close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Junos Space Security Director
- play_arrow Overview
play_arrow Dashboard
- play_arrow Overview
  - Dashboard Overview
play_arrow Monitor
- play_arrow Events and Logs-All Events
  - Events and Logs Overview
  - Creating Alerts
  - Creating Reports
  - Creating Filters
  - Grouping Events
  - Using Events and Logs Settings
  - Selecting Events and Logs Table Columns
  - Viewing Threats
  - Viewing Data for Selected Devices
  - Using the Detailed Log View
  - Using the Raw Log View
  - Showing Exact Match
  - Using Filter on Cell Data
  - Using Exclude Cell Data
  - Showing Firewall Policy
  - Showing Source NAT Policy
  - Showing Destination NAT Policy
  - Downloading Packets Captured
  - Showing Attack Details
  - Using Filters
- play_arrow Events and Logs-Firewall
  - Firewall Events and Logs Overview
- play_arrow Events and Logs-Web Filtering
  - Web Filtering Events and Log Overview
- play_arrow Events and Logs-VPN
  - VPN Events and Logs Overview
- play_arrow Events and Logs-Content Filtering
  - Content Filtering Events and Logs Overview
- play_arrow Events and Logs-Antispam
  - Antispam Events and Logs Overview
- play_arrow Events and Logs-Antivirus
  - Antivirus Events and Logs Overview
- play_arrow Events and Logs-IPS
  - IPS Events and Logs Overview
- play_arrow Events and Logs-Screen
  - Screen Events and Logs Overview
- play_arrow Events and Logs-ATP Cloud
  - ATP Cloud Events and Logs Overview
- play_arrow Events and Logs-Apptrack
  - Apptrack Events and Logs Overview
- play_arrow Threat Prevention-Hosts
  - Infected Hosts Overview
  - Infected Host Details
- play_arrow Threat Prevention-C&C Servers
  - Command and Control Servers Overview
  - Command and Control Server Details
- play_arrow Threat Prevention-HTTP File Download
  - HTTP File Download Overview
  - HTTP File Download Details
- play_arrow Threat Prevention-Email Quarantine and Scanning
  - SMTP Quarantine Overview
  - Email Attachments Scanning Overview
  - Email Attachments Scanning Details
- play_arrow Threat Prevention-IMAP Block
  - IMAP Block Overview
- play_arrow Threat Prevention-Manual Upload
  - File Scanning Limits
- play_arrow Threat Prevention-Feed Status
  - Device Feed Status Details
- play_arrow Threat Prevention-All Hosts Status
  - All Hosts Status Details
- play_arrow Threat Prevention-DDoS Feeds Status
  - DDoS Feeds Status Details
- play_arrow Applications
  - About the Application Visibility Page
  - Application Visibility Overview
  - Block Applications
  - Block Users
  - Block Source IP Addresses
- play_arrow Live Threat Map
  - Threat Map Overview
  - Blocking Threat Events
- play_arrow Threat Monitoring
  - Threat Monitoring Overview
- play_arrow Alerts and Alarms - Overview
  - Alerts and Alarms Overview
- play_arrow Alerts and Alarms-Alerts
  - Deleting an Alert
  - Searching Alerts
  - Using Generated Alerts
- play_arrow Alerts and Alarms-Alert Definitions
  - Creating Alert Definitions
  - Editing Alert Definitions
  - Cloning Alert Definition
  - Deleting Alert Definitions
  - Searching Alert Definitions
  - Alert Definitions Main Page Fields
- play_arrow Alerts and Alarms-Alarms
  - Using Device Alarms
  - Device Alarms Main Page Fields
- play_arrow VPN
  - IPsec VPN Monitoring Overview
  - About the Overview Page
  - Managing Monitored and Unmonitored VPNs
  - About the Monitored Tunnels Page
  - About the Devices Page
- play_arrow Insights
  - How to Monitor Incidents
  - How to Monitor Mitigation
- play_arrow Job Management
  - Using Job Management in Security Director
  - Overview of Jobs in Security Director
  - Archiving and Purging Jobs in Security Director
  - Viewing the Details of a Job in Security Director
  - Canceling Jobs in Security Director
  - Reassigning Jobs in Security Director
  - Rescheduling and Modifying the Recurrence of Jobs in Security Director
  - Retrying a Failed Job on Devices in Security Director
  - Exporting the Details of a Job in Security Director
