- play_arrow Introduction
- play_arrow Dashboard
- play_arrow Monitor
- play_arrow Alerts
- play_arrow Logs
- play_arrow Maps and Charts
- play_arrow Tunnel Status
- play_arrow Service Locations
- play_arrow Advanced Threat Prevention
- Hosts Overview
- Host Details
- Threat Sources Overview
- Threat Source Details
- Reverse Shell Overview
- Add IP Address to Allowlist
- HTTP File Download Overview
- HTTP File Download Details
- Signature Details
- Manual Scanning Overview
- SMB File Download Overview
- SMB File Download Details
- Email Attachments Scanning Overview
- Email Attachments Scanning Details
- DNS DGA Detection Overview
- DNS Tunnel Detection Overview
- DNS DGA and Tunneling Detection Details
- Encrypted Traffic Insights Overview
- Encrypted Traffic Insights Details
- SMTP Quarantine Overview
- IMAP Block Overview
- Telemetry Overview
- play_arrow Reports
- play_arrow Report Definitions
- Report Definitions Main Page Fields
- Create and Manage Threat Assessment Report Definitions
- Create and Manage Application User Usage Report Definitions
- Create and Manage IPS Report Definitions
- Create and Manage Rule Analysis Report Definitions
- Create and Manage Security Events Report Definitions
- Create and Manage Top Talkers Report Definitions
- Create and Manage Network Operations Report Definitions
- Create and Manage URLs Visited Per User Report Definitions
- Create and Manage Log Streaming Report Definitions
- Using Report Definitions
- Editing Report Definitions
- Deleting Report Definitions
- play_arrow Generated Reports
- play_arrow ATP Report Definitions
- play_arrow ATP Generated Reports
- play_arrow Secure Edge Reports
-
- play_arrow SRX Security Policy
- play_arrow SRX Security Policies
- play_arrow SRX Security Policy Rules
- Security Policy Rules Overview
- Security Policy Rule Analysis Overview
- Add and Manage Security Policy Rules
- Analyze Security Policy Rules
- Edit, Clone, and Delete a Security Policy Rule
- Reorder a Security Policy Rule
- Configure Default Rule Option
- Select a Security Policy Rule Source
- Select a Security Policy Rule Destination
- Select Applications and Services
- Common Operations on a Security Policy Rule
- Add SRX Policy Rules to Secure Edge Policy (From SRX Policy Page)
- play_arrow SRX Security Policy Versions
- play_arrow Device View
-
- play_arrow SRX Security Subsciptions
- play_arrow IPS Profiles
- play_arrow IPS Signatures
- play_arrow Content Security
- play_arrow Content Security Profiles
- play_arrow Web Filtering Profiles
- play_arrow Antivirus Profiles
- play_arrow Antispam Profiles
- play_arrow Content Filtering Profiles
- play_arrow Content Filtering Policies (New)
- play_arrow Decrypt Profiles
- play_arrow SecIntel
- play_arrow SecIntel Profiles
- play_arrow SecIntel Profile Groups
- play_arrow Anti-Malware
- play_arrow Secure Web Proxy
- play_arrow Flow-Based Antivirus
- play_arrow ICAP Redirect Profile
- play_arrow Metadata Streaming Policy
- Security Metadata Streaming Policies Overview
- Create and Manage Metadata Streaming Profiles
- Create and Manage Metadata Streaming Profiles to Detect all DNS Threats
- Create and Manage Metadata Streaming Profiles to Detect DGA-Based Threats
- Create and Manage Metadata Streaming Profiles to Detect DNS Tunnels
- Create and Manage Metadata Streaming Profiles to Detect all HTTP Threats
- Create and Manage Metadata Streaming Profiles to Detect Command-and-Control (C2) Communications
- Edit, Clone, or Delete Metadata Streaming Profile
- Create and Manage Metadata Streaming Rules
- Edit or Delete Metadata Streaming Rule
- Deploy Metadata Streaming Policy
- Import Metadata Streaming Policy and DNS Cache
- play_arrow DNS Filter
-
- play_arrow SRX IPSec VPN
- play_arrow IPsec VPNs
- IPsec VPN Overview
- Understanding IPsec VPN Modes
- Understanding IPsec VPN Routing
- Understanding IKE Authentication
- IPsec VPN Global Settings
- Create a Policy-Based Site-to-Site VPN
