Juniper Virtual Advanced Threat Prevention Appliance (vJATP Appliance) Integration Guide

Virtual Advanced Threat Prevention Appliance (vJATP Appliance)
Juniper
Brand
Juniper
Model
Virtual Advanced Threat Prevention Appliance (vJATP Appliance)
Type
Integration Guide

This manual is also suitable for

Juniper Advanced Threat Prevenon
Appliance Integraon with the SRX Series
Firewall
Published
2023-12-03
Juniper Networks, Inc.
1133 Innovaon Way
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
Juniper Networks, the Juniper Networks logo, Juniper, and Junos are registered trademarks of Juniper Networks, Inc.
in the United States and other countries. All other trademarks, service marks, registered marks, or registered service
marks are the property of their respecve owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right
to change, modify, transfer, or otherwise revise this publicaon without noce.
Juniper Advanced Threat Prevenon Appliance Integraon with the SRX Series Firewall
Copyright © 2023 Juniper Networks, Inc. All rights reserved.
The informaon in this document is current as of the date on the tle page.
YEAR 2000 NOTICE
Juniper Networks hardware and soware products are Year 2000 compliant. Junos OS has no known me-related
limitaons through the year 2038. However, the NTP applicaon is known to have some diculty in the year 2036.
END USER LICENSE AGREEMENT
The Juniper Networks product that is the subject of this technical documentaon consists of (or is intended for use
with) Juniper Networks soware. Use of such soware is subject to the terms and condions of the End User License
Agreement ("EULA") posted at hps://support.juniper.net/support/eula/. By downloading, installing or using such
soware, you agree to the terms and condions of that EULA.
ii
Table of Contents
About This Guide | v
1
Overview
ATP Appliance and SRX Series Firewall Integraon Overview | 2
2
Licensing
Licensing and Plaorm Support informaon | 4
3
Geng Started
Geng Started with ATP Appliance and the SRX Series Firewall | 8
ATP Appliance and SRX Series Threat Level Comparison Chart | 14
4
ATP Appliance Conguraon
Congure SMTP and IMAP Email Management | 17
Congure File Type Proles | 19
Global Cong | 20
Add SRX Series Firewalls to ATP Appliance Zones | 21
Congure MSSP Mul-Tenancy Zones | 21
Add SRX Series Firewalls to Exisng Zones | 22
Add Proxy IP Addresses for SRX Series Firewalls to ATP Appliance | 25
5
SRX Series Conguraon
Congure the SRX Series Firewall SMTP Email Policies for Integraon with ATP
Appliance | 28
Congure the SRX Series Firewall IMAP Email Policies for Integraon with ATP
Appliance | 34
Congure the SRX Series and Geolocaon IP for Integraon with ATP Appliance | 41
6
ATP Appliance Incidents
Viewing and Taking Acon on Infected Hosts | 48
iii
Viewing File and Command and Control Incidents | 50
iv
About This Guide
Use this guide to integrate the SRX Series Firewall with the ATP Appliance Core to provide le and email
scanning and feeds for blocking infected hosts.
v
1
CHAPTER
Overview
ATP Appliance and SRX Series Firewall Integraon Overview | 2
ATP Appliance and SRX Series Firewall Integraon
Overview
The Juniper Advanced Threat Prevenon Appliance integrates with the SRX Series Firewall to protect all
hosts in your network against evolving security threats by employing ATP Appliance’s threat detecon
soware with a next-generaon rewall system.
For this release, the SRX Series Firewall integrates with the ATP Appliance Core to provide the following
features:
• File scanning with global allowlists and blocklists.
• File scanning for administrator-created le proles for specied le types.
• Feeds for infected hosts, command and control servers, and GeoIP.
• Email aachment scanning for SMTP and IMAP.
Conguraon is required on both ATP Appliance and the SRX Series Firewall for these features.
NOTE: ATP Appliance (previously Cyphort) already worked with the SRX Series Firewall for
“Auto-Migaon” of infected hosts using address sets. The integraon described in this guide is
a more complete soluon that requires the SRX Series Firewall to enroll with ATP Appliance to
make use of many more features explained here.
See the Operator’s Guide, and the secon entled “Verifying Auto-Migaon Rule Operaons,”
