Just got through a major PCI DSS audit, and our SRX firewalls sailed through the network security controls. The auditors were particularly impressed with the clarity and segmentation of our rulebase. I think a lot of folks overcomplicate this, so I wanted to share the core policy structure that did the heavy lifting.
Our goal was simple: zero-trust segmentation between payment card data and everything else. We used dynamic address groups fed from our SIEM to keep things agile. The key zones were:
* `PCI-Cardholder-Data`
* `PCI-Servers`
* `Corporate-Trust`
* `DMZ`
* `Internet`
Here's the policy framework that made it work:
**1. Explicit Deny All at the Top:** A global `deny-all` log policy as the first rule. This gives you clean, actionable logs for any unexpected traffic right off the bat.
**2. Inbound to PCI (DMZ/Internet -> PCI-Servers):**
* Only permitted specific, whitelisted source IPs (our payment processor) to the exact application ports.
* Used application identification (`junos-https`, `junos-mssql`) for L7 validation where possible.
* Every allowed rule had `log session-close` for full session accounting.
**3. Outbound from PCI (PCI-Servers -> Payment Processor):**
* Locked down to initiate connections only to known good FQDNs/IPs on required ports.
* We used source NAT with persistent IPs for whitelisting on their end.
**4. Management Traffic (Corporate-Trust -> PCI-Devices):**
* Separate, tiny rule for IT admin subnets to jump hosts **only** via SSH.
* Two-factor authentication at the jump host, not the firewall (simpler to audit).
**5. Logging & Monitoring is Non-Negotiable:**
* All deny rules log at session-init.
* All accept rules for PCI zones log at session-close.
* We streamed these logs directly to our SIEM for correlation and retention.
The biggest ROI wasn't just passing the audit—it's in the ongoing ops. Troubleshooting is faster because the rules are intent-based, and any new unexpected flow gets caught by that first deny-all and alerts us.
Has anyone else taken a similar approach? I'm curious if you used IDP signatures for the PCI segment or found the built-in App-ID sufficient.
Keep automating!
Keep automating!
Wow, congratulations on passing the audit. That's huge.
I'm really curious about the dynamic address groups from your SIEM. We're looking at a similar segmentation project, but managing IP changes manually is a big worry. How much work was it to set up that feed, and did you run into any latency issues with the groups updating? I'd hate to block legitimate traffic because of a sync delay.
Also, for the `log session-close` on every allowed rule, did you find that created a massive amount of log data? We're trying to budget for the storage and parsing overhead, and I'm wondering if it was manageable or if you had to tune it down later.