This article provides information on how to configure integrated Web filtering by using a custom URL pattern and URL category lists from a category server.

• This article provides an example of configuring Enhanced Web filtering (also known as URL filtering) by using custom objects.
• For basic information, additional examples, and troubleshooting about integrated Web filtering, refer to KB16334 - SRX Getting Started - Integrated Web Filtering [juniper.net] .

This section contains the following sections:

• Configuration Task Overview
• J-Web Configuration
• CLI Configuration
• Complete Working Configuration Example

Configuration Task Overview

Configuring integrated Web filtering consists of the following tasks:

• Configuring UTM custom objects and assigning them to categories 
• Configuring integrated Web filtering parameters
• Configuring a UTM policy for each protocol and attaching the policy to a profile
• Attaching the UTM policy to a firewall security policy

Note : Juniper-Enhanced requires a license.  Run the show system license command, and look for wf_key_websense_ewf.

J-Web Configuration

To configure the Enhanced Web filtering feature profile:

• Go to Security Services>Content Security>Web Filtering Profiles
• Click the + symbol to the right and populate the fields 

To configure a UTM policy for Web filtering:

• Go to Security Services>Content Security>Content Security Policies
• Click the + symbol to the right and populate the fields 

To attach the UTM policy to a security policy:

• Go to Security Policies & Objects>Security Policies
• Select an existing security policy and add the utm policy under advanced services>Content Security

Note : Make sure that the policy is activated. By default, after a policy is created, it is activated.

To create an URL pattern list custom object:

• Go to Security Services>Content Security>Custom Objects
• You'll create the URL patterns from "URL Pattern"
• You'll add these patterns to "URL Category"

CLI Configuration

The following example activates Juniper enhanced Web filtering.

1. Configure the device to use the Enhanced Web filtering feature.

user@host# set security utm feature-profile web-filtering type juniper-enhanced

2. Create a UTM policy and associate the "junos-wf-enhanced-default" profile to the policy.

user@host# set security utm utm-policy custom-utm-policy web-filtering http-profile junos-wf-enhanced-default 

3. Apply the UTM policy to the existing trust-to-untrust security policy.

user@host# set security policies from-zone trust to-zone untrust policy default-permit then permit application-services utm-policy custom-utm-policy

To configure enhanced Web filtering, create the UTM custom objects first. Custom objects are global parameters for UTM features and apply to all UTM policies where applicable, rather than only to individual policies. In this example, custom URL block and allow lists are put into two separate categories. 

1. Define the custom URL pattern lists--block-list and allow-list.

   user@host# set security utm custom-objects url-pattern black-list value http://*.sex.com
user@host# set security utm custom-objects url-pattern white-list value http://*.juniper.net

2. Define the custom URL categories allowed-sites and blocked-sites), by putting the allow-list in one category and the block-list in the other category.

   user@host# set security utm custom-objects custom-url-category allowed-sites value white-list
user@host# set security utm custom-objects custom-url-category blocked-sites value black-list

After creating custom objects, configure the Web filtering feature parameters.

1. Set the type of web-filtering to surf-control-integrated.

   user@host# set security utm feature-profile web-filtering type juniper-enhanced

2. Define the URL allow and block lists.

   user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 category allowed-sites action permit
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 category blocked-sites action block

3. Create the Web filtering profile and specify the actions to be taken for each category (user-defined and custom).

   user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Adult_Content action block
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Hacking action block
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Weapons action block
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Office_Mail action permit
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 default block

4. Define the fallback settings for the Web filtering profile. The fallback options define the actions to be taken for traffic when errors in each configured category occur.

   user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings default block
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings server-connectivity block
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings timeout block
user@host# set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings too-many-requests block

Define the UTM policy for the protocol and attach this policy to a profile. Then apply the UTM policy to a firewall security policy as an application service.

1. Define the UTM policy for HTTP (web-filter) and attach this policy to a profile (surfcontrol-profile1).

   user@host# set security utm utm-policy custom-utm-policy web-filtering http-profile profile1

2. Apply the UTM policy to a policy from the Trust zone to the Untrust zone, and set the application services to be allowed:

   user@host# set security policies from-zone trust to-zone untrust policy web-filter match source-address any
user@host# set security policies from-zone trust to-zone untrust policy web-filter match destination-address any
user@host# set security policies from-zone trust to-zone untrust policy web-filter match application any
user@host# set security policies from-zone trust to-zone untrust policy web-filter then permit application-services utm-policy custom-utm-policy

Full Working Configuration Example

user@host# show security utm | display set 
set security utm custom-objects url-pattern black-list value http://*.sex.com
set security utm custom-objects url-pattern white-list value http://*.juniper.net
set security utm custom-objects custom-url-category allowed-sites value white-list
set security utm custom-objects custom-url-category blocked-sites value black-list

set security utm feature-profile web-filtering type juniper-enhanced
set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Adult_Content action block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Hacking action block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Weapons action block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 category Enhanced_Office_Mail action permit
set security utm feature-profile web-filtering juniper-enhanced profile profile1 category allowed-sites action permit
set security utm feature-profile web-filtering juniper-enhanced profile profile1 category blocked-sites action block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 default block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings default block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings server-connectivity block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings timeout block
set security utm feature-profile web-filtering juniper-enhanced profile profile1 fallback-settings too-many-requests block

set security utm utm-policy custom-utm-policy web-filtering http-profile profile1

set security policies from-zone trust to-zone untrust policy web-filter match source-address any
set security policies from-zone trust to-zone untrust policy web-filter match destination-address any
set security policies from-zone trust to-zone untrust policy web-filter match application any
set security policies from-zone trust to-zone untrust policy web-filter then permit application-services utm-policy custom-utm-policy

2025-06-25: As of Junos OS Release 15.1X49-D10, the surf-control-integrated feature is not supported

2021-03-25: Updated the article terminology to align with Juniper's Inclusion & Diversity initiatives. 
2020-12-31:​ Replaced words that failed to represent the inclusion and diversity Juniper values