  - Job Management Main Page Fields
- play_arrow Audit Logs
  - Using Audit Logs in Security Director
  - Understanding Audit Logs in Security Director
  - Purging or Archiving and Purging Audit Logs in Security Director
  - Exporting Audit Logs in Security Director
  - Viewing the Details of an Audit Log in Security Director
  - Audit Logs Main Page Fields
- play_arrow Packet Capture
  - Packet Capture Overview
  - About the Packets Captured Page
  - Setting the Purge Policy
- play_arrow NSX Inventory-Security Groups
  - About the Security Groups Page
  - View Members of a Security Group
- play_arrow vCenter Server Inventory-Virtual Machines
  - About the Virtual Machines Page
  - View Network Details of a Virtual Machine
  - View Security Groups of a Virtual Machine
- play_arrow Data Plane Packet Capture
  - About the Data Plane Packet Capture Page
  - Capture Data Plane Packets
play_arrow Devices
play_arrow Configure
- play_arrow Firewall Policy-Standard Policies
  - Firewall Policies Overview
  - Policy Ordering Overview
  - Creating Firewall Policies
  - Firewall Policies Best Practices
  - Creating Firewall Policy Rules
  - Rule Base Overview
  - Firewall Policy Locking Modes
  - Rule Operations on Filtered Rules Overview
  - Create and Manage Policy Versions
  - Assigning Devices to Policies
  - Comparing Policies
  - Export Policies
  - Creating Custom Columns
  - Promoting to Group Policy
  - Converting Standard Policy to Unified Policy
  - Probe Latest Policy Hits
  - Disable Firewall Policy Rules Based on Hits Over a Specified Duration
  - Viewing and Synchronizing Out-of-Band Firewall Policy Changes Manually
  - Importing Policies
  - Delete and Replace Policies and Objects
  - Unassigning Devices from Policies
  - Edit and Clone Policies and Objects
  - Publishing Policies
  - Showing Duplicate Policies and Objects
  - Show and Delete Unused Policies and Objects
  - Updating Policies on Devices
  - Firewall Policies Main Page Fields
  - Firewall Policy Rules Main Page Fields
- play_arrow Firewall Policy-Unified Policies
  - About the Unified Policies Page
  - Unified Policy Overview
  - Creating Unified Firewall Policies
  - Creating Unified Firewall Policy Rules
  - Configuring a Default SSL Proxy Profile
  - Configure a Default IDP Policy
- play_arrow Firewall Policy-Devices
  - Devices with Firewall Policies Main Page Fields
- play_arrow Firewall Policy-Schedules
  - Schedules Overview
  - Creating Schedules
  - Schedules Main Page Fields
- play_arrow Firewall Policy-Profiles
  - Understanding Firewall Policy Profiles
  - Understanding Captive Portal Support for Unauthenticated Browser Users
  - Creating Firewall Policy Profiles
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - Assigning Policies and Profiles to Domains
  - Firewall Policy Profiles Main Page Fields
- play_arrow Firewall Policy-Templates
  - Understanding Firewall Policy Templates
  - Creating Firewall Policy Templates
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - Firewall Policy Templates Main Page Fields
- play_arrow Firewall Policy-Secure Web Proxy
  - About the Secure Web Proxy Page
  - Create a Secure Web Proxy Profile
  - Edit, Clone, and Delete a Secure Web Proxy Profile
  - Assign Secure Web Proxy Profile to a Domain
  - Find Secure Web Proxy Profile Usage Details
- play_arrow Firewall Policy-DNS Security & ETI Profile
  - DNS Security and Encrypted Traffic Insights Overview
  - About the DNS Security and ETI Profile Page
  - Create a DNS Security and ETI Profile
  - Clone, Edit, and Delete DNS Security and ETI Profile
- play_arrow Firewall Policy-DNS Security & ETI Policy
  - About the DNS Security and ETI Policy Page
  - Create a DNS Security and ETI Policy
  - Edit and Delete DNS Security and ETI Policy
- play_arrow Firewall Policy-DNS Sinkhole
  - About the DNS Sinkhole Page
  - Create a Sinkhole
  - Assign Devices to a Sinkhole
  - Unassign Devices from a Sinkhole
  - Clone a Sinkhole
  - Assign a Sinkhole to a Domain
