Starting from Junos OS Release 18.4R1, the unified policies feature is enhanced to include URL categories as match criteria for the web filtering category.

For basic information, refer to Configure a URL Category with Unified Policies .

This article provides information about configuring URL Category with Unified Policies by using a custom URL pattern and URL category.

The minimum configuration required is as follows:

set security utm custom-objects url-pattern URL value www.juniper.net
set security utm custom-objects custom-url-category CAT value URL
set security utm default-configuration web-filtering type juniper-enhanced

set security policies from-zone trust to-zone untrust policy DNS match source-address any
set security policies from-zone trust to-zone untrust policy DNS match destination-address any
set security policies from-zone trust to-zone untrust policy DNS match application junos-defaults
set security policies from-zone trust to-zone untrust policy DNS match dynamic-application junos:DNS
set security policies from-zone trust to-zone untrust policy DNS then permit
set security policies from-zone trust to-zone untrust policy TEST match source-address any
set security policies from-zone trust to-zone untrust policy TEST match destination-address any
set security policies from-zone trust to-zone untrust policy TEST match application junos-defaults
set security policies from-zone trust to-zone untrust policy TEST match dynamic-application any
set security policies from-zone trust to-zone untrust policy TEST match url-category CAT
set security policies from-zone trust to-zone untrust policy TEST then deny
set security policies from-zone trust to-zone untrust policy ALL match source-address any
set security policies from-zone trust to-zone untrust policy ALL match destination-address any
set security policies from-zone trust to-zone untrust policy ALL match application junos-defaults
set security policies from-zone trust to-zone untrust policy ALL match dynamic-application any
set security policies from-zone trust to-zone untrust policy ALL then permit

set security zones security-zone untrust interfaces ge-0/0/0.0
set security zones security-zone trust interfaces ge-0/0/1.0
set interfaces ge-0/0/0 unit 0 family inet address 192.168.253.4/24
set interfaces ge-0/0/1 unit 0 family inet address 192.168.4.254/24

Other Requirement: Appid Signature Installation

Appid signature is required for unified policy. If it is not installed, traffic will not hit the security policy that is configured. To install the signature,  idp-sig or  appid-sig license is required.

If idp-sig license is installed, the appid signature will be installed along with the IDP signature installation. Refer to IDP Signature Database Overview  for further information. If appid-sig license is installed, run following command to install the appid signature.

request services application-identification download
request services application-identification install

Note

In the current Junos image, when same url-pattern is defined in multiple custom-url-category, it does not work.
For url-category match under <security policy>, all the category defined in UTM will be searched to get the best match.
However if the best match url-category is not configured in security policy, traffic will not hit the expected policy.
For multiple match, only the longest match will be chosen.
For same pattern in different category, only match one category (it depends on the configuration sequence).
 

Example

Non-working scenario

In this configuration,www.juniper.net is defined in both url1 and url2. In this case, traffic destined to this URL might not hit the policy.

set security utm custom-objects url-pattern URL2 value www.juniper.net

set security utm custom-objects url-pattern URL2 value www.jtac.com
set security utm custom-objects url-pattern URL1 value www.juniper.net
set security utm custom-objects url-pattern URL1 value www.juniper-networks.net
set security utm custom-objects custom-url-category CAT2 value URL2
set security utm custom-objects custom-url-category CAT1 value URL1
set security utm default-configuration web-filtering type juniper-enhanced

set security policies from-zone trust to-zone untrust policy USER1 match source-address USER1
set security policies from-zone trust to-zone untrust policy USER1 match destination-address any
set security policies from-zone trust to-zone untrust policy USER1 match application junos-defaults
set security policies from-zone trust to-zone untrust policy USER1 match dynamic-application any
set security policies from-zone trust to-zone untrust policy USER1 match url-category CAT1
set security policies from-zone trust to-zone untrust policy USER1 then deny
set security policies from-zone trust to-zone untrust policy USER2 match source-address USER2
set security policies from-zone trust to-zone untrust policy USER2 match destination-address any
set security policies from-zone trust to-zone untrust policy USER2 match application junos-defaults
set security policies from-zone trust to-zone untrust policy USER2 match dynamic-application any
set security policies from-zone trust to-zone untrust policy USER2 match url-category CAT2
set security policies from-zone trust to-zone untrust policy USER2 then deny

Working Scenario

Instead of defining the URL in multiple categories, create individual url-pattern and category for the URL and apply the category to each security policy.

set security utm custom-objects url-pattern URL3 value www.juniper.net

set security utm custom-objects url-pattern URL2 value www.jtac.com
set security utm custom-objects url-pattern URL1 value www.juniper-networks.net
set security utm custom-objects custom-url-category CAT1 value URL1
set security utm custom-objects custom-url-category CAT2 value URL2
set security utm custom-objects custom-url-category CAT3 value URL3
set security utm default-configuration web-filtering type juniper-enhanced

set security policies from-zone trust to-zone untrust policy USER1 match source-address USER1
set security policies from-zone trust to-zone untrust policy USER1 match destination-address any
set security policies from-zone trust to-zone untrust policy USER1 match application junos-defaults
set security policies from-zone trust to-zone untrust policy USER1 match dynamic-application any
set security policies from-zone trust to-zone untrust policy USER1 match url-category CAT1
set security policies from-zone trust to-zone untrust policy USER1 match url-category CAT3
set security policies from-zone trust to-zone untrust policy USER1 then deny
set security policies from-zone trust to-zone untrust policy USER2 match source-address USER2
set security policies from-zone trust to-zone untrust policy USER2 match destination-address any
set security policies from-zone trust to-zone untrust policy USER2 match application junos-defaults
set security policies from-zone trust to-zone untrust policy USER2 match dynamic-application any
set security policies from-zone trust to-zone untrust policy USER2 match url-category CAT2
set security policies from-zone trust to-zone untrust policy USER2 match url-category CAT3
set security policies from-zone trust to-zone untrust policy USER2 then deny