SRX

Hello Team,

We are in the process of deploying the SRX firewall through Security Director and migrating all relevant configurations-including zones, policies, applications, services, interfaces, etc.-from the legacy Juniper firewall to the new Juniper SRX firewall. Our objective is to complete the deployment using Security Director.

In the legacy firewall systems, addresses were created in association with specific zones. However, we have observed that when using Security Director, addresses are created independently and are not associated with any particular zone. Additionally, when policies are created using zones and addresses within Security Director, the corresponding addresses are automatically moved to the global address group.

Therefore, I would like to clarify: Is it possible for an address or address group to be associated with a specific zone in Security Director? Or, as is the case with next-generation firewalls, are addresses created in a general manner and then automatically treated as part of the global address group when used in policy creation?

All addresses for policies are created in the Configure ->Shared Objects -> Addresses section and then referenced in the policies created in each of the zones.  One exception is when setting up NAT addresses. The NAT pools are under Configure->NAT Policy->Pools. 

Hello Team,

We are in the process of deploying the SRX firewall through Security Director and migrating all relevant configurations-including zones, policies, applications, services, interfaces, etc.-from the legacy Juniper firewall to the new Juniper SRX firewall. Our objective is to complete the deployment using Security Director.

In the legacy firewall systems, addresses were created in association with specific zones. However, we have observed that when using Security Director, addresses are created independently and are not associated with any particular zone. Additionally, when policies are created using zones and addresses within Security Director, the corresponding addresses are automatically moved to the global address group.

Therefore, I would like to clarify: Is it possible for an address or address group to be associated with a specific zone in Security Director? Or, as is the case with next-generation firewalls, are addresses created in a general manner and then automatically treated as part of the global address group when used in policy creation?