  - Publish a DNS Sinkhole Policy
  - Update a DNS Sinkhole Policy
  - Edit and Delete a Sinkhole
- play_arrow Firewall Policy-DNS Filter
  - About the DNS Filter Page
  - Create a DNS Filter
  - Assign Devices to a DNS Filter
  - Unassign Devices from a DNS Filter
  - Clone a DNS Filter
  - Assign a DNS Filter to Domain
  - Detailed View of a DNS Filter
  - Publish a DNS Filter Policy
  - Update a DNS Filter Policy
  - Edit and Delete a DNS Filter
- play_arrow Environment
  - Environment Variables and Conditions Overview
  - About the Environment Page
  - Creating a New Environment Variable
  - Editing and Deleting Environment Variables
  - Creating a New Environment Condition
  - Editing and Deleting Environment Conditions
- play_arrow Application Firewall Policy-Policies
  - Understanding Application Firewall Policies
  - Creating Application Firewall Policies
  - Delete and Replace Policies and Objects
  - Edit and Clone Policies and Objects
  - Show and Delete Unused Policies and Objects
  - Finding Usages for Policies and Objects
  - Application Firewall Policies Main Page Fields
- play_arrow Application Firewall Policy-Signatures
  - Understanding Custom Application Signatures
  - Creating Application Signatures
  - Editing, Cloning, and Deleting Custom Application Signatures
  - Creating Application Signature Groups
  - Application Signatures Main Page Fields
- play_arrow Application Firewall Policy-Redirect Profiles
  - About the Redirect Profiles Page
  - Adding a Redirect Profile
  - Cloning, Editing, and Deleting Redirect Profiles
- play_arrow SSL Profiles
  - SSL Forward Proxy Overview
  - Creating SSL Forward Proxy Profiles
  - SSL Forward Proxy Profile Main Page Fields
  - SSL Reverse Proxy Overview
  - Creating SSL Reverse Proxy Profiles
- play_arrow User Firewall Management-Active Directory
  - About the Active Directory Profile Page
  - Creating Active Directory Profiles
  - Deploying the Active Directory Profile to SRX Series Devices
  - Editing and Deleting Active Directory Profiles
- play_arrow User Firewall Management-Access Profile
  - Access Profile Overview
  - About the Access Profile Page
  - Creating Access Profiles
  - Deploying the Access Profile to SRX Series Devices
  - Editing and Deleting Access Profiles
- play_arrow User Firewall Management-Address Pools
  - About the Address Pool Page
  - Create Address Pool
  - Edit and Delete Address Pool
- play_arrow User Firewall Management-Identity Management
  - Juniper Identity Management Service Overview
  - About the Identity Management Profile Page
  - Creating Identity Management Profiles
  - Editing, Cloning, and Deleting Identity Management Profiles
  - Updating the Identity Management Profile to SRX Series Devices
- play_arrow User Firewall Management-End User Profile
  - End User Profile Overview
  - About the End User Profile Page
  - Creating an End User Profile
  - Edit and Delete End User Profile
  - End User Profile Operations
- play_arrow IPS Policy-Policies
  - Understanding IPS Policies
  - Creating IPS Policies
  - Creating IPS Policy Rules
  - Publishing Policies
  - Updating Policies on Devices
  - Assigning Devices to Policies
  - Create and Manage Policy Versions
  - Creating Rule Name Template
  - Export Policies
  - Unassigning Devices to Policies
  - Viewing and Synchronizing Out-of-Band IPS Policy Changes Manually
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - Assigning Policies and Profiles to Domains
  - IPS Policies Main Page Fields
  - Configure IPS Policy in a Firewall Policy
  - Import a Firewall Policy that Has IPS Policy Configured
- play_arrow IPS Policy-Devices
  - Understanding IPS Policies
  - Devices with IPS Policies Main Page Fields
- play_arrow IPS Policy-Signatures
  - Understanding IPS Signatures
  - Creating IPS Signatures
  - Creating IPS Signature Static Groups
  - Creating IPS Signature Dynamic Groups
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - IPS Policy Signatures Main Page Fields
- play_arrow IPS Policy-Templates
