Description

This article documents the step-by-step configuration of UTM (Unified Threat Management) Web Filtering on a Juniper SRX firewall using the juniper-local engine. This approach performs URL categorization entirely on-box without requiring cloud connectivity, making it suitable for air-gapped or latency-sensitive environments.

Symptoms

An administrator needs to enforce URL-based access control for outbound web traffic on a Juniper SRX firewall without relying on an external cloud categorization service. Specifically:

 

  • Certain websites (e.g., streaming platforms) must be blocked to enforce acceptable use policies or reduce bandwidth consumption on corporate networks.
  • Trusted or business-critical domains (e.g., juniper.net) must be explicitly permitted, ensuring they are never caught by a broader block rule.
  • All other web traffic not covered by either rule should be permitted by default, maintaining normal internet access for end users.

Solution

Step 1 — Define a Custom URL Pattern

set security utm custom-objects url-pattern NETFLIX value https://*.netflix.com

Defines the URLs the UTM engine will match against. The wildcard * covers all subdomains, so no subdomain can be used to bypass the rule.

 

Step 2 — Create Custom URL Categories

set security utm custom-objects custom-url-category BLOCK-LIST value NETFLIX

Groups URL patterns into named categories. The web-filtering profile acts on categories, not raw patterns, so new URLs can be added to a category later without touching the profile.

 

Step 3 — Define a Custom Block Message

set security utm custom-objects custom-message UTM-WF-BLK-MESS type user-message
set security utm custom-objects custom-message UTM-WF-BLK-MESS content "This URL has been blocked by SRX UTM local engine"

Defines what the end user sees when a request is blocked. The user-message type injects the text directly into the browser response — no external redirect server required.

 

Step 4 — Configure the Web-Filtering Profile

set security utm feature-profile web-filtering type juniper-local
set security utm feature-profile web-filtering juniper-local profile UTM-WF-PROFILE category BLOCK-LIST action block
set security utm feature-profile web-filtering juniper-local profile UTM-WF-PROFILE category BLOCK-LIST custom-message UTM-WF-BLK-MESS
set security utm feature-profile web-filtering juniper-local profile UTM-WF-PROFILE fallback-settings default log-and-permit
set security utm feature-profile web-filtering juniper-local profile UTM-WF-PROFILE default permit

The core enforcement object. Key behaviors to note: juniper-local performs all categorization on-box with no cloud dependency. The default permit action allows anything not matched by an explicit category. fallback-settings log-and-permit prevents traffic from being silently dropped if the UTM engine encounters an error.

 

Step 5 — Create the UTM Policy

set security utm utm-policy UTM-WF-POLICY web-filtering http-profile UTM-WF-PROFILE

Wraps the web-filtering profile into a reusable policy object that security policies can reference. Additional UTM features (antivirus, content-filtering) can be added here later without changing the security policy.

 

Step 6 — Apply the UTM Policy to the Security Policy

set security policies from-zone trust to-zone untrust policy UTM-WF-LOCAL match application junos-http
set security policies from-zone trust to-zone untrust policy UTM-WF-LOCAL match application junos-https
set security policies from-zone trust to-zone untrust policy UTM-WF-LOCAL then permit application-services ssl-proxy profile-name SRXasCA
set security policies from-zone trust to-zone untrust policy UTM-WF-LOCAL then permit application-services utm-policy UTM-WF-POLICY

Applies UTM inspection to HTTP and HTTPS traffic from trust to untrust. The SSL proxy (SRXasCA) decrypts HTTPS sessions before they reach the UTM engine — without it, URL matching is bound to server name ID (SNI) which might not be as exact as decrypting the TLS connection. Both junos-http and junos-https must be matched or HTTPS becomes an uninspected bypass path.

 

Verification: 

 

user@SRX> show security utm status
UTM service status: Running

 

user@SRX> show security utm web-filtering status
 UTM web-filtering status:
    Server status: Juniper local URL filtering

 

user@SRX> show system processes extensive | match utmd
 2150 root      20    0 52044K 27456K select 0   0:07  0.00% utmd

 

 

Modification History

04/21/2026-Article Created

04/22/2026-Minor changes, device hostname