SRX

Hi Andrea,

You don't mention what version of Junos you are running but in this configuration Junos version 22.2R3-S2 is jtac recommended. 

Cheers

-Tom

I noticed the same problem with the currently recommended version 22.4R3-S2.

Check this KB out: https://supportportal.juniper.net/s/article/How-to-stop-JWeb-on-the-JSC-interface

We were kind of involved in this when the bug became apparent but I can't remember the details. If the above will not resolve your problems, please get back here and I can check with a colleague of mine.

The problem still persists. Maybe there is some interaction I'm not seeing yet.

We have jweb configured so it should be accessible only on the trust interface (irb.1 in our case)with url jweb, like so:

system {
    [...]
    services {
        web-management {
            management-url jweb;
            https {
                pki-local-certificate juniper;
                interface irb.1;
            }
        }
    }
}
security {
    zones {
        security-zone untrust {
            interfaces {
                ge-0/0/0.0 {
                    host-inbound-traffic {
                        system-services {
                            ping;
                            ike;
                            https;
                            ssh;
                            tcp-encap;
                        }
                    }
                }
            }
        }
    }
}

jweb is then still accessible via the ge-0/0/0.0 interface.

We do have an additional security policy from-zone untrust to-zone junos-host to block unwanted ssh traffic.

This is with 22.4R3-S2.

Just to add to this thread, I found a solution for the Problem, which is in KB33505: https://supportportal.juniper.net/s/article/SRX-Stopping-J-Web-login-from-External-Untrust-interface-when-dynamic-VPN-is-in-use?language=en_US

When using jweb and JSC, you MUST NOT set "system services web-management management-url". Removing this solved the problem for me on 22.4R3.

Versions before 22.4R3 and 23.2R1-S2 might still be affected by KB77716 I've posted above, so for older versions an upgrade might be neccessary.