This article explains the scenario where in the CASB filtering works fine without CASB Instance been configured.
SRX Admin wants to know whether:
SRX Admin configures the CASB Policy (without CASB Instance) and applies the same to a Security Policy.
When traffic hits the Security Policy, it was noticed/observed that the filtering is working fine while the Instance config is Missing.
This is an expected behavior.
If no CASB Instance is explicitly specified in the policy, the system defaults to applying the policy rule globally across all traffic hitting the Security Policy detected for that application (Sharepoint, BOX etc), regardless of the tenant domain configuration.
NOTE : Instance Config is used to differentiate between corporate and non-corporate Applications. This is an Optional config.
Referrance Doc :
https://www.juniper.net/documentation/us/en/software/junos/application-identification/topics/topic-map/casb-security-devices.html
For CASB, to differentiate between corporate and non-corporate SaaS application instances, administrators need to configure access policies using the instance parameter.
To identify an instance, CASB requires instance ID, domain, and type (optional).
Sample Instance configuration:
Corporate : /company-box.com
User@FW> show configuration security casb instance BOX | display set
set security casb instance BOX application Box
set security casb instance BOX instance-id company-box.com <<<<< Instance ID specific to a Company is used.
set security casb instance BOX domain box.com
set security casb instance BOX tag unsanctioned
set security casb instance BOX type corporate <<< Tagged as corporate
Personal : /box.com
Instance-ID config is not required in this case.
set security casb instance BOX type personal <<< Tagged as personal