SRX

After referring to http://kb.juniper.net/InfoCenter/index?page=content&id=KB16509&actp=search

I am still not seeing traffic that is denied. I'm guessing I am missing something in the security policy itself?

here is what I have as an example ...  am I missing something?

 from-zone untrust to-zone test {
            policy 33 {
                match {
                    source-address [ test_Users testFixInternal ];
                    destination-address testSecuredNet;
                    application any;
                }
                then {
                    permit;
                    log {
                        session-init;
                    }
                }
            }

I have the following (under syslog), but I am only able to see traffic-log but not blocked-traffic

file blocked-traffic {
    any any;
    match RT_FLOW_SESSION_DENY;
}

file traffic-log {
    any any;
    match RT_FLOW_SESSION;
}

show log traffic-log (shows tons)

show log blocked-traffic (shows nothing)

show log traffic-log | match DENY (shows nothing)

Try making a global deny policy and add logging to it. Global rules will capture any traffic from all zones, like "from-zone * to-zone *"

set security policies global policy DENY-ALL match source-address any
set security policies global policy DENY-ALL match destination-address any
set security policies global policy DENY-ALL match application any
set security policies global policy DENY-ALL then deny
set security policies global policy DENY-ALL then log session-init

Wow... Ok... that of course explains everything thank you.

Here is my pickle I guess .. all of our security policies are permits, so global may be the way I need to go on this, unless if there is an "else" statement after logging "permits" but I'm guessing no.

So global seems like the way to go, only its a bit scary to the inexperienced (which is me). The security policy you suggest is a bit intimidating, isnt it globally denying everything despite all the other permits? .. or is global sort of a last resort policy ... like an ACL?

thats pretty awesome actually... and makes total sense. Thank you so much for the help!