- play_arrow Junos Space Security Director
- play_arrow Dashboard
- play_arrow Overview
-
- play_arrow Monitor
- play_arrow Events and Logs-All Events
- Events and Logs Overview
- Creating Alerts
- Creating Reports
- Creating Filters
- Grouping Events
- Using Events and Logs Settings
- Selecting Events and Logs Table Columns
- Viewing Threats
- Viewing Data for Selected Devices
- Using the Detailed Log View
- Using the Raw Log View
- Showing Exact Match
- Using Filter on Cell Data
- Using Exclude Cell Data
- Showing Firewall Policy
- Showing Source NAT Policy
- Showing Destination NAT Policy
- Downloading Packets Captured
- Showing Attack Details
- Using Filters
- play_arrow Events and Logs-Firewall
- play_arrow Events and Logs-Web Filtering
- play_arrow Events and Logs-VPN
- play_arrow Events and Logs-Content Filtering
- play_arrow Events and Logs-Antispam
- play_arrow Events and Logs-Antivirus
- play_arrow Events and Logs-IPS
- play_arrow Events and Logs-Screen
- play_arrow Events and Logs-ATP Cloud
- play_arrow Events and Logs-Apptrack
- play_arrow Threat Prevention-Hosts
- play_arrow Threat Prevention-C&C Servers
- play_arrow Threat Prevention-HTTP File Download
- play_arrow Threat Prevention-Email Quarantine and Scanning
- play_arrow Threat Prevention-IMAP Block
- play_arrow Threat Prevention-Manual Upload
- play_arrow Threat Prevention-Feed Status
- play_arrow Threat Prevention-All Hosts Status
- play_arrow Threat Prevention-DDoS Feeds Status
- play_arrow Applications
- play_arrow Live Threat Map
- play_arrow Threat Monitoring
- play_arrow Alerts and Alarms - Overview
- play_arrow Alerts and Alarms-Alerts
- play_arrow Alerts and Alarms-Alert Definitions
- play_arrow Alerts and Alarms-Alarms
- play_arrow VPN
- play_arrow Insights
- play_arrow Job Management
- Using Job Management in Security Director
- Overview of Jobs in Security Director
- Archiving and Purging Jobs in Security Director
- Viewing the Details of a Job in Security Director
- Canceling Jobs in Security Director
- Reassigning Jobs in Security Director
- Rescheduling and Modifying the Recurrence of Jobs in Security Director
- Retrying a Failed Job on Devices in Security Director
- Exporting the Details of a Job in Security Director
- Job Management Main Page Fields
- play_arrow Audit Logs
- play_arrow Packet Capture
- play_arrow NSX Inventory-Security Groups
- play_arrow vCenter Server Inventory-Virtual Machines
- play_arrow Data Plane Packet Capture
-
- play_arrow Devices
- play_arrow Security Devices
- Using Features in Security Devices
- Security Devices Overview
- Add Devices to Juniper Security Director Cloud
- Updating Security-Specific Configurations or Services on Devices
- Resynchronizing Managed Devices with the Network in Security Director
- Performing Commit Check
- Logical Systems Overview
- Tenant Systems Overview
- Create a Logical System
- Create a Tenant System
- Uploading Authentication Keys to Devices in Security Director
- Modifying the Configuration of Security Devices
- Modifying the Basic Configuration for Security Devices
- Modifying the Static Routes Configuration for Security Devices
- Modifying the Routing Instances Configuration for Security Devices
- Modifying the Physical Interfaces Configuration for Security Devices
- Modifying the Syslog Configuration for Security Devices
- Modifying the Security Logging Configuration for Security Devices
- Modifying the Link Aggregation for Security Devices
- Modifying the User Management Configuration for Security Devices
- Modifying the Screens Configuration for Security Devices
- Modifying the Zones Configuration for Security Devices
- Modifying the IPS Configuration for Security Devices
- Modifying the SSL Initiation Profile for Security Devices
- Modifying the ICAP Redirect Profile for Security Devices
- Configuring Aruba ClearPass for Security Devices
- Configuring APBR Tunables for Security Devices
- Modifying the Express Path Configuration for Security Devices
- Modifying the Device Information Source Configuration for Security Devices
- Viewing the Active Configuration of a Device in Security Director
- Deleting Devices in Security Director
- Rebooting Devices in Security Director
- Resolving Key Conflicts in Security Director
- Launching a Web User Interface of a Device in Security Director
- Connecting to a Device by Using SSH in Security Director
- Importing Security Policies to Security Director
- Importing Device Changes
- Viewing Device Changes
- Viewing and Exporting Device Inventory Details in Security Director
- Previewing Device Configurations
- Refreshing Device Certificates
- Assigning Security Devices to Domains
- Acknowledging Device SSH Fingerprints in Security Director
- Viewing Security Device Details
- Security Devices Main Page Fields
- play_arrow Device Discovery
- Overview of Device Discovery in Security Director
- Creating Device Discovery Profiles in Security Director
- Editing, Cloning, and Deleting Device Discovery Profiles in Security Director
