[SRX] How to use Junos configuration-groups to simplify the process of adding same security policies in multiple contexts

Description

This article provides information on how to use Junos configuration groups to simplify the process of adding many security policies in different contexts.

Symptoms

While deploying SRX devices in a production environment, there may be a need to create and apply the same security policy, in multiple contexts. Is there any way to simplify this?

Solution

In Junos, almost at every hierarchy, we have apply-groups and apply-groups-except statements like below:

root@srx# set system ? Possible completions: > accounting System accounting configuration + apply-groups Groups from which to inherit configuration data + apply-groups-except Don't inherit configuration data from these groups

For an explanation of the configuration groups feature, refer to the following link in the technical documentation: http://www.juniper.net/techpubs/en_US/junos11.1/topics/concept/junos-software-configuration-groups-understanding.html .

The following is an example configuration, to illustrate the purpose of these two statements:

[edit]

Create a common security policy definition and apply in all contexts i.e. from-zone any to-zone any using wildcard match <*>.

(This sample configuration includes only apply-groups statement.)

root@srx# show | no-more 
## Last changed: 2010-11-29 09:28:33 UTC
version 10.2R2.11;
groups {
    test {
        security {
            policies {
                from-zone <*> to-zone <*> {
                    policy testpolicy {
                        match {
                            source-address any;
                            destination-address any;
                            application any;
                        }
                        then {
                            deny;
                            log {
                                session-init;
                                session-close;
                            }
                        }
                    }
                }
            }
        }
    }
}
system {
    root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
security {
    zones {
        security-zone 1;
        security-zone 2;
        security-zone 3;
        security-zone 4;
        security-zone 5;
        security-zone 7;
        security-zone 6;
    }
    policies {
        apply-groups test;
        from-zone 1 to-zone 2;
        from-zone 1 to-zone 3;
        from-zone 1 to-zone 4;
        from-zone 1 to-zone 5;
        from-zone 1 to-zone 6;
        from-zone 1 to-zone 7;
    }
}

Note : Use the 'display |inheritance' filter option, to view the inherited portion of the configuration with comments (indicated by ##). If you do not want to see the comments, use the 'display |inheritance | except ##' option.

[edit]
root@srx# show security | display inheritance | no-more 
zones {
    security-zone 1;
    security-zone 2;
    security-zone 3;
    security-zone 4;
    security-zone 5;
    security-zone 7;
    security-zone 6;
}
policies {
    from-zone 1 to-zone 2 {
        ##
        ## 'testpolicy' was inherited from group 'test'
        ##
        policy testpolicy {
            ##
            ## 'match' was inherited from group 'test'
            ##
            match {
                ##
                ## 'any' was inherited from group 'test'
                ##
                source-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                destination-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                application any;
            }
            ##
            ## 'then' was inherited from group 'test'
            ##
            then {
                ##
                ## 'deny' was inherited from group 'test'
                ##
                deny;
                ##
                ## 'log' was inherited from group 'test'
                ##
                log {
                    ##
                    ## 'session-init' was inherited from group 'test'
                    ##
                    session-init;
                    ##
                    ## 'session-close' was inherited from group 'test'
                    ##
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 3 {
        ##
        ## 'testpolicy' was inherited from group 'test'
        ##
        policy testpolicy {
            ##
            ## 'match' was inherited from group 'test'
            ##
            match {
                ##
                ## 'any' was inherited from group 'test'
                ##
                source-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                destination-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                application any;
            }
            ##
            ## 'then' was inherited from group 'test'
            ##
            then {
                ##
                ## 'deny' was inherited from group 'test'
                ##
                deny;
                ##
                ## 'log' was inherited from group 'test'
                ##
                log {
                    ##
                    ## 'session-init' was inherited from group 'test'
                    ##
                    session-init;
                    ##
                    ## 'session-close' was inherited from group 'test'
                    ##
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 4 {
        ##
        ## 'testpolicy' was inherited from group 'test'
        ##
        policy testpolicy {
            ##
            ## 'match' was inherited from group 'test'
            ##
            match {
                ##
                ## 'any' was inherited from group 'test'
                ##
                source-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                destination-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                application any;
            }
            ##
            ## 'then' was inherited from group 'test'
            ##
            then {
                ##
                ## 'deny' was inherited from group 'test'
                ##
                deny;
                ##
                ## 'log' was inherited from group 'test'
                ##
                log {
                    ##
                    ## 'session-init' was inherited from group 'test'
                    ##
                    session-init;
                    ##
                    ## 'session-close' was inherited from group 'test'
                    ##
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 5 {
        ##
        ## 'testpolicy' was inherited from group 'test'
        ##
        policy testpolicy {
            ##
            ## 'match' was inherited from group 'test'
            ##
            match {
                ##
                ## 'any' was inherited from group 'test'
                ##
                source-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                destination-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                application any;
            }
            ##
            ## 'then' was inherited from group 'test'
            ##
            then {
                ##
                ## 'deny' was inherited from group 'test'
                ##
                deny;
                ##
                ## 'log' was inherited from group 'test'
                ##
                log {
                    ##
                    ## 'session-init' was inherited from group 'test'
                    ##
                    session-init;
                    ##
                    ## 'session-close' was inherited from group 'test'
                    ##
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 6 {
        ##
        ## 'testpolicy' was inherited from group 'test'
        ##
        policy testpolicy {
            ##
            ## 'match' was inherited from group 'test'
            ##
            match {
                ##
                ## 'any' was inherited from group 'test'
                ##
                source-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                destination-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                application any;
            }
            ##
            ## 'then' was inherited from group 'test'
            ##
            then {
                ##
                ## 'deny' was inherited from group 'test'
                ##
                deny;
                ##
                ## 'log' was inherited from group 'test'
                ##
                log {
                    ##
                    ## 'session-init' was inherited from group 'test'
                    ##
                    session-init;
                    ##
                    ## 'session-close' was inherited from group 'test'
                    ##
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 7 {
        ##
        ## 'testpolicy' was inherited from group 'test'
        ##
        policy testpolicy {
            ##
            ## 'match' was inherited from group 'test'
            ##
            match {
                ##
                ## 'any' was inherited from group 'test'
                ##
                source-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                destination-address any;
                ##
                ## 'any' was inherited from group 'test'
                ##
                application any;
            }
            ##
            ## 'then' was inherited from group 'test'
            ##
            then {
                ##
                ## 'deny' was inherited from group 'test'
                ##
                deny;
                ##
                ## 'log' was inherited from group 'test'
                ##
                log {
                    ##
                    ## 'session-init' was inherited from group 'test'
                    ##
                    session-init;
                    ##
                    ## 'session-close' was inherited from group 'test'
                    ##
                    session-close;
                }
            }
        }
    }
}

