Expand All close

Contrail Service Orchestration User Guide

play_arrow Administration Portal
- play_arrow Introduction
  - Unified Administration and Customer Portal Overview
  - Administration Portal Overview
  - Logging in to Administration Portal
  - Switching the Tenant Scope
  - Changing the Administration Portal Password
  - Changing the Password on First Login
  - Resetting the Password
  - Setting Password Duration
  - Extending the User Login Session
  - Setting Up the Cloud CPE Centralized Deployment Model with Administration Portal
  - Setting Up the Cloud CPE Distributed Deployment Model with Administration Portal
- play_arrow Managing Objects
  - Creating Objects
  - Modifying an Object
  - Deleting Objects
  - Viewing Object Details
  - Searching for Text in an Object Data Table
  - Sorting Objects
- play_arrow Using the Dashboard
  - About the Administration Portal Dashboard
- play_arrow Monitoring Alerts, Alarms, and Device Events
  - About the Monitor Overview Page
  - Alerts Overview
  - About the Generated Alerts Page
  - About the Alert Definitions Page
  - Creating SD-WAN Alert Definitions
  - Editing and Deleting SD-WAN Alert Definitions
  - About the Alarms Page
  - About the Device Events Page
- play_arrow Monitoring Tenants SLA Performance
  - Multidepartment CPE Device Support
  - About the SLA Performance of All Tenants Page
  - About the SLA Performance of a Single Tenant Page
  - Monitoring Application-Level SLA Performance for real time-optimized SD-WAN
  - Viewing the SLA Performance of a Site
  - Viewing the SLA Performance of an Application or Application Group
  - Understanding SLA Performance Score for Applications, Links, Sites, and Tenants
- play_arrow Monitoring Jobs
  - About the Jobs Page
  - Viewing Job Details
  - Editing and Deleting Scheduled Jobs
  - Retrying a Failed Job on Devices
- play_arrow Managing POPs
  - About the POPs Page
  - Creating a Single POP
  - Importing Data for Multiple POPs
  - Viewing the History of POP Data Imports
  - Viewing the History of POP Data Deletions
  - Managing a Single POP
  - About the VIMs Page
  - Creating a Cloud VIM
  - About the EMS Page
  - Creating an EMS
  - Changing the Junos Space Virtual Appliance Password
  - About the Routers Page
  - Creating Devices
  - Configuring Devices
  - View the History of Device Data Deletions
- play_arrow Managing Devices
  - About the Tenant Devices Page
  - About the Cloud Hub Devices Page
  - Managing a Tenant Device
  - Managing a Cloud Hub Device
  - Device Redundancy Support Overview
  - Viewing the History of Tenant Device Activation Logs
  - Viewing the History of Cloud Hub Device Activation Logs
  - Secure OAM Network Overview
  - Adding a Cloud Hub Device
  - Upgrading a Cloud Hub Device
  - Rebooting a CPE Device
- play_arrow Managing Device Templates
  - Device Template Overview
  - About the Device Template Page
  - Cloning a Device Template
  - Importing a Device Template
  - Configuring a Device Template
  - Modifying a Device Template Description
  - Deleting a Device Template
- play_arrow Managing Software Images
  - Device Images Overview
  - About the Device Images Page
  - Deploying Device Images to Devices
  - Uploading a Device Image
  - Deleting Device Images
- play_arrow Configuring Network Services in a Centralized Deployment
  - Network Services Overview
  - About the Network Services Page
  - About the Service Overview Page
  - About the Service Instances Page
  - Configuring VNF Properties
  - Allocating a Service to Tenants
  - Removing a Service from Tenants
  - Viewing a Service Configuration
  - vSRX VNF Configuration Settings
  - LxCIPtable VNF Configuration Settings
  - Cisco CSR-1000v VNF Configuration Settings
  - Riverbed Steelhead VNF Configuration Settings
  - Managing a Single Service
- play_arrow Configuring Application SLA Profiles
  - Application Quality of Experience (AppQoE) Overview
  - About the Application Traffic Type Profiles Page
  - Creating Traffic Type Profiles
