Juniper SRX Security Policy Configuration: Zones to Policy Rules

Juniper SRX security policies are the core mechanism for controlling transit traffic between security zones, and mastering their configuration is essential for any firewall administrator. This guide breaks down the policy elements every SRX rule is built from — source and destination zones, address books, applications, and match-and-action logic — and shows real set commands you can paste into configuration mode. You will learn how to build a complete policy set that allows HTTP, telnet and ICMP while explicitly denying and logging everything else.

Understanding Juniper SRX Security Policy Elements

A security policy on Junos OS is a set of statements that control traffic flowing from a specific source to a specific destination while using a specific service. Each policy is unidirectional and contains:

• A unique policy name
• A from-zone to to-zone direction, for example set security policies from-zone untrust to-zone trust
• Matching criteria based on source/destination IP addresses and applications
• Actions such as permit, deny or reject
• Accounting and auditing options such as count and session logging

Policy Rules and Match Criteria

Each security policy rule is identified by its zone pair and a set of match characteristics: source zone, destination zone, one or many source address names, destination address names, and application names. Every policy has an action linked to it — permit, deny, reject, count, log, or tunnel (VPN). With flow-based forwarding enabled via set security forwarding-options family inet6 mode flow-based, IPv6 policies are also supported.

Configuring SRX Security Policies with set Commands

In the scenario below the SRX connects the 172.168.10.0/24 subnet (incoming zone) to the outgoing zone. Four policies are configured: ALLOW-WEB, ALLOW-TELNET, ALLOW-ICMP and an explicit DENY-ALL with logging.

set security policies from-zone incoming to-zone outgoing policy ALLOW-WEB match source-address NET_172_168_10_0__24
set security policies from-zone incoming to-zone outgoing policy ALLOW-WEB match destination-address any
set security policies from-zone incoming to-zone outgoing policy ALLOW-WEB match application junos-http
set security policies from-zone incoming to-zone outgoing policy ALLOW-WEB then permit
set security policies from-zone incoming to-zone outgoing policy ALLOW-WEB then log session-init
set security policies from-zone incoming to-zone outgoing policy ALLOW-WEB then log session-close
set security policies from-zone incoming to-zone outgoing policy ALLOW-WEB then count

set security policies from-zone incoming to-zone outgoing policy ALLOW-TELNET match source-address NET_172_168_10_0__24
set security policies from-zone incoming to-zone outgoing policy ALLOW-TELNET match destination-address any
set security policies from-zone incoming to-zone outgoing policy ALLOW-TELNET match application junos-telnet
set security policies from-zone incoming to-zone outgoing policy ALLOW-TELNET then permit
set security policies from-zone incoming to-zone outgoing policy ALLOW-TELNET then log session-init
set security policies from-zone incoming to-zone outgoing policy ALLOW-TELNET then log session-close
set security policies from-zone incoming to-zone outgoing policy ALLOW-TELNET then count

set security policies from-zone incoming to-zone outgoing policy ALLOW-ICMP match source-address NET_192_168_10_0__24
set security policies from-zone incoming to-zone outgoing policy ALLOW-ICMP match destination-address any
set security policies from-zone incoming to-zone outgoing policy ALLOW-ICMP match application junos-icmp-all
set security policies from-zone incoming to-zone outgoing policy ALLOW-ICMP then permit
set security policies from-zone incoming to-zone outgoing policy ALLOW-ICMP then log session-init
set security policies from-zone incoming to-zone outgoing policy ALLOW-ICMP then count

set security policies from-zone incoming to-zone outgoing policy DENY-ALL match source-address any
set security policies from-zone incoming to-zone outgoing policy DENY-ALL match destination-address any
set security policies from-zone incoming to-zone outgoing policy DENY-ALL match application any
set security policies from-zone incoming to-zone outgoing policy DENY-ALL then reject
set security policies from-zone incoming to-zone outgoing policy DENY-ALL then log session-init
set security policies from-zone incoming to-zone outgoing policy DENY-ALL then count
set security policies pre-id-default-policy then log session-close

Verifying Security Policies on Junos

After committing the configuration with commit, verify the policy set and session behavior using operational commands such as show security policies, show security policy hits and show security flow session. The count and log actions configured above make it easy to confirm that only expected traffic is permitted.

Related Juniper Resources

For more Junos troubleshooting and configuration practice, see our guides on troubleshooting IRB VLAN interfaces on Juniper EX and inter-VLAN communication issues on EX switches. You can also review BGP security with ASPA and route-leak prevention for edge-firewall best practices.

原文链接：https://networkinterview.com/how-to-configure-juniper-srx-security-policy/