  - Understanding IPS Policy Templates
  - Creating IPS Policy Templates
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - IPS Policy Templates Main Page Fields
- play_arrow NAT Policy-Policies
  - NAT Overview
  - NAT Global Address Book Overview
  - Creating NAT Policies
  - Publishing Policies
  - NAT Policy Rules Main Page Field
  - Creating NAT Rules
  - Updating Policies on Devices
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - Assigning Policies and Profiles to Domains
  - Comparing Policies
  - Create and Manage Policy Versions
  - Export Policies
  - Assigning Devices to Policies
  - Unassigning Devices to Policies
  - Creating Rule Name Template
  - Viewing and Synchronizing Out-of-Band NAT Policy Changes Manually
  - Configuring NAT Rule Sets
  - Auto Grouping
  - NAT Policies Main Page Fields
- play_arrow NAT Policy-Devices
  - Devices with NAT Policies Main Page Fields
- play_arrow NAT Policy-Pools
  - Creating NAT Pools
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - Show and Delete Unused Policies and Objects
  - Showing Duplicate Policies and Objects
  - Assigning Policies and Profiles to Domains
  - NAT Pools Main Page Fields
- play_arrow NAT Policy-Port Sets
  - Creating Port Sets
  - Delete and Replace Policies and Objects
  - Edit and Clone Policies and Objects
  - Show and Delete Unused Policies and Objects
  - Showing Duplicate Policies and Objects
  - Assigning Policies and Profiles to Domains
  - Port Sets Main Page Fields
- play_arrow Content Security Policy-Policies
  - Content Security Overview
  - Creating Content Security Policies
  - Comparing Policies
  - Delete and Replace Policies and Objects
  - Viewing Policy and Shared Object Details
  - Assigning Policies and Profiles to Domains
  - Showing Duplicate Policies and Objects
  - Edit and Clone Policies and Objects
  - Show and Delete Unused Policies and Objects
  - Content Security Policies Main Page Fields
- play_arrow Content Security Policy-Web Filtering Profiles
  - Creating Web Filtering Profiles
  - Selecting a Web Filtering Solution
  - Web Filtering Profile Main Page Fields
- play_arrow Content Security Policy-Category Update
  - About the Category Update Page
  - Configuring the Download URL Settings
  - Downloading and Installing URL Categories
  - Uploading and Installing URL Categories
  - Installing URL Categories on SRX Series Devices
- play_arrow Content Security Policy-Antivirus Profiles
  - Creating Antivirus Profiles
  - Antivirus Profile Main Page Fields
- play_arrow Content Security Policy-Antispam Profiles
  - Creating Antispam Profiles
  - Antispam Profile Main Page Fields
- play_arrow Content Security Policy-Content Filtering Profiles
  - Creating Content Filtering Profiles
  - Content Filtering Profile Main Page Fields
- play_arrow Content Security Policy-Global Device Profiles
  - Creating Device Profiles
  - Device Profiles Main Page Fields
- play_arrow Content Security Policy-Default Configuration
  - About the Default Configuration Page
  - Create a Default Content Security Configuration
  - Edit and Clone the Default Configuration
  - View and Delete Unused Default Configuration
- play_arrow Content Security Policy-URL Patterns
  - Creating URL Patterns
- play_arrow Content Security Policy-Custom URL Categories
  - Creating Custom URL Category Lists
- play_arrow Application Routing Policies
  - Understanding Application-Based Routing
  - About the Application Routing Policies Page
  - Configuring Advanced Policy-Based Routing Policy
  - About the Rules Page (Advanced Policy-Based Routing)
  - Creating Advanced Policy-Based Routing Rules
  - About the App Based Routing Page
  - Edit and Clone Policies and Objects
  - Assigning Devices to Policies
  - Customizing Profile Names
  - Publishing Policies
  - Updating Policies on Devices
- play_arrow Threat Prevention - Policies
  - Creating Threat Prevention Policies
  - Threat Prevention Policy Overview
  - Threat Policy Analysis Overview
