Parsing Srx Configs

Parsing Juniper SRX Configurations

Overview

Use this skill to parse Juniper SRX / Junos firewall configurations into the shared vendor-neutral firewall intermediate schema. It supports both show configuration | display set lines and hierarchical curly-brace configuration, including zones, address books, applications, security policies, NAT, logical-systems, routing-instances, interfaces, routing protocols, VPN, chassis cluster, and system settings.

For design interpretation after extraction, load the adjacent SRX operational skill that matches the topic: srx-policy, srx-nat, srx-mnha, srx-mpls-in-flow, or srx-dynamic-ip-feed.

Scope and routing

Use only for Juniper SRX or Junos hierarchy and display-set syntax. Hand off ASA/FTD access-list, nameif, or object network input to parsing-cisco-configs, FortiOS blocks to parsing-fortinet-configs, and PAN-OS XML or set deviceconfig to parsing-palo-configs. Verify production-bound results against current device documentation and output. Downstream consumers are the SRX playbooks and the audit, conversion, and diff skills.

Input Format Detection

SRX configs come in two formats. Detect which one:

1. Set commands — Lines starting with set or deactivate . Example:

`` set security zones security-zone trust interfaces ge-0/0/0.0 set security policies from-zone trust to-zone untrust policy allow-web match source-address any ``

1. Hierarchical (curly-brace) — Nested blocks with { } and ; terminators. Example:

`` security { zones { security-zone trust { interfaces { ge-0/0/0.0; } } } } ``

Detection heuristic: Check the first 2000 characters for known top-level stanza names followed by { (e.g., system {, security {, interfaces {, routing-options {). If found, treat as hierarchical. Otherwise treat as set-command format.

Hierarchical to Set Conversion

If hierarchical format is detected, mentally convert to flat set commands before parsing:

• Track the current path as you descend into { } blocks
• Each leaf value terminated by ; becomes: set
• Handle inactive: prefix → convert to deactivate

Note: inactive: (hierarchical format) and deactivate (set format) are equivalent. In hierarchical parsing, strip inactive: and set enabled: false on the affected object. Handle the re-parse: strip the prefix, rebuild as a normal set line, re-tokenize to extract the target object name.

• Handle bracket lists [val1 val2] → expand to one set command per value
• Handle quoted strings as single tokens
• Handle backslash escapes inside quoted strings
• Strip block comments /* ... */

Hierarchical-to-set normalization: After conversion, normalize these impedance mismatches:

1. range-address X to range-high Y → range-address X to Y
2. address NAME ip-prefix CIDR → address NAME CIDR
3. then static-nat prefix name CIDR → then static-nat prefix CIDR
4. then source-nat pool pool-name NAME → then source-nat pool NAME
5. then destination-nat pool pool-name NAME → then destination-nat pool NAME
6. then destination-nat ip addr X → then destination-nat ip X

Extraction Pipeline

Parse the following sections in order. For each, read the reference files as needed.

1. Zones

Path: security.zones.security-zone. Extract: zone name, interfaces list, description, host-inbound-traffic services/protocols

1b. Interfaces

Path: interfaces. with units at interfaces..unit.

Extract per-interface/unit:

• IPv4 address: family inet address
• IPv6 address: family inet6 address
• DHCP client: family inet dhcp
• VLAN tagging: vlan-tagging / flexible-vlan-tagging
• VLAN ID per unit: vlan-id
• MTU: mtu
• Description at both physical and unit level
• LAG membership: ether-options 802.3ad → set lag_parent
• LAG master: aggregated-ether-options lacp config

Interface type derivation: ae*=lag, lo*=loopback, st0/gr-/ip-/lt-=tunnel, fxp0/fxp1/me0/em0/em1=management. Management interface zone exclusion: Remove management interfaces (fxp0, me0, em0, etc.) from security zones with a warning. Unit-0 normalization: When resolving zone membership, normalize .0 suffixed names (e.g., ge-0/0/0.0 → ge-0/0/0) for matching. Cluster interface exclusion: Skip only true fabric/control interfaces (fab*) and management (fxp*) from security zones with a warning. reth* (redundant Ethernet) and reth*. are normal dataplane interfaces bound to security zones in a chassis cluster — parse them as usable zone interfaces, not as excluded cluster interfaces. After all interfaces parsed, back-populate lag_members on ae interfaces.

2. Address Objects

Path: security.address-book.global.address. Types to handle:

• ip-prefix (e.g., 10.0.0.0/24) — type: "subnet"
• dns-name — type: "fqdn"
• range-address with to — type: "range", value: "start-end"
• wildcard-address — type: "wildcard"
• Plain IP with /32 — type: "host"

• ip-prefix / ipv6-prefix — explicit keywords in hierarchical format (normalize away during hierarchical-to-set conversion)

Zone-attached address books — two valid forms:

• Named books with zone attachment: security.address-book..address. plus security.address-book..attach.zone.. The book name is arbitrary (operators often name it after the zone) — derive zone scope from the attach zone statement, never from the book name.
• Legacy zone-local books: security.zones.security-zone..address-book.address. (older configs; a zone cannot use both forms at once).

