This article describes a situation in which session logs are not generated when unified policies are used in SRX devices, and provides a workaround for the same.
Starting from Junos OS Release 18.2R1, unified policies are supported on SRX Series devices, which allows granular control and enforcement of dynamic Layer 7 applications within the security policy. Unified policies are the security policies that enable you to use dynamic applications as match conditions as part of the existing 5-tuple or 6-tuple (5-tuple with user firewall) match conditions to detect application changes over time. For more information, see Unified Policies Support for Flow .
When unified policies are used in SRX devices as shown below:
set security policies from-zone trust to-zone untrust policy test match source-address any set security policies from-zone trust to-zone untrust policy test match destination-address any set security policies from-zone trust to-zone untrust policy test match application junos-ssh set security policies from-zone trust to-zone untrust policy test match dynamic-application any set security policies from-zone trust to-zone untrust policy test then permit set security policies from-zone trust to-zone untrust policy test then log session-init
And traffic is tested
192.68.4.54 ---> 192.168.5.1 destination port: 15002
The test result of the security flow session is as follows:
SSH: 22
root# run show security flow session extensive Session ID: 146383, Status: Normal Flags: 0x40/0x0/0x3/0x2008103 Policy name: test/4 <<<<here</span> Source NAT pool: Null, Application: junos-ssh/22 Dynamic application: junos:SSH, Dynamic nested application: junos:UNKNOWN <<<<here</span> Encryption: No Application traffic control rule-set: INVALID, Rule: INVALID Maximum timeout: 1800, Current timeout: 1798 Session State: Valid Start time: 8735969, Duration: 3 In: 192.168.4.54/55050 --> 192.168.5.1/22;tcp, Conn Tag: 0x0, Interface: ge-0/0/0.0, Session token: 0x7, Flag: 0x1621 Route: 0x30010, Gateway: 192.168.4.54, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 8, Bytes: 1972 Out: 192.168.5.1/22 --> 192.168.4.54/55050;tcp, Conn Tag: 0x0, Interface: ge-0/0/1.0, Session token: 0x8, Flag: 0x1620 Route: 0x40010, Gateway: 192.168.5.1, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 5, Bytes: 1589 Total sessions: 1
Unknown application: 15002 [edit] root# run show security flow session extensive Session ID: 146354, Status: Normal Flags: 0x40000040/0x0/0x1/0x2008103 Policy name: pre-id-default-policy-logical-system-00/3 <<<<< Here, pre-id-default-policy is the default security policy. Source NAT pool: Null Dynamic application: INCONCLUSIVE, << Here, only one TCP sync packet with unknown destination port is seen. The SRX device is unable to identify its application type. Encryption: Unknown Application traffic control rule-set: INVALID, Rule: INVALID Maximum timeout: 1800, Current timeout: 18 Session State: Valid Start time: 8735316, Duration: 1 In: 192.168.4.54/1024 --> 192.168.5.1/15002;tcp, Conn Tag: 0x0, Interface: ge-0/0/0.0, Session token: 0x7, Flag: 0x1621 Route: 0x30010, Gateway: 192.168.4.54, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 1, Bytes: 40 Out: 192.168.5.1/15002 --> 192.168.4.54/1024;tcp, Conn Tag: 0x0, Interface: ge-0/0/1.0, Session token: 0x8, Flag: 0x620 Route: 0x40010, Gateway: 192.168.5.1, Tunnel: 0 Port sequence: 0, FIN sequence: 0, FIN state: 0, Pkts: 0, Bytes: 0 Total sessions: 1
Note that only one session log is generated (for SSH 1):
root# run show log policy-log Apr 25 05:40:15 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.4.54/55052->192.168.5.1/22 0x0 junos-ssh 192.168.4.54/55052->192.168.5.1/22 0x0 N/A N/A N/A N/A 6 test trust untrust 146847 N/A(N/A) ge-0/0/0.0 SSH UNKNOWN No Remote-Access Command 4
The TCP sync packet that is sent to destination port 15002 (which is not well known) does not match the custom defined policy test, so we will not see the related session log.
To see the related session log, add the following command:
set security policies pre-id-default-policy then log session-init commit
Then the related session logs are generated as shown below:
root# run show log policy-log Apr 25 05:40:08 clear-log[41092]: logfile cleared Apr 25 05:40:15 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.4.54/55052->192.168.5.1/22 0x0 junos-ssh 192.168.4.54/55052->192.168.5.1/22 0x0 N/A N/A N/A N/A 6 test trust untrust 146847 N/A(N/A) ge-0/0/0.0 SSH UNKNOWN No Remote-Access Command 4 Apr 25 05:43:48 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 192.168.4.54/1024->192.168.5.1/15002 0x0 None 192.168.4.54/1024->192.168.5.1/15002 0x0 N/A N/A N/A N/A 6 pre-id-default-policy-logical-system-00 trust untrust 146858 N/A(N/A) ge-0/0/0.0 UNKNOWN UNKNOWN UNKNOWN N/A N/A -1 <<<<here</span>