  - Implementing Threat Policy on VMWare NSX
- play_arrow Threat Prevention - Feed Sources
  - About the Feed Sources Page
  - Juniper ATP Cloud Realm Overview
  - Juniper ATP Cloud Malware Management Overview
  - Juniper ATP Cloud Email Management Overview
  - File Inspection Profiles Overview
  - Juniper ATP Cloud Email Management: SMTP Settings
  - Configure IMAP Settings
  - Creating Juniper ATP Cloud Realms and Enrolling Devices or Associating Sites
  - Modifying Juniper ATP Cloud Realm
  - Creating File Inspection Profiles
  - Creating Allowlist for Juniper ATP Cloud Email and Malware Management
  - Creating Blocklists for Juniper ATP Cloud Email and Malware Management
  - Add ATP Appliance Server
  - Edit or Delete a ATP Appliance Server
  - Custom Feed Sources Overview
  - Creating Custom Feeds
  - Example: Creating a Dynamic Address Custom Feed and Firewall Policy
  - Configuring Settings for Custom Feeds
- play_arrow IPsec VPN-VPNs
  - IPsec VPN Overview
  - Create a Site-to-Site VPN
  - Create a Hub-and-Spoke (Establishment All Peers) VPN
  - Create a Hub-and-Spoke (Establishment by Spokes) VPN
  - Create a Hub-and-Spoke Auto Discovery VPN
  - Create a Full Mesh VPN
  - Create a Remote Access VPN—Juniper Secure Connect
  - Create a Remote Access VPN—NCP Exclusive Client
  - IPsec VPN Global Settings
  - Understanding IPsec VPN Modes
  - Comparison of Policy-Based VPNs and Route-Based VPNs
  - Understanding IPsec VPN Routing
  - Understanding IKE Authentication
  - Publishing IPsec VPNs
  - Updating IPSec VPN
  - Modify IPsec VPN Settings
  - Viewing Tunnels
  - Importing IPsec VPNs
  - Deleting IPSec VPN
  - IPsec VPN Main Page Fields
- play_arrow IPsec VPN-Extranet Devices
  - Creating Extranet Devices
  - Find Usage for Extranet Devices
  - Extranet Devices Main Page Fields
- play_arrow IPsec VPN-Profiles
  - VPN Profiles Overview
  - Creating VPN Profiles
  - Edit and Clone IPsec VPN profiles
  - Assigning Policies and Profiles to Domains
  - VPN Profiles Main Page Fields
- play_arrow Insights
  - About the Log Parsers Page
  - Create a New Log Parser
  - Edit and Delete a Log Parser
  - About the Log Sources Page
  - Add a Log Source
  - Edit and Delete a Log Source
  - View Log Statistics
  - About the Event Scoring Rules Page
  - Create an Event Scoring Rule
  - Edit and Delete Event Scoring Rules
  - About the Incident Scoring Rules Page
  - Create an Incident Scoring Rule
  - Edit and Delete Incident Scoring Rules
- play_arrow Shared Objects-Geo IP
  - Creating Geo IP Policies
  - Geo IP Overview
  - Delete and Replace Policies and Objects
- play_arrow Shared Objects-Policy Enforcement Groups
  - Creating Policy Enforcement Groups
  - Policy Enforcement Groups Overview
- play_arrow Shared Objects-Addresses
  - Addresses and Address Groups Overview
  - Creating Addresses and Address Groups
  - Import and Export CSV Files
  - Assigning Addresses and Address Groups to Domains
  - Showing Duplicate Policies and Objects
  - Delete and Replace Policies and Objects
  - Addresses Main Page Fields
- play_arrow Shared Objects-Services
  - Services and Service Groups Overview
  - Creating Services and Service Groups
  - Import and Export CSV Files
  - Delete and Replace Policies and Objects
  - Showing Duplicate Policies and Objects
- play_arrow Shared Objects-Variables
  - Variables Overview
  - Creating Variables
  - Editing Variables
  - Import and Export CSV Files
  - Showing Duplicate Policies and Objects
- play_arrow Shared Objects-Zone Sets
  - Understanding Zone Sets
  - Creating Zone Sets
  - Edit and Clone Policies and Objects
  - Delete and Replace Policies and Objects
  - Finding Usages for Policies and Objects
  - Show and Delete Unused Policies and Objects
  - Showing Duplicate Policies and Objects
  - Viewing Policy and Shared Object Details
  - Zone Sets Main Page Fields
- play_arrow Shared Objects-Metadata
  - Metadata-Based Policy Enforcement Overview
  - About the Metadata Page
  - Creating a Metadata
