Description

  • Is it  possible to integrate Juniper Vsrx that we have version 15.1-X49-D90 with the active Directory and apply a webfilter profiles based on LDAP users/Groups,
  • If any software is needed or if any license should be purchased.

Symptoms

  • Is it  possible to integrate Juniper Vsrx that we have version 15.1-X49-D90 with the active Directory and apply a webfilter profiles based on LDAP users/Groups,
  • If any software is needed or if any license should be purchased.

Solution

 

It is possible to integrate a vSRX with Active Directory.  

 

Example: Configuring Integrated User Firewall on SRX Series Firewalls to Use Web-Redirect for Unauthenticated and Unknown Users

https://www.juniper.net/documentation/us/en/software/junos/authentication-firewall/topics/topic-map/security-user-auth-configure-integrated-userfw.html#id-example-configuring-integrated-user-firewall-to-use-web-redirect-for-unauthenticated-and-unknown-users

 

 

Since the implementation of LDAP is using Security Policies and you need to use Web Filtering, you can refer to the documents below. Foe using regular Web Filtering, a license is needed since the device has to query a Server for getting Web Site categories and reputation. If you would like to setup the pages to be blocked manually, you can do it using "Local Web Filtering" and a license is not needed. 

 

 

Example: Configuring Enhanced Web Filtering

https://www.juniper.net/documentation/us/en/software/junos/utm/topics/topic-map/security-utm-web-filtering.html#id-example-configuring-enhanced-web-filtering 

 

 

Understanding Local Web Filtering

https://www.juniper.net/documentation/us/en/software/junos/utm/topics/topic-map/security-utm-local-web-filtering.html

 

 

Additionally, there is a known situation with Active Directory after a Microsoft Update. This service is working with some specific Junos versions you can see in the below document. 

 

 

[SRX/NFX] Integrated User Firewall with Active Directory stops working after Microsoft Update for KB5004442 [juniper.net]

https://supportportal.juniper.net/s/article/SRX-Integrated-User-Firewall-with-Active-Directory-stops-working-after-Microsoft-Update-for-KB5004442?language=en_US [juniper.net]

 

To Configure the connection between SRX Series devices to JIMS allows the JIMS server to send the IP address, username, and group relationship information to SRX Series devices through CSO. You can also configure a set of optional advanced settings for authentication timeout, domain filters, and choose to include or exclude user identity information in the communication between the JIMS server and the SRX Series device.

 

Configuring JIMS for an SRX Device

https://www.juniper.net/documentation/en_US/cso4.0/topics/task/operational/cp-jims-srx-configuring.html

 

In simple terms, JIMS is a server that runs on windows which listens to remote DC security event log events (like logins) and active directory events (like add/remove users to a group) to generate a list of current sessions (a mapping of IP address to usernames and devices).

 SRX connects to the JIMS server(s) to get that list of current sessions.

 If there are two JIMS servers configured, it will bias towards the primary unless it is down, in which case it will fail over to the seconda

 

JIMS Installation

https://www.juniper.net/documentation/us/en/software/jims/JIMS/jims-guide/topics/topic-map/jims-installation.html

 

Juniper Identity Management Service User Guide (JIMS):

https://www.juniper.net/documentation/us/en/software/jims/jims-guide/jims-guide.pdf

For more understanding:

https://www.juniper.net/documentation/en_US/cso5.1/topics/task/operational/cp-jims-srx-configuring.html

https://www.juniper.net/documentation/us/en/software/jims/JIMS/topics/topic-map/jims-overview.html

 

Modification History

--

Related Information

---