- Create a Route-Based Site-to-Site VPN
- Create a Hub-and-Spoke (Establishment All Peers) VPN
- Create a Hub-and-Spoke (Establishment by Spokes) VPN
- Create a Hub-and-Spoke Auto Discovery VPN
- Create a Remote Access VPN—Juniper Secure Connect
- Importing IPsec VPNs
- Deploy an IPsec VPN
- Modify IPsec VPN Settings
- Delete an IPsec VPN
- play_arrow VPN Profiles
- play_arrow Extranet Devices
-
- play_arrow SRX NAT
- play_arrow NAT Policies
- play_arrow NAT Pools
- Devices with NAT Policies
-
- play_arrow SRX Identity
- play_arrow JIMS
- play_arrow Active Directory
- play_arrow Access profile
- play_arrow Address Pools
-
- play_arrow Secure Edge Service Management
- Juniper Secure Edge Overview
- Service Locations Overview
- Create and Manage Service Locations
- Edit and Delete Service Locations
- Sites Overview
- Create and Manage Sites
- Create and Manage Bulk Sites
- Edit and Delete Sites
- About the IPsec Profiles Page
- Create and Manage IPsec Profiles
- Edit or Delete an IPsec Profile
- External Probe Overview
- play_arrow Secure Edge Security Policy
- Secure Edge Policy Overview
- Add and Manage Secure Edge Policy Rules
- Edit, Clone, and Delete a Secure Edge Policy Rule
- Reorder a Security Policy Rule
- Select a Secure Edge Policy Source
- Select a Secure Edge Policy Destination
- Select Applications and Services
- Common Operations on a Secure Edge Policy
- Deploy Secure Edge Policies
- Add SRX Policy Rules to Secure Edge Policy (From Secure Edge Policy Page)
- play_arrow Secure Edge Security Subscriptions
- IPS Policies Overview
- IPS Policies Overview
- Create and Manage IPS Rules
- Edit, Clone, and Delete IPS Rules
- Create and Manage Exempt Rules
- Edit, Clone, and Delete Exempt Rule
- Web Filtering Profiles Overview
- Web Filtering Profiles Overview
- Create and Manage Web Filtering Profiles
- Edit, Clone, and Delete a Web Filtering Profile
- CASB Overview
- CASB Profiles Overview
- Create and Manage CASB Profiles
- Edit and Delete a CASB Profile
- CASB Rules Overview
- Add and Manage CASB Profile Rules
- Edit and Delete a CASB Rule
- Application Instances Overview
- Create and Manage Application Instances
- Edit and Delete an Application Instance
- Application Tagging Overview
- Content Filtering Policies Overview
- Content Filtering Policies Overview
- Create and Manage Content Filtering Policies
- Add and Manage Content Filtering Policy Rules
- Edit and Delete a Content Filtering Policy
- Edit, Clone, and Delete a Content Filtering Policy Rule
- SecIntel Profiles Overview
- SecIntel Profiles Overview
- Create and Manage Command and Control Profiles
- Create and Manage DNS Profiles
- Create and Manage Infected Hosts Profiles
- Edit, Clone, and Delete SecIntel Profile
- SecIntel Profile Groups Overview
- Create and Manage SecIntel Profile Groups
- Edit, Clone, and Delete SecIntel Profile Group
- Anti-malware Profiles Overview
- About Anti-malware Profiles
- Create and Manage Anti-malware Profiles
- Edit, Clone, and Delete Anti-malware Profile
- Create a DNS Security Profile
- Create an Encrypted Traffic Insights Profile
- play_arrow Secure Edge Service Administration
- Certificate Management Overview
- Certificate Management Overview
- Generate and Manage Certificates
- Upload and Download a Certificate
- Regenerate and Delete a Certificate
- Add Juniper Clouds Root CA Certificate on Microsoft Windows
- Add Juniper Clouds Root CA Certificate on MacOS
- Add Juniper Clouds Root CA Certificate in Google Chrome
- Add Juniper Clouds Root CA Certificate in Mozilla Firefox
- Proxy Auto Configuration Files Overview
- Proxy Auto Configuration (PAC) Files Overview
- Edit, Clone, and Delete a Proxy Auto Configuration File
- Distribute a Proxy Auto Configuration File URL to Web Browsers
- Manually Add a Proxy Auto Configuration File URL to a Web Browser
- Configure an Explicit Proxy Profile
- Decrypt Profiles Overview
- Decrypt Profiles Overview
- Create and Manage Decrypt Profiles