for more details about exisng opons for infected host migaon using ATP Appliance and the
SRX Series, that don’t include enrollment.
RELATED DOCUMENTATION
Licensing and Plaorm Support informaon | 4
Geng Started with ATP Appliance and the SRX Series Firewall | 8
2
2
CHAPTER
Licensing
Licensing and Plaorm Support informaon | 4
Licensing and Plaorm Support informaon
IN THIS SECTION
ATP Appliance and SRX Series Integraon Licensing | 4
Supported SRX Series Firewalls | 4
The following secons provide informaon on licensing requirements and SRX Series Firewall plaorm
support.
ATP Appliance and SRX Series Integraon Licensing
Unlike other Layer 7 features, there is no separate license required on the SRX Series Firewall for
integraon with ATP Appliance. In this deployment, the ATP Appliance Core is the licensed component.
If the Core has a valid license, then the SRX Series Firewall can connect to the Core and enroll
successfully. If not, the enrollment will fail.
For ATP Appliance license upload instrucons, see Seng the Juniper ATP Appliance License Key.
NOTE: AppSecure funconality on the SRX Series Firewall is a pre-requisite for integrang with
ATP Appliance. Depending on the SRX Series plaorm, a separate license may be required to
enable AppSecure. Please consult the SRX Series plaorm data sheet for the most accurate
informaon.
Supported SRX Series Firewalls
This secon describes the hardware and soware components that are compable with ATP Appliance.
4
Plaorm Hardware Requirements Soware Versions
vSRX Virtual Firewall Series Junos 18.2R1 and above
SRX Series SRX320, SRX300 Junos 18.3R1 and above
SRX Series SRX4100, SRX4200, SRX4600 Junos 15.1X49-D65 and above for
SRX4100 and SRX4200
Junos 17.4R1-S1 and above for
SRX4600
SRX Series SRX340, SRX345, SRX550m Junos 15.1X49-D60 and above
SRX Series SRX5800, SRX5600, SRX5400 Junos 15.1X49-D50 and above
SRX Series SRX1500 Junos 15.1X49-D33 and above
The following devices support scanning SMTP e-mail aachments:
• SRX300 Series Firewall
• SRX320 Series Firewall
• SRX340 Series Firewall
• SRX345 Series Firewall
• SRX1500 Series Firewall
• SRX4100 Series Firewall
• SRX4200 Series Firewall
• SRX4600 Series Firewall
• SRX5400 Series Firewall
• SRX5600 Series Firewall
• SRX5800 Series Firewall
• vSRX Virtual Firewall Series
5
The following devices support scanning IMAP e-mail aachments:
• SRX300 Series Firewall
• SRX320 Series Firewall
• SRX340 Series Firewall
• SRX345 Series Firewall
• SRX1500 Series Firewall
• SRX4100 Series Firewall
• SRX4200 Series Firewall
• SRX4600 Series Firewall
• SRX5400 Series Firewall
• SRX5600 Series Firewall
• SRX5800 Series Firewall
• vSRX Virtual Firewall Series
RELATED DOCUMENTATION
Geng Started with ATP Appliance and the SRX Series Firewall | 8
6
3
CHAPTER
Geng Started
Geng Started with ATP Appliance and the SRX Series Firewall | 8
ATP Appliance and SRX Series Threat Level Comparison Chart | 14
Geng Started with ATP Appliance and the SRX
Series Firewall
IN THIS SECTION
Congure the SRX Series Firewall to Begin | 8
On ATP Appliance: Login to the Web UI and Enroll SRX Series Firewalls | 10
On the SRX Series Firewall: Congure Security Policies | 12
These are basic setup instrucons to begin using the SRX Series Services Gateway with ATP Appliance
(for those less familiar with SRX). Refer to the rest of the integraon document for further conguraon
informaon such as email scanning, infected hosts, and viewing incidents.
Congure the SRX Series Firewall to Begin
Inial Conguraon
To begin using the SRX Series Firewall:
1. Load the factory defaults.
load factory-default
2. Set the root password.
set system root-authentication <password>
3. Set the host name.
set system host-name <hostname>
4. Commit the conguraon. Once you commit, you should see the host name in the prompt.
commit
8
Congure Interfaces and a Default Route
On the SRX Series Firewall, congure interfaces and the default route. (For the following instrucons,
these are generic examples. Please insert your own addresses and interfaces):
1. Enter the following commands for interfaces:
set interfaces ge-0/0/2 unit 0 family inet address x.x.x.x/x
set interfaces ge-0/0/4 unit 0 family inet address x.x.x.x/x