  - Editing and Deleting Traffic Type Profiles
  - SLA Profiles and SD-WAN Policies Overview
  - Cost-Based Link Switching
  - Local Breakout Overview
  - About the Application SLA Profiles Page
  - Creating SLA Profiles
  - Editing and Deleting SLA Profiles
- play_arrow Configuring Application Signatures
  - Application Signatures Overview
  - About the Application Signatures Page
  - Creating Application Signature Groups
  - Editing, Cloning, and Deleting Application Signature Groups
- play_arrow Managing Tenants
  - Tenant Overview
  - Full Mesh Topology Overview
  - About the Tenants Page
  - Adding a Single Tenant
  - Editing Tenant Information
  - Importing Data for Multiple Tenants
  - Allocating Network Services to a Tenant
  - Viewing the History of Imported Tenant Data
  - Viewing the History of Deleted Tenant Data
- play_arrow Managing Operating Companies
  - Operating Companies Overview
  - About the Operating Companies Page
  - Creating Operating Companies
  - Editing and Deleting Operating Companies
- play_arrow Configuring SP Users
  - Role-Based Access Control Overview
  - About the Service Provider Users Page
  - Adding Service Provider Users
  - Editing and Deleting Service Provider Users
  - Resetting the Password for Service Provider and Tenant Users
- play_arrow Managing Audit Logs
  - Audit Logs Overview
  - About the Audit Logs Page
  - Viewing the Details of an Audit Log
  - Exporting Audit Logs
- play_arrow Managing Roles
  - Roles Overview
  - About the Roles Page
  - Adding User-Defined Roles for Service Provider, OpCo, and Tenant Users
  - Editing, Cloning, and Deleting User-Defined Roles for Service Provider, OpCo, and Tenant Users
  - Access Privileges for Role Scopes (Service Provider, Tenant, and Operating Company)
- play_arrow Configuring Authentication
  - Authentication Methods Overview
  - About the Authentication Page
  - Editing the Authentication Method
  - Configuring a Single Sign-On Server
  - Editing and Deleting SSO Servers
  - Configuring SMTP Settings
- play_arrow Configuring Licenses
  - About the License Files Page
  - Uploading a License File
  - Editing and Deleting Licenses
  - Pushing a License to Devices
- play_arrow Customizing the Unified Portal
  - Personalizing the Unified Administration and Customer Portal
- play_arrow Managing Signature Database
  - Signature Database Overview
  - About the Active Database Page
  - Downloading a Signature Database
  - Download Locations for Signature Database
  - Installing Signatures
play_arrow Customer Portal
- play_arrow Introduction
  - Unified Administration and Customer Portal Overview
  - Customer Portal Overview
  - Switching the Tenant Scope
  - Accessing Customer Portal
  - Setting Up Your Network with Customer Portal
  - Changing the Password on First Login
  - Changing the Customer Portal Password
  - Resetting the Password
  - Extending the User Login Session
- play_arrow Using the Dashboard
  - About the Customer Portal Dashboard
- play_arrow Managing Objects
  - Sorting Objects
  - Viewing Object Details
  - Searching for Text in an Object Data Table
- play_arrow Monitoring Security Alerts and Alarms
  - About the Monitor Overview Page
  - Alerts Overview
  - About the Generated Alerts Page
  - About the Alert Definitions Page
  - Managing Security Alerts Definitions
  - Creating Security Alert Definitions
  - Editing, Cloning, and Deleting Security Alert Definitions
  - About the Alarms Page
- play_arrow Monitoring Security and Device Events
  - About the All Security Events Page
  - About the Firewall Events Page
  - About the Web Filtering Events Page
  - About the IPsec VPNs Events Page
  - About the Content Filtering Events Page
  - About the Antispam Events Page
  - About the Antivirus Events Page
  - About the IPS Events Page
  - About the Device Events Page
  - About the Screen Events Page
- play_arrow Monitoring SD-WAN Events
  - SD-WAN Events Overview
  - About the SD-WAN Events Page
