close

keyboard_arrow_left

Table of Contents Expand all

play_arrow vSRX Virtual Firewall Deployment for KVM
- play_arrow Overview
  - Understand vSRX Virtual Firewall with KVM
  - Requirements for vSRX Virtual Firewall on KVM
- play_arrow Install vSRX Virtual Firewall in KVM
- play_arrow vSRX Virtual Firewall VM Management with KVM
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters on KVM
play_arrow vSRX Virtual Firewall Deployment for VMware
- play_arrow Overview
  - Understand vSRX Virtual Firewall with VMware
  - Requirements for vSRX Virtual Firewall on VMware
- play_arrow Install vSRX Virtual Firewall in VMware
- play_arrow vSRX Virtual Firewall VM Management with VMware
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters in VMware
play_arrow vSRX Virtual Firewall Deployment for Microsoft Hyper-V
- play_arrow Overview
  - Understand vSRX Virtual Firewall with Microsoft Hyper-V
  - Requirements for vSRX Virtual Firewall on Microsoft Hyper-V
- play_arrow Install vSRX Virtual Firewall in Microsoft Hyper-V
- play_arrow vSRX Virtual Firewall VM Management with Microsoft Hyper-V
- play_arrow Configure vSRX Virtual Firewall Chassis Clusters
  - vSRX Virtual Firewall Cluster Staging and Provisioning in Hyper-V
  - Configure a vSRX Virtual Firewall Chassis Cluster in Junos OS
play_arrow vSRX Virtual Firewall Deployment for Contrail
- play_arrow Overview of vSRX Virtual Firewall Service Chains in Contrail
- play_arrow Install vSRX Virtual Firewall in Contrail
- play_arrow vSRX Virtual Firewall VM Management with Contrail
play_arrow vSRX Virtual Firewall Deployment for Nutanix
- play_arrow Overview
  - Understand vSRX Virtual Firewall Deployment with Nutanix
  - Requirements for vSRX Virtual Firewall on Nutanix
- play_arrow Install vSRX Virtual Firewall in Nutanix
  - Launch and Deploy vSRX Virtual Firewall in Nutanix AHV Cluster
  - Upgrade the Junos OS for vSRX Virtual Firewall Software Release
play_arrow vSRX Virtual Firewall Deployment for AWS
play_arrow vSRX Virtual Firewall Deployment for Microsoft Azure
- play_arrow Overview
  - Understand vSRX Virtual Firewall with Microsoft Azure Cloud
  - Requirements for vSRX Virtual Firewall on Microsoft Azure
- play_arrow Deploy vSRX Virtual Firewall from the Azure Portal
- play_arrow Deploy vSRX Virtual Firewall from the Azure CLI
  - Before You Deploy vSRX Virtual Firewall Using the Azure CLI
  - Deploy vSRX Virtual Firewall from the Azure CLI
- play_arrow Configure and Manage vSRX Virtual Firewall for Microsoft Azure
- play_arrow Configure Azure Features on vSRX Virtual Firewall and Use Cases
play_arrow vSRX Virtual Firewall Deployment for Google Cloud Platform
- play_arrow Overview
  - Understand vSRX Virtual Firewall Deployment with Google Cloud
  - Requirements for vSRX Virtual Firewall on Google Cloud Platform
- play_arrow Install vSRX Virtual Firewall in Google Cloud
play_arrow vSRX Virtual Firewall Deployment for IBM Cloud
- play_arrow Overview
- play_arrow Installing and Configuring vSRX Virtual Firewall in IBM
- play_arrow Managing vSRX Virtual Firewall in IBM Cloud
  - vSRX Virtual Firewall Configuration and Management Tools
  - Managing Security Policies for Virtual Machines Using Junos Space Security Director
- play_arrow Monitoring and Troubleshooting
  - Technical Support
play_arrow vSRX Virtual Firewall Deployment for OCI
- play_arrow Overview
  - Understanding vSRX Virtual Firewall Deployment in Oracle Cloud Infrastructure
  - Requirements for vSRX Virtual Firewall on Oracle Cloud Infrastructure
- play_arrow Installing vSRX Virtual Firewall in OCI
  - vSRX Virtual Firewall Deployment in Oracle Cloud Infrastructure
  - Upgrade the Junos OS for vSRX Virtual Firewall Software Release
- play_arrow vSRX Virtual Firewall Licensing
  - Licenses for vSRX Virtual Firewall

list Table of Contents

English

Centralized Monitoring and Troubleshooting using AWS Features

date_range 27-May-23

arrow_backward

arrow_forward

This topic provides you details on how you can perform monitoring and troubleshooting of your vSRX Virtual Firewall instances on the AWS console by integrating vSRX Virtual Firewall with CloudWatch, IAM, and Security Hub.