- Running a Device Discovery Profile in Security Director
- Viewing the Device Discovery Profile Details in Security Director
- Device Discovery Main Page Fields
- play_arrow Secure Fabric
- play_arrow NSX Managers
- Understanding Juniper Connected Security for VMware NSX Integration
- Understanding Juniper Connected Security for VMware NSX-T Integration
- Before You Deploy vSRX in VMware NSX Environment
- Before You Deploy vSRX in VMware NSX-T Environment
- About the NSX Managers Page
- Download the SSH Key File
- Add the NSX Manager
- Registering Security Services
- Editing NSX Managers
- Viewing Service Definitions
- Deleting the NSX Manager
- Delete the NSX-T Manager
- Deploying the vSRX as an Advanced Security Service in a VMware NSX Environment
- Deploy the vSRX as an Advanced Security Service in a VMware NSX-T Environment
- play_arrow vCenter Servers
- play_arrow Licenses
-
- play_arrow Reports
- play_arrow Administration
- play_arrow My Profile
- play_arrow Users and Roles-Users
- Overview of Users in Security Director
- Creating Users in Security Director
- Editing and Deleting Users in Security Director
- Viewing and Terminating Active User Sessions in Security Director
- Viewing the User Details in Security Director
- Clearing Local Passwords for Users in Security Director
- Disabling and Enabling Users in Security Director
- Unlocking Users in Security Director
- Users Main Page Fields
- play_arrow Users and Roles-Roles
- play_arrow Users and Roles-Domains
- Overview of Domains in Security Director
- Creating Domains in Security Director
- Edit and Delete Domains in Security Director
- Exporting Domains in Security Director
- Viewing Users, Devices, and Remote Profiles Assigned to a Domain in Security Director
- Assigning Devices to Domains in Security Director
- Assigning and Unassigning Remote Profiles to Domains in Security Director
- Assigning and Unassigning Users to Domains in Security Director
- Domains Main Page Fields
- play_arrow Users and Roles-Remote Profiles
- play_arrow Logging Management
- play_arrow Logging Management-Logging Nodes
- play_arrow Logging Management-Statistics & Troubleshooting
- play_arrow Logging Management-Logging Devices
- play_arrow Monitor Settings
- play_arrow Signature Database
- play_arrow License Management
- play_arrow Migrating Content from NSM to Security Director
- play_arrow Policy Sync Settings
- play_arrow Insights Management
- Add Insights Nodes
- About the Alerts Settings Page
- Create a New Alert Setting
- Configure System Settings
- About the Identity Settings Page
- Add JIMS Configuration
- Edit and Delete an Identity Setting
- Configure Mitigation Settings
- About the Threat Intelligence Page
- Configure Threat Intelligence Source
- Edit and Delete Threat Intelligence Source
- About the ServiceNow Configuration Page
- About the Backup & Restore Page
- Create a Backup File and Restore the Configuration
- Download and Delete a Backup File
-
SSL Forward Proxy Overview
Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL, also called Transport Layer Security (TLS), ensures the secure transmission of data between a client and a server through a combination of privacy, authentication, confidentiality, and data integrity. SSL relies on certificates and private-public key exchange pairs for this level of security.
Server authentication guards against fraudulent transmissions by enabling a Web browser to validate the identity of a Web server. Confidentiality mechanisms ensure that communications are private. SSL enforces confidentiality by encrypting data to prevent unauthorized users from eavesdropping on electronic communications. Finally, message integrity ensures that the contents of a communication have not been tampered with.
SSL forward proxy is a transparent proxy; that is, it performs SSL encryption and decryption between the client and the server, but neither the server nor the client can detect its presence. SSL forward proxy ensures that it has the keys to encrypt and decrypt the payload:
For the server, SSL forward proxy acts as a client—Because SSL forward proxy generates the shared pre-primary key, it determines the keys to encrypt and decrypt.
For the client, SSL forward proxy acts as a server—SSL forward proxy first authenticates the original server and replaces the public key in the original server certificate with a key that is known to it. It then generates a new certificate by replacing the original issuer of the certificate with its own identity and signs this new certificate with its own public key (provided as a part of the proxy profile configuration). When the client accepts such a certificate, it sends a shared pre-primary key encrypted with the public key on the certificate. Because SSL forward proxy replaced the original key with its own key, it is able to receive the shared pre-primary key. Decryption and encryption take place in each direction (client and server), and the keys are different for both encryption and decryption.
