Description

This article provides information about the supported versions for configuring the policy and address-book descriptions in SRX devices.

Symptoms

User wants to configure description for security policy or address-book, which is not supported in Junos OS versions 11.4  and earlier on SRX devices.

root# run show version
Model: srx650
JUNOS Software Release [11.4R9.4]

Address-Book Description:

root# set security zones security-zone Trust address-book address Test-book ?

Possible completions:

<ip-prefix>              Numeric IPv4 or IPv6 address with prefix
+ apply-groups           Groups from which to inherit configuration data
+ apply-groups-except    Don't inherit configuration data from these groups
> dns-name               DNS address name
> wildcard-address       Numeric IPv4 wildcard address with in the form of a.d.d.r/netmask

*Description parameter is missing here.


Policy-Description:

[edit security policies]
root# set from-zone Trust to-zone Untrust policy Test-policy ?

Possible completions:

+ apply-groups          Groups from which to inherit configuration data
+ apply-groups-except   Don’t inherit configuration data from these groups
> match                 Specify security policy match-criteria
scheduler-name          Name of scheduler
> then                  Specify policy action to take when packet match criteria

*Description parameter is missing here.

Solution


Policy and address-book description configuration is supported from Junos OS version 12.1R1.9 and later. In the Junos OS 11.4 version, this feature is not supported.

root# run show version
Model: srx650
JUNOS Software Release [12.1R1.9]

Address-Book Description:

[edit security zones security-zone Trust]
root# set address-book address Test-book?

Possible completions:

<ip-prefix>                Numeric IPv4 or IPv6 address with prefix
+ apply-groups            Groups from which to inherit configuration data
+ apply-groups-except     Don't inherit configuration data from these groups
description               Text description of address>>>>>>>>>>>
> dns-name                DNS address name
> range-address           Address range
> wildcard-address        Numeric IPv4 wildcard address with in the form of a.d.d.r/netmask

Policy-description:

[edit security policies]
root# set from-zone Trust to-zone Untrust policy Test-policy ?

Possible completions:

+ apply-groups            Groups from which to inherit configuration data
+ apply-groups-except     Don’t inherit configuration data from these groups
description               Text description of policy>>>>>>>>>
> match                   Specify security policy match-criteria
scheduler-name            Name of scheduler
> then                    Specify policy action to take when packet matches criteria

Sample configuration:


[edit security zones security-zone Trust]
root# show
address-book {
address Test-book {
description "MY Test address-book";
10.10.10.0/24;
}
}



[edit security policies]
root# show
from-zone Trust to-zone Untrust {
policy Test-policy {
description "My Test policy";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}