Juniper NextGen Web Filtering (SRX Series and cSRX) - Starting in Junos OS Release 23.4R1, Juniper NextGen Web Filtering (NGWF) is available as the URL filtering infrastructure in the Juniper cloud. It uses the OEM Cloud for URL reputation and category. NGWF enables the SRX Series Firewall and cSRX Container Firewall to permit or deny access to specific URLs based on the reputation and category to which the URLs belong. It intercepts, scans, and acts upon HTTP or HTTPS traffic to prevent inappropriate Web content access. It also provides better visibility into the URL.

Juniper NextGen is available at Security Services > Content Security: 

•  In Default Configuration, under Web Filtering. 
•  In Web Filtering Profiles > Create Web Filtering Profiles, under Engine Type. 

For more details about NextGen Web Filtering like benefits of it, or a comparison vs Enhanced Web Filtering refer to: NextGen Web Filtering

For supported models of the feature, refer to: Supported Platforms

+ Device runs Junos version 23.4R1 onwards.

+ There is a need to configure new NextGen Web Filtering feature.

The following example, outlines a full config example for newer feature NextGen Web Filtering.

This assumes, SRX has interface with internet (public internet connectivity), dns resolving FQDNs (fully qualified domain names) properly, and routing in place towards the internet. 

User ip is 192.168.100.100.

This is used to check status of web filtering:

show security utm web-filtering status

    UTM web-filtering status:
    Web-filtering type: NG-Juniper > this confirms the type of web-filtering service. 
    Server status: Juniper Cloud Server UP
    JDPI Parser: Enabled
    Dynapp-profile-selection : Enabled

This is used to display web-filtering service statistics:

show security utm web-filtering statistics

UTM web-filtering statistics:

Total requests: 1407

White list hit: 0

Black list hit: 0

Default action hit: 0

No license permit: 0

Queries to server: 490

Server reply permit: 481

Server reply block: 9


This is used to confirm the new license type sits in place - now it adds automatically the new license type for next-gen web-filtering.

root@vsrxlab1> show system license
License usage:
                                 Licensed     Licensed    Licensed
                                  Feature      Feature     Feature
  Feature name                       used    installed      needed    Expiry
  Web Filtering NG Juniper              0            1           0    2026-04-23 00:00:00 UTC 

================

Config example:

================

Config and request to enable WF to NG and connection enabled: (Note: You must configure SSL initiation profile for NGWF to communicate through HTTPS connections)

=======

1- Configuring SSL initiation profile which requires the usage of a certificate. In this example, a self-signed certificate is being used.

Operation Level:

request security pki generate-key-pair certificate-id utmcert size 1024 type rsa

request security pki local-certificate generate-self-signed certificate-id utmcert subject "DC=Domain_component,CN=utmcert,OU=SLT_QA,O=Juniper,L=Sunnyvale,ST=CA,C=US" ip-address 0.0.0.0 domain-name juniper.net add-ca-constraint

======

======

2- Configurational changes needed:

• set the web-filter type to ng-juniper and bound the created ssl profile to it.

set security utm default-configuration web-filtering type ng-juniper

set security utm default-configuration web-filtering ng-juniper server tls-profile ssl_init_prof

set security utm default-configuration web-filtering ng-juniper default log-and-permit

set services ssl initiation profile ssl_init_prof client-certificate utmcert

set services ssl initiation profile ssl_init_prof actions ignore-server-auth-failure

commit

• Configure a web-filtering profile, attach it to an UTM profile and bind it to a security policy where you want the feature to be used:

set security utm feature-profile web-filtering ng-juniper profile http-profile category NG_Gambling_in_general action block

set security utm feature-profile web-filtering ng-juniper profile http-profile site-reputation-action

set security utm feature-profile web-filtering ng-juniper profile http-profile default log-and-permit

set security utm feature-profile web-filtering ng-juniper profile http-profile fallback-settings default log-and-permit

set security utm feature-profile web-filtering ng-juniper profile http-profile fallback-settings server-connectivity log-and-permit

set security utm feature-profile web-filtering ng-juniper profile http-profile fallback-settings timeout log-and-permit

set security utm feature-profile web-filtering ng-juniper profile http-profile fallback-settings too-many-requests log-and-permit

set security utm utm-policy NG-WF web-filtering http-profile http-profile

set security zones security-zone untrust address-book address 192.168.100.100 192.168.100.100/32

set security policies from-zone untrust to-zone trust policy 99 match source-address 192.168.100.100

set security policies from-zone untrust to-zone trust policy 99 match destination-address any

set security policies from-zone untrust to-zone trust policy 99 match application any

set security policies from-zone untrust to-zone trust policy 99 then permit application-services ssl-proxy profile-name ssl_init_prof

set security policies from-zone untrust to-zone trust policy 99 then permit application-services utm-policy NG-WF

set security policies from-zone untrust to-zone trust policy 99 then log session-init

set security policies from-zone untrust to-zone trust policy 99 then log session-close

======

Test, results and logging below:

Logging, if not setup already:

set system syslog file web-filter-deny any any

set system syslog file web-filter-deny match webfilter_url_blocked

or

set system syslog file web-filter-deny match RT_UTM > this would be for logging all UTM events in general.

root@vsrxlab1# run show log web-filter-deny | match draftkings

Apr 22 17:51:18 vsrxlab1 RT_UTM: WEBFILTER_URL_BLOCKED: WebFilter: ACTION="URL Blocked" source-zone="untrust" destination-zone="trust" 192.168.100.100(51363)->104.76.210.207(80) SESSION_ID=9813 APPLICATION="HTTP" NESTED-APPLICATION="UNKNOWN" CATEGORY="NG_Gambling_in_general" REASON="BY_PRE_DEFINED" PROFILE="http-profile" URL=draftkings.com username N/A roles N/A application-sub-category N/A urlcategory-risk 1

=====