- play_arrow Change Management-Change Requests
  - Change Control Workflow Overview
  - Creating a Firewall or NAT Policy Change Request
  - About the Changes Submitted Page
  - Approving and Updating Changes Submitted
  - Creating and Updating a Firewall Policy Using Change Control Workflow
  - Editing, Denying, and Deleting Change Requests
  - About the Changes Not Submitted Page
  - Discarding Policy Changes
  - Viewing Submitted and Unsubmitted Policy Changes
- play_arrow Change Management-Change Request History
  - About the Change Request History Page
- play_arrow Overview of Policy Enforcer and Juniper ATP Cloud
  - Policy Enforcer Overview
  - Benefits of Policy Enforcer
  - Juniper ATP Cloud Overview
- play_arrow Concepts and Configuration Types to Understand Before You Begin (Policy Enforcer and Juniper ATP Cloud)
  - Policy Enforcer Components and Dependencies
  - Policy Enforcer Configuration Concepts
  - Juniper ATP Cloud Configuration Type Overview
  - Features By Juniper ATP Cloud Configuration Type
  - Available UI Pages by Juniper ATP Cloud Configuration Type
  - Comparing the Juniper Connected Security and non-Juniper Connected Security Configuration Steps
- play_arrow Configuring Policy Enforcer Settings and Connectors
  - Policy Enforcer Settings
  - Policy Enforcer Connector Overview
  - Creating a Policy Enforcer Connector for Public and Private Clouds
  - Creating a Policy Enforcer Connector for Third-Party Switches
  - Editing and Deleting a Connector
  - Viewing VPC or Projects Details
  - Integrating ForeScout CounterACT with Juniper Networks Connected Security
  - ClearPass Configuration for Third-Party Plug-in
  - Cisco ISE Configuration for Third-Party Plug-in
  - Integrating Pulse Policy Secure with Juniper Networks Connected Security
  - Policy Enforcer Backup and Restore
  - Configure Certificate-Based Authentication in Policy Enforcer
- play_arrow Guided Setup-ATP Cloud with SDSN
  - Using Guided Setup for Juniper ATP Cloud with Juniper Connected Security
- play_arrow Guided Setup-ATP Cloud
  - Using Guided Setup for Juniper ATP Cloud
- play_arrow Guided Setup for No ATP Cloud (No Selection)
  - Using Guided Setup for No Juniper ATP Cloud (No Selection)
- play_arrow Manual Configuration- ATP Cloud with SDSN
  - Configuring Juniper ATP Cloud with Juniper Connected Security (Without Guided Setup) Overview
- play_arrow Manual Configuration-ATP Cloud
  - Configuring Juniper ATP Cloud (No Juniper Connected Security and No Guided Setup) Overview
  - Creating Juniper ATP Cloud Realms and Enrolling Devices or Associating Sites
- play_arrow Cloud Feeds Only Threat Prevention
  - Configuring Cloud Feeds Only
- play_arrow Configuring No ATP Cloud (No Selection) (without Guided Setup)
  - Configuring No ATP Cloud (No Selection) (without Guided Setup) Overview
- play_arrow Migration Instructions for Spotlight Secure Customers
  - Moving From Spotlight Secure to Policy Enforcer
play_arrow Reports
- play_arrow Reports
play_arrow Administration
- play_arrow My Profile
  - Modifying Your User Profile in Security Director
- play_arrow Users and Roles-Users
- play_arrow Users and Roles-Roles
- play_arrow Users and Roles-Domains
- play_arrow Users and Roles-Remote Profiles
- play_arrow Logging Management
  - Logging and Reporting Overview
- play_arrow Logging Management-Logging Nodes
- play_arrow Logging Management-Statistics & Troubleshooting
  - Using the Log Statistics and Troubleshooting
- play_arrow Logging Management-Logging Devices
  - Logging Devices Main Page Fields
  - Creating Security Logs
- play_arrow Monitor Settings
  - About the Monitor Settings Page
  - Monitor Settings Overview
- play_arrow Signature Database
- play_arrow License Management
  - About the License Notification Settings Page
  - Notification Settings
- play_arrow Migrating Content from NSM to Security Director
  - NSM Migration
- play_arrow Policy Sync Settings
  - About the Policy Sync Settings Page
  - Out-of-Band Changes Overview
- play_arrow Insights Management

