Description

This article describes a situation in which session logs are not generated when unified policies are used in SRX devices, and provides a workaround for the same.

 

Symptoms

Starting from Junos OS Release 18.2R1, unified policies are supported on SRX Series devices, which allows granular control and enforcement of dynamic Layer 7 applications within the security policy. Unified policies are the security policies that enable you to use dynamic applications as match conditions as part of the existing 5-tuple or 6-tuple (5-tuple with user firewall) match conditions to detect application changes over time. For more information, see Unified Policies Support for Flow .

When unified policies are used in SRX devices as shown below:

set security policies from-zone trust to-zone untrust policy test match source-address any
set security policies from-zone trust to-zone untrust policy test match destination-address any
set security policies from-zone trust to-zone untrust policy test match application junos-ssh
set security policies from-zone trust to-zone untrust policy test match dynamic-application any
set security policies from-zone trust to-zone untrust policy test then permit
set security policies from-zone trust to-zone untrust policy test then log session-init
 

And traffic is tested

  1. 192.68.4.54 ---> 192.168.5.1 destination port:22  SSH
  2. 192.68.4.54 ---> 192.168.5.1 destination port: 15002

The test result of the security flow session is as follows:

SSH: 22

root# run show security flow session extensive    
Session ID: 146383, Status: Normal
Flags: 0x40/0x0/0x3/0x2008103
Policy name: test/4                                                <<<<here</span>                                                    
Source NAT pool: Null, Application: junos-ssh/22
Dynamic application: junos:SSH, Dynamic nested application: junos:UNKNOWN <<<<here</span>
Encryption:  No
Application traffic control rule-set: INVALID, Rule: INVALID
Maximum timeout: 1800, Current timeout: 1798
Session State: Valid
Start time: 8735969, Duration: 3
   In: 192.168.4.54/55050 --> 192.168.5.1/22;tcp,
  Conn Tag: 0x0, Interface: ge-0/0/0.0,
    Session token: 0x7, Flag: 0x1621
    Route: 0x30010, Gateway: 192.168.4.54, Tunnel: 0
    Port sequence: 0, FIN sequence: 0,
    FIN state: 0,
    Pkts: 8, Bytes: 1972
   Out: 192.168.5.1/22 --> 192.168.4.54/55050;tcp,
  Conn Tag: 0x0, Interface: ge-0/0/1.0,
    Session token: 0x8, Flag: 0x1620
    Route: 0x40010, Gateway: 192.168.5.1, Tunnel: 0
    Port sequence: 0, FIN sequence: 0,
    FIN state: 0,
    Pkts: 5, Bytes: 1589
Total sessions: 1

Unknown application: 15002    

[edit]
root# run show security flow session extensive    
Session ID: 146354, Status: Normal
Flags: 0x40000040/0x0/0x1/0x2008103
Policy name: pre-id-default-policy-logical-system-00/3  <<<<< Here, pre-id-default-policy is the default security policy.
Source NAT pool: Null
Dynamic application: INCONCLUSIVE,  << Here, only one TCP sync packet with unknown destination port is seen. The SRX device is unable to identify its application type.
Encryption:  Unknown
Application traffic control rule-set: INVALID, Rule: INVALID
Maximum timeout: 1800, Current timeout: 18
Session State: Valid
Start time: 8735316, Duration: 1
   In: 192.168.4.54/1024 --> 192.168.5.1/15002;tcp,
  Conn Tag: 0x0, Interface: ge-0/0/0.0,
    Session token: 0x7, Flag: 0x1621
    Route: 0x30010, Gateway: 192.168.4.54, Tunnel: 0
    Port sequence: 0, FIN sequence: 0,
    FIN state: 0,
    Pkts: 1, Bytes: 40
   Out: 192.168.5.1/15002 --> 192.168.4.54/1024;tcp,
  Conn Tag: 0x0, Interface: ge-0/0/1.0,
    Session token: 0x8, Flag: 0x620
    Route: 0x40010, Gateway: 192.168.5.1, Tunnel: 0
    Port sequence: 0, FIN sequence: 0,
    FIN state: 0,
    Pkts: 0, Bytes: 0
Total sessions: 1
 

Note that only one session log is generated (for SSH 1):

root# run show log policy-log    
Apr 25 05:40:15   RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.4.54/55052->192.168.5.1/22 0x0 junos-ssh 192.168.4.54/55052->192.168.5.1/22 0x0 N/A N/A N/A N/A 6 test trust untrust 146847 N/A(N/A) ge-0/0/0.0 SSH UNKNOWN No Remote-Access Command 4

 

Solution

The TCP sync packet that is sent to destination port 15002 (which is not well known) does not match the custom defined policy test, so we will not see the related session log.

 

To see the related session log, add the following command:

set security policies pre-id-default-policy then log session-init
commit
 

Then the related session logs are generated as shown below:

root# run show log policy-log    
Apr 25 05:40:08  clear-log[41092]: logfile cleared
Apr 25 05:40:15   RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.4.54/55052->192.168.5.1/22 0x0 junos-ssh 192.168.4.54/55052->192.168.5.1/22 0x0 N/A N/A N/A N/A 6 test trust untrust 146847 N/A(N/A) ge-0/0/0.0 SSH UNKNOWN No Remote-Access Command 4
Apr 25 05:43:48   RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.4.54/1024->192.168.5.1/15002 0x0 None 192.168.4.54/1024->192.168.5.1/15002 0x0 N/A N/A N/A N/A 6 pre-id-default-policy-logical-system-00 trust untrust 146858 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN N/A N/A -1  <<<<here</span>