- Edit, Clone, and Delete a Decrypt Profile
- play_arrow Secure Edge Identity
- End User Authentication Overview
- About the End User Authentication Page
- Add and Manage End User Profiles
- Create a SAML Profile
- Create an LDAPS Profile
- Manage the Hosted Database
- Edit and Delete an End User Profile
- Add and Manage Groups
- Edit and Delete a Group
- Juniper Identity Management Service Overview
- Juniper Identity Management Service Overview
- JIMS Collector Onboarding Overview
- Onboard JIMS Collector
- Create JIMS Collector Service Accounts
- Install JIMS Collector
- Configure JIMS Collector to Get Information from the Directory Service
- Configure JIMS Collector to Get Microsoft Event Logs
- Configure JIMS Collector to Probe Unknown IP Addresses
- Delete JIMS Collector
- Authentication Settings Overview
- Configure the Authentication Frequency
- play_arrow Secure Edge CASB and DLP
- play_arrow Shared Services Firewall Policies
- play_arrow Rule Options
- play_arrow Redirect Profiles
-
- play_arrow Shared Services Objects
- play_arrow Addresses
- play_arrow GeoIP
- play_arrow Services
- play_arrow Applications
- play_arrow Schedules
- play_arrow URL Patterns
- play_arrow URL Categories
- play_arrow SSL Initiation Profile
-
- play_arrow Shared Services Advanced Threat Prevention
- Enroll an SRX Series Firewall using Juniper ATP Cloud Web Portal
- Remove an SRX Series Firewall From Juniper Advanced Threat Prevention Cloud
- Search for SRX Series Firewalls Within Juniper Advanced Threat Prevention Cloud
- Device Information
- File Inspection Profiles Overview
- Create File Inspection Profiles
- Email Management Overview
- Configure SMTP Email Management
- Configure IMAP Email Management
- Adaptive Threat Profiling Overview
- Create an Adaptive Threat Profiling Feed
- Allowlists Overview
- Create Allowlists
- Blocklists Overview
- Create Blocklists
- SecIntel Feeds Overview
- Configure DAG Filter
- Global Configuration for Infected Hosts
- Enable Logging
- Configure Threat Intelligence Sharing
- Configure Trusted Proxy Servers
- Configure Webhook
- play_arrow Administration
- play_arrow Subscriptions
- play_arrow Users & Roles
- play_arrow Single Sign-On Configuration
- play_arrow Two-Factor Authentication
- play_arrow Audit Logs
- play_arrow Service Updates
- play_arrow Jobs
- play_arrow Data Management
- play_arrow Log Streaming
- play_arrow URL Recategorization
- play_arrow API Security
- play_arrow Organization
- play_arrow ATP Mapping
- play_arrow ATP Audit Logs
- play_arrow ATP Application Tokens
-
ON THIS PAGE
Add Devices
Overview
You can add devices to Juniper Security Director Cloud in the following ways:
Using Commands - Juniper Security Director Cloud generates commands for adding an individual device, device cluster, or MNHA pair devices. When you copy-paste and commit the commands into the device console, the device, device cluster, or MNHA pair devices are added to Juniper Security Director Cloud. See Add Standalone Devices, Device Clusters, or MNHA Pair Devices Using Commands. For the list of supported SRX Series firewalls on which MNHA is supported, see the High Availability User Guide.
Note:Juniper Security Director Cloud supports MNHA pair devices running Junos OS Release 22.4R1 or later.
Zero Touch Provisioning - You can configure and provision devices automatically without any manual intervention. See Add Devices Using Zero Touch Provisioning.
Using J-Web - See Add an SRX Series Firewall to Juniper Security Director Cloud in the J-Web User Guide for SRX Series Firewalls for details.
From Security Director - See Add Devices to Security Director Cloud in the Security Director User Guide for details.
By scanning QR code - Onboard cloud-ready SRX firewalls by scanning the device QR code. See Add Device by Scanning QR Code.
Before You Begin
Ensure that each SRX Series Firewall port can communicate with a Juniper Security Director Cloud FQDN. The FQDN of each region is different.