list Table of Contents

English

Benefits
Before You Begin
Overview
Generate SSL certificates
Upload the CA Certificate
Upload the User Certificate
Upload X.509 Certificate File in Policy Enforcer
Configure the Web Browser Settings
Change the User Authentication Mode to Certificate-Based Authentication Mode
Verify the Certificate-Based Authentication Mode
Troubleshoot Authentication Issues

keyboard_arrow_right

Configure Certificate-Based Authentication in Policy Enforcer

date_range 07-Jan-25

arrow_backward

arrow_forward

Users typically gain access to resources from an application or system on the basis of their username and password. You can also use certificates to authenticate and authorize sessions among various servers and users. Only one authentication mode is supported at a time and all users are authenticated using the selected authentication mode. In this use case, you’ll learn how to configure certificate-based authentication for a Policy Enforcer user.

Benefits

Certificate-based authentication over a Secure Sockets Layer (SSL) connection is the most secure type of authentication.

Before You Begin

Install Junos Space Security Director. See Junos Space Security Director Installation and Upgrade Guide.
Install and configure Security Director Insights as Policy Enforcer, see Security Director Insights Installation and Upgrade Guide.
Generate X.509 certificates, and make sure that the user certificates are available on your local machine. See Generate SSL certificates.

Note:

Only mandatory fields and other required fields are included in the procedures in this use case.

Overview

Starting in Policy Enforcer Release 20.1R1, you can enable certificate-based authentication for the Policy Enforcer user.

The following topology shows Policy Enforcer configured in Junos Space Security Director. The user can configure certificate-based authentication mode and use certificates to gain access to the application.

Generate SSL certificates

Let’s learn how to generate a certification authority (CA) certificate, generate a client certificate and a private key for the SSL client, and then convert the client certificate and private key to Personal Information Exchange-pkcs#12 format for use by web browsers.

Generate a CA certificate
Generate Client SSL certificates
Copy the Certificates from the Linux Server to Your Local Machine

Generate a CA certificate

Log in to the Linux server.
Run the following command:
openssl req -newkey rsa:4096 -keyform PEM -keyout ca.key -x509 -days 3650 -outform PEM -out ca.cer
Enter the PEM passphrase, for example: 1234.
You’ll need this passphrase while you generate client certificates.
Enter the following details, for example:
- Country Name: IN
- State or Province name: KAR
- Locality Name: BAN
- Organization Name: Juniper
- Organization Unit Name: space
- Common Name: space_user
  
  The certificate is issued by this name.
- Email Address: example@juniper.com
The CA certificate is generated.

Generate Client SSL certificates

Log in to the Linux server.
Run the following command to generate a private key for the SSL client, for example: client1.key.
openssl genrsa -out client1.key 4096
Run the following command to generate the certificate request, for example: client1.req.
openssl req -new -key client1.key -out client1.req
Enter the following details for client1, for example:
- Country Name: IN
- State or Province name: KAR
- Locality Name: BAN
- Organization Name: Juniper
- Organization Unit Name: space
- Common Name: space_user1
  
  The certificate is issued by this name.
- Email Address: example1@juniper.com
Enter the challenge password, for example: 12345.
Run the following command to issue the client certificate using the certificate request and the CA key, for example: client1.cer.
openssl x509 -req -in client1.req -CA ca.cer -CAkey ca.key -set_serial 101 -extensions client1 -days 365 -outform PEM -out client1.cer
Enter the passphrase for the ca.key as 1234. This must be the same passphrase that you provided while creating the CA certificate in Step 3.
Run the following command to convert the client certificate and private key to pkcs#12 format for use by web browsers, for example: client1.p12 (Personal Information Exchange file type).
openssl pkcs12 -export -inkey client1.key -in client1.cer -out client1.p12
Enter the export password, for example 123456.
You’ll need this password to import the certificate to the web browser.

The following certificates are generated:

Similarly, generate client2.cer, client2.key, and client2.p12 certificates with the following details, for example:
- Country Name: IN
- State or Province name: KAR
- Locality Name: BAN
- Organization Name: Juniper
- Organization Unit Name: space
- Common Name: space_user2
  
  The certificate is issued by this name.
- Email Address: example2@juniper.com

Note:

In this example, we will use the generated client1 certificates for the Junos Space user (user1) and client2 certificates for the Policy Enforcer user (pe_user).

Copy the Certificates from the Linux Server to Your Local Machine

Log in to the WinSCP client to copy the certificates that you generated from the Linux server to your local machine.
You can use any file transfer protocol client.
Select the file protocol as SFTP.
Enter the hostname of the Linux server, username, and password, and click Login.
Select the certificate files that you generated in the Linux server, and copy the files to the preferred location on your local machine.

Upload the CA Certificate

Let’s upload the CA certificate or the root certificate to verify user certificates. The private key of the root certificate is used to sign the user certificates, which then inherits the trustworthiness of the root certificate.

To upload a CA certificate:

Log in to Junos Space Network Management Platform.
Select Administration > CA/CRL Certificates.
The CA CRL Certificates page is displayed.
Click the arrow next to the + icon, and select X.509 CA Certificate.
The Upload X.509 CA Certificate File page is displayed.
Browse the X.509 CA certificate file (for example: ca.cer) from your local machine that you generated in Generate SSL certificates.
Click Upload.
A success message is displayed after you upload the valid certificate. You can view the CA certificate details on the CA/CRL Certificates page.

Upload the User Certificate

Let’s upload user certificates to authenticate the Junos Space user by using certificate-based authentication. You need to upload the corresponding certificate for each user for the Junos Space server to authenticate the user. To create a user in Junos Space Network Management Platform, see Create Users in Junos Space Network Management Platform.

