Filter
Top Products
8 Copyright © 2010, Juniper Networks, Inc.
IMPLEMENTATION GUIDE -Juniper Networks SRX Series Services Gateways/Websense V10000
2. Create a FBF that is used to redirect specific traffic from the User LAN to the V10000 P1 port.
This technique requires a forwarding-based routing-instance that has a single next-hop route to the V10000 P1 port.
The forwarding instance has an independent routing table, which is the basis for changing the routing rules for traffic
processing. In order to populate the forwarder’s routing table correctly, a policy-statement must be defined to only
include routing for the interface going to the V10000 P1 port—in this case ge-2/0/1.
admin@SRX# show policy-options
policy-statement only-web-redirect-interface {
term allow {
from {
instance master;
interface ge-2/0/1.0;
}
then accept;
}
term reject {
then reject;
}
}
The next part is to define the forwarding instance and import only the interface route defined by the only-web-
redirect-interface routing policy. The forwarding instance has a single next hop to the V10000 P1 address
192.168.10.12. This is the configuration that redirects all traffic to the V10000 P1 port for processing.
admin@SRK# show routing-instances
to-P1-V10000-alpha {
instance-type forwarding;
routing-options {
static {
route 0.0.0.0/0 next-hop 192.168.10.12;
}
instance-import only-web-redirect-interface;
}
}
3. Add a security policy from user-lan to web-redirect. This step is necessary to allow any traffic to be redirected to the
V10000. A separate access control list is used to explicitly specify which traffic is actually redirected.
admin@SRX# show security policies
from-zone user-lan to-zone web-redirect {
policy permit-all {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
Note that you should follow this step if the user-lan security zone has already been set up. If it has not been set up,
then do the following to first configure the physical interface and then the security zone. Within the security zone
definition there is an address book definition that identifies the local hosts on the user-lan network. This address book
definition is used in a later step involving a specific security policy.