Content Security
Syntax
utm {
application-proxy {
traceoptions {
flag flag;
}
}
custom-objects {
custom-url-category object-name {
value [value];
}
filename-extension object-name {
value [value];
}
mime-pattern object-name {
value [value];
}
protocol-command object-name {
value [value];
}
url-pattern object-name {
value [value];
}
}
feature-profile {
anti-spam {
address-blacklist list-name;
address-whitelist list-name;
sbl {
profile profile-name {
custom-tag-string [string];
(sbl-default-server | no-sbl-default-server);
spam-action (block | tag-header | tag-subject);
}
}
traceoptions {
flag flag;
}
}
anti-virus {
juniper-express-engine {
pattern-update {
email-notify {
admin-email email-address;
custom-message message;
custom-message-subject message-subject;
}
interval value;
no-autoupdate;
proxy {
password password-string;
port port-number;
server address-or-url;
username name;
}
url url;
}
profile profile-name {
fallback-options {
content-size (block | log-and-permit);
default (block | log-and-permit);
engine-not-ready (block | log-and-permit);
out-of-resources (block | (log-and-permit);
timeout (block | log-and-permit);
too-many-requests (block | log-and-permit);
}
notification-options {
fallback-block {
administrator-email email-address;
allow-email;
custom-message message;
custom-message-subject message-subject;
display-host;
(notify-mail-sender | no-notify-mail-sender);
type (message | protocol-only);
}
fallback-non-block {
custom-message message;
custom-message-subject message-subject;
(notify-mail-recipient | no-notify-mail-recipient);
}
virus-detection {
custom-message message;
custom-message-subject message-subject;
(notify-mail-sender | no-notify-mail-sender);
type (message | protocol-only);
}
}
scan-options {
content-size-limit value;
(intelligent-prescreening | no-intelligent-prescreening);
timeout value;
}
trickling {
timeout value;
}
}
}
kaspersky-lab-engine {
pattern-update {
email-notify {
admin-email email-address;
custom-message message;
custom-message-subject message-subject;
}
interval value;
no-autoupdate;
proxy {
password password-string;
port port-number;
server address-or-url;
username name;
}
url url;
}
profile profile-name {
fallback-options {
content-size (block | log-and-permit);
corrupt-file (block | log-and-permit);
decompress-layer (block | log-and-permit);
default (block | log-and-permit);
engine-not-ready (block | log-and-permit);
out-of-resources (block | (log-and-permit);
password-file (block | (log-and-permit);
timeout (block | log-and-permit);
too-many-requests (block | log-and-permit);
}
notification-options {
fallback-block {
administrator-email email-address;
allow-email;
custom-message message;
custom-message-subject message-subject;
display-host;
(notify-mail-sender | no-notify-mail-sender);
type (message | protocol-only);
}
fallback-non-block {
custom-message message;
custom-message-subject message-subject;
(notify-mail-recipient | no-notify-mail-recipient);
}
virus-detection {
custom-message message;
custom-message-subject message-subject;
(notify-mail-sender | no-notify-mail-sender);
type (message | protocol-only);
}
}
scan-options {
content-size-limit value;
decompress-layer-limit value;
(intelligent-prescreening | no-intelligent-prescreening);
scan-extension filename;
scan-mode (all | by-extension);
timeout value;
}
trickling {
timeout value;
}
}
}
mime-whitelist {
exception listname;
list listname {
exception listname;
}
}
sophos-engine {
pattern-update {
email-notify {
admin-email email-address;
custom-message message;
custom-message-subject message-subject;
}
interval value;
no-autoupdate;
proxy {
password password-string;
port port-number;
server address-or-url;
username name;
}
url url;
}
profile <name> {
fallback-options {
content-size (block | log-and-permit | permit);
default (block | log-and-permit | permit);
engine-not-ready (block | log-and-permit | permit);
out-of-resources (block | log-and-permit | permit);
timeout (block | log-and-permit | permit);
too-many-requests (block | log-and-permit | permit);
}
notification-options {
fallback-block {
administrator-email email-address;
allow-email;
custom-message message;
custom-message-subject message-subject;
display-host;
(notify-mail-sender | no-notify-mail-sender);
type (message | protocol-only);
}
fallback-non-block {
custom-message message;
custom-message-subject message-subject;
(notify-mail-recipient | no-notify-mail-recipient);
}
virus-detection {
custom-message message;
custom-message-subject message-subject;
(notify-mail-sender | no-notify-mail-sender);
type (message | protocol-only);
}
}
scan-options {
content-size-limit value;
(no-uri-check | uri-check);
timeout value;
}
trickling {
timeout value;
}
}
sxl-retry value;
sxl-timeout seconds;
}
traceoptions {
flag flag;
}
type (juniper-express-engine | kaspersky-lab-engine | sophos-engine);
url-whitelist listname;
}
content-filtering {
profile profile-name {
block-command protocol-command-list;
block-content-type (activex | exe | http-cookie | java-applet | zip);
block-extension extension-list;
block-mime {
exception list-name;
