Creating Firewall Policy Rules

Before You Begin

Read the Overview Firewall Policies topic.
Review the Firewall Rules main page for an understanding of your current data set. See Firewall Policy Rules Main Page Fields for field descriptions.

Use the Create Rule page to configure firewall rules that control transit traffic within a context (source zone to destination zone). The traffic is classified by matching its source and destination zones, the source and destination addresses, and the application that the traffic carries in its protocol headers with the policy database.

Security Director allows a device to have a device-specific policy and to be part of multiple group policies. Rules for a device are updated in this order:

Rules within Policies Applied Before 'Device Specific Policies'
Rules within Device-Specific Policies
Rules within Policies Applied After 'Device Specific Policies'

Rules within Policies Applied Before 'Device Specific Policies' take priority and cannot be overridden. However, you can override rules within Policies Applied After 'Device Specific Policies' by adding an overriding rule in the Device-Specific Policies. In an enterprise scenario, “common-must-enforce” rules can be assigned to a device from the Policies Applied Before ‘Device Specific Policies’, and “common-nice-to-have” rules can be assigned to a device from the Policies Applied After ‘Device Specific Policies’.

Note:

An exception can be added on a per device basis in “Device-Specific Policies” . For a complete list of rules applied to a device, select Configure > Firewall Policy > Devices. Select a device to view rules associated with that device.

To configure a firewall policy rule:

Select Configure > Firewall Policy.
Select the policy for which you want to define rules and click the + icon.
The Create Rules page appears.

Note:
To edit and create rules inline, click the policy to make the fields editable.
Complete the configuration according to the guidelines provided in Table 1.
Click OK.
The rules you configured are associated with the selected policy.

