Whenever a configuration change is made for the Application Firewall feature on the SRX, traceoptions run on application firewall will show how the firewall is processing the configuration and how the compilation is done. Sample output is provided to explain this behavior.

The following configuration was added on the firewall to block the website, Youtube from using APPFW.

root@SRX240> show configuration | display set | match application-firewall
set security application-firewall rule-sets AppFwrule rule Youtube-123 match dynamic-application junos:YOUTUBE-STREAM
set security application-firewall rule-sets AppFwrule rule Youtube-123 match dynamic-application junos:YOUTUBE
set security application-firewall rule-sets AppFwrule rule Youtube-123 match dynamic-application junos:YOUTUBE-COMMENT
set security application-firewall rule-sets AppFwrule rule Youtube-123 then deny
set security application-firewall rule-sets AppFwrule default-rule permit
set security policies from-zone Trust to-zone Untrust policy Internet-Access then permit application-services application-firewall rule-set AppFwrule

In this scenario, we did a trace options with flag all. We can selectively also flag them for issues specific to compilation, configuration or lookup.

The output of the trace options collected while commiting the above configuration will be as follows:

root@SRX240BLR# run show log appid_trace

Initially, the SRX will identify the ruleset for Application Firewall and verify the configuration for APPFW profile. In this case, APPFW profile is not configured. Once the profile is checked, it checks for the rulesets configured under Application Firewall. Here, the ruleset is called AppFwrule. 

Jun 6 17:11:03 trace option old 0 new 65535. nsd_appfw_config_read,current lsys 0
Jun 6 17:11:03 appfw_profile_config_process: no appfw profile is configured
Jun 6 17:11:03 appfw_profile_mark_all action 3
Jun 6 17:11:03 appfw_name_tree_create, 0x9a34b0-
Jun 6 17:11:03 process rule-set AppFw appfw_parse_one_ruleset
Jun 6 17:11:03 appfw_parse_ruleset_default_rule: appfw ruleset AppFwrule default rule is 2
Jun 6 17:11:03 appfw_parse_ruleset_profile: appfw profile is not configured in ruleset AppFwrule.

APPFW ruleset AppFwrule is getting parsed on the SRX. It identifies that the rule Youtune-123 is configured.

Jun 6 17:11:03 rule-set AppFwrule is already existing appfw_parse_one_ruleset.
Jun 6 17:11:03 appfw_name_tree_create, 0x9a34d0
Jun 6 17:11:03 process one rule appfw_parse_one_rule.
Jun 6 17:11:03 ---- rule name Youtube-123 appfw_parse_one_rule---
Jun 6 17:11:03 processing rule match appfw_parse_rule_match_obj
Jun 6 17:11:03 appfw_parse_rule_then_obj: appfw rule Youtube-123 then action is 4
Jun 6 17:11:03 rule Youtube-123 is already existing appfw_parse_one_ruleset.
Jun 6 17:11:03 end processing rule-set AppFwrule appfw_parse_one_ruleset
Jun 6 17:11:04 display new rule-set-name-tree

Details relate to the rule-set configurations

Jun 6 17:11:04 ------rule-set AppFwrule ---
Jun 6 17:11:04 ------rule-set AppFwrule's id 1 ---
Jun 6 17:11:04 ------rule-set AppFwrule's rule num 1 ---
Jun 6 17:11:04 ------rule-set AppFwrule's default rule 2 ---
Jun 6 17:11:04 ------rule-set AppFwrule's change flag 8 ---
Jun 6 17:11:04 ------rule-set AppFwrule's position 0 ---
Jun 6 17:11:04 ------rule-set AppFwrule's pos changed rules ---

Details related to rule configurations

Jun 6 17:11:04 ----------rule Youtube-123 ---
Jun 6 17:11:04 ----------rule Youtube-123's id 6 ---
Jun 6 17:11:04 ----------rule Youtube-123's action4 ---
Jun 6 17:11:04 ----------rule Youtube-123's ssl-encryption 0 ---
Jun 6 17:11:04 ----------rule Youtube-123's change flag 8 ---
Jun 6 17:11:04 ----------rule Youtube-123's item change flag 0 ---
Jun 6 17:11:04 ----------rule Youtube-123's position 1 ---
Jun 6 17:11:04 ----------rule Youtube-123's old position 1 ---
Jun 6 17:11:04 ----------rule Youtube-123's dyn appl num 3 ---
Jun 6 17:11:04 ----------rule Youtube-123's dyn appl0 is junos:YOUTUBE-STREAM id is 240---
Jun 6 17:11:04 ----------rule Youtube-123's dyn appl1 is junos:YOUTUBE id is 240---
Jun 6 17:11:04 ----------rule Youtube-123's dyn appl2 is junos:YOUTUBE-COMMENT id is 10833---
Jun 6 17:11:04 ----------rule Youtube-123's dyn appl from group num 0 ---
Jun 6 17:11:04 ----------rule Youtube-123's dyn appl group num 0 ---
Jun 6 17:11:04 appfw post config nsd_appfw_config_post_process mode 1.

After Parsing and compilation, the information is used by the device.

Jun 6 17:11:04 Sending the delta configuration appfw_send_begin
Jun 6 17:11:04 send data len 0 appfw_send_info_common.
Jun 6 17:11:04 nsd_appfw_send_msg: Successfully sent appfw msg to control component.sub_type (1), len (0), fpc(-1)-pic(-1)

Jun 6 17:11:04 send appfw configure option old 65535 new 65535.nsd_appfw_config_post_process lsys_id 0
Jun 6 17:11:04 Send delta configure: add traceoption flag 65535. appfw_send_trace_option
Jun 6 17:11:04 send data len 4 appfw_send_info_common.
Jun 6 17:11:04 nsd_appfw_send_msg: Successfully sent appfw msg to control component.sub_type (7), len (4), fpc(-1)-pic(-1)

Jun 6 17:11:04 appfw_send_profile_config: no profile needs to be pushed to PFE
Jun 6 17:11:04 End sending the delta configuration appfw_send_end
Jun 6 17:11:04 send data len 0 appfw_send_info_common.
Jun 6 17:11:04 nsd_appfw_send_msg: Successfully sent appfw msg to control component.sub_type (2), len (0), fpc(-1)-pic(-1)

Jun 6 17:11:04 entering appfw_name_tree_destroy
Jun 6 17:11:04 Security appfw config cleanup nsd_appfw_config_cleanup check_only 1.

APPFW trace options end here.