Understanding Centralized Monitoring Using Cloudwatch

AWS provides a comprehensive view of various metrics, logs, security events from third-party services across AWS accounts. With the support of CloudWatch, vSRX Virtual Firewall can publish native metrics and logs to cloud, which you can use to monitor vSRX Virtual Firewall running status. Security Hub is the single place that aggregates, organizes and prioritizes security alerts.

The CloudWatch logs agent provides an automated way to send log data to CloudWatch Logs from Amazon EC2 instances. The agent pushes log data to CloudWatch Logs.

The cloudagent daemon that runs on the vSRX Virtual Firewall allows integration of AWS CloudWatch and Security Hub. The cloudagent:

Collects device metrics and send metrics to AWS CloudWatch
Collects system and security logs and sends the logs to AWS CloudWatchLog

Any event type (component or log level) that can be collected by the cloudagent under vSRX Virtual Firewall event log mode is supported for CloudWatch log collection. Events supported for CloudWatchLog are:
- System activities such as Interfaces status (up/down), configuration changes, user login logout and so on.
- Security events such as IDP, ATP Cloud, and security logs such as Content Security logs, and Screen, ATP Cloud and so on.
Collects security alerts and import those alerts to Security Hub in security finding format.

To import security events to Security Hub, you need to configure CloudWatch log collection and import the security events based on the log messages.

Security Hub collects security data from across AWS accounts, services, and supported third-party partners and helps you analyze your security trends and identify the highest priority security issues. After the AWS security hub support is added on vSRX Virtual Firewall, it helps administrator reduces the effort of collecting and prioritizing security findings across accounts. With the help of Security hub, you can run automated, continuous account-level configuration and compliance checks based on vSRX Virtual Firewall security output.

For the list of events and metrics that are imported, see Table 1 and Table 2.

For more information on the events and their purpose, see Juniper System Log Explorer.

Table 1: Events Imported to Security Hub
Metric	Description
AV_MANY_MSGS_NOT_SCANNED_MT	Skip antivirus scanning due to excessive traffic
WEBFILTER_URL_BLOCKED	Web request blocked
AAMW_CONTENT_FALLBACK_LOG	AAMW content fallback info
AV_MANY_MSGS_DROPPED_MT	Drop the received file due to excessive traffic
PFE_SCREEN_MT_CFG_ERROR	screen config failure
WEBFILTER_URL_REDIRECTED	Web request redirected
AV_FILE_NOT_SCANNED_PASSED_MT	The antivirus scanner passed the received traffic without scanning because of exceeding the maximum content size
RT_SCREEN_TCP_SRC_IP	TCP source IP attack
RT_SCREEN_SESSION_LIMIT	Session limit
SECINTEL_ACTION_LOG	Secintel action info
IDP_APPDDOS_APP_STATE_EVENT	IDP: DDOS application state transition event
AAMW_HOST_INFECTED_EVENT_LOG	AAMW cloud host status event info
IDP_ATTACK_LOG_EVENT	IDP attack log
IDP_SESSION_LOG_EVENT	IDP session event log
AAMW_MALWARE_EVENT_LOG	AAMW cloud malware event info
WEBFILTER_URL_PERMITTED	Web request permitted
IDP_PACKET_CAPTURE_LOG_EVENT	IDP packet captutre event log
RT_SCREEN_WHITE_LIST	Screen white list
RT_SCREEN_IP	IP attack
AAMW_SMTP_ACTION_LOG	AAMW SMTP action info
RT_SCREEN_TCP_DST_IP	TCP destination IP attack
IDP_APPDDOS_APP_ATTACK_EVENT	IDP: DDOS attack on application
RT_SCREEN_ICMP	ICMP attack
IDP_TCP_ERROR_LOG_EVENT	IDP TCP error log
AV_FILE_NOT_SCANNED_DROPPED_MT	The antivirus scanner dropped the received traffic without scanning because of exceeding the maximum content size
AAMW_ACTION_LOG	AAMW action info
PFE_SCREEN_MT_ZONE_BINDING_ERROR	screen config failure
AV_VIRUS_DETECTED_MT	The antivirus scanner detected a virus
PFE_SCREEN_MT_CFG_EVENT	screen config
RT_SCREEN_TCP	TCP attack
RT_SCREEN_UDP	UDP attack
AV_SCANNER_DROP_FILE_MT	The antivirus scanner dropped the received traffic because of an internal error
AAMW_IMAP_ACTION_LOG	AAMW IMAP action info
AV_SCANNER_ERROR_SKIPPED_MT	Skip antivirus scanning due to an internal error
AV_MEMORY_INSUFFICIENT_MT	The DRAM size is too small to support antivirus

