Restricting web access to management GUI when running dynamic VPN on external interface

[SapphireNET]

I am setting up a dyn vpn on an srx setup.

I have followed the appnotes but I am concerned that when enabling https on my external interface for clients to connect and download the vpn client they are also able to see the management GUI

we used to restrict http access via a filter on the lo0 but is there a way I can say:

<ip>/dynamic-vpn = allowed from anywhere

<ip>/ = allowed from only specific IP prefix list

so that the management GUI is restricted to a specific prefix list whilst the dynamic vpn page is available to all?

[muttbarker]

Do you have the UTM license on your box? You could use custom web filtering rules to accomplish this task.

[Whadmin]

Kevin,

I'm also looking to do the same on an SRX210. Can you give me an example of the proposed config.

Thanks,

Anton

[mawr]

Long story short, this can't be done:

1. Even when setting management-url J-Web can still be accessed as https://wan.ipa.ddr.ess/login.

2. Web filter rules cannot be applied to HTTPS.

mawr