set interfaces ge-0/0/5 unit 0 family inet address x.x.x.x/x
2. Enter the following to congure the default route:
set routing-options static route 0.0.0.0/0 next-hop x.x.x.x
Congure Security Zones
The SRX Series Firewall is a zone-based rewall. You must assign each interface to a zone in order to
pass trac through it: To congure security zones, enter the following commands:
set security zones security-zone untrust interfaces ge-0/0/2.0
set security zones security-zone untrust interfaces ge-0/0/5.0
set security zones security-zone trust host-inbound-traffic system-services all
set security zones security-zone trust host-inbound-traffic protocols all
set security zones security-zone trust interfaces ge-0/0/4.0
Congure DNS
On the SRX Series Firewall, congure DNS using the following commands:
set groups global system name-server x.x.x.x
set groups global system name-server x.x.x.x
Congure NTP
On the SRX Series Firewall, congure NTP using the following commands:
set groups global system processes ntp enable
set groups global system ntp boot-server x.x.x.x
set groups global system ntp server x.x.x.x
9
On ATP Appliance: Login to the Web UI and Enroll SRX Series Firewalls
Enroll the SRX Series Firewall to ATP Appliance Web UI
Enrollment establishes a secure connecon between ATP Appliance and the SRX Series Firewall. It also
performs basic conguraons tasks such as:
• Downloads and installs cercate authority (CAs) licenses onto your SRX Series Firewall
• Creates local cercates and enrolls them with ATP Appliance
• Establishes a secure connecon to ATP Appliance
WARNING: If you are using a custom SSL cercate with ATP Appliance, before you
enroll SRX Series Firewalls, you must upload the CA bundle containing a CA cercate
which validates the ATP Appliance cercate. This ONLY applies if you are using a
Custom SSL cercate. See The Juniper ATP Operator’s Guide for instrucons. Search
for the “Managing Cercates” heading. Once this is done, proceed to the enrollment
instrucons.
WARNING: If you already have SRX Series Firewalls enrolled with ATP Appliance and
you change the cercate (from the default to custom or vice-versa), you must re-enroll
all SRX Series Firewalls.
WARNING: Network Environment Consideraons and Requirements
• It is required that both your Roung Engine (control plane) and Packet Forwarding
Engine (data plane) can connect to the Juniper ATP Appliance. (The Packet
Forwarding Engine and the Roung Engine perform independently but communicate
constantly through a 100-Mbps internal link. This arrangement provides streamlined
forwarding and roung control and the ability to run Internet-scale networks at high
speeds. Refer to Juniper Network’s Junos documentaon for more informaon.)
• You do not need to open any ports on the SRX Series Firewall to communicate with
ATP Appliance. However, if you have a device in the middle, such as a rewall, then
that device must have port 443 open.
• You cannot use FXP0 interfaces to communicate with ATP Appliance. You must use
a separate revenue interface.
10
• If you are using addresses in the same subnet for ATP Appliance management and
SRX Series management, you must use a virtual router instance to separate the
management and revenue interfaces. If the addresses of ATP Appliance management
and SRX Series management congured through FXP0 are in dierent subnets, you
do not need to congure an addional virtual router instance. Note that trac must
be routed through the revenue interface congured for ATP Appliance management.
• If you are registering ATP Appliance through a VPN tunnel, it must be a named
tunnel. ATP Appliance expects an IP address on the interface. Therefore you must
congure an IP address on the VPN tunnel interface before running the OP URL
script to enroll the SRX Series Firewall. Otherwise, the registraon will fail.
• SRX Series Integraon with ATP Appliance requires api keys to generate the
enrollment script (op url). The ATP Appliance UI only allows generang API keys for
local users. Therefore, if users authencate using radius and aempt to generate an
enrollment script to register an SRX Series Firewall, it will fail because the remote