Migrate both forms to global scope with a warning.

Auto-detect IP version (v4 vs v6) from the value.

3. Address Groups

Path: security.address-book.global.address-set. Extract members from address and nested address-set references.

4. Service Objects (Applications)

Path: applications.application. Extract: protocol (from protocol field), destination port (from destination-port), source port if present, ICMP type/code, inactivity-timeout, description.

Map protocol values: 6 or tcp → TCP, 17 or udp → UDP, 1 or icmp → ICMP.

5. Application Mapping (L7 → Canonical)

JunOS uses predefined junos-* applications that are matched by name in security policies. These are L7-aware on SRX and must be resolved to canonical names for cross-vendor conversion.

JunOS predefined application names to canonical:

| JunOS Name | Protocol/Port | Canonical App | Category | |------------|---------------|---------------|----------| | junos-https | TCP/443 | https | web | | junos-http | TCP/80 | http | web | | junos-ssh | TCP/22 | ssh | remote-access | | junos-telnet | TCP/23 | telnet | remote-access | | junos-ftp | TCP/21 | ftp | file-transfer | | junos-tftp | UDP/69 | tftp | file-transfer | | junos-dns-udp | UDP/53 | dns | network-mgmt | | junos-dns-tcp | TCP/53 | dns | network-mgmt | | junos-ntp | UDP/123 | ntp | network-mgmt | | junos-smtp | TCP/25 | smtp | email | | junos-smtps | TCP/587, TCP/465 | smtps | email | | junos-imap | TCP/143 | imap | email | | junos-imaps | TCP/993 | imaps | email | | junos-pop3 | TCP/110 | pop3 | email | | junos-ldap | TCP/389 | ldap | auth | | junos-bgp | TCP/179 | bgp | network-mgmt | | junos-ospf | IP-89 | ospf | network-mgmt | | junos-sip | UDP/5060 | sip | voip | | junos-h323 | TCP/1720 (+UDP/1719 RAS, TCP/1503/389/522/1731 — multi-term) | h323 | voip | | junos-ms-rpc | TCP+UDP/135 (application-set) | msrpc | other | | junos-ms-sql | TCP/1433 | mssql | database | | junos-smb | TCP/139, TCP/445 | smb | file-transfer | | junos-ike | UDP/500 | ipsec | tunnel | | junos-ike-nat | UDP/4500 | ipsec-nat-t | tunnel | | junos-pptp | TCP/1723 | pptp | tunnel | | junos-ping | ICMP (proto 1, all types) | ping | network-mgmt | | junos-icmp-ping | ICMP echo-request | ping | network-mgmt | | junos-icmp-all | ICMP (all types) | icmp-all | network-mgmt | | junos-pingv6 | ICMPv6 (proto 58, all types) | ping6 | network-mgmt | | junos-icmp6-all | ICMPv6 (all types) | icmpv6-all | network-mgmt | | junos-nntp | TCP/119 | nntp | other | | junos-rdp | TCP/3389 | rdp | remote-access | | junos-syslog | UDP/514 | syslog | network-mgmt |

Names verified against show configuration groups junos-defaults applications on Junos 24.4. Note there is no predefined junos-snmp, junos-snmptrap, junos-mysql, junos-ike-nat-t, junos-icmpv6-all, or junos-ping6 — SNMP and MySQL matching require custom applications application definitions (extract those as custom apps); the NAT-T/ICMPv6 predefined names are junos-ike-nat, junos-icmp6-all, and junos-pingv6.

Resolution in policies: When match application lists a predefined app:

1. Look up in the table above
2. Populate policy's apps array: { vendor_name: "junos-https", canonical: "https", confidence: 1.0, category: "web" }
3. The services array keeps application-default or explicit port references separately

Custom applications (applications.application.): These are user-defined with explicit protocol and port. Extract as service objects AND attempt canonical resolution from protocol+port. If the port matches a known app, set confidence: 0.9.

Unresolvable apps: For any application match or custom apps without a canonical mapping, set confidence: 0.0, preserve the vendor_name, and warn.

5b. Service Groups (Application Sets)

Path: applications.application-set. Extract member applications and nested application-sets.

Application-Set vs Application-Group distinction:

• Determine member types: for each member, check if it is a predefined junos-* L7 app or a

user-defined port-based application

• Application-sets containing all L7/predefined apps → promote to application_groups with

canonical member names

• Sets containing user-defined port-based apps → keep as service_groups
• Mixed sets → split: L7 members → application_groups, port-based → service_groups

Resolve each L7 member from JunOS name to canonical before storing in application_groups.

