skills.rest
fastrevmd-lab
fastrevmd-labCOMMUNITY
Explore all skills by this author →
GitHub

srx-policy

Design, migrate, and troubleshoot Juniper SRX security policies on Junos 23.x platforms.

9|Updated Mar 7, 2026
Search Tags:#security policy#junos#juniper srx#firewall migration#global policy#web filtering#appfw
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-policy-fastrevmd-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: srx-policy
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/srx-policy
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-policy-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Juniper SRX policy work is unforgiving: a wrong rule order, a shadowed global policy, or a misattached UTM profile can silently break segmentation or inspection. This Skill pins the agent to verified Junos 23.x syntax and an enforced global-policy output contract so generated, migrated, and audited SRX policies are correct, ordered, and reviewable. ## Core Features & Use Cases - Global-Policy Generation and Migration: Converts zone-pair contexts and other vendors' rulebases into one ordered security policies global table with preserved rule order, global address-book objects, and Junos application sets. - Security Services Attachment: Guides AppID/AppFW, NextGen Web Filtering (NGWF), Enhanced Web Filtering (EWF), SecIntel, and ATP integration, including license, platform, and fallback verification. - Troubleshooting and Verification: Provides hit-count analysis, show security match-policies prediction, insert-ordering pitfall checks, and a symptom-to-fix matrix for shadowed rules and failed inspections. - Use Case: Migrating a FortiGate rulebase to an SRX345 on Junos 23.4R1 — the Skill normalizes objects into the global address book, emits an ordered global policy table with a logged default deny, and attaches NGWF to permitted web traffic. ## Quick Start Use the srx-policy skill to convert this zone-pair SRX configuration into an ordered global policy table with a logged default deny.

Frequently Asked Questions about srx-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I migrate zone-pair policies to global policies on Juniper SRX?▼

Detect existing `from-zone ... to-zone` contexts, preserve rule order within each context, and rewrite them as ordered `security policies global` rules with zones moved into match fields. Verify parity with `show security match-policies`, then remove legacy contexts only in an approved cutover since zone-pair policies take lookup priority.

Should I use NGWF or EWF for web filtering on SRX?▼

Prefer NextGen Web Filtering (NGWF) for Junos 23.4R1+ greenfield and migration designs when platform, license, and cloud connectivity support it. Keep Enhanced Web Filtering (EWF) for existing estates or unsupported releases, and plan migration using the documented asynchronous `migrate-to-ng-juniper` workflow.

Why is my new SRX global policy rule never hit?▼

Common causes are rule order, zone or address mismatches, NAT changing the destination, or a legacy zone-pair policy shadowing the global table. Check `show security policies hit-count` and re-display the final order with `show configuration security policies global | display set`, especially after mixing appended rules with `insert` commands.

Does SRX policy alone enable cross-VLAN mDNS or SSDP discovery?▼

No. mDNS and SSDP use TTL-1 link-local multicast that a flow-mode SRX will not route regardless of policy. You need an off-box reflector like Avahi or multicast routing, plus a permit policy for the post-discovery unicast traffic.

Can AppFW block an application if the base policy denies the traffic?▼

No. AppFW inspects only flows already permitted by the security policy, since application services attach under `then permit application-services`. The base policy must permit the flow first, then the AppFW rule-set can deny specific dynamic applications.

Related Skills

Explore More Software Engineering Skills→
dgethingsdgethings

fwrule-analyzer

Detect overlaps, shadowing, conflicts, and duplicates in multi-vendor firewall rules.

Community
Advanced
equaltoaiequaltoai
3

deploy-body

Orchestrates staged AWS CDK deployments of merged lesser-body changes.

Official
Advanced
rennerenne

nat-timeout

Configure OS-level TCP keepalive parameters to prevent FritzBox NAT timeouts.

Community
Intermediate
imMamdouhaboammarimMamdouhaboammar

agency-network-engineer

Generate rollback-ready configuration change plans for Cisco, Juniper, and Palo Alto networks.

Community
Advanced