Using Juniper Local Web filtering (whitelist/blacklist) does not require a license. However,starting in Junos OS Release 22.2R1, the web filtering uses JDPI-Decoder support for processing the application data.
You must enable the JDPI-Decoder to enforce the web filtering functionality. https://www.juniper.net/documentation/us/en/software/junos/utm/topics/concept/utm-web-filtering-overview.html
Once upgrading a working Local Web Filtering to 22.2R1 or later, you will notice that whitelist/blacklist stopped working. It shows that the Web Filtering statistics are not incrementing and UTM is bypassed.
root@srxlab> show security utm web-filtering status
UTM web-filtering status:
Server status: Juniper local URL filtering
JDPI Parser : Enabled
root@srxlab> show security utm web-filtering statistics
UTM web-filtering statistics:
Total requests: 0
White list hit: 0
Black list hit: 0
Default action hit: 0
Custom category permit: 0
Custom category block: 0
Custom category quarantine: 0
Custom category qurantine block: 0
Custom category quarantine permit: 0
Safe-search redirect: 0
Safe-search rewrite: 0
Web-filtering sessions in total: 128000
Web-filtering sessions in use: 0
Fallback: log-and-permit block
Default 0 0
Timeout 0 0
Connectivity 0 0
Too-many-requests 0 0
You can still use the Juniper local Web Filtering without buying the license by performing the below steps:
“set security utm default-configuration web-filtering performance-mode", this command disable the JDPI-decoder then we can use the local-web-filtering without the JDPI-Decoder (app-id signature database), however, the local web-filtering will be restricted for standard ports (TCP 80 and 443)
01-05-2007 14:02
JDPI Parser : Disabled
If you want to use non standard ports for Local Webfiltering like port 8080, you need to explicitly create a custom application and add it to the security policy that has the UTM applied to it.
Below is an example of using port 8080 :
set security utm custom-objects url-pattern URL-LIST-1 value *.google.com
set security utm custom-objects url-pattern BLOCK-ALL value *.bbc.com
set security utm custom-objects custom-url-category WHITELIST value URL-LIST-1
set security utm custom-objects custom-url-category BLACKLIST value BLOCK-ALL
set security utm default-configuration web-filtering performance-mode <<<<<<<<<<<<
set security utm default-configuration web-filtering type juniper-local
set security utm feature-profile web-filtering juniper-local profile WEB_FILTER_LOCAL_PROFILE default permit
set security utm feature-profile web-filtering juniper-local profile WEB_FILTER_LOCAL_PROFILE category BLACKLIST action block
set security utm feature-profile web-filtering juniper-local profile WEB_FILTER_LOCAL_PROFILE category WHITELIST action permit
set security utm utm-policy WEB_FILTER_LOCAL_POLICY web-filtering http-profile WEB_FILTER_LOCAL_PROFILE
set security policies from-zone lan-mgmt to-zone wan-internet policy term3 match source-address any
set security policies from-zone lan-mgmt to-zone wan-internet policy term3 match destination-address any
set security policies from-zone lan-mgmt to-zone wan-internet policy term3 match application app8080 <<<<<<<<<<<<<<<<<
set security policies from-zone lan-mgmt to-zone wan-internet policy term3 then permit application-services utm-policy WEB_FILTER_LOCAL_POLICY
set applications application app8080 application-protocol http
set applications application app8080 destination-port 8080
https://gnats.juniper.net/web/default/1809344/