Traffic is not passing or is using an incorrect policy on an SRX device.  This article shows how to verify the value of address book names.

Verify security policies to investigate why traffic is not passing through SRX  or is not matching an expected policy.

An effective method for verifying the address name values is to use the 'detail' option in the 'show security policies' command:

show security policies from-zone <zone> to-zone <zone> policy-name <policy> detail

A useful feature with this command is that it lists the address names and corresponding IP address/subnet configured in the security policy.

root@SiteA> show security policies from-zone trust to-zone untrust policy-name internal-net detail

Policy: internal-net, action-type: permit, State: enabled, Index: 4, Scope Policy: 0
  Policy Type: Configured
  Sequence number: 1
  From zone: trust, To zone: untrust
  Source addresses:
    internal-net: 10.20.20.0/24  <------ Address Name and corresponding value are listed
    local-net: 192.168.10.0/24   <------
  Destination addresses:
    remote-net: 192.168.20.0/24  <------
  Application: any
    IP protocol: 0, ALG: 0, Inactivity timeout: 0
      Source port range: [0-0]
      Destination port range: [0-0]
  Per policy TCP Options: SYN check: No, SEQ check: No

Alternate methods:

1. Display the security policy and note the address names.  Note that when the 'detail' option is not used (like in the example above), the corresponding IP address/subnet for the address names are not displayed.

root@SiteA> show security policies from-zone <zone> to-zone <zone>

Example:


root@SiteA> show security policies from-zone trust to-zone untrust

From zone: trust, To zone: untrust
  Policy: internal-net, State: enabled, Index: 4, Scope Policy: 0, Sequence number: 1
    Source addresses: local-net, internal-net   <------ Only Address Names are listed
    Destination addresses: remote-net           <------
    Applications: any
    Action: permit

2. To see the IP address/subnet value for an address name, use the ' show security zones security-zone <zone-name> ' command:

      root@SiteA# show security zones security-zone <zone>

Example:


root@SiteA# show security zones security-zone trust
address-book {
    address local-net 192.168.10.0/24;
    address internal-net 10.20.20.0/24;
}

root@SiteA# show security zones security-zone untrust
address-book {
    address remote-net 192.168.20.0/24;
}

1. Navigate to Monitor > Security > Policy > Activities . Look for the address names specified in the Source and Destination Address fields of a security policy.

   

2. Navigate to Configure > Security > Policy Elements > Address Book and verify if the address names configured in the security policy are configured with the correct IP address and prefix.

   

• KB10113 - How to troubleshoot a security policy that is not passing data [juniper.net]