6. Security Policies

Path: security.policies.from-zone..to-zone..policy. Also: security.policies.global.policy. (global policies, src/dst zones = ["any"])

For each policy extract:

• name and description
• srczones / dstzones — from the path (or ["any"] for global)
• srcaddresses / dstaddresses — from match source-address / match destination-address
• applications — from match application
• action — permit → "allow", deny → "deny", reject → "reset-both" (the schema's reject-family value). Note: SRX reject notifies the source only — TCP RST to the client, ICMP unreachable for other protocols — not both sides; emit an info warning so conversions do not overstate reset-both semantics on the target platform.
• log_start — true if then log session-init
• log_end — true if then log session-close
• security_profiles — extract from then permit application-services:
• utm-policy → profile_group
• idp-policy → IDP profile
• ssl-proxy → SSL proxy profile
• disabled — true if deactivate prefix on the policy path
• schedule — from scheduler-name
• source_users — from match source-identity
• Handle then count and then permit firewall-authentication as no-ops (do not misinterpret as action modifiers)

7. NAT Rules

Paths:

• security.nat.source.rule-set..rule. — source NAT
• security.nat.destination.rule-set..rule. — destination NAT
• security.nat.static.rule-set..rule. — static NAT

Extract: type, src/dst zones (from rule-set from/to), match addresses, translated source/destination/port.

Source NAT specifics:

• then source-nat interface → translate to egress interface
• then source-nat pool → translate to named pool (emit as pool:)

Destination NAT specifics:

• destination-port → original service match
• then destination-nat pool → translated destination from pool
• Port translation lives on the pool object, not the rule: security.nat.destination.pool. carries address and optional port — resolve translated address AND port from the referenced pool definition (... pool port on the rule is not valid Junos)
• Handle hierarchical ip addr form for inline destination translation

Static NAT specifics:

• then static-nat prefix → bidirectional static translation

8. Schedules

Path: schedulers.scheduler. Extract: name, type (daily-except/daily), start-date, stop-date, days of week, time ranges.

9. Routing

• Static routes (IPv4): routing-options.static.route. with next-hop, qualified-next-hop (floating statics), or discard (null routes)
• Static routes (IPv6): routing-options.rib.inet6.0.static.route. — same structure
• Routing Instances / VRF: routing-instances. — extract interface membership, per-VR static routes (IPv4+IPv6), per-VR OSPF/BGP config
• BGP: protocols.bgp — extract:
• Local-AS, router-ID
• Per-group: type (ebgp/ibgp), peer-as, local-address, authentication-key (presence only — redact), hold-time, keepalive
• Per-neighbor overrides: peer-as, description, local-address, authentication-key (presence only — redact), hold/keepalive timers, next-hop-self, route-reflector-client
• deactivate support for disabled neighbors
• Merge group-level defaults with neighbor-level overrides
• OSPF: protocols.ospf — extract:
• Router-ID, reference-bandwidth (with unit parsing: g/m/k suffixes)
• Areas: area ID, type (normal/stub/nssa with no-summary), default-cost
• Area authentication type and key presence (redact the key value)
• Per-interface: passive, metric, priority, hello/dead intervals, link-type (p2p/broadcast), per-interface authentication
• Redistribute: source, metric, metric-type
• deactivate support for disabled OSPF interfaces
• Normalize area IDs to dotted-decimal
• OSPFv3: protocols.ospf3 — same structure as OSPF via ospf3 instances
• Multicast (presence flag + residual capture): flow-mode SRX does not route multicast by default, so most configs have none — but a multicast-related task has nothing to anchor on unless the parser records whether multicast routing exists at all. Mirror the control-plane-protection handling: emit a presence flag and push full detail to residual_raw. Detect and flag:
• protocols.igmp — interfaces, version, static groups, ssm-map
• protocols.pim — mode (sparse/dense), RP (static / auto-RP / BSR), interfaces
• protocols.mld — IPv6 multicast equivalent of IGMP
• forwarding-options multicast stanzas (e.g. helpers, multicast scoping)
• routing-options.multicast / multicast scope policies

Set system.multicast_routing { present: true, protocols: [...] } listing the families seen (e.g. ["igmp","pim"]); absent → present: false. Send the stanza detail to residual_raw. This is a presence flag so downstream skills can reason about "is this box doing multicast routing at all" — not a full multicast parse.

10. System Configuration

Path: system Extract:

• system.host-name → hostname
• system.domain-name → domain
• system.name-server → DNS servers
• system.ntp.server → NTP servers with prefer flag
• system.services → management services: ssh, telnet, netconf, https, http
• system.login.user → admin users with class and SSH public keys
• Class mapping: super-user→super-admin, operator→operator, read-only→read-only
• system.services.ssh { root-login, rate-limit, ciphers, protocol-version, connection-limit } → system.ssh (omit/null absent keys; root-login defaults to Junos deny-password when unset).
• system.login.password { minimum-length→min_length, `ch

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: fastrevmd-lab
• Source: fastrevmd-lab/fwskillsshare
• License: Apache-2.0
• Homepage: https://mechub.org

Install and usage instructions live in the source repository linked above.