SRX

last person joined: yesterday 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.
  • 1.  How to monitor UTM (anti-virus and anti-spam)

    Posted 10-23-2013 21:34

    I m new in juniper SRX650. I impliment UTM ( anti-Virus and Anti-spam) on policy. How to monitor UTM (anti-virus and anti-spam) and confirm utm are working properly?



  • 2.  RE: How to monitor UTM (anti-virus and anti-spam)

    Posted 10-26-2013 04:02

    If u r just asking about how to check status of anti-virus/anti-spam u installed,,,,

    To see status of anti-virus that u have configured, simply use command "show security utm anti-virus status"..
    To see statistics of ur configured anti-virus feature, use "show security utm anti-virus statistics",
    same goes for anti-spam,like "show security utm anti-spam status", "show security utm anti-spam statistics"...
    Further "show log messages" may also help u to find some logs of viruses/spam found.


    Still if u need to test and verify its funcitoning, u need to launch some attack like u transfer a file to some server/pc from your system having this srx in between, and same should be shown in statistics with results...



  • 3.  RE: How to monitor UTM (anti-virus and anti-spam)
    Best Answer

    Posted 10-27-2013 20:42

    Use the question mark "?" a lot anywhere in the heirarchy.

     
    >show security utm ?
      anti-spam             Show anti-spam information
      anti-virus              Show anti-virus information
      content-filtering    Show content-filtering information
      session                 Show security utm session
      status                   Show security utm status
      web-filtering          Show web-filtering information
     
    >show security utm anti-spam status
    >show security utm anti-spam statistics
    >show security utm anti-virus status
    >show security utm anti-virus statistics
     
    >show security idp status
    >show security idp memory

     

     



  • 4.  RE: How to monitor UTM (anti-virus and anti-spam)

    Posted 10-28-2013 00:03

    Many Thanks,

     

    Herewith a configuration,  Could you please advise, is configuration correct?

     

                policy trust-to-pdsn-aaa-network {
                    match {
                        source-address HQ-Billing-Group;
                        destination-address PDSN-AAA-Block;
                        application any;
                    }
                    then {
                        permit {
                            application-services {
                                utm-policy av-as-policy;
                            }
                        }
                        log {
                            session-init;
                            session-close;
                        }
                        count;
                    }
                }



    utm {
            feature-profile {
                anti-virus {
                    kaspersky-lab-engine {
                        pattern-update {
                            email-notify {
                                admin-email "netadmin@citycell.com";
                                custom-message "Core Firewall UTM Update notification";
                                custom-message-subject "Core Firewall UTM has been updated successfully";
                            }
                        }
                    }
                }
            }
    utm-policy av-as-policy {
                anti-virus {
                    http-profile junos-av-defaults;
                    ftp {
                        upload-profile junos-av-defaults;
                        download-profile junos-av-defaults;
                    }
                    smtp-profile junos-av-defaults;
                    pop3-profile junos-av-defaults;
                    imap-profile junos-av-defaults;
                }
                anti-spam {
                    smtp-profile junos-as-defaults;
                }
                traffic-options {
                    sessions-per-client {
                        over-limit log-and-permit;
                    }
                }
            }