Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Enrolling an SRX Series Device without the Juniper ATP Cloud Web Portal

Starting in Junos OS Release 19.3R1, you can use the request services advanced-anti-malware enroll command on the SRX Series to enroll a device to the Juniper ATP Cloud Web Portal. With this command, you do not have to perform any enrollment tasks on the Web Portal itself. All enrollment is done from the CLI on the SRX.

Enrollment establishes a secure connection between the Juniper ATP Cloud cloud server and the SRX Series device. It also performs basic configuration tasks such as:

  • Downloads and installs certificate authorities (CAs) onto your SRX Series device

  • Creates local certificates and enrolls them with the cloud server

  • Establishes a secure connection to the cloud server

Note:

Juniper Advanced Threat Prevention Cloud requires that both your Routing Engine (control plane) and Packet Forwarding Engine (data plane) can connect to the Internet. You do not need to open any ports on the SRX Series device to communicate with the cloud server. However, if you have a device in the middle, such as a firewall, then that device must have ports 80, 8080, and 443 open.

Also note, the SRX Series device must be configured with DNS servers in order to resolve the cloud URL.

Using the device enrollment command on the SRX Series device, request services advanced-anti-malware enroll, you can enroll the device to an existing realm or create a new realm and then enroll to it.

Here is an example configuration that creates a new realm and then enrolls to that realm.

root@host> request services advanced-anti-malware enroll

  1. Enroll the SRX Series device to Juniper ATP Cloud (CLI only):

    user@host> request services advanced-anti-malware enroll

    Please select geographical region from the list:

    1. North America

    2. European Region

    3. Canada

    4. Asia Pacific

    Your choice: 1

  2. Select an existing realm or create a new realm:

    Enroll SRX to:

    1. A new SkyATP security realm (you will be required to create it first)

    2. An existing SkyATP security realm

    If you select option 1 to create a new realm, the steps are as follows:

    • You are going to create a new Sky ATP realm, please provide the required information:

    • Please enter a realm name (This should be a name that is meaningful to your organization. A realm name can only contain alphanumeric characters and the dash symbol. Once a realm is created, it cannot be changed):

      Real name: example-company-a

    • Please enter your company name:

      Company name: Example Company A

    • Please enter your e-mail address. This will be your username for your Sky ATP account:

      Email: me@example-company-a.com

    • Please setup a password for your new Sky ATP account (It must be at least 8 characters long and include both uppercase and lowercase letters, at least one number, at least one special character):

      Password: **********

      Verify: **********

    • Please review the information you have provided:

      Region: North America

      New Realm: example-company-a

      Company name: Example Company A

      Email: me@example-company-a.com

    • Create a new realm with the above information? [yes,no]

      yes

      Device enrolled successfully!

    If you select option 2 to use an existing realm, the steps are as follows:

    Note:

    You must enter a valid username and password for the existing realm as part of the enrollment procedure.

    • Enter the name of the existing realm:

      Please enter a realm name.

      Realm name: example-company-b

    • Please enter your company name:

      Company name: Example Company B

    • Enter your email adddress/username for the realm. This is the email address that was previously created when setting up the realm.

      Please enter your e-mail address. This will be your username for your Sky ATP account:

    • Enter the password for the realm. This is the password that was previously created when setting up the realm.

      Password:********

    • Enroll device to the realm above? [yes,no] yes

      Device enrolled successfully!

You can use the show services advanced-anti-malware status CLI command on your SRX Series device to verify that a connection has been made to the cloud server from the SRX Series device.

Once enrolled, the SRX Series device communicates to the cloud through multiple, persistent connections established over a secure channel (TLS 1.2) and the SRX Series device is authenticated using SSL client certificates.