Cannot access web management through HTTPS despite being configured

juniperjuniper-junosjuniper-srx

I'm configuring a Juniper SRX240 router, and I wanted to set up the HTTPS protocol for web management, as opposed to plain HTTP which is working fine.

I configure HTTPS as documented here, but whenever I attempt to access web management over HTTPS, I'm immediately shown one of many error pages depending on the browser I'm using. The errors vary but suggest that the page cannot be found or the server cannot be reached. If I try with HTTP it works just fine.

I did try changing the HTTPS web management port from 443 to use 8080 instead, and instead of seeing an error page immediately it would just try to load until it timed out. I've also tried restarting the web-management service, and the router itself.

I've had a look at the httpd log and it indicates that HTTP requests are being listened for on port 80, but there's no mention of HTTPS anywhere in the log.

Here are the relevant configuration settings:

system services

services {
    web-management {
        http {
            interface ge-0/0/1.0;
        }
        https {
            system-generated-certificate;
            interface ge-0/0/1.0;
        }
        session {
            idle-timeout 10;
        }
    }
}

interfaces

ge-0/0/1 {
        description "Management Interface";
        unit 0 {
            description "Management Interface";
            family inet {
                address 192.168.1.1/24;
            }
        }
    }

security zones

functional-zone management {
            interfaces {
                ge-0/0/1.0 {
                    host-inbound-traffic {
                        system-services {
                            http;
                            https;
                        }
                    }
                }
            }
            host-inbound-traffic {
                system-services {
                    http;
                    https;
                }
            }
        }

Best Answer

According to Juniper the functional-zone is supposed to be used with the dedicated management interfaces (fxp0). Since this device doesn't have dedicated management interfaces (unless it's set-up as chassis cluster - which in that case interface ge-0/0/0 is assigned to fxp0), you can't use the functional zone.

Also, you have everything configured for interface ge-0/0/1 but you show the configuration of interface ge-0/0/15, so maybe there's a mistake there.

So, if you want to use a non dedicated management interface, you have to use a "normal" security zone. If you want to use the dedicated interface, then you can use the functional zone.

Related Topic