Secure Web Proxy was introduced in Junos OS Release 19.2R1.
This article describes how to configure Secure Web Proxy along with Unified Security Policy.
Secure Web Proxy does not support Unified Security Policy due to which it does not work on the policy.
Not working configuration
set security policies from-zone trust to-zone untrust policy rule1 match source-address any set security policies from-zone trust to-zone untrust policy rule1 match destination-address proxy1 set security policies from-zone trust to-zone untrust policy rule1 match application junos-defaults set security policies from-zone trust to-zone untrust policy rule1 match dynamic-application any << Unified Security Policy configuration. Secure Web Proxy does not work on this configuration. set security policies from-zone trust to-zone untrust policy rule1 then permit application-services web-proxy profile-name test-profile
In some cases, Secure Web Proxy needs to be configured along with Unified Security Policy.
Refer to Unified Security Policies and Secure Web Proxy for additional information.
Lab Topology
PC (HTTP client) ---- Trust Zone SRX Untrust Zone ---- Web Proxy server (192.168.253.150:8080) ---- Internet
Configuration Example and Verification
Step 1
Configure the web-proxy profile.
The Office365 application is used here for the Secure Web Proxy function to proxy the web proxy traffic that is destined to Office365 on an SRX device.
set services application-identification application-group office-365-group applications junos:OFFICE365-CREATE-CONVERSATION set services application-identification application-group office-365-group applications junos:OUTLOOK set services web-proxy secure-proxy profile test-profile proxy-address external_proxy ip 192.168.253.150/32 set services web-proxy secure-proxy profile test-profile proxy-address external_proxy port 8080 set services web-proxy secure-proxy profile test-profile dynamic-web-application-group office-365-group
Step 2
Configure the Security Policy.
Since the Secure Web Proxy function does not support Unified Security Policy, the dynamic-application command cannot be used for it.
dynamic-application
To configure a Non-Unified Security Policy and Unified Security Policy in the same Security Policy, the Non-Unified Security Policy must be before the Unified Security Policy rule.
In following example, rule1 is a policy for Secure Web Proxy (Non-Unified Security Policy) and rule2 and rule3 are for the Unified Security Policy. In rule1, the destination address and destination port of the web proxy server are specified to hit the web-proxy traffic. Rule2 is for a proxied session and a security application such as IDP, UTM, or AppQoS can be used for the session. In the example, a security application is not configured to make it simple.
In following example, rule1 is a policy for Secure Web Proxy (Non-Unified Security Policy) and rule2 and rule3 are for the Unified Security Policy.
In rule1, the destination address and destination port of the web proxy server are specified to hit the web-proxy traffic.
Rule2 is for a proxied session and a security application such as IDP, UTM, or AppQoS can be used for the session. In the example, a security application is not configured to make it simple.
set security address-book web-proxy address proxy1 192.168.253.150/32 set security address-book web-proxy attach zone untrust set applications application web-proxy protocol tcp set applications application web-proxy destination-port 8080 set security policies from-zone trust to-zone untrust policy rule1 match source-address any set security policies from-zone trust to-zone untrust policy rule1 match destination-address proxy1 set security policies from-zone trust to-zone untrust policy rule1 match application web-proxy set security policies from-zone trust to-zone untrust policy rule1 then permit application-services web-proxy profile-name test-profile set security policies from-zone trust to-zone untrust policy rule2 match source-address any set security policies from-zone trust to-zone untrust policy rule2 match destination-address any set security policies from-zone trust to-zone untrust policy rule2 match application junos-defaults set security policies from-zone trust to-zone untrust policy rule2 match dynamic-application office-365-group set security policies from-zone trust to-zone untrust policy rule2 then permit set security policies from-zone trust to-zone untrust policy rule3 match source-address any set security policies from-zone trust to-zone untrust policy rule3 match destination-address any set security policies from-zone trust to-zone untrust policy rule3 match application junos-defaults set security policies from-zone trust to-zone untrust policy rule3 match dynamic-application any set security policies from-zone trust to-zone untrust policy rule3 then permit
Step 3
To verify:
Check the web-proxy status.
When the Secure Web Proxy function is not working, even when there is web proxy traffic going through the SRX device, nothing will be displayed in the result. In this case, double-check the configuration.
root> show services web-proxy session summary Web Proxy sessions: Client Session Proxy Session [337157] 192.168.204.10/57006 ---> 192.168.253.150/8080 [337167] 192.168.204.10/57006 ---> 13.107.6.156/443 root> show services web-proxy session detail Web Proxy sessions: Client Session ID: 337157, Proxy Session ID: 337167 Client: 192.168.204.10/57006 ---> 192.168.253.150/8080 Proxy : 192.168.204.10/57006 ---> 13.107.6.156/443 Proxy Request: CONNECT:www.office.com:443 Dynamic Web App: junos:OFFICE365-CREATE-CONVERSATION
Check the security flow sessions.
When the Secure Web Proxy function is working, two sessions will be created for the traffic. Web Proxy session (Dst port 8080) will hit rule1 and the proxied session (Dst port 443) will hit rule2.
root> show security flow session destination-prefix 192.168.253.150 Session ID: 337157, Policy name: rule1/5, Timeout: 1786, Valid In: 192.168.204.10/57006 --> 192.168.253.150/8080;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 26, Bytes: 3066, Out: 192.168.253.150/8080 --> 192.168.204.10/57006;tcp, Conn Tag: 0x0, If: st0.0, Pkts: 81, Bytes: 90767, root> show security flow session destination-prefix 13.107.6.156 Session ID: 337167, Policy name: rule2/6, Timeout: 1766, Valid In: 192.168.204.10/57006 --> 13.107.6.156/443;tcp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 21, Bytes: 2632, Out: 13.107.6.156/443 --> 192.168.204.10/57006;tcp, Conn Tag: 0x0, If: st0.0, Pkts: 81, Bytes: 92208,