This article explains how to prevent users from logging in to J-Web from an External/Untrust interface when dynamic VPN is in use.

As mentioned in KB19411 - Not able to access J-Web management on SRX-Branch after upgrading to recent JUNOS 10.2 and later releases [juniper.net] , when dynamic VPN is in use, users cannot use J-Web on the interface that is used as the IPSec external interface. However, J-Web can optionally be made available on the same external interface by using a different, configurable directory path via the following setting:

set system services web-management management-url /mgmt   <<<For J-web login URL</span>

To access J-Web, an administrator would then browse to: https:// <srx-domain-or-ip> /mgmt .

However, some customers may want to prevent users from using the External/Untrusted interface to log in to the SRX device via J-Web, and may want to allow users to use only the Internal/Trusted interface for logging in.

If the administrator does not want to provide J-Web access at the External/Untrusted interface, the administrator should not configure the additional management-url , or remove it if it is already configured. Then, J-Web will be enabled only on the internal interfaces that are specified under set system services web-management https interface <interface> .

Example

delete system services web-management management-url

set system services web-management https system-generated-certificate
set system services web-management https interface ge-0/0/0.0
commit

When this is configured, users will be able to access J-Web only via the ge-0/0/0.0 interface. Any access by using HTTPS on the external interface will redirect to https:// <srx-domain-or-ip> /dynamic-vpn for dynamic VPN access.