[edit]
root@srx# show security | display inheritance | except # | no-more 
zones {
    security-zone 1;
    security-zone 2;
    security-zone 3;
    security-zone 4;
    security-zone 5;
    security-zone 7;
    security-zone 6;
}
policies {
    from-zone 1 to-zone 2 {
        policy testpolicy {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                deny;
                log {
                    session-init;
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 3 {
        policy testpolicy {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                deny;
                log {
                    session-init;
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 4 {
        policy testpolicy {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                deny;
                log {
                    session-init;
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 5 {
        policy testpolicy {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                deny;
                log {
                    session-init;
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 6 {
        policy testpolicy {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                deny;
                log {
                    session-init;
                    session-close;
                }
            }
        }
    }
    from-zone 1 to-zone 7 {
        policy testpolicy {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                deny;
                log {
                    session-init;
                    session-close;
                }
            }
        }
    }
}

[edit]

Using apply-groups-except statement. Here we have two groups called test and permitgroup . Except for one context, we have applied both groups and in one context, we have used apply-groups-except.

root@srx# show | no-more 
## Last changed: 2010-11-29 09:38:37 UTC
version 10.2R2.11;
groups {
    test {
        security {
            policies {
                from-zone <*> to-zone <*> {
                    policy testpolicy {
                        match {
                            source-address any;
                            destination-address any;
                            application any;
                        }
                        then {
                            deny;
                            log {
                                session-init;
                                session-close;
                            }
                        }
                    }
                }
            }
        }
    }
    permitgroup {
        security {
            policies {
                from-zone <*> to-zone 4 {
                    policy 1 {
                        match {
                            source-address any;
                            destination-address any;
                            application any;
                        }
                        then {
                            permit;
                        }
                    }
                }
            }
        }
    }
}
system {
    root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
    license {
        autoupdate {
            url https://ae1.juniper.net/junos/key_retrieval;
        }
    }
}
security {
    zones {
        security-zone 1;
        security-zone 2;
        security-zone 3;
        security-zone 4;
        security-zone 5;
        security-zone 7;
        security-zone 6;
    }
    policies {
        apply-groups [ test permitgroup ];
        from-zone 1 to-zone 2;
        from-zone 1 to-zone 3;
        from-zone 1 to-zone 4 {
            apply-groups-except test;
        }
        from-zone 1 to-zone 5;
        from-zone 1 to-zone 6;
        from-zone 1 to-zone 7;
    }
}

[edit]
root@srx# show security policies | display inheritance | except # | no-more 
from-zone 1 to-zone 2 {
    policy testpolicy {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            deny;
            log {
                session-init;
                session-close;
            }
        }
    }
}
from-zone 1 to-zone 3 {
    policy testpolicy {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            deny;
            log {
                session-init;
                session-close;
            }
        }
    }
}
from-zone 1 to-zone 4 {
    policy 1 {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit;
        }
    }
}
from-zone 1 to-zone 5 {
    policy testpolicy {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            deny;
            log {
                session-init;
                session-close;
            }
        }
    }
}
from-zone 1 to-zone 6 {
    policy testpolicy {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            deny;
            log {
                session-init;
                session-close;
            }
        }
    }
}
from-zone 1 to-zone 7 {
    policy testpolicy {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            deny;
            log {
                session-init;
                session-close;
            }
        }
    }
}

Note : Junos Software provides a hidden and immutable configuration group called Junos-defaults, that is automatically applied to the configuration of your router. The Junos-defaults group contains preconfigured statements that contain predefined values for common applications. Some of the statements must be referenced to take effect, such as definitions for applications (for example, FTP or telnet settings). Other statements are applied automatically, such as terminal settings.

Use the following command, to view most of the security configuration defaults such as, ALG, applications, UTM, and so on.

root@srx# run show configuration groups junos-defaults security

For more information, see KB16311 - How to Determine Default Web-Filtering Settings on SRX Platform [juniper.net] .