Understanding the source-identity based policy in SRX

This article provides information about the new feature – source-identity based policy in SRX.

Information about the new feature – source-identity based policy in SRX.

From Junos 12.1 on SRX, Juniper Networks supports user role based firewall security policies, which will let you classify traffic based on the roles, to which a user is assigned.

With this policy being configured, you can match the policy by collecting the user role either locally on the SRX Series device or from a Junos Pulse Access Control Service device (UAC).

Note: Authenticated users are those who have role information on the firewall; un-authenticated users are those who do not have role information on the firewall.

Example 1: source-identity based policy for authenticated users; with captive portal re-direction:

Note: To match the above policy, you should have the role information either locally configured on SRX or from the Junos Pulse Access Control Service device (UAC). You will get the role information from the auth-table, only if you have already authenticated from UAC.

Example 2: source-identity based policy for unauthenticated users; with captive portal re-direction:

Note: ‘unauthenticated’ is not a role name; it is a string which is used to match all the unauthenticated users.
Example 3: source-identity based policy for any users with captive portal re-direction:

 

About the author

Prasanna

Leave a Comment