- play_arrow Set Up
- play_arrow Juniper Advanced Threat Prevention Cloud Overview
- play_arrow Enroll SRX Series Firewalls to Juniper Advanced Threat Prevention Cloud
- play_arrow Configure Security Policies on SRX Series Firewall
- play_arrow Configure SRX Series Firewall
- Configure the SRX Series Firewall to Block Outbound Requests to a C&C Host
- Configure the SRX Series Firewall to Block Infected Hosts
- Configure Reverse Proxy on the SRX Series Firewall
- Configure the IMAP Emails Policy on the SRX Series Firewall
- Configure the SMTP Emails Policy on the SRX Series Firewall
-
- play_arrow Configuration Statements and Operational Commands
- play_arrow SRX Series Firewall Commands to Configure Juniper ATP Cloud
-
- play_arrow Use Cases
- play_arrow SecIntel Feeds for MX Series Routers
- play_arrow Amazon Web Services GuardDuty with vSRX Virtual Firewall
- play_arrow Juniper ATP Cloud with Policy Enforcer
-
- play_arrow Troubleshoot
- Juniper Advanced Threat Prevention Cloud Troubleshooting Overview
- Troubleshooting Juniper Advanced Threat Prevention Cloud: Checking DNS and Routing Configurations
- Troubleshooting Juniper Advanced Threat Prevention Cloud: Checking Certificates
- Troubleshooting Juniper Advanced Threat Prevention Cloud: Checking the Routing Engine Status
- Troubleshooting Juniper Advanced Threat Prevention Cloud: Checking the application-identification License
- Viewing Juniper Advanced Threat Prevention Cloud System Log Messages
- Configure traceoptions
- Viewing the traceoptions Log File
- Turning Off traceoptions
- Juniper Advanced Threat Prevention Cloud Dashboard Reports Not Displaying
- Juniper Advanced Threat Prevention Cloud RMA Process
- play_arrow More Documentation
- play_arrow Additional Documentation on Juniper.net
-
ON THIS PAGE
Configure Flow-Based Antivirus Policy
Overview
Let’s take a look at a typical enterprise network. An end user unknowingly visits a compromised website and downloads a malicious content. This action results in compromise of the endpoint. The harmful content on the endpoint also becomes a threat to other hosts within the network. It is important to prevent the download of the malicious content.
You can use an SRX Series Firewall with flow-based antivirus to protect users from virus attacks and to prevent the spread of malware in your network. The flow-based antivirus scans network traffic for viruses, trojans, rootkits, and other types of malicious code and blocks the malicious content immediately when detected.
The following configuration creates a flow-based antivirus policy with the following properties:
Firewall policy name is fw-av-policy.
Flow antivirus policy is av-policy.
Block any file if its returned verdict is greater than or equal to 7 and create a log entry.
When there is an error condition, allow files to be downloaded and create a log entry.
Requirements
Before you begin
Configure security zones and security policies. For more information, see Example: Creating Security Zones in Security Policies User Guide for Security Devices.
Verify that you have a Juniper antivirus license. For more information about how to verify licenses on your device, see Software Licenses for SRX Series Firewalls. A sample license information is given below:
content_copy zoom_out_mapLicense identifier: JUNOSXXXXXXXX License version: 4 Valid for device: XXXXXXXXXXXX Features: Juniper AV - Juniper Anti-virus Scan Engine date-based, 2022-10-23 17:00:00 PDT - 2022-11-23 16:00:00 PST
The CDN server must be reachable from the SRX Series Firewall. For releases prior to Junos OS 24.2.0, the Juniper content delivery network (CDN) server must be https://signatures.juniper.net/phase. From Junos OS Release 24.2.0 onwards, the CDN server is https://signatures.juniper.net/.
SRX Series Firewall with Junos OS Release 23.4R1 or later.
Configuration
Step-by-Step Procedure
The following configuration requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.
Create the antivirus policy and block any file if its returned verdict is greater than or equal to 7.
content_copy zoom_out_mapset services anti-virus policy av-policy action block set services anti-virus policy av-policy default-notification log set services anti-virus policy av-policy fallback-options notification log set services anti-virus policy av-policy http-client-notify message "test message for anti-virus flow" set services anti-virus policy av-policy notification log set services anti-virus policy av-policy verdict-threshold 7
- By default, the latest antivirus signature pack is automatically downloaded
from the Juniper Networks content delivery network (CDN) server to your
firewall device every five minutes. You can manually update the virus
signature database by specifying the URL of the CDN
server.You can also customize the setting by using thecontent_copy zoom_out_map
set services anti-virus update url https://signatures.juniper.net/
set services anti-virus update automatic interval <5...60>command. Configure the firewall policy and apply the antivirus policy.
content_copy zoom_out_mapset security policies from-zone trust to-zone untrust policy fw-av-policy match source-address any set security policies from-zone trust to-zone untrust policy fw-av-policy match destination-address any set security policies from-zone trust to-zone untrust policy fw-av-policy match application any set security policies from-zone trust to-zone untrust policy fw-av-policy match dynamic-application any set security policies from-zone trust to-zone untrust policy fw-av-policy then permit application-services anti-virus-policy av-policy
Commit the configuration.
content_copy zoom_out_mapcommit
Results
From configuration mode, confirm your configuration by entering the show
services anti-virus policy av-policy and show configuration
|display set commands. If the output does not display the intended
configuration, repeat the configuration instructions to correct it.
Check the results of the configuration:
show services anti-virus
update {
url https://signatures.juniper.net/;
}
policy av-policy {
action block;
default-notification {
log;
}
fallback-options {
notification {
log;
}
}
http-client-notify {
message "test message for anti-virus flow";
}
notification {
log;
}
verdict-threshold 7;
}
show security policies from-zone trust to-zone untrust
policy fw-av-policy {
match {
source-address any;
destination-address any;
application any;
dynamic-application any;
}
then {
permit {
application-services {
anti-virus-policy av-policy;
}
}
}
}
Verification
To verify the configuration is working properly, use the following steps:
Obtaining Information About the Current Antivirus Statistics
Purpose
After some traffic has passed through your SRX Series Firewall, check the statistics to see how many sessions were permitted, blocked, and so on according to your profile and policy settings.
Action
From operational mode, enter the show services anti-virus
statistics command.
Sample Output
show services anti-virus statistics
show services anti-virus statistics
Anti-virus scan statistics:
Virus DB type: anti-virus
Total signatures: 11
Anti-virus DB version: 1654594666
Anti-virus DB update time: 2022-08-25 13:03:58 PDT
Total HTTP HTTPS SMTP SMTPS IMAP IMAPS SMB
File scanned: 419382 81947 177549 16067 31591 15994 31925 64309
Virus found: 290713 1613 161485 15940 31591 15994 31925 32165
Virus blocked: 290713 1613 161485 15940 31591 15994 31925 32165
Virus permitted: 0 0 0 0 0 0 0 0
Meaning
Shows statistics on viruses scanned, identified and blocked or permitted.