Table 1: Firewall Policy Rules Setting
Setting	Guideline
`General Information`
Rule Name	Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores. No spaces are allowed and the; maximum length is 63 characters.
Description	Enter a description for the policy rules; maximum length is 1024 characters. Comments entered in this field are sent to the device.
`Identify the traffic that the rule applies to`
(Source) Zone	For SRX Series devices, specify a source zone (from-zone) to define the context for the policy. Zone policies are applied on traffic entering one security zone (source zone) to another security zone (destination zone). This combination of a source zone and a destination zone is called a context. Starting in Junos Space Security Director Release 16.2, for MX Series routers, the source zone field acts as an ingress interface from where the packet enters. The match direction is input, if the packet is entering the interface. The match direction is output, if the packet is leaving the interface. Configure the ingress key by selecting the aggregated multiservices (AMS) value. Starting in Junos Space Security Director Release 16.2, polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy.
(Source) Address(es)	Enter one or more address names or address set names. Click Select to add source addresses. On the Source Address page: Include Any Address—Add any address to the firewall rule. Include Specific—Add the selected source address to the rule. When you add an NSX manager, the security groups are synchronized and the corresponding dynamic address groups (DAG) are created in Security Director database. For your NSX manager, select the required DAGs from the list. Exclude Specific—Exempt the selected source addresses from the rule. By Metadata Filter—Choose the matching address of a user-defined metadata as the source address. Metadata Filter—Click the field to select the required metadata from the list. The matching addresses are filtered and listed in the Matched Address field. Matched Addresses—Lists the addresses matching the selected metadata. This address is used as a source address. For every metadata expression, a unique dynamic address group (DAG) is created. This DAG has the feed server URL pointing to the feed server URL of Security Director. Office 365 is now included in the list of third party feeds to push Microsoft Office 365 services endpoint information (IP addresses) to the SRX Series device. This feed works differently from other feeds and requires certain configuration parameters, including a pre-defined name of “ipfilter_office365”. You must enable the Office 365 feed in Juniper ATP Cloud. To understand how to enable the Office 365 feed in Juniper ATP Cloud and create a DAG on the SRX Series device that refers to the ipfilter_office365 feed, see Enabling Third Party Threat Feeds. Configure the feed server URL by using the following CLI command to each SRX Series device or vSRX that acts on the metadata based policies. `set security dynamic-address feed-server <SD IP Address> hostname <SD IP Address>` See Creating Addresses and Address Groups.
(Source) User ID	Specify the source identity (users and roles) to be used as match criteria for the policy. You can have different policy rules based on user roles and user groups. Click Select to specify source identities to permit or deny. On the User ID page, you can select a user identity from the available list or you can add a new identity by clicking Add New User ID. To delete a user identity from the Security Director database, click Delete User ID and select a value from the drop-down list, which is not configured in any policy. If you try to delete a user identity which is configured in a policy, a message with its reference ID and user ID are displayed. Note: The user IDs which are only created in Security Director are displayed in the drop-down list.
(Source) End User Profile	Select an end user profile from the list. The firewall policy rule is applied to it. When traffic from device A arrives at an SRX Series device, the SRX Series obtains the IP address of device A from the first traffic packet and uses it to search the device identity authentication table for a matching device identity entry. Then it matches that device identity profile with a security policy whose End User Profile field specifies the device identity profile name. If a match is found, the security policy is applied to traffic issuing from device A.
(Destination) Zone	For SRX Series devices, specify a destination zone (to-zone) to define the context for the policy. Zone policies are applied on traffic entering one security zone (source zone) to another security zone (destination zone). This combination of a source zone and a destination zone is called a context. Starting in Junos Space Security Director Release 16.2, for MX Series routers, this field acts as an egress interface from where the packet enters. The match direction is input, if the packet is entering the interface. The match direction is output, if the packet is leaving the interface. Configure the egress key by selecting the aggregated multiservices (AMS) value. Polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy.
(Destination) Address(es)	Select one or more address names or address sets. Click Select to add destination addresses. On the Destination Address page: Select the Include option to add the selected destination addresses or any address to the rule. Select the Exclude option to exempt the selected destination addresses from the rule. Select the By Metadata Filter option to choose the matching address of a user-defined metadata as the destination address. Metadata Filter—Click the field to select the required metadata from the list. The matching addresses are filtered and listed in the Matched Address field. Matched Addresses—Lists the addresses matching the selected metadata. This address is used as a destination address. For every metadata expression, a unique dynamic address group(DAG) is created. This DAG has the feed server URL pointing to the feed server URL of Security Director. Office 365 is now included in the list of third party feeds to push Microsoft Office 365 services endpoint information (IP addresses) to the SRX Series device. This feed works differently from other feeds and requires certain configuration parameters, including a pre-defined name of “ipfilter_office365”. You must enable the Office 365 feed in Juniper ATP Cloud. To understand how to enable the Office 365 feed in Juniper ATP Cloud and create a DAG on the SRX Series device that refers to the ipfilter_office365 feed, see Enabling Third Party Threat Feeds. Configure the feed server URL by using the following CLI command to each SRX Series device or vSRX that acts on the metadata based policies. `set security dynamic-address feed-server <SD IP Address> hostname <SD IP Address>` See Creating Addresses and Address Groups.