Table 1: Region to FQDN Mapping Region Purpose Port FQDN North Virginia, US
ZTP
443
jsec2-virginia.juniperclouds.net
Outbound SSH
7804
srx.sdcloud.juniperclouds.net
Syslog TLS
6514
srx.sdcloud.juniperclouds.net
Ohio, US
ZTP
443
jsec2-ohio.juniperclouds.net
Outbound SSH
7804
srx.jsec2-ohio.juniperclouds.net
Syslog TLS
6514
srx.jsec2-ohio.juniperclouds.net
Montreal, Canada
ZTP
443
jsec-montreal2.juniperclouds.net
Outbound SSH
7804
srx.jsec-montreal2.juniperclouds.net
Syslog TLS
6514
srx.jsec-montreal2.juniperclouds.net
Frankfurt, Germany
ZTP
443
jsec-frankfurt.juniperclouds.net
Outbound SSH
7804
srx.jsec-frankfurt.juniperclouds.net
Syslog TLS
6514
srx.jsec-frankfurt.juniperclouds.net
Use TCP port 53 and UDP port 53 to connect to Google DNS servers (IP addresses—8.8.8.8 and 8.8.4.4). The Google DNS servers are specified as the default servers in the factory settings of the SRX Series Firewalls. You must use these default DNS servers when you use ZTP to onboard the firewalls. You can use private DNS servers when you use other methods to onboard the firewalls. Note that you must make sure that the private DNS servers can resolve the Juniper Security Director Cloud FQDNs.
To discover and manage the device from Juniper Security Director Cloud, ensure that the netconf and ssh rate limit is set to 32 or higher on the device. For more information, see Junos CLI Reference.
Add Standalone Devices, Device Clusters, or MNHA Pair Devices Using Commands
Juniper Security Director Cloud generates commands for adding a standalone device, a device cluster, or a multinode high availability (MNHA) pair devices. You can copy-paste and commit the commands into the device console, after which the devices are discovered and added to Juniper Security Director Cloud. For more information about MNHA, see the High Availability User Guide.
After discovery is complete, the status in the Management Status column changes to Up. If the discovery fails, Discovery failed status is displayed. Hover over the Discovery failed status to see the reason for the failure.
If the job fails for an MNHA pair, the deployment mode is not displayed beside the MNHA pair name. You can delete and add the MNHA pair again or initiate the discovery process again.
If security certificate installation job failed on a device in the MNHA pair, retry the job from the Jobs page and then reinitiate security logs configuration for the device from the Devices page.
Auto Import Behavior on Devices Added to Juniper Security Director Cloud
If you have selected the auto-import option under the Organization tab and the devices are managed using the adopt devices method and device discovery profiles, this will automatically import security policies, NAT and referred objects. See About the Organization Page.
The auto import process creates copies of objects that conflict with the existing objects in Juniper Security Director Cloud.
The auto import process does not overwrite default Content Security settings in Juniper Security Director Cloud. The existing Content Security configuration is considered instead of the imported device configuration. We recommend you review and configure the Content Security settings in Juniper Security Director Cloud before managing the device. See Configure the Content Security Settings.
Add Devices Using Zero Touch Provisioning
You can configure and provision devices automatically using Zero Touch Provisioning (ZTP). ZTP reduces the manual intervention for adding devices to a network. To ensure valid devices are onboarded through ZTP, you can configure Juniper Security Director Cloud to prompt you to approve or reject onboarding requests.
For supported cloud-ready SRX Series Firewalls , see Juniper Security Director Cloud Supported Firewalls.
To add other devices models, configure the basic device settings and connectivity, and add the device using Add Standalone Devices, Device Clusters, or MNHA Pair Devices Using Commands.
The devices are added and displayed on the Devices page and the device discovery process is initiated.
If Juniper Security Director Cloud is configured to prompt you to approve or reject onboarding requests for devices through ZTP, a link to approve or reject the request is displayed in the Management Status column. See Approve or Reject Onboarding Requests for ZTP Devices.
Add Device by Scanning QR Code
You can add cloud-ready SRX Series Firewalls to Juniper Security Director Cloud by scanning the QR code available on the firewall. Your SRX Series Firewall is cloud-ready if it has a QR claim code on the front or the back panel.
The firewall is powered on.
The firewall is not already added in an organization. You can add a firewall in only one organization.
Approve or Reject Onboarding Requests for ZTP Devices
The Approve/reject device onboarding requests toggle button on the Organization page must be enabled to receive onboarding requests.
Zero Touch Provisioning (ZTP) reduces the manual intervention for adding devices to a network. However, to ensure valid devices are onboarded through ZTP, you can configure Juniper Security Director Cloud to prompt you to approve or reject onboarding requests for devices.
When you enter an incorrect serial number, an onboarding request is not generated. It ensures that only devices with valid serial numbers are added in Juniper Security Director Cloud.
