This article provides information on how to activate the SSH tunnels between managed hosts and the console.

To encrypt the data flow between JSA/STRM managed hosts (EC/EP and FC/FP) and the console, encryption must be enabled when adding managed hosts in the deployment editor.

The SSH tunnels are activated when adding a managed host. When you enter the address of the new system during the add process, the following checkboxes are present at the bottom:

• Host is NATed

• Enable encryption

• Enable compression

When you enable encryption, the communication from the host, which is marked as encrypted, is sent through the SSH tunnels on port 22. If you want to have both directions encrypted, you will also need to enable this for the QRadar console.

1. To do this, go to the Deployment Editor and click the System View tab.

2. Right click each IP address that you want to encrypt, select Edit Managed Host and click the Next button.

3. On the subsequent screen, you can enable encryption.
   Note : This does not encrypt any data, which is coming into JSA/STRM from other sources, such as syslog messages coming in on port 514 or external flow traffic such as netflow on port 2055.
4. Save and deploy the changes.

For more information, refer to the Juniper Secure Analytics (formally known as STRM) Administration Guide (for Release 2014.7, the information can found in Chapter 10: Deployment Editor). To download and view the admin guide for your installed version of STRM, refer to the following link:

2017-03-24: Added references to JSA and linked to technical documentation.

• Juniper Secure Analytics: Administration Guide [juniper.net]