Description

This article describes how to configure a Custom Dynamic Application on SRX devices to match specific URL signatures using the SSL Server Name Indication (SNI) field.
The custom application can be used in Security Policies to block traffic or in Advanced Policy-Based Routing (APBR) policies to steer matching traffic through a specific path.

Solution

Create a custom dynamic application with an SNI-based signature and reference it in a Security Policy or APBR policy.
 

Example Configuration (matching domains containing "juniper"):

 
set services application-identification application custom_ssl_server_name cacheable
set services application-identification application custom_ssl_server_name priority high
set services application-identification application custom_ssl_server_name order 3
set services application-identification application custom_ssl_server_name over SSL signature sig1 member m01 depth 8000
set services application-identification application custom_ssl_server_name over SSL signature sig1 member m01 context ssl-server-name
set services application-identification application custom_ssl_server_name over SSL signature sig1 member m01 pattern .*juniper.*
set services application-identification application custom_ssl_server_name over SSL signature sig1 member m01 direction client-to-server
 

If URL matching is not working as expected in browsers, disable or block ECH so that the SRX can inspect the SNI and apply the Dynamic Application policy correctly.

For additional guidance on ECH, refer to: https://supportportal.juniper.net/s/article/SRX-Some-URLs-are-accessible-even-though-we-have-blocked-it-using-UTM-web-filtering

To disable on browser : (firefox)

about:config → network.dns.echconfig.enabled = false
 

Modification History

2026-07-06 : Article Created