3

I'm configuring a Juniper SRX240 router, and I wanted to set up the HTTPS protocol for web management, as opposed to plain HTTP which is working fine.

I configure HTTPS as documented here, but whenever I attempt to access web management over HTTPS, I'm immediately shown one of many error pages depending on the browser I'm using. The errors vary but suggest that the page cannot be found or the server cannot be reached. If I try with HTTP it works just fine.

I did try changing the HTTPS web management port from 443 to use 8080 instead, and instead of seeing an error page immediately it would just try to load until it timed out. I've also tried restarting the web-management service, and the router itself.

I've had a look at the httpd log and it indicates that HTTP requests are being listened for on port 80, but there's no mention of HTTPS anywhere in the log.

Here are the relevant configuration settings:

system services

services {
    web-management {
        http {
            interface ge-0/0/1.0;
        }
        https {
            system-generated-certificate;
            interface ge-0/0/1.0;
        }
        session {
            idle-timeout 10;
        }
    }
}

interfaces

ge-0/0/1 {
        description "Management Interface";
        unit 0 {
            description "Management Interface";
            family inet {
                address 192.168.1.1/24;
            }
        }
    }

security zones

functional-zone management {
            interfaces {
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            http;
                            https;
                        }
                    }
                }
            }
            host-inbound-traffic {
                system-services {
                    http;
                    https;
                }
            }
        }
2
  • The certificate will not be signed by a CA which will cause any browser to throw a warning / do not proceed page. You may be able to install a signed cert on it but that might be a waste of money. ...just thought I'd throw that out there. – Ronnie Royston Sep 10 '16 at 2:14
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 13 '17 at 6:20
2

According to Juniper the functional-zone is supposed to be used with the dedicated management interfaces (fxp0). Since this device doesn't have dedicated management interfaces (unless it's set-up as chassis cluster - which in that case interface ge-0/0/0 is assigned to fxp0), you can't use the functional zone.

Also, you have everything configured for interface ge-0/0/1 but you show the configuration of interface ge-0/0/15, so maybe there's a mistake there.

So, if you want to use a non dedicated management interface, you have to use a "normal" security zone. If you want to use the dedicated interface, then you can use the functional zone.

2
  • Fair enough, I'll give that a shot. I didn't realise it needed to be used with a dedicated management port - I thought it could be used for any port accessing web management. – Andre C Feb 12 '16 at 21:02
  • Also, interface 15 should just be interface 1 - I updated this in the question – Andre C Feb 12 '16 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.