list list-name;
}
notification-options {
custom-message message;
(notify-mail-sender | no-notify-mail-sender);
type (message | protocol-only);
}
permit-command protocol-command-list;
}
traceoptions {
flag flag;
}
}
web-filtering {
juniper-enhanced {
cache {
size value;
timeout value;
}
profile profile-name {
block-message {
type {
custom-redirect-url;
}
url url;
}
quarantine-message {
type {
custom-redirect-url;
}
url url;
}
category customurl-list name {
action (block | log-and-permit | permit | quarantine);
}
custom-block-message value;
custom-quarantine-message value;
default (block | log-and-permit | permit | quarantine);
fallback-settings {
default (block | log-and-permit);
server-connectivity (block | log-and-permit);
timeout (block | log-and-permit);
too-many-requests (block | log-and-permit);
}
no-safe-search;
site-reputation-action {
fairly-safe (block | log-and-permit | permit | quarantine);
harmful (block | log-and-permit | permit | quarantine);
moderately-safe (block | log-and-permit | permit | quarantine);
suspicious (block | log-and-permit | permit | quarantine);
very-safe (block | log-and-permit | permit |quarantine);
}
timeout value;
}
server {
host host-name;
port number;
}
}
juniper-local {
profile profile-name {
custom-block-message value;
default (block | log-and-permit | permit);
fallback-settings {
default (block | log-and-permit);
server-connectivity (block | log-and-permit);
timeout (block | log-and-permit);
too-many-requests (block | log-and-permit);
}
timeout value;
}
}
surf-control-integrated {
cache {
size value;
timeout value;
}
profile profile-name {
category customurl-list name {
action (block | log-and-permit | permit);
}
custom-block-message value;
default (block | log-and-permit | permit);
fallback-settings {
default (block | log-and-permit);
server-connectivity (block | log-and-permit);
timeout (block | log-and-permit);
too-many-requests (block | log-and-permit);
}
timeout value;
}
server {
host host-name;
port number;
}
}
traceoptions {
flag flag;
}
type (juniper-enhanced | juniper-local | surf-control-integrated | websense-redirect);
url-blacklist listname;
url-whitelist listname;
websense-redirect {
profile profile-name {
account value;
custom-block-message value;
fallback-settings {
default (block | log-and-permit);
server-connectivity (block | log-and-permit);
timeout (block | log-and-permit);
too-many-requests (block | log-and-permit);
}
server {
host host-name;
port number;
}
sockets value;
timeout value;
}
}
}
}
ipc {
traceoptions flag flag;
}
traceoptions {
flag flag;
}
utm-policy policy-name {
anti-spam {
smtp-profile profile-name;
}
anti-virus {
ftp {
download-profile profile-name;
upload-profile profile-name;
}
http-profile profile-name;
imap-profile profile-name;
pop3-profile profile-name;
smtp-profile profile-name;
}
content-filtering {
ftp {
download-profile profile-name;
upload-profile profile-name;
}
http-profile profile-name;
imap-profile profile-name;
pop3-profile profile-name;
rule-set rule-set-name {
rule rule-name {
match {
application any; /*http, pop3, impa, smtp, ftp */
direction any; /* upload or download */
file-type exe; /*predetected file types*/
}
then {
action {
no-action; /* No action */
/* block Block and drop connection */
/* close-client Close client */
/* close-server Close server */
/* close-client-and-server Close client and server */
}
notification {
seclog; /* event logging */
endpoint { /* endpoint notification options */
type protocol-only;
notify-mail-sender;
custom-message "CF Blocks content";
}
}
}
}
}
}
}
smtp-profile profile-name;
}
traffic-options {
sessions-per-client {
limit value;
over-limit (block | log-and-permit);
}
}
web-filtering {
http-profile profile-name;
}
}
}
Hierarchy Level
[edit security utm default-configuration] [edit security]
Description
Configure Content Security features.
Options
The remaining statements are explained separately. See CLI Explorer.
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Starting in Junos OS Release 21.4R1, content filtering is performed by detecting the
file content and not the file extensions. So, content filtering options based on
mime-type, content-type, and protocol command is not supported. After you upgrade to
Junos OS Release 21.4R1 above listed options are no more available for
configuration. The rule-set and rules configurations are introduced under the
[edit security utm utm-policy <utm-policy-name>
content-filtering] hierarchy level. These rules and rule-set allows you
to configure direction specific content filters and connection reset.
The [edit security utm default-configuration] hierarchy level is
introduced in Junos OS Release 18.2R1.
The Kaspersky, surf-control-integrated, and express antivirus features are not supported from Junos OS Release 15.1X49-D10 onwards. For previous releases, statement introduced in Junos OS Release 9.5 .
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.
Release
Description
15.1X49-D10
The Kaspersky,
surf-control-integrated, and express antivirus features are not supported
from Junos OS Release 15.1X49-D10 onwards.