Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

show security dynamic-address

Syntax

Description

Displays information about dynamic addresses. Each dynamic address belongs to only one instance. Within that instance is a set of categories to which the dynamic address further belongs.

A dynamic address entry provides dynamic IP address information to security policies. A dynamic address entry is a group of IP addresses, not just a single IP prefix, that can be imported in from external sources. These IP addresses are for specific domains or for entities that have a common attribute such as a particular undesired location that poses a threat. The administrator can then configure security policies to use the DAE within a security policy.

Options

none

Display source category (feed) and dynamic address name for all nodes (primary and backup nodes in case of HA.) The same as the show security dynamic-address ip-start 1.0.0.0 ip-end 255.255.255.255 command.

summary

(Optional) Display basic information of dynamic-address including their name, feeds, properties and number of IPv4 and IPv6 entries.

If a Dynamic Address Entry (DAE) contains duplicate IP addresses, the output displays the IP address once, ignoring the duplicate entry.

category-name (category-name)

(Optional) Display the source category (feed) and dynamic address name for the specified threat type (category name). A category is basically a list of feeds of the same type. The type defines SRX Series enforcement point criteria for feed lookup and enforcement. Supported category names are:

  • Blocklist—A list of locations (IP addresses, URLs, etc.) that you do not trust. A blocklist allows everyone access except for the members on the blocklist.

  • CC—A list of known C&C servers that are able to send commands to members of a botnet.

  • GeoIP—A list giving you the ability to filter traffic to and from specific geographies in the world.

  • IPFilter—A list of addresses and ranges of malicious sites that can send junk data.

  • Infected-Hosts—A lists of hosts within your network that may have been compromised and require attention. This list is generated from ATP Cloud based on hosts that have downloaded malware.

  • SecProfiling—A security intelligence category. You configure the security policy or IDP rule to add the source IP or destination IP of the traffic to the secProfiling feed in the cloud. You can also configure the security policy or IDP to match the source IP or destination IP of the traffic against the secProfiling feed in the cloud.

  • Allowlist—A list of locations (IP addresses, URLs, etc.) that you trust. An allowlist denies everyone access except for the members on the allowlist.

family

(Optional) Show the dynamic-address for specified protocol-family. Both IPv4 and IPv6 are displayed if no family is specified. ‘inet’ and ‘inet6’ can be combined with other options of the show command. For example, show security dynamic-address family inet6 ip-start 1111::1 ip-end 3333::3.

feed-name

(Optional) User-defined name of the source feed.

address-name

(Optional) The dynamic address name. If you do not specify an address-name, then information related to all dynamic addresses downloaded to this SRX Series Firewall is displayed.

ip-start

(Optional) The numerical minimum IP address where you want to investigate. Specifying ip-start and optionally ip-end (it is not required to specify ip-end if you use ip-start) is helpful to filter the output to a specific range instead of having to review the entire list which can be very long.

ip-end

(Optional) The numerical maximum IP address where you want to investigate. Specifying ip-start and optionally ip-end is helpful to filter the output to a specific range instead of having to review the entire list which can be very long. If you specify ip-end, you must specify ip-start.

instance (instance-name)

(Optional) The physically separated database. Supported instance names are:

  • advanced-anti-malware—The IP-based allowlists and blocklists.

  • default—The default instance holds the following data: blocklist, allowlist, C&C, infected host, and IPfilter.

  • geoip—The geoip data.

logical-system (logical-system-name | all)

Perform this operation on all logical systems or on a particular logical system.

tenant (tenant-name | all)

Perform this operation on all tenant systems or on a particular tenant system.

Required Privilege Level

View

Output Fields

Table 1 describes the output fields for the show security dynamic-address command. Output fields are listed in the approximate order in which they appear.

Table 1: show security dynamic-address Output Fields

Field Name

Field Description

Address name

Dynamic address entry name.

Address ID

Internal ID used to uniquely identify the dynamic address entry.

IPv4 entries

The number of IPv4 entries in the specific dynamic address.

IPv6 entries

The number of IPv6 entries in the specific dynamic address.

Category/feed

The threat type associated with the dynamic address. See description of category-name and feed-name above.

Country code Two-letter code (alpha-2) ISO 3166 country code in capital ASCII letters; Example" US or CN

Total number of IPv4 entries

The number of IPv4 entries in the database.

Total number of IPv4 entries from feed

The number of IPv4 entries in the feed. An entry in a feed can correspond to multiple entries in the database.

Total number of IPv6 entries

The number of IPv6 entries in the database.

Total number of IPv6 entries from feed

The number of IPv6 entries in the feed. An entry in a feed can correspond to multiple entries in the database.

Instance default

Total number of default matching entries.

Instance geoip

Total number of geoip data matching entries.

Instance advanced-anti-malware

Total number of the IP-based allowlists and blocklists matching entries.

Session-scan

Status of the session scan.

Sample Output

show security dynamic-address summary

show security dynamic-address summary

show security dynamic-address summary

show security dynamic-address (Junos OS Release 23.2R1)

show security dynamic-address summary (Junos OS Release 23.2R1)

show security dynamic-address instance geoip (Junos OS Release 23.2R1)

show security dynamic-address instance advanced-anti-malware

show security dynamic-address instance geoip

show security dynamic-address category-name Infected-Hosts

show security dynamic-address logical-system LSYS1

show security dynamic-address logical-system all

show security dynamic-address tenant TSYS1

show security dynamic-address tenant all

Release Information

Command introduced in Junos OS Release 12.1X46-D25.

Command <family inet | inet6> introduced in Junos OS Release 18.1.

The logical-system and tenant options are introduced in Junos OS Release 18.4R1.