Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configure Web Filtering Profile from Juniper Enhanced to Next-Generation Firewall

Configure the web-filtering engine on SRX series firewalls from Juniper Enhanced to Juniper NextGen (NGWF) through Juniper Security Director Cloud. The configuration requires you to update the default Content Security profile in Security settings to point to a Juniper NextGen web-filtering profile, remove unsupported URL categories from the profile before initial deployment.

Before You Begin:

  • Ensure the SRX firewall has a valid web filtering license, either Juniper Enhanced or Juniper NextGen (recommended).

  • Verify that the firewall is running Junos OS version 23.4R1 or later for Juniper NextGen web filtering compatibility

  • Identify existing Juniper Enhanced configurations in the firewall.

  • Record the current Juniper Enhanced web-filtering settings such as URL categories and the assigned actions, site-reputation settings, fallback behavior and timeout values to replicate in the new Juniper NextGen profile.

  • Ensure the Juniper NextGen profile excludes NextGen specific categories available only after URL category installation. Verify using the following CLI command: show security utm web-filtering category ng-category-list.

  • Changing the default Content Security profile in Security Settings affects all policies or devices using the default configurations. Refer to Create and Manage Device-Specific Profiles for device-specific configurations.

To configure web filtering profile from Juniper Enhanced to NextGen firewall:
  1. Click Security > Security Policies > Security Settings
    The Security Settings page is displayed.
  2. Select the Juniper NextGen profile from the Content Security profile drop-down list under Default Profile, or use the Device-specific Profile to apply different settings for individual devices.
    The engine type for the web filtering profile is now set to Juniper NextGen.
  3. Select Content Security profile under Security Subscription in a Security Policy rules page.
  4. Deploy the security policy to the device.
  5. Click Inventory > Security Packages. Select URL Categories and click Install Security Packages.

    The Install Security Packages page is displayed.

    Click Probe Devices to get the latest license details and security package version installed on the device. To refresh the display information, click the refresh icon.

  6. Select the Juniper NextGen enabled device and install the URL categories.

    You have now migrated from the default Juniper Enhanced web filter engine to Juniper NextGen webfilter engine.

    After installation, you can run the following CLI commands on the SRX Series firewall to verify:

    • Web filtering engine type, device server status: show security utm web-filtering status

    • URL category version: show security utm web-filtering category status

Related Documentation