Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Security Policy Rules Overview

Security policy rules define how traffic is inspected, permitted, denied, or redirected as it traverses the network. Each rule specifies match conditions—such as source and destination zones, addresses, applications, and users—and the action the system takes when traffic matches those conditions.

Security policies apply security policy rules to the network traffic within a context, such as the from-zone to the to-zone. The network traffic is classified by matching the security policy rules. Each security policy is associated with these security policy rule characteristics:

Table 1: Security Policy Rule Characteristics
Context Element

Source
  • IP addresses or subnets
  • User or group identities through directory services like Active Directory
  • Source zones, VLANs, or interfaces

Destination
  • IP addresses, FQDNs, or subnets
  • Destination zones or interfaces
  • URL categories or specific URLs

Applications and services
  • Service definitions such as HTTPS, DNS, custom ports
  • Application and application groups such as social media apps

Action and handling
  • Allow, deny, drop, or reset
  • Decrypt and inspect SSL and TLS traffic where permitted
  • Apply IPS and IDS, anti‑malware, sandboxing, or DLP profiles
  • Log traffic with specified log level and log destination

Time and schedule

Policies that apply only during specific times or days

Security posture and QoS
  • Bandwidth limits or QoS marking for certain applications
  • Session limits or connection rate limits

These characteristics are called the match criteria. Each policy also has actions associated with it—permit, deny, reject, count, log, and VPN tunnel. You must specify the match condition arguments when you configure a security policy, source address, destination address, and application name.

Security Policy Rule Types

In Juniper Security Director Cloud, rules are classified into two types—zone-based rules and global rules.

Zone-Based Rules Global Rules

Zone-based rules apply to traffic flowing between a specific source zone and destination zone.

  • Require both source and destination zones to be defined.
  • Used for intra- and inter-zone traffic control.
  • Provide fine-grained segmentation and enforcement.
  • Common for branch-to-date center traffic, trust-to-untrust filtering, and east-west segmentation.

Global rules apply to traffic regardless of zone context.

  • Do not require zone-specific matching.
  • Evaluated as catch-all or overarching rules.
  • Useful for enforcing organization-wide security policies.
  • Common for blocking known malicious applications globally, applying baseline security controls, defining default deny or allow behaviors.

Security Policy Rules Workflow

This workflow shows how to create security policy rules.

Category Task More Information
Select the security policy rule type Determine whether the security policy rule is a zone-based rule or a global rule based on the required enforcement scope. Add and Manage Security Policy Rules
Configure source zones Specify the zones from which traffic originates. Source zones define where the policy is applied.
Configure destination zones Specify the zones to which traffic is directed. Destination zones help determine traffic flow and policy evaluation.
Define source and destination addresses Select address objects, address groups, or any predefined addresses that identify the traffic endpoints.
Specify applications and services

Configure specific applications or application groups to match and control traffic based on application identity.

Specify services, ports, or protocols that the rule should match when evaluating traffic.
Select the rule action Configure the action to take when traffic matches the rule, such as Permit, Reject, Deny, Redirect, or Tunnel.
Attach security profiles Associate IPS, Content Security, SSL Proxy, or other security profiles to inspect and protect permitted traffic.
Configure an optional schedule Apply a schedule to activate the rule only during specified dates or time periods.
Configure logging options Enable session initiation, session closure, or other logging settings to improve visibility and auditing.
Position the rule in the policy Arrange the rule appropriately within the rulebase because security policies are evaluated in order. Reorder a Security Policy Rule
Review rule configuration Verify that zones, addresses, applications, services, actions, and security profiles are configured correctly. —

Security Policy Rules Field Descriptions

You can view and manage security policy rules associated with SRX Series Firewalls. To access this page, click Security > Security Policies and click the security policy rule.

You can filter the security policy rules to get a better understanding of what you want to configure. You can filter security policy rules by fields such as Name, Action, Source Zone, Destination Zone, Applications, Services, and other security policy fields. These filters help you search, review, and audit large policy rule bases.

Table 2: Fields on the Security Policy Rules Page
Field Description

Seq

The order number of the policy.

The security policy lookup is performed in the order that the policies are configured. The first policy that matches the traffic is used.

Hit Count

The number of times a policy is used based on the traffic flow. The hit count is the number of hits since the last reset.

For example, the hit count is useful when you are using a large policy set and want to verify which rules are highly used and which ones are rarely used. If you see that some of the rules are not being used, you can verify that the rules are not being shadowed by another policy.

This helps you manage devices without having to generate traffic manually.

Name

The name of the security policy rule.

Sources

The source endpoint to which a security policy rule applies.

A source endpoint consists of zones, addresses, and identities.

Destinations

The destination endpoint to which a security policy rule applies.

A destination endpoint can be zones, addresses, and URL categories.

Applications/Services

 The applications and services associated with the security policy.

Action

 The action that applies to all traffic that matches the specified criteria.
  • Permit—Devices permit traffic using the type of security authentication applied to the policy.
  • Deny—Devices silently drop all packets for the session and do not send any active control messages such as TCP resets or ICMP unreachable.
  • Reject—Devices send a TCP reset message if the protocol is TCP. Devices send an ICMP reset if the protocols are UDP, ICMP, or any other IP protocol. This option is useful when dealing with trusted resources so that applications do not waste time waiting for timeouts and instead get the active message.

  • Redirect—Devices redirect traffic to the configured redirect URL or display a custom message when HTTP requests are blocked.

  • Tunnel—Devices permit traffic using the type of VPN tunneling options applied to the policy.

Security Subscriptions

The security subscription profiles that are applied to a security policy rule.

  • IPS—The IPS profile to monitor and prevent intrusions.

  • Content Security—The Content Security profile for protection against multiple threat types, such as spam and malware, and control access to unapproved websites and content.

    To choose the Juniper NextGen Content Security profile, your device needs to have Junos OS version 23.3R1 or later.

  • Decrypt profile—The decrypt profile to encrypt and decrypt the SSL connection between the client and the server to obtain granular application information. This profile enables you to apply advanced security subscriptions protection and detect threats.

  • Flow-based AV—The flow-based antivirus profile to scan packets in the payload content for threats in real-time and block the content if a threat is detected.

  • Anti-malware profile—The anti-malware profile to define which files to send to the ATP Cloud for inspection and the action to be taken when malware is detected.

  • SecIntel profile group—The SecIntel profile group to add SecIntel profiles, such as C&C, DNS, and infected hosts.

Options

 The scheduling, logging, and rule options applicable to the security policy rule.

Deploy Status

 The deployment status of the security policy rule.

Related Documentation