Application security (AppSecure, IPS, UTM)
Application security (AppSecure, IPS, UTM)
This domain tests layered application inspection: AppSecure identifies and controls applications, IPS detects exploits and protocol anomalies, and UTM adds antivirus, antispam, web filtering, and content filtering. Know which profile attaches to a security policy.
Core rules
- AppID identifies applications by signature and behavior; AppTrack logs application usage; AppFW enforces application-based rules; AppQoS marks or prioritizes traffic.
- IPS uses signatures and protocol anomaly detection. An IPS profile is attached to a policy through application-services.
- UTM profiles are combined into a UTM policy, which is also attached to the security policy. Web filtering and content filtering are separate functions from antivirus.
- Encrypted HTTPS traffic generally requires SSL proxy before UTM or IPS can inspect payload content.
- These features depend on valid licenses and current signature databases; a missing license or stale package changes the result.
Worked example
You permit trust-to-untrust HTTP and HTTPS for users. The policy matches junos-http and junos-https, action permit, with an application-services block containing an IPS profile and a UTM policy for web filtering and antivirus. AppID can refine the rule to specific applications. For HTTPS, the firewall sees the TLS session; without SSL proxy it can enforce category-based blocking by SNI or certificate metadata but cannot scan the encrypted payload. If users report blocked business sites, check the web-filtering category and the UTM policy attachment before changing the policy action.
Traps
Do not attach a UTM profile directly without the policy reference. Do not expect IPS to inspect encrypted payload without decryption. Do not confuse AppTrack logging with AppFW enforcement. A profile that exists but is not bound to the matching policy does nothing.