Table 2: Supported vSRX Virtual Firewall Metrics Published on CloudWatch by Coudagent
Metric	Unit	Description
ControlPlaneCPUUtil	Percent	Utilization of the CPU on which control plane tasks are running
DataPlaneCPUUtil	Percent	Utilization of each CPU on which data plane tasks are running
DiskUtil	Percent	Disk storage utilization
ControlPlaneMemoryUtil	Percent	Memory utilization of control plane tasks
DataPlaneMemoryUtil	Percent	Memory utilization of data plane task
FlowSessionInUse	Count	Monitors the number of flow session in use, including all those sessions are allocated in valid, invalid, pending and other states.
FlowSessionUtil	Percent	Flow session utilization
RunningProcesses	Count	Number of processes in running state.
Ge00XInputKBPS	Kilobits/Second	Interfaces input statistics on Kilobits per second. Each GE interface will be monitored separately.
Ge00XInputPPS	Count/Second	Interfaces input statistics on packets per second. Each GE interface will be monitored separately.
Ge00XOutputKBPS	Kilobits/Second	Interfaces output statistics on Kilobits per second. Each GE interface will be monitored separately.
Ge00XOutputPPS	Count/Second	Interfaces output statistics on packets per second. Each GE interface will be monitored separately.

Besides the agent running in vSRX Virtual Firewall, you must configure the AWS console to enable CloudWatch and Security Hub service for vSRX Virtual Firewall, including:

Grant privileges for vSRX Virtual Firewall to post data to CloudWatch and Security Hub
Create a role with corresponding permission in AWS Identity and Access Management (IAM) console
Attach the role to vSRX Virtual Firewall instances in AWS EC2 console
Configure CloudWatch dashboard to display metric items with chart widget

Figure 1 shows how a cloudagent collects data from vSRX Virtual Firewall and posts to AWS services.

Figure 1: Integration of AWS Cloudwatch on vSRX Virtual Firewall 3.0

Benefits
CloudWatch Overview
Security Hub Overview
Identity and Access Management Console

Benefits

Observability of events and data on a single platform across applications and infrastructure
Easiest way to collect metric in AWS and on-premises
Improve operational performance and resource optimization
Get operational visibility and insight
Derive actionable insights from logs

CloudWatch Overview

Amazon CloudWatch is a monitoring and management service built for developers, system operators, site reliability engineers (SRE), and IT managers. CloudWatch provides you with data and actionable insights to monitor your applications, understand and respond to system-wide performance changes, optimize resource utilization, and get a unified view of operational health.

You can use CloudWatch to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your vSRX Virtual Firewall 3.0 instances running smoothly.

CloudWatch collects monitoring and operational data in the form of logs, metrics, and events, and visualizes it using automated dashboards so you can get a unified view of your AWS resources, applications, and services that run in AWS and on-premises. You can correlate your metrics and logs to better understand the health and performance of your resources. You can also create alarms based on metric value thresholds you specify, or that can watch for anomalous metric behavior based on machine learning algorithms. To take action quickly, you can set up automated actions to notify you if an alarm is triggered and automatically start auto scaling, for example, to help reduce mean-time-to-resolution. You can also dive deep and analyze your metrics, logs, and traces, to better understand how to improve application performance.

Security Hub Overview

AWS Security Hub gives you a comprehensive view of your high-priority security alerts and compliance status across AWS accounts. Security Hub is the single place that aggregates, organizes, and prioritizes security alerts. vSRX Virtual Firewall supports Security Hub with authentication to post security finding data to Security Hub.