To upload the user certificate for an existing user, for example user1:

Log in to Junos Space Network Management Platform.
Select Role Based Access Control > User Accounts.
The User Accounts page is displayed.
Right-click the Junos Space user, for example: user1, and select Modify User.
The Modify User page for user1 is displayed.
In the X509 Cert File field, browse the X.509 certificate file (for example: client1.cer) from your local machine that you generated in Generate SSL certificates.
Click Upload.
A success message is displayed.

Upload X.509 Certificate File in Policy Enforcer

After you configure Policy Enforcer, a new user called pe_user is created. You must add X.509 certificate for the pe_user for seamless certificate-based authentication. Policy Enforcer authenticates with Junos Space Security Director and Junos Space Network Management Platform using certificates in the certificate-based authentication mode.

Log in to Junos Space Security Director.
Select Administration > Policy Enforcer > Settings.
The Settings page is displayed.
Enable Certificate Based Authentication.
This provides seamless operation when Junos Space Network Management Platform user switches to certificate-based authentication mode.
Browse the X509 certificate file, for example: client2.cer, and X509 certificate key file, for example: client2.key that you generated in Generate SSL certificates.
Click OK.

After uploading the certificates on the Settings Page, navigate to Junos Space Network Management Platform, select User > Role Based Access control > User Accounts. Right-click the pe_user, and select Modify User. Here, you can view the certificate details uploaded for the pe_user.

Configure the Web Browser Settings

You must import the Personal Information Exchange-pkcs#12 file type certificate uploaded to the Junos Space user (user1) on all the supported web browser settings page. In this example, let’s upload the client1.p12 on Google Chrome to enable certificate-based authentication.

Open the Google Chrome web browser.

Note:
You can use any supported web browser.
Click on the ellipsis icon on the top-right corner of the web browser, and select Settings.
Select Security and Privacy.
The Security and Privacy page is displayed.
Select Security.
The Security page is displayed.
Select Manage Certificates.
The Certificates page is displayed.
Click Import.
The Certificate Import Wizard is displayed.
Browse the personal information file type, for example: client1.p12.
You must select the personal information file type of the same certificate that you selected for the Junos Space Network Management Platform user (user1) as in Upload the User Certificate.
Click Next.
Enter the password for the private key as 123456. You must use the same password that you provided in Step 9 while creating the client1 certificates.
Browse the location to store the certificate.
A summary of certificate details is displayed.
Click Finish.
A pop-up is displayed confirming the import of new private exchange key.
Click OK.
A success message is displayed and the certificate is added to your web browser settings.

Change the User Authentication Mode to Certificate-Based Authentication Mode

Now let’s change the authentication mode from password-based to complete certificate–based for users to get authenticated on the basis of their certificates.

Log in to Junos Space Network Management Platform.
Select Administration > Application.
Right-click Network Management Platform, and select Modify Application Settings.
The Modify Network Management Platform Settings page is displayed.
Select User.
The User page is displayed.
Select the Use X509 Certificate Complete Certificate option as the authentication mode.
The Change Summary page is displayed.
Click Confirm to enable the certificate-based authentication.
When you change the authentication mode, all existing user sessions, except that of the current administrator who is changing the authentication mode, are automatically terminated and the users are forced to log out.

Verify the Certificate-Based Authentication Mode

Purpose
Action

Purpose

Let’s verify that you can log in to Junos Space Network Management Platform using certificates.

Action

Access the Junos Space Network Management Platform application.

The following pop-up is displayed.
Click OK.

The Security Page is displayed.
Click Allow.

The user1 is logged in to the Junos Space Network Management application without providing any username and password.

Problem

Description

You must follow all the steps in the previous sections to enable certificate-based authentication. However, if you are restricted from logging in by using certificate–based authentication mode, then you can change the authentication mode to password-based from the CLI.

Solution

To change the authentication mode to password-based authentication from the CLI:

Log in to the CLI of the Junos Space server VIP node.
Navigate to the following directory: /var/www/cgi-bin.
Type the following command:

./setSpaceAuthMode password-based

The authentication mode is changed to password-based, and you can login with the username and password.

arrow_backward PREVIOUS Policy Enforcer Backup and Restore

NEXT arrow_forward Using Guided Setup for Juniper ATP Cloud with Juniper Connected Security

Junos Space Security Director User Guide

ON THIS PAGE