This KB describes how to configure an SRX user account where the user is restricted to configuring only /32 static routes with an explicit next‑hop, while all other configuration changes are denied.

Requirement to restrict an SRX user to static route configuration only, while denying all other prefixes.

By default, SRX user permissions do not support prefix‑length–based restrictions for static routes. This requirement can be met using login classes with allow and deny configuration regex statements, explicitly denying /24 and /16 static routes while allowing all others.

This solution was validated and works as expected when regex additive logic is enabled.

Configuration template:

set system login class static-route-user permissions configure

set system login class static-route-user permissions view

set system login class static-route-user allow-configuration-regexps "routing-options static route .*\/32 next-hop .*"

set system login class static-route-user deny-configuration-regexps .*

set system login user staticuser class static-route-user

set system login user staticuser authentication encrypted-password "$6$fay.07tQ$v6r7/mov"

set system regex-additive-logic

Notes:

• deny-configuration-regexps takes precedence over allow statements when regex additive logic is enabled
• Regex patterns can be adjusted to restrict additional prefix lengths if required

Use Case

• Suitable for environments where routing changes must be controlled while preventing configuration of broader or more impactful route prefixes.