4120, and SRX4300 Firewalls share the same maximum values for address objects, applications, and policy counts, enabling you to design a common policy model across these firewalls without adjusting object or policy scale per firewall.
| Policy Object Type | Supported Numbers (SRX1600, SRX4120, and SRX4300) |
|---|---|
| Address objects per policy | 16384 |
| Max applications per policy | 3072 |
| Security policies (total) | 100000 |
| Policy contexts (zone pairs) | 8192 |
| Policies per context | 100000 |
| Policies with counting enabled | 1024 |
The following table shows the maximum number of address and application objects supported per firewall.
| Platform | Maximum Source Address Objects | Maximum Destination Address Objects | Maximum Application Objects |
|---|---|---|---|
| SRX1600 | 8000 | 8000 | 1024 |
| SRX4120 | 40000 | 40000 | 8000 |
| SRX4300 | 40000 | 40000 | 8000 |
These firewalls provide the following capabilities:
-
Support reusing identical address and application objects across multiple policies.
-
Apply consistent global limits to the total number of objects, irrespective of the number of policies created.
-
Support dynamic address objects associated with feed server–based IP lists.