Figure 1 depicts how SSL inspection (on an existing SRX Series IPS module) is typically used to protect servers. SSL inspection requires access to private keys used by the servers so that the SRX Series device can decrypt the encrypted traffic.
Figure 2 shows how SSL forward proxy works on an encrypted payload. When application firewall (AppFW), intrusion prevention system (IPS), or application tracking (AppTrack) is configured, SSL forward proxy acts as an SSL server terminating the SSL session from the client and a new SSL session is established to the server. The device decrypts and then re-encrypts all SSL forward proxy traffic. SSL forward proxy uses the following services:
SSL-T-SSL terminator on the client side.
SSL-I-SSL initiator on the server side.
Configured AppFW, IPS, or AppTrack services use the decrypted SSL sessions.
If none of the services (AppFW, IPS, or AppTrack) are configured, then SSL forward proxy services are bypassed even if an SSL proxy profile is attached to a firewall policy. IPS does not perform SSL inspection on a session if SSL forward proxy is enabled for that session. That is, if both SSL inspection and SSL forward proxy are enabled on a session, SSL forward proxy always takes precedence.
Supported Ciphers in Proxy Mode
An SSL cipher comprises encryption ciphers, authentication method, and compression. Table 1 displays a list of supported ciphers. NULL ciphers are excluded.
The following SSL protocols are supported:
SSLv3
TLS1
SSL Cipher | Key Exchange Algorithm | Data Encryption | Message Integrity |
|---|---|---|---|
RSA_WITH_RC4_128_MD5 | RSA key exchange | 128-bit RC4 | Message Digest 5 (MD5) hash |
RSA_WITH_RC4_128_SHA | RSA key exchange | 128-bit RC4 | Secure Hash Algorithm (SHA) hash |
RSA_WITH_DES_CBC_SHA | RSA key exchange | DES CBC | SHA hash |
RSA_WITH_3DES_EDE_CBC_SHA | RSA key exchange | 3DES EDE/CBC | SHA hash |
RSA_WITH_AES_128_CBC_SHA | RSA key exchange | 128-bit AES/CBC | SHA hash |
RSA_WITH_AES_256_CBC_SHA | RSA key exchange | 256-bit AES/CBC | SHA hash |
RSA_EXPORT_WITH_RC4_40_MD5 | RSA-export | 40-bit RC4 | MD5 hash |
RSA_EXPORT_WITH_DES40_CBC_SHA | RSA-export | 40-bit DES/CBC | SHA hash |
RSA_EXPORT1024_WITH_DES_CBC_SHA | RSA 1024 bit export | DES/CBC | SHA hash |
RSA_EXPORT1024_WITH_RC4_56_MD5 | RSA 1024 bit export | 56-bit RC4 | MD5 hash |
RSA_EXPORT1024_WITH_RC4_56_SHA | RSA 1024 bit export | 56-bit RC4 | SHA hash |
RSA-WITH-AES-256-GCM-SHA384 | RSA key exchange | 256-bit AES/GCM | SHA384 hash |
RSA-WITH-AES-256-CBC-SHA256 | RSA key exchange | 256-bit AES/CBC | SHA256 hash |
RSA-WITH-AES-128-GCM-SHA256 | RSA key exchange | 128-bit AES/GCM | SHA256 hash |
RSA-WITH-AES-128-CBC-SHA256 | RSA key exchange | 128-bit AES/CBC | SHA256 hash |
Server Authentication
Implicit trust between the client and the device (because the client accepts the certificate generated by the device) is an important aspect of SSL proxy. It is extremely important that server authentication is not compromised; however, in reality, self-signed certificates and certificates with anomalies are in abundance. Anomalies can include expired certificates, instances of common name not matching a domain name, and so forth.
Server authentication is governed by selecting the Ignore Server Authentication option in the SSL forward proxy profile.
If the Ignore Server Authentication option is not selected, the following scenarios occur:
If authentication succeeds, a new certificate is generated by replacing the keys and changing the issuer name to the issuer name that is configured in the root CA certificate in the proxy profile.
If authentication fails, the connection is dropped.
If the Ignore Server Authentication option is defined as an action in the SSL forward proxy profile, the following scenarios occur:
If the certificate is self-signed, a new certificate is generated by replacing the keys only. The issuer name is not changed. This ensures that the client browser displays a warning that the certificate is not valid.
If the certificate has expired or if the common name does not match the domain name, a new certificate is generated by replacing the keys and changing the issuer name to SSL-PROXY: DUMMY_CERT:GENERATED DUE TO SRVR AUTH FAILURE. This ensures that the client browser displays a warning that the certificate is not valid.
Trusted CA List
SSL forward proxy ensures secure transmission of data between a client and a server. Before establishing a secure connection, SSL forward proxy checks certificate authority (CA) certificates to verify signatures on server certificates. For this reason, a reasonable list of trusted CA certificates is required to effectively authenticate servers.