- play_arrow Monitoring Applications
  - About the SLA Performance of a Single Tenant Page
  - Viewing the SLA Performance of a Site
  - Viewing the SLA Performance of an Application or Application Group
  - Application Visibility Overview
  - About the Application Visibility Page
  - Selecting Devices
- play_arrow Monitoring Threats
  - About the Threats Map (Live) Page
- play_arrow Monitoring Jobs
  - About the Jobs Page
  - Editing and Deleting Scheduled Jobs
  - Viewing Job Details
  - Retrying a Failed Job on Devices
- play_arrow Managing Devices
  - Multidepartment CPE Device Support
  - About the Devices Page
  - Performing Return Material Authorization (RMA) for a Single-CPE Device
  - Performing Return Material Authorization (RMA) for Dual-CPE Devices
  - Granting RMA for a Device
  - Managing a Single CPE Device
  - Rebooting a CPE Device
- play_arrow Managing Device Images
  - Device Images Overview
  - About the Device Images Page
  - Deleting Device Images
- play_arrow Configuring Network Services in a Distributed Deployment
  - Network Service Overview
  - About the Network Services Page
  - About the Service Overview Page
  - About the Service Instances Page
  - Configuring VNF Properties
  - vSRX VNF Configuration Settings
  - LxCIPtable VNF Configuration Settings
  - Cisco CSR-1000v VNF Configuration Settings
  - Riverbed Steelhead VNF Configuration Settings
- play_arrow Managing Firewall Policies
  - Firewall Policy Overview
  - About the Firewall Policy Page
  - Creating Firewall Policy Intents
  - Editing, Cloning, and Deleting Firewall Policy Intents
  - Selecting Firewall Source
  - Selecting Firewall Destination
  - Firewall Policy Examples
  - Firewall Policy Schedules Overview
  - About the Firewall Policy Schedules Page
  - Creating Schedules
  - Editing, Cloning, and Deleting Schedules
- play_arrow Unified Threat Management
  - UTM Overview
  - Configuring UTM Settings
  - About the UTM Profiles Page
  - Creating UTM Profiles
  - Editing, Cloning, and Deleting UTM Profiles
  - About the Web Filtering Profiles Page
  - Creating Web Filtering Profiles
  - Editing, Cloning, and Deleting Web Filtering Profiles
  - About the Antivirus Profiles Page
  - Creating Antivirus Profiles
  - Editing, Cloning, and Deleting Antivirus Profiles
  - About the Antispam Profiles Page
  - Creating Antispam Profiles
  - Editing, Cloning, and Deleting Antispam Profiles
  - About the Content Filtering Profiles Page
  - Creating Content Filtering Profiles
  - Editing, Cloning, and Deleting Content Filtering Profiles
  - About the URL Patterns Page
  - Creating URL Patterns
  - Editing, Cloning, and Deleting URL Patterns
  - About the URL Categories Page
  - Creating URL Categories
  - Editing, Cloning, and Deleting URL Categories
- play_arrow Managing SD-WAN
  - SLA Profiles and SD-WAN Policies Overview
  - About the SD-WAN Policy Page
  - Creating SD-WAN Policy Intents
  - Editing and Deleting SD-WAN Policy Intents
  - About the Application SLA Profiles Page
  - Creating SLA Profiles
  - Editing and Deleting SLA Profiles
- play_arrow Managing NAT Policies
  - NAT Policies Overview
  - About the NAT Policies Page
  - Creating NAT Policies
  - Editing and Deleting NAT Policies
  - About the Single NAT Policy Page
  - Creating NAT Policy Rules
  - Editing, Cloning, and Deleting NAT Policy Rules
  - Deploying NAT Policy Rules
  - Selecting NAT Source
  - Selecting NAT Destination
  - NAT Pools Overview
  - About the NAT Pools Page
  - Creating NAT Pools
  - Editing, Cloning, and Deleting NAT Pools
- play_arrow Managing SSL Proxies
  - SSL Forward Proxy Overview
  - About the SSL Proxy Policy Page
  - Creating SSL Proxy Policy Intents
  - Editing, Cloning, and Deleting SSL Proxy Policy Intents
  - Understanding How SSL Proxy Policy Intents Are Applied
  - About the SSL Proxy Profiles Page
  - Creating SSL Forward Proxy Profiles
  - Editing, Cloning, and Deleting SSL Forward Proxy Profiles
  - Configuring and Deploying an SSL Forward Proxy Policy