user will not have an API key. As a workaround, you can log into the ATP Appliance
UI using local credenals (hps://<ATP Appliance IP>/cyadmin/?local_login) and
connue with the instrucons below. If your network policy doesn’t allow local
users, there is no workaround for this issue.
To enroll a SRX Series Firewall with ATP Appliance, do the following:
1. From the ATP Appliance web UI, you must enable the API Key for the admin user. This is used for
enrolling the SRX Series Firewall. From the Cong tab, navigate to System Prole > Users. Select the
admin user for ATP Appliance and enable the Generate New API Key checkbox. Click Update User.
2. From the Cong tab, navigate to > System Prole > SRX sengs and click the Enrollment URL buon
in top right side of the page. A screen with the enrollment command appears.
3. Copy the enre enrollment command to your clipboard and click OK.
4. Paste the command into the Junos OS CLI of the SRX Series Firewall you want to enroll with ATP
Appliance and press Enter.
NOTE: (Oponal) Use the show services advanced-anti-malware status CLI command to verify that
a connecon is made to ATP Appliance from the SRX Series Firewall.
Once congured, the SRX Series Firewall communicates with ATP Appliance through mulple
persistent connecons established over a secure channel (TLS 1.2) and the SRX Series Firewall is
authencated using SSL client cercates.
11
Use the Delete buon in the ATP Appliance SRX sengs page to remove the SRX Series Firewall
currently enrolled in ATP Appliance. To access the Delete buon, click the arrow to the le of the device
name to expand device informaon.
Use the Search eld at the top of the page to search for enrolled devices in the list by serial number.
On the SRX Series Firewall: Congure Security Policies
Congure the An-Malware Policy
On the SRX Series Firewall, enter the following commands to create and congure the an-malware
policy. (Note that commands for both SMTP and IMAP are included here.):
set services advanced-anti-malware policy aamw-policy http inspection-profile default
set services advanced-anti-malware policy aamw-policy http action permit
set services advanced-anti-malware policy aamw-policy http notification log
set services advanced-anti-malware policy aamw-policy smtp inspection-profile default
set services advanced-anti-malware policy aamw-policy smtp notification log
set services advanced-anti-malware policy aamw-policy imap inspection-profile default
set services advanced-anti-malware policy aamw-policy imap notification log
set services advanced-anti-malware policy aamw-policy fallback-options notification log
set services advanced-anti-malware policy aamw-policy default-notification log
Congure the SSL Forward Proxy
SSL Forward Proxy is required to collect les from HTTPS trac in the data plane.
1. On the SRX Series Firewall, generate the local cercate.
request security pki generate-key-pair certificate-id ssl-inspect-ca size 2048 type rsa
request security pki local-certificate generate-self-signed certificate-id ssl-inspect-ca domain-name
www.juniper.net subject "CN=www.juniper.net,OU=IT,O=Juniper Networks,L=Sunnyvale,ST=CA,C=US" email security-
[email protected]
2. Load the trusted root CA proles.
request security pki ca-certificate ca-profile-group load ca-group-name trusted-ca-* filename default
12
3. Enter the following commands to congure the SSL forward proxy.
set services ssl proxy profile ssl-inspect-profile-dut root-ca ssl-inspect-ca
set services ssl proxy profile ssl-inspect-profile-dut actions log all
set services ssl proxy profile ssl-inspect-profile-dut actions ignore-server-auth-failure
set services ssl proxy profile ssl-inspect-profile-dut trusted-ca all
Oponally, Congure the An-Malware Source Interface
If you are using a roung instance, you must congure the source interface for the an-malware
connecon. If you are using a non-default roung instance, you do not have to complete this step on the
SRX Series Firewall.
set services advanced-anti-malware connection source-interface ge-0/0/2
Congure a Security Intelligence Prole
ATP Appliance and SRX use dierent threat level thresholds. See the "ATP Appliance and SRX Series
Threat Level Comparison Chart" on page 14 for informaon.
