Description

This article provides information about the default status of ALGs on SRX devices.

Symptoms

  • Information about the default status of ALGs on SRX devices.
  • By default, which ALG's are enabled?

Solution

The default status of ALGs on SRX devices are as follows:

  • Branch SRX (SRX100, 110, 210, 220, 550, 650) (by default,  IKE-ESP, RSH, SQL are disabled)
  • Branch SRX (SRX300, 320, 340, 345, 380, 550HM) (by default,  IKE-ESP, RSH, SQL, TWAMP are disabled)
  • Mid-Range SRX (SRX1500, 4100, 4200, 4600, vSRX) (by default, H323, MGCP, RSH, RTSP, SCCP, SIP, SQL, IKE-ESP, TWAMP are disabled)
  • High-end SRX devices (by default, H323, MGCP, RSH, RTSP, SCCP, SIP, SQL, IKE-ESP, TWAMP are disabled):

SRX5800> show security alg status
ALG Status :
  DNS      : Enabled
  FTP      : Enabled
  H323     : Disabled
  MGCP     : Disabled
  MSRPC    : Enabled
  PPTP     : Enabled
  RSH      : Disabled
  RTSP     : Disabled
  SCCP     : Disabled
  SIP      : Disabled
  SQL      : Disabled
  SUNRPC   : Enabled
  TALK     : Enabled
  TFTP     : Enabled
  IKE-ESP  : Disabled
 TWAMP: Disabled

To change the status of the ALG:
  • To disable a specific ALG: 
    # set security alg [alg-name] disable
# commit
  • To enable a specific ALG: 
    # set security alg [alg-name]
# commit

Modification History

2020-06-03: Removed J-series and updated outputs based on current devices and Junos versions.
 

Related Information