Ignore Server Authentication
You can use the Ignore Server Authentication option to ignore server authentication completely. In this case, SSL forward proxy ignores errors encountered during the server certificate verification process (such as CA signature verification failure, self-signed certificates, and certificate expiry).
We do not recommend this option for authentication, because configuring it results in websites not being authenticated at all. However, you can use this option to effectively identify the root cause for dropped SSL sessions.
Root CA
In a public key infrastructure (PKI) hierarchy, the root CA is at the top of the trust path. The root CA identifies the server certificate as a trusted certificate.
Session Resumption
An SSL session refers to the set of parameters and encryption keys created by performing a full handshake. A connection is the conversation or active data transfer that occurs within the session. The computational overhead of a complete SSL handshake and generation of primary keys is considerable. In short-lived sessions, the time taken for the SSL handshake can be more than the time for data transfer. To improve throughput and still maintain an appropriate level of security, SSL session resumption provides a session caching mechanism so that session information, such as the pre-primary secret key and agreed-upon ciphers, can be cached for both the client and server. The cached information is identified by a session ID. In subsequent connections both parties agree to use the session ID to retrieve the information rather than create a new pre-primary secret key. Session resumption shortens the handshake process and accelerates SSL transactions.
SSL Proxy Logs
When logging is enabled in an SSL proxy profile, SSL proxy can generate the messages shown in Table 2.
Log Type | Description |
|---|---|
SSL_PROXY_SSL_SESSION_DROP | Logs generated when a session is dropped by SSL proxy. |
SSL_PROXY_SSL_SESSION_ALLOW | Logs generated when a session is processed by SSL proxy even after encountering some minor errors. |
SSL_PROXY_SESSION_IGNORE | Logs generated if non-SSL sessions are initially mistaken as SSL sessions. |
SSL_PROXY_SESSION_ALLOWLIST | Logs generated when a session is allowlisted. |
SSL_PROXY_ERROR | Logs used for reporting errors. |
SSL_PROXY_WARNING | Logs used for reporting warnings. |
SSL_PROXY_INFO | Logs used for reporting general information. |
All logs contain similar information; the message field contains the reason for the log generation. One of three prefixes shown in Table 3 identifies the source of the message. Other fields are descriptively labeled.
Prefix | Description |
|---|---|
system | Logs generated due to errors related to the device or an action taken as part of the SSL proxy profile. Most logs fall into this category. |
openssl error | Logs generated during the handshaking process if an error is detected by the openssl library. |
certificate error | Logs generated during the handshaking process if an error is detected in the certificate (x509 related errors). |
Perfect Forward Secrecy
Perfect Forward Secrecy is a specific key agreement protocol that provides assurance that your session keys are not compromised even if the private key of the server is compromised. By generating a unique session key for every session a user initiates, even if a single session keys gets compromised does not affect any data other than that exchanged in a specific session protected by that particular key.
The Elliptic Curve DHE (ECDHE) cipher suits are supported to enable the perfect forward secrecy on SSL forward proxy. The SSL forward proxy still uses RSA for authentication. However, it uses EC Diffie-Hellman ephemeral key exchange to agree on a shared secret.
ECDHE cipher suites are faster than the DHE counterparts and therefore, the SSL forward proxy supports only ECDHE cipher suits. The ECDHE cipher suits are based on the elliptic curve cryptography which allows you to achieve the same level of security than RSA with smaller keys. For example, a 224 bit elliptic curve is as secure as a 2048 bit RSA key.
Table 4 shows the supported ECDHE cipher suits.
SSL Cipher | Key Exchange Algorithm | Data Encryption | Message Integrity |
|---|---|---|---|
ECDHE-RSA-WITH-AES-256-GCM-SHA384 | ECDHE RSA | 256-bit AES/GCM | SHA 384 hash |
ECDHE-RSA-WITH-AES-256-CBC-SHA384 | ECDHE RSA | 256-bit AES/CBC | SHA 384 hash |
ECDHE-RSA-WITH-AES-256-CBC-SHA | ECDHE RSA | 256-bit AES/CBC | SHA hash |
ECDHE-RSA-WITH-AES-3DES-EDE-CBC-SHA | ECDHE RSA | 3DES AES/EDE/CBC | SHA hash |
ECDHE-RSA-WITH-AES-128-GCM-SHA256 | ECDHE RSA | 128-bit AES/GCM | SHA 256 hash |
ECDHE-RSA-WITH-AES-128-CBC-SHA256 | ECDHE RSA | 128-bit AES/CBC | SHA 256 hash |
ECDHE-RSA-WITH-AES-128-CBC-SHA | ECDHE RSA | 128-bit AES/CBC | SHA hash |