(Destination) URL Category	Select one or more predefined or custom URL category as a match criterion. URL category is supported on devices running Junos OS Release 18.4R3 and later. Click Select to select a URL category. Select one or more predefined or custom URL categories from the Available list and move them to the Selected list. Click OK.
(Service Protocols) Services	Select one or more service (application) names. Select the Include, Any Service to disable the any option in the services list builder. Clear the Any Service check box to permit or deny services from the services list builder available column. Click Add New Service to create a service. See Creating Services and Service Groups.
Application Signatures	Click the + icon to add the application signatures. You can add both predefined and custom application signatures.
`Advanced Security`
Rule Action	Action applies to all traffic that matches the specified criteria. Deny—Device silently drops all packets for the session and does not send any active control messages such as TCP Resets or ICMP unreachable. Reject—Device sends a TCP reset if the protocol is TCP, and device sends an ICMP reset if the protocols are UDP, ICMP, or any other IP protocol. This option is useful when facing trusted resources so that the applications do not waste time waiting for timeouts and instead get the active message. Permit—Device permits traffic using the type of firewall authentication you applied to the policy. Tunnel—Device permits traffic using the type of VPN tunneling options you applied to the policy.
Advanced Security	Firewall policies provide a core layer of security that ensures that network traffic is restricted to only that which a policy dictates through its match criteria. Firewall policies provide a core layer of security that ensures that network traffic is restricted to only that which a policy dictates through its match criteria. When the traditional policy is not enough, select application identification components to create an advanced security profile for the policy: App Firewall—Select this option to enforce traditional firewall controls on the traffic while layering application firewall to ensure that applications conform not only to the port information but also to what is transmitted between a client and a server. You can permit, deny, and reject applications. There is also a special redirect feature for HTTP and HTTPS. Click the Add New link to create application firewall policy and click Add New APPFW Rule to create rules. See Creating Application Firewall Policies. SSL Forward Proxy—Select this option to enable an application-level protocol that provides encryption technology for the Internet. Click Add Forward Proxy to create SSL Forward Proxy Profiles. See Creating SSL Forward Proxy Profiles. Click Add Reverse Proxy to create SSL Reverse Proxy Profiles. See Creating SSL Reverse Proxy Profiles. IPS—Select the IPS value as On or Off. IPS Policy—Provides support for IPS policy within the standard firewall policy. Select an IPS policy to assign to the firewall policy. IPS policies that are not assigned to any device are listed in the drop-down. For devices with Junos OS Release 18.2 onward, CLI configuration for the assigned IPS policy is generated along with the standard firewall policy. Note: The rule action should be Permit. In Junos OS Release 18.1 and earlier, if you have configured a policy with both IPS as On or Off and an IPS policy, Security Director ignores the IPS policy and sends only IPS On CLI command to the device. In Junos OS Release 18.2 and later, if you have configured a policy with both IPS as On or Off and an IPS Policy, Security Director ignores the IPS On CLI command and sends only the IPS policy CLI command to the device. UTM—Select this option to define Layer 7 protection against client-side threats. Click Add New to create Content Security policies. See Creating UTM Policies. Secure Web Proxy—Select a secure Web proxy profile created in Create a Secure Web Proxy Profile. You can use secure Web proxy to enable traffic for selected applications to bypass the external proxy server and sent directly to a webserver. Threat Prevention Policy—Select an option to provide protection and monitoring for the selected threat profiles, including command and control servers, infected hosts, and malware. Note: For creating inline application firewall policy, SSL proxy profiles, and Content Security, the rule action must be permit.
Threat Profiling	Juniper ATP Cloud Adaptive Threat Profiling allows SRX Series devices to generate, propagate, and consume threat feeds based on their own advanced detection and policy-match events. Starting in Junos Space Security Director Release 21.2, you can configure a firewall policy with source and destination addresses as threat types, which injects the source IP address and destination IP address into the selected threat feed when traffic matches the rule. Threat feed can be leveraged by other devices as a dynamic-address-group (DAG). Add Source IP to Feed—Select a security feed from the list. The source IP address is added to the threat feed when the traffic matches the rule. Add Destination IP to Feed—Select a security feed from the list. The destination IP address is added to the threat feed when the traffic matches the rule. Note: To use these fields, first enroll the devices in ATP Cloud and then configure Policy Enforcer to display feeds in the drop-down list.
`Rule Options`
Profile	Select a default profile or a custom profile, or you can inherit a policy profile from another policy. Policy profile specifies the basic settings of a security policy. See Creating Firewall Policy Profiles.
Schedule	Policy schedules allow you to define when a policy is active, and thus are an implicit match criterion. You can define the day of the week and the time of the day when the policy is active. For instance, you can define a security policy that opens or closes access based on business hours. Multiple schedulers can be applied to different policies, but only one scheduler can be active per policy. Select a pre-saved schedule and the schedule options are populated with the selected schedule’s data. Click New to create another schedule.
`Rule Analysis`
New Rule, Perform Analysis	Select this option if you want to analyze your rules to avoid any anomalies.
`Rule Placement`
Location/Sequence	Displays the sequence number and the order in which the rule is placed.

Release History Table

Release

Description

16.2

Starting in Junos Space Security Director Release 16.2, for MX Series routers, the source zone field acts as an ingress interface from where the packet enters.

16.2

Starting in Junos Space Security Director Release 16.2, polymorphic zones can be used as source zone and destination zone, when you assign SRX Series devices and MX Series routers to the same group policy.

16.2

Starting in Junos Space Security Director Release 16.2, for MX Series routers, this field acts as an egress interface from where the packet enters.

Creating Firewall Policy Rules

Related Documentation