SRX

Hi Andrea,

You don't mention what version of Junos you are running but in this configuration Junos version 22.2R3-S2 is jtac recommended. 

Cheers

-Tom

I noticed the same problem with the currently recommended version 22.4R3-S2.

Check this KB out: https://supportportal.juniper.net/s/article/How-to-stop-JWeb-on-the-JSC-interface

We were kind of involved in this when the bug became apparent but I can't remember the details. If the above will not resolve your problems, please get back here and I can check with a colleague of mine.

The problem still persists. Maybe there is some interaction I'm not seeing yet.

We have jweb configured so it should be accessible only on the trust interface (irb.1 in our case)with url jweb, like so:

system {
    [...]
    services {
        web-management {
            management-url jweb;
            https {
                pki-local-certificate juniper;
                interface irb.1;
            }
        }
    }
}
security {
    zones {
        security-zone untrust {
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            ike;
                            https;
                            ssh;
                            tcp-encap;
                        }
                    }
                }
            }
        }
    }
}

jweb is then still accessible via the ge-0/0/0.0 interface.

We do have an additional security policy from-zone untrust to-zone junos-host to block unwanted ssh traffic.

This is with 22.4R3-S2.