Search our Knowledge Base sites to find answers to your questions.
Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles[SRX] Integrated web filtering example via custom objects.
This article provides information on how to configure integrated Web filtering by using a custom URL pattern and URL category lists from a category server (SurfControl Content Portal Authority provided by Websense).
This section contains the following sections:
Configuring integrated Web filtering consists of the following tasks:
Note: Integrated Web Filtering requires a license. Run the show system license command, and look for wf_key_surfcontrol_cpa.
To configure the integrated Web filtering feature profile:
To configure a UTM policy for Web filtering:
To attach the UTM policy to a security policy:
To create an URL pattern list custom object:
To create a custom URL category list custom object:
To configure the redirect Web filtering feature profile:
To attach the UTM policy to a security policy:
The following example activates integrated Web filtering.
user@host#set security utm feature-profile web-filtering type surf-control-integrated
user@host#set security utm utm-policy custom-utm-policy web-filtering http-profile JUNOS-wf-cpa-default
user@host#set security policies from-zone trust to-zone untrust policy default-permit then permit application-services utm-policy custom-utm-policy
To configure integrated Web filtering, create the UTM custom objects first. Custom objects are global parameters for UTM features and apply to all UTM policies where applicable, rather than only to individual policies. In this example, custom URL black and white lists are put into two separate categories.
user@host# set security utm custom-objects url-pattern black-list value http://*.sex.com
user@host# set security utm custom-objects url-pattern black-list value http://*.guns.com
user@host# set security utm custom-objects url-pattern black-list value http://*.hacking.com
user@host# set security utm custom-objects url-pattern white-list value http://*.juniper.net
user@host# set security utm custom-objects url-pattern white-list value http://*.cnn.net
user@host# set security utm custom-objects url-pattern white-list value http://*.msn.netuser@host# set security utm custom-objects custom-url-category allowed-sites value white-list
user@host# set security utm custom-objects custom-url-category blocked-sites value black-listAfter creating custom objects, configure the Web filtering feature parameters.
user@host# set security utm feature-profile web-filtering type surf-control-integrateduser@host# set security utm feature-profile web-filtering url-whitelist allowed-sites
user@host# set security utm feature-profile web-filtering url-blacklist blocked-sitesuser@host# set security utm feature-profile web-filtering surf-control-integrated cache timeout 1800
user@host# set security utm feature-profile web-filtering surf-control-integrated cache size 500
user@host# set security utm feature-profile web-filtering surf-control-integrated server host cpa.surfcpa.com
user@host# set security utm feature-profile web-filtering surf-control-integrated server port 9020user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 category Adult_Sexually_Explicit action block
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 category Hacking action block
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 category Weapons action block
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 category Web_based_Email action permit
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 default block
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 custom-block-message ***DENIED***user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 fallback-settings default block
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 fallback-settings server-connectivity block
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 fallback-settings timeout block
user@host# set security utm feature-profile web-filtering surf-control-integrated profile surfcontrol-profile1 fallback-settings too-many-requests blockDefine the UTM policy for the protocol and attach this policy to a profile. Then apply the UTM policy to a firewall security policy as an application service.
user@host# set security utm utm-policy web-filter web-filtering http-profile surfcontrol-profile1user@host# set security policies from-zone trust to-zone untrust policy web-filter match source-address any
user@host# set security policies from-zone trust to-zone untrust policy web-filter match destination-address any
user@host# set security policies from-zone trust to-zone untrust policy web-filter match application any
user@host# set security policies from-zone trust to-zone untrust policy web-filter then permit application-services utm-policy web-filter
Full Working Configuration Example
version 10.1R1.8;
system {
host-name Starburst;
root-authentication {
encrypted-password "$ABC123"; ## SECRET-DATA
}
login {
message "/**** Please reload /var/tmp/default.conf when you are done ****/ ";
user lab {
uid 2000;
class superuser;
authentication {
encrypted-password "$ABC123"; ## SECRET-DATA
}
}
}
services {
ftp;
ssh;
telnet;
web-management {
http {
interface ge-0/0/0.0;
}
https {
system-generated-certificate;
interface ge-0/0/0.0;
}
}
}
syslog {
user * {
any emergency;
}
file messages {
any any;
authorization info;
}
file interactive-commands {
interactive-commands any;
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.10.66.94/24;
}
}
}
}
routing-options {
static {
route 66.129.243.0/24 {
next-hop 10.10.66.1;
no-readvertise;
}
}
}
security {
zones {
security-zone trust {
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone untrust;
}
policies {
from-zone trust to-zone untrust {
policy web-filter {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
utm-policy web-filter;
}
}
}
}
}
}
utm {
custom-objects {
url-pattern {
black-list {
value [ http://*.sex.com http://*.guns.com http://*.hacking.com ];
}
white-list {
value [ http://*.juniper.net http://*.cnn.net http://*.msn.net ];
}
}
custom-url-category {
allowed-sites {
value white-list;
}
blocked-sites {
value black-list;
}
}
}
feature-profile {
web-filtering {
url-whitelist allowed-sites;
url-blacklist blocked-sites;
type surf-control-integrated;
traceoptions {
flag all;
}
surf-control-integrated {
cache {
timeout 1800;
size 500;
}
server {
host surfcontrolserver;
port 8080;
}
profile surfcontrol-profile1 {
category {
Adult_Sexually_Explicit {
action block;
}
Hacking {
action block;
}
Weapons {
action block;
}
Web_based_Email {
action permit;
}
}
default block;
custom-block-message ***DENIED***;
fallback-settings {
default block;
server-connectivity block;
timeout block;
too-many-requests block;
}
}
}
}
}
utm-policy web-filter {
web-filtering {
http-profile surfcontrol-profile1;
}
}
}
}
Getting Up and Running with Junos
Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search