BETA — built and unit-tested, not yet proven on a live SRX. One read-only Junos login gives SmartTile's agent the SRX's identity, health, IPsec VPNs, security policies and NAT with a change history, commit history and configuration backups, next to the rest of the network, with problems routed to the IT Service Management (ITSM) system or task list your team already uses.
An SRX watched by ping alone says up or down and nothing more. Junos answers the questions a NOC actually asks — is the chassis cluster healthy, which VPN dropped, who committed what — and SmartTile's agent only ever reads it: the client refuses any Junos command that is not a get-* RPC, so it cannot commit, load or reboot. Beta: every part is built and switched off per company until a company admin turns it on; it has not yet been run against a real SRX.
Model, serial, Junos version, hostname and MAC are written to the device record each read, marked “Juniper Junos API”. A value typed by a person is never overwritten.
Chassis cluster redundancy groups, routing-engine CPU and memory, chassis and system alarms, flow-session use, licences and who is logged in — in the device's Juniper window, with Read now.
Every interface with admin/oper state, zone and IP. Every VPN under security ipsec vpn judged against its IKE and IPsec SAs: up, IKE only, or down.
Security policies (per zone pair) and NAT rules re-read hourly. Each rule added, removed, changed or moved is logged; the first read is the baseline.
The SRX's own commit list — who committed, when, from which client and with what comment — kept beside the rule changes on the Changes tab.
With Config Backups on for the device, the full configuration is pulled as text over the same login, saved only when it changes, with a diff, in the device's documents.
Junos has no update feed, so SmartChoice records the recommended release per model family (from Juniper KB21476). A newer one becomes an advisory; SmartTile verifies the running version afterwards. Never installs.
Commits and sign-ins (from /var/log/messages) feed AccessAutomate. Any SRX VPN can be watched in VPNAutomate; an unreadable firewall is “unknown”, never down.
set system login class smarttile-ro permissions [ view view-configuration ], then set system login user smarttile class smarttile-ro authentication plain-text-password, and commit.set system services rest https port 3443 with that server-certificate, and rest control allowed-sources [ 157.245.117.9 ]. Or NETCONF: set system services netconf ssh port 830.| Setting | What it means |
|---|---|
Login class view + view-configuration | Everything on this page. Without secret, Junos shows passwords and keys to SmartTile as /* SECRET-DATA */, so they never reach a backup. |
| REST 3443 or NETCONF 830 | Same read-only commands either way. Certificate (REST) or host key (NETCONF) trusted by fingerprint; a different one stops the read before the password is sent. |
| Company switch · off by default | Off: no SRX in that company is tested, read, backed up, firmware-checked or watched. Saved logins are kept. |
Every request passes a guard that refuses anything but a get-* RPC. SmartTile never commits, loads, edits or reboots — and never installs Junos.
Encrypted at rest (AES-256-GCM, bound to the device row) the moment it is saved; the API returns only “password set”. Sent only in the HTTPS authorization header or SSH login, never logged.
Trust on first Test: the certificate or SSH host-key fingerprint is stored, and a changed one stops SmartTile before it sends the password.
Every route checks the device belongs to the caller's company; viewers cannot change anything. Saves (field names only) and switch changes are written to the activity log.
POST /rpc, or NETCONF)get-software-information · get-chassis-inventorymodel, Junos, hostname, serial; the Test callget-route-engine-information · get-chassis-cluster-statusRE CPU / memory / uptime · clusterget-interface-informationinterfaces, state, zone, IP, MACget-alarm-information · get-system-alarm-informationchassis and system alarmsget-flow-session-information (summary)session table useget-ike-… · get-security-associations-informationIKE and IPsec SAs per VPNget-license-summary-information · get-system-users-informationlicences · logged-in usersget-configuration (security policies · