This article provides more information about a new configurable knob that has been introduced to modify the default UTM Enhanced Web Filtering (EWF) lookup query behavior in SRX devices.

The default behavior of EWF lookup queries is to use both "URL + IP" as input parameters in a lookup query request. However, in some environments, for example where proxy-ip exists, "URL + IP" queries may return an unexpected category based on the inclusion of a destination IP.

A new configurable option knob for query-type has been introduced to enable the default EWF lookup query behavior to be modified that may prevent unexpected results as specified above.

query-type {
    url-ip;   /* Use both URL and IP address as query parameter in cloud request.*/
    url;      /* Use URL as query parameter in cloud request.*/
}

This new feature is available in the following Junos OS versions: 15.1X49-D160, 17.4R3, 18.1R4, 18.2R2, 18.3R2 and later.

• For Junos OS versions prior to 18.2, the option is available under set security utm feature-profile web-filtering juniper-enhanced query-type .

• For Junos OS versions 18.2 and later, the option is available under set security utm default-configuration web-filtering juniper-enhanced query-type .