This article describes a commit warning that may be seen when a security policy with dynamic-applications uses the junos-defaults application in SRX Series devices.

In unified security policies , the  junos-defaults  option has been introduced in the security policy configuration as application match criteria. The  junos-defaults  group contains pre-configured statements that include predefined values for common applications.

However, there are some dynamic applications that do not have the default TCP/UDP port as per design. When this kind of dynamic application is used with the junos-defaults option, there is no application match criteria using which a TCP/UDP port can be assigned and the security policy will not work as expected. In this case, a warning message will be displayed after running the commit command.

Example Configuration

set security policies from-zone trust to-zone untrust policy p1 match source-address any
set security policies from-zone trust to-zone untrust policy p1 match destination-address any
set security policies from-zone trust to-zone untrust policy p1 match application junos-defaults
set security policies from-zone trust to-zone untrust policy p1 match dynamic-application junos:IPERF
set security policies from-zone trust to-zone untrust policy p1 then deny

Warning Message

root# commit
[edit security policies from-zone trust to-zone untrust policy p1]
  'match'
    warning: Dynamic-application junos:IPERF does not contain any default ports, please add a more restrictive application to the policy and remove "junos-defaults"!
commit complete

When the above warning is seen during configuration commit, you will have to use " any " for the application option to resolve the warning.

Example

set security policies from-zone trust to-zone untrust policy p1 match source-address any
set security policies from-zone trust to-zone untrust policy p1 match destination-address any
set security policies from-zone trust to-zone untrust policy p1 match application any
set security policies from-zone trust to-zone untrust policy p1 match dynamic-application junos:IPERF
set security policies from-zone trust to-zone untrust policy p1 then deny