- play_arrow Managing Shared Objects
  - Addresses and Address Groups Overview
  - About the Addresses Page
  - Creating Addresses or Address Groups
  - Editing, Cloning, and Deleting Addresses and Address Groups
  - Services and Service Groups Overview
  - About the Services Page
  - Creating Services and Service Groups
  - Creating Protocols
  - Editing and Deleting Protocols
  - Editing, Cloning, and Deleting Services and Service Groups
  - Application Signatures Overview
  - About the Application Signatures Page
  - Creating Application Signature Groups
  - Editing, Cloning, and Deleting Application Signature Groups
  - About the Departments Page
  - Creating a Department
  - Modifying a Department
  - Deleting a Department
- play_arrow Managing Deployments
  - Deploying Policies Overview
  - About the Deployments Page
  - Using the Deployment Icon to Deploy Policies
  - Deploying Policies
- play_arrow Managing Sites
  - About the Sites Page
  - Local Breakout Overview
  - Multihoming Overview
  - Device Redundancy Support Overview
  - Upgrading Sites Overview
  - Creating Spoke Sites for Hybrid WAN Deployment
  - Creating Local Service Edge Sites for Hybrid WAN Deployment
  - Creating Regional Service Edge Sites for Hybrid WAN Deployment
  - Creating On-Premise Hub Sites for SD-WAN Deployment
  - Creating On-Premise Spoke Sites for SD-WAN Deployment
  - Creating Cloud Hub Sites for SD-WAN Deployment
  - Creating Cloud Spoke Sites for SD-WAN Deployment
  - Provisioning a Cloud Spoke Site in AWS VPC
  - Importing Multiple Sites
  - Managing a Single Site
  - Configuring a Single Site
  - Upgrading Sites
  - Managing LAN Segments on a Tenant Site
  - Activating a CPE Device
  - Activating Dual CPE Devices (Device Redundancy)
  - Viewing the History of Tenant Device Activation Logs
  - Configuring VRFs and PNE Details for a Site in a Centralized Deployment
- play_arrow Managing Site Groups
  - About the Site Groups Page
  - Creating Site Groups
- play_arrow Security Reports
  - Reports Overview
  - About the Security Report Definitions Page
  - Performing Different Actions on Reports
  - About the Security Generated Reports Page
  - Creating Log Report Definition
  - Creating Bandwidth Report Definition
  - Editing and Deleting Log Report Definitions
  - Editing and Deleting Bandwidth Report Definitions
- play_arrow SD-WAN Reports
  - About the SD-WAN Report Definitions Page
  - Editing and Deleting SD-WAN Report Definitions
  - Creating SD-WAN Tenant Performance Report Definition
  - Creating SD-WAN Site Performance Report Definition
  - About the SD-WAN Generated Reports Page
- play_arrow Managing Tenant Users
  - Role-Based Access Control Overview
  - About the Tenant Users Page
  - Adding Tenant Users
  - Editing and Deleting Tenant Users
  - Resetting the Password for Tenant Users
- play_arrow Managing Audit Logs
  - Audit Logs Overview
  - About the Audit Logs Page
  - Viewing the Details of an Audit Log
  - Exporting Audit Logs
- play_arrow Managing Tenant User Roles
  - Roles Overview
  - About the Tenant Roles Page
  - Adding User-Defined Roles for Tenant Users
  - Editing, Cloning, and Deleting User-Defined Roles for Tenant Users
  - Access Privileges for Role Scopes (Service Provider, Tenant, and Operating Company)
- play_arrow Licenses
  - About the Licenses Page
- play_arrow Signature Database
  - Signature Database Overview
  - About the Active Database Page
  - Installing Signatures
- play_arrow Managing Certificates
  - Certificates Overview
  - About the Certificates Page
  - Importing a Certificate
  - Installing and Uninstalling Certificates
  - About the VPN Authentication Page
- play_arrow Managing Juniper Identity Management Service
  - Juniper Identity Management Service Overview
  - About the Identity Management Page
  - Configuring CSO and JIMS Connection
  - Configuring JIMS for an SRX Device
play_arrow Designer Tools
play_arrow Downloads
- Download this guide: User Guide

