Device Integration: Juniper Firewall

TABLE OF CONTENTS

• Overview
• Configuring to Send Syslog Messages
  • Option 1- Using J-Web
  • Option 2- In case Using CLI
• To enable logging for Security policy
  • 1- Using J-Web
  • 2- Using CLI
• Configuring Syslog on Juniper IDP (IDP 50 Series)
• Sending Syslog Directly from IDP Sensor
• Sending Syslog via NSM (Network and Security Manager)
• Verification (MSSP Only)
  • 1. Verify Syslog Logs
  • 2. Verify NetFlow (sFlow/NetStream) Flows

Overview

This article provides detailed steps to configure Juniper SRX Firewalls and IDP devices to send syslog messages to ADR SIEM, enabling comprehensive visibility and proactive threat detection in your environment.

Configuring to Send Syslog Messages

Option 1- Using J-Web

1. Log in to the Juniper SRX device.
2. Click Configure > CLI Tools > Point and Click CLI in the Juniper SRX device.
3. Expand System and click Syslog.
4. In the Syslog page, click Add New Entry placed next to 'Host'.
5. Enter the IP address of the remote Syslog server (CCE server IP) (i.e., Firewall Analyzer).
6. Click Apply to save the configuration.

Option 2- In case Using CLI

1. Log in to the Juniper SRX device CLI console.
2. Execute the following command:

user@host#  set system syslog host <IP address of the remote Syslog server (i.e., Firewall Analyzer)> any any

To enable logging for Security policy

1- Using J-Web

1. Select Configure > Security > Policy > FW Policies.
2. Click on the policy for which you would like to enable logging.
3. Navigate to Logging/Count and in Log Options, select Log at Session Close Time.

2- Using CLI

1. Log in to the Juniper SRX device CLI console.
2. Execute the following command:

user@host# set security policies from-zone trust to-zone untrust policy permit-all then log session-close

Configuring Syslog on Juniper IDP (IDP 50 Series)

Sending Syslog Directly from IDP Sensor

1. Log in to the Juniper Networks IDP device.
2. Click Device > Report Settings > Enable Syslog in the Juniper Networks IDP device.
3. Select the Enable Syslog Messages check box.
4. Click Apply to save the changes.

Logs generated with this configuration:

• All attacks
• Policy load
• Restart

Logs not generated with this configuration:

• Profiler logs
• Device connect/disconnect logs
• Interface UP/DOWN logs
• Logs for Bypass State Changes

Sending Syslog via NSM (Network and Security Manager)

1. Log in to NSM.
2. Click Action Manager > Action Parameters > Define a Syslog Server in the NSM.
3. Click Action Manager > Device Log Action Criteria > Category in the NSM.
4. Select Category = all and Actions = syslog enable
5. Click Apply to save the changes.

Logs generated with this configuration:

• All attacks
• Policy load
• Restart
• Profiler logs
• Device connect/disconnect logs

Logs not generated with this configuration:

• Interface UP/DOWN logs
• Logs for Bypass State Changes

Verification (MSSP Only)

1. Verify Syslog Logs

Run the following on the CCE server:

sudo tcpdump -i any port 514 and host <Juniper_Firewall_IP> -AAA

• This checks whether syslog packets are arriving from the Juniper firewall.

2. Verify NetFlow (sFlow/NetStream) Flows

If you’ve enabled flow export (commonly UDP 6343 for sFlow or 9995 for NetFlow/IPFIX):

sudo tcpdump -i any port 9995 and host <Juniper_Firewall_IP> -AAA

• This confirms flow packets are being exported from the firewall and reaching the CCE.

STEP 1: Login to UI >> SYSTEM >> LOGS AND FLOWS COLLECTION STATUS.

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS.

STEP 3: >> Inside SOURCE DEVICE IP, IP will reflect.