Various security alerts from your vSRX Virtual Firewall instances are collected by Security Hub. With the integration of Security Hub, you now have a single place that aggregates, organizes, and prioritizes your security alerts, or findings, from your vSRX Virtual Firewall instances. Your findings are visually summarized on integrated dashboards with actionable graphs and tables. You can also continuously monitor your environment using automated compliance checks based on the AWS best practices and Juniper standards. Enable Security Hub using the management console and once enabled, Security Hub will begin aggregating and prioritizing the findings.

Identity and Access Management Console

AWS Identity and Access Management (IAM) enables you to manage access to AWS services and resources securely. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources.

IAM is a feature of your AWS account offered at no additional charge.

Integration of vSRX Virtual Firewall with AWS Monitoring and Troubleshooting Features

This topic provides details on how to integrate CloudWatch and Security Hub with vSRX Virtual Firewall 3.0 for centralized monitoring and troubleshooting on the AWS console.

Grant Permission for vSRX Virtual Firewall to access AWS CloudWatch and Security Hub
Enable Monitoring of vSRX Virtual Firewall Instances with AWS CloudWatch Metric
Collect, Store, and View vSRX Virtual Firewall Logs to AWS CloudWatch
Enable and Configure Security Hub on vSRX Virtual Firewall

Grant Permission for vSRX Virtual Firewall to access AWS CloudWatch and Security Hub

This section provides you details on how to enable access on vSRX Virtual Firewall instances to interact with AWS CloudWatch and Security Hub.

Create an IAM role using AWS IAM console.
Login to AWS IAM console, create IAM role and attach the role to vSRX Virtual Firewall instances to grant those permissions. You must create an IAM role before you can launch an instance with that role or attach it to an instance. For more information, see IAM Roles for Amazon EC2.
Configure an IAM role role on the AWS console and attach the role to vSRX Virtual Firewall instance. After you create and IAM role, the role can be viewed on IAM console and edited as necessary.
To launch an instance with an IAM role or to attach or replace an IAM role for an existing instance, permissions have to be granted to pass the role to the instance. AWS has to grant permission to pass an IAM role to an instance. For more information, see Granting an IAM User Permission to Pass an IAM Role to an Instance.
Attach an IAM role to vSRX Virtual Firewall instances by selecting a IAM role and the vSRX Virtual Firewall instance ID under the Attach/Replace IAM Role tab on the AWS console as shown in Figure 2. With the created role, you can enable CloudWatch and Security Hub access for vSRX Virtual Firewall instance by attaching the role.
Figure 2: Attach or Replace IAM Role to the vSRX Virtual Firewall Instances

Enable Monitoring of vSRX Virtual Firewall Instances with AWS CloudWatch Metric

This procedure provides us steps to enable monitoring of vSRX Virtual Firewall with AWS CloudWatch Metric.

Metric is data about the performance of the system. By enabling CloudWatch Metric monitoring, you can monitor some resources of vSRX Virtual Firewall instances.

Enable CloudWatch and Security Hub using the AWS console.
Configure CloudWatch metric in the Cloudwatch agent.
To enable CloudWatch metric monitoring, you need to configure metric namespace and collection interval on the instance by executing the # set security cloud aws cloudwatch metric namespace <namespace> collect-interval <integer> command.

A namespace is a container for CloudWatch metrics. Metric in different namespaces are isolated from each other, so that metrics from different applications are not mistakenly aggregated into the same statistics. Different vSRX Virtual Firewall instances can use same CloudWatch metric namespace. Metric from different vSRX Virtual Firewall instances can be differentiated by dimensional data (instances id/name) in metric value.

Collection interval is the frequency at which the firewall publishes the metrics to CloudWatch. The value can be set between 1 minute and 60 minutes. The default value is 3 minutes.

Once the Cloudwatch metric monitoring is enabled, the cloudagent running on vSRX Virtual Firewall collects all the required metric and publishes the metric data on the Cloudwatch.

Once monitoring is enabled you can view CloudWatch Metric. CloudWatch metric can be graphed after cloudagent starts to collect and post metric data to the cloud. By selecting the metric namespaces created from vSRX Virtual Firewall on AWS CloudWatch console, administrator can check and display all metric data. Check AWS CloudWatch guide for how to filter and display on those collected metric.
View the Cloudwatch metric data. CloudWatch metrics can be graphed after cloudagent starts to collect and post metric data to cloud.
Configure CloudWatch dashboard to display metric items with chart widget.
Amazon CloudWatch dashboards are customizable home pages in the CloudWatch console that you can use to monitor your resources in a single view, even those resources that are spread across different regions. You can manually create a dashboard for the vSRX Virtual Firewall under monitoring.

Collect, Store, and View vSRX Virtual Firewall Logs to AWS CloudWatch

CloudWatch Logs are used to monitor, store, and access log files from Amazon Elastic Compute Cloud (Amazon EC2) instances, AWS CloudTrail, Route 53, and other sources. For a vSRX Virtual Firewall instance, cloudagent collects both system and security logs and then post these logs to CloudWatchLog. The log collection in cloudagent will cache logs in a time window and post them to CloudWatchLog in a batch.

This procedure provides you details on how to enable and configure CloudWatch Logs on vSRX Virtual Firewall

To enable log collection for CloudWatchLog, you need to configure a log group, collect interval and from which file to collect log messages on the device.
```
# set security cloud aws cloudwatch log group vsrx-group
# set security cloud aws cloudwatch log file mylog collect-interval 2
# set security cloud aws cloudwatch log file syslog collect-interval 1
```
A log stream is a sequence of log events that share the same source. Each separate source of logs into CloudWatch Logs makes up a separate log stream. For log collection, one vSRX Virtual Firewall will post logs as a dedicated stream which means vSRX Virtual Firewall will automatically create a log stream in the destination log group.

A log group is a group of log streams that share the same retention, monitoring, and access control settings. By defining the log groups on the vSRX Virtual Firewall instance, yiu can specify which streams are placed into which group.

Collection interval is the frequency at which the firewall publishes logs to CloudWatchLog. The value can be set between 1 minute and 60 minutes. The default value is 3 minutes.

Three vSRX Virtual Firewall log files can be collected in CloudWatch simultaneously per vSRX Virtual Firewall instance. Each log file will create a corresponding a log stream in Cloudwatch. The log stream will be named under log group with convention <vsrx_instance_id> <log_file_name>.

After you enable CloudWatch logging in the cloudagent on vSRX Virtual Firewall instances, you need to configure syslog message file.
Configure the syslog message file.
Any filters can be applied based on vSRX Virtual Firewall syslog filtering. It provides the capability to define which log messages will be sent to CloudWatchLogs. For example, the below configuration means system will log any error messages to the syslog file under the /var/log and cloudagent will collect the messages from /var/log/syslog and post the messages to CloudWatchLogs.
```
# set security cloud aws cloudwatch log file syslog collect-interval 1
# set system syslog file syslog any error
```
View and search vSRX Virtual Firewall logs on CloudWatchLog console. Log groups and stream will be created automatically after configured on vSRX Virtual Firewall instances.
Select the log group and stream to check and search those logs sent to CloudWatch from the vSRX Virtual Firewall instance.

Enable and Configure Security Hub on vSRX Virtual Firewall

To import security events to AWS Security Hub, you need to configure CloudWatch log collection and then import the security events based on the log messages.

For example:

# set security cloud aws cloudwatch log group vsrx-group

# set security cloud aws cloudwatch log file mylog security-hub-import

# set security cloud aws cloudwatch log file mylog collect-interval 1

# set system syslog file mylog any any

# set system syslog file mylog structured-data

In the above configuration you are configuring CloudWatch log collection on file mylog under /var/log directory and any security events in the log file will be imported from the vSRX Virtual Firewall to Security Hub in the AWS security finding format.

Note:

The security-hub-import option is only supported on log files with structured-data format. Which means if a message is logged with plain text format, security events in log messages cannot be converted to AWS security finding and imported to Security Hub.

You can view the security findings posted from vSRX Virtual Firewall on the Security Hub console.

arrow_backward PREVIOUS Multi-Core Scaling Support on AWS with SWRSS and ENA

NEXT arrow_forward Deploying vSRX Virtual Firewall 3.0 for Securing Data using AWS KMS

vSRX Virtual Firewall Deployment Guide for Private and Public Cloud Platforms

ON THIS PAGE