list Table of Contents

PDF

English

Understanding How SSL Proxy Policy Intents Are Applied

date_range 19-Dec-17

arrow_backward

arrow_forward

When you deploy an SSL proxy policy, SSL proxy profiles are deployed to the applicable sites based on SSL proxy policy intents. The deployments of firewall and SSL polices are related in that firewall policy deployments take into account the last-deployed SSL snapshots and vice versa. Therefore, even if an SSL proxy profile is deployed to the applicable sites, it is applied only to traffic to which the firewall policy intent applies.

The decision regarding which SSL proxy profile is attached to a firewall policy intent is based on matching criteria between SSL proxy policy and firewall policy intents. In addition, if there is a match between the SSL proxy policy intent and the firewall policy intent, the SSL profile is applied only to the policy intents that are common between the firewall and the SSL proxy policies.

The following examples demonstrate the matching logic between SSL proxy policy and firewall policy intents.

Example 1: Firewall Policy Intent and SSL Proxy Policy Intent Match

Table 1 shows an example of a firewall policy intent and an SSL proxy policy intent that match, which means that the SSL proxy profile attaches to the firewall policy intent. In this case, the firewall policy intent has a source and destination of Any IP address, which signifies traffic from any IP address from any site to any IP address on the Internet. The SSL proxy policy intent has a source of Any IP address, which signifies any IP address from any site, and a destination IP address of 198.51.100.0.

Therefore, there is a match between the firewall policy intent and the SSL proxy policy intent and the SSL proxy profile is applied only to traffic from any IP address of any site to the IP address 198.51.100.0.

Table 1: (Example) Match Between Firewall Policy Intent and SSL Proxy Policy Intent

Type	Source	Destination	Action or Profile
Firewall policy intent	IP address—Any	IP address—Any	Allow
SSL proxy policy intent	IP address—Any	IP address—198.51.100.0	SSL-Profile-1

Example 2: Firewall Policy Intent and SSL Proxy Policy Intent Do Not Match

Table 2 shows an example of a firewall policy intent and an SSL proxy policy intent that do not match, which means that the SSL proxy profiles do not attach.

Although, at first glance, it appears that an SSL proxy policy intent with a source and destination IP address Any should match a firewall policy intent with a source IP address Any and destination department Finance, this is not the case because of what the IP address Any signifies in the destination.

For both firewall and SSL proxy policy intents:

A source IP address value of Any signifies any IP address from any site.
A destination IP address value of Any signifies traffic going to the Internet—that is, to any IP address on the Internet. Traffic within sites (internal traffic) is not covered by the destination IP address value of Any.

In this example, the firewall policy intent applies to traffic from any IP address (from any site) to the Finance department. However, the SSL proxy policy intent applies to traffic from any IP address (from any site) to any IP address on the Internet. This means that there is no match between the firewall policy intent and the SSL proxy policy intent and the SSL proxy profile does not attach.

Table 2: (Example) No Match Between Firewall Policy Intent and SSL Proxy Policy Intent

Type	Source	Destination	Action or Profile
Firewall policy intent	IP address—Any	Department—Finance	Allow
SSL proxy policy intent	IP address—Any	IP address—Any	SSL-Profile-2

Example 3: Applying SSL Proxy Policy Intents on Internal (Site-to-Site) Traffic

Note

SSL forward proxy typically might not be used for site-to-site traffic, but this example is provided as an explanation of how an SSL proxy policy intent applies to site-to-site traffic.

Consider a scenario in which you have three sites (A, B, C) and you want to configure an SSL proxy for traffic between the sites. Table 3 displays the firewall policy and SSL proxy policy intents that you can use for such a scenario.

Both the firewall policy intent and the SSL proxy policy intent use Site A, Site B, and Site C as the source and destination. Therefore, the firewall policy intent and the SSL proxy policy intent match, and the SSL proxy profile attaches to the firewall policy intent.

Note

The destination must be Site A, Site B, and Site C because the destination IP address Any signifies any IP address on the Internet.

Table 3: (Example) Firewall Policy and SSL Proxy Policy Intents for Site-to-Site Traffic

Type	Source	Destination	Action or Profile
Firewall Policy Intent	Site A, Site B, Site C	Site A, Site B, Site C	Allow
SSL Proxy Policy Intent	Site A, Site B, Site C	Site A, Site B, Site C	SSL-Profile-3