Search our Knowledge Base sites to find answers to your questions.
Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles[SRX] Redirect web filtering example via custom objects
This article provides information on how to configure redirect Web filtering by using a custom URL pattern and URL category lists.
This section contains the following:
Configuring redirect Web filtering consists of the following tasks:
You do not need a license on the SRX device to use the redirect Web filtering feature.
To configure the redirect Web filtering feature profile:
To configure a UTM policy for Web filtering:
To attach the UTM policy to a security policy:
Make sure that your policy is activated. By default, after you create a policy, it is activated.
To create an URL pattern list custom object:
The following example activates redirect Web filtering.
user@host#set security utm feature-profile web-filtering type websense-redirect
user@host#set security utm utm-policy custom-utm-policy web-filtering http-profile JUNOS-wf-websense-default
user@host#set security policies from-zone trust to-zone untrust policy default-permit then permit application-services utm-policy custom-utm-policy
To configure redirect Web filtering, create the UTM custom objects first. Custom objects are global parameters for UTM features and apply to all UTM policies where applicable, rather than only to individual policies. In this example, custom URL block and allow lists are put into two separate categories.
Define the custom URL pattern lists.
user@host# set security utm custom-objects url-pattern black-list value http://*.sex.com
user@host# set security utm custom-objects url-pattern black-list value http://*.guns.com
user@host# set security utm custom-objects url-pattern black-list value http://*.hacking.com
user@host# set security utm custom-objects url-pattern white-list value http://*.juniper.net
user@host# set security utm custom-objects url-pattern white-list value http://*.cnn.net
user@host# set security utm custom-objects url-pattern white-list value http://*.msn.netDefine the custom URL categories by putting the allow-list in one category and the block-list in the other category.
user@host# set security utm custom-objects custom-url-category allowed-sites value white-list
user@host# set security utm custom-objects custom-url-category blocked-sites value black-listAfter creating custom objects, Define the global URL Lists.
Define the global URL allow and block lists.
user@host# set security utm feature-profile web-filtering url-whitelist allowed-sites
user@host# set security utm feature-profile web-filtering url-blacklist blocked-sitesDefine the Websense Redirect Server settings:
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect server host Websenseserver
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect server port 8080
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect custom-block-message ***DENIED***
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect timeout 1800
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect sockets 4Create the Web filtering profile and specify the actions to be taken for each category (user-defined and custom). The fallback options define the actions to be taken for traffic when errors in each configured category occur.
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect fallback-settings default block
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect fallback-settings server-connectivity block
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect fallback-settings timeout block
user@host# set security utm feature-profile web-filtering websense-redirect profile web-filter-redirect fallback-settings too-many-requests blockDefine the UTM policy for the protocol and attach this policy to a profile. Then apply the UTM policy to a firewall security policy as an application service.
Define the UTM policy for HTTP and attach this policy to a profile.
user@host# set security utm utm-policy utm-web-filter-redirect web-filtering http-profile web-filter-redirectApply the UTM policy to a policy from the Trust zone to the Untrust zone.
user@host# set security policies from-zone trust to-zone untrust policy web-filter-redirect match source-address any
user@host# set security policies from-zone trust to-zone untrust policy web-filter-redirect match destination-address any
user@host# set security policies from-zone trust to-zone untrust policy web-filter-redirect match application any
user@host# set security policies from-zone trust to-zone untrust policy web-filter-redirect then permit application-services utm-policy web-filter-redirect
version 10.0R3.10;
system {
host-name Starburst;
root-authentication {
encrypted-password "$ABC123"; ## SECRET-DATA
}
login {
message "/**** Please reload /var/tmp/default.conf when you are done ****/ ";
user lab {
uid 2000;
class superuser;
authentication {
encrypted-password "$ABC123"; ## SECRET-DATA
}
}
}
services {
ftp;
ssh;
telnet;
web-management {
http {
interface ge-0/0/0.0;
}
https {
system-generated-certificate;
interface ge-0/0/0.0;
}
}
}
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.10.66.94/24;
}
}
}
}
routing-options {
static {
route 66.129.243.0/24 {
next-hop 10.10.66.1;
no-readvertise;
}
}
}
security {
zones {
security-zone trust {
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone untrust;
}
policies {
from-zone trust to-zone trust {
policy allow {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone trust {
policy web-filter {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone trust to-zone untrust {
policy web-filter-redirect {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
utm-policy web-filter-redirect;
}
}
}
}
}
}
utm {
custom-objects {
url-pattern {
black-list {
value [ http://*.test1.com http://*.test2.com http://*.test3.com ];
}
white-list {
value [ http://*.test4.net http://*.test5.net http://*.test6.net ];
}
}
custom-url-category {
allowed-sites {
value white-list;
}
blocked-sites {
value black-list;
}
}
}
feature-profile {
web-filtering {
url-whitelist allowed-sites;
url-blacklist blocked-sites;
type websense-redirect;
traceoptions {
flag all;
}
websense-redirect {
profile web-filter-redirect {
server {
host Websenseserver;
port 8080;
}
custom-block-message ***DENIED***;
fallback-settings {
default block;
server-connectivity block;
timeout block;
too-many-requests block;
}
timeout 1800;
sockets 4;
}
}
}
}
utm-policy web-filter-redirect {
web-filtering {
http-profile web-filter-redirect;
}
}
}
}
Getting Up and Running with Junos
Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search