The Juniper SRX Services Gateway Firewall must continuously monitor outbound communications traffic for unusual/unauthorized activities or conditions.
An XCCDF Rule
Description
If outbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs. The Juniper SRX is a highly scalable system that can provide stateful or stateless continuous monitoring when placed in the architecture at the perimeter or internal boundaries. Unusual/unauthorized activities or conditions may include use of unusual protocols or ports and attempted communications from trusted zones to external addresses.
- ID
- SV-214538r1056075_rule
- Version
- JUSX-AG-000145
- Severity
- High
- References
- Updated
Remediation Templates
A Manual Procedure
Configure a security policy or screen to each outbound zone to implement continuous monitoring. The following commands configure a security zone called "untrust" that can be used to apply security policy for inbound interfaces that are connected to untrusted networks. This example assumes that interfaces ge-0/0/1 and ge-0/0/2 are connected to untrusted and trusted network segments.
Apply policy or screen to a zone example:
set security zones security-zone untrust interfaces ge-0/0/1.0
set security zones security-zone trust interfaces ge-0/0/2.0