On the SRX Series Firewall, enter the following commands to create a security intelligence prole on the
SRX Series Firewall.
set services security-intelligence profile secintel_profile category CC
set services security-intelligence profile secintel_profile rule secintel_rule match threat-level [ 7 8 9 10 ]
set services security-intelligence profile secintel_profile rule secintel_rule then action block drop
set services security-intelligence profile secintel_profile rule secintel_rule then log
set services security-intelligence profile secintel_profile default-rule then action permit
set services security-intelligence profile secintel_profile default-rule then log
set services security-intelligence profile ih_profile category Infected-Hosts
set services security-intelligence profile ih_profile rule ih_rule match threat-level [ 7 8 9 10 ]
set services security-intelligence profile ih_profile rule ih_rule then action block drop
set services security-intelligence profile ih_profile rule ih_rule then log
set services security-intelligence policy secintel_policy Infected-Hosts ih_profile
set services security-intelligence policy secintel_policy CC secintel_profile
13
Congure a Security Policy
On the SRX Series Firewall, enter the following commands to create a security policy on the SRX Series
Firewall for the inspecon proles.
set security policies from-zone trust to-zone untrust policy 1 match source-address any
set security policies from-zone trust to-zone untrust policy 1 match destination-address any
set security policies from-zone trust to-zone untrust policy 1 match application any
set security policies from-zone trust to-zone untrust policy 1 then permit application-services ssl-proxy profile-
name ssl-inspect-profile-dut
set security policies from-zone trust to-zone untrust policy 1 then permit application-services advanced-anti-
malware-policy aamw-policy
set security policies from-zone trust to-zone untrust policy 1 then permit application-services security-
intelligence-policy secintel_policy
The inial conguraon is complete.
RELATED DOCUMENTATION
ATP Appliance and SRX Series Threat Level Comparison Chart | 14
ATP Appliance and SRX Series Threat Level
Comparison Chart
ATP Appliance uses a threat level threshold range of 0 - 1. While the SRX Series Firewall uses a
threshold range of 0 -10. When conguring SRX Series policies that use threat levels based on
informaon provided by ATP Appliance, please refer to the following comparison table to understand
how ATP Appliance levels match those set on the SRX Series.
Table 1: Threat Level Comparisons
Severity Level SRX Series Firewall ATP Appliance
Benign 0 0
14
Table 1: Threat Level Comparisons
(Connued)
Severity Level SRX Series Firewall ATP Appliance
Low 1 - 3 0.25
Medium 4 - 6 0.50
High 7 - 9 0.75
Crical 10 1.0
RELATED DOCUMENTATION
Congure SMTP and IMAP Email Management | 17
15
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
  • Page 1 1
  • Page 2 2
  • Page 3 3
  • Page 4 4
  • Page 5 5
  • Page 6 6
  • Page 7 7
  • Page 8 8
  • Page 9 9
  • Page 10 10
  • Page 11 11
  • Page 12 12
  • Page 13 13
  • Page 14 14
  • Page 15 15
  • Page 16 16
  • Page 17 17
  • Page 18 18
  • Page 19 19
  • Page 20 20
  • Page 21 21
  • Page 22 22
  • Page 23 23
  • Page 24 24
  • Page 25 25
  • Page 26 26
  • Page 27 27
  • Page 28 28
  • Page 29 29
  • Page 30 30
  • Page 31 31
  • Page 32 32
  • Page 33 33
  • Page 34 34
  • Page 35 35
  • Page 36 36
  • Page 37 37
  • Page 38 38
  • Page 39 39
  • Page 40 40
  • Page 41 41
  • Page 42 42
  • Page 43 43
  • Page 44 44
  • Page 45 45
  • Page 46 46
  • Page 47 47
  • Page 48 48
  • Page 49 49
  • Page 50 50
  • Page 51 51
  • Page 52 52
  • Page 53 53
  • Page 54 54
  • Page 55 55
  • Page 56 56

Juniper Virtual Advanced Threat Prevention Appliance (vJATP Appliance) Integration Guide

Virtual Advanced Threat Prevention Appliance (vJATP Appliance)
Juniper
Brand
Juniper
Model
Virtual Advanced Threat Prevention Appliance (vJATP Appliance)
Type
Integration Guide
This manual is also suitable for
Download PDF
report

Ask a question and I''ll find the answer in the document

Finding information in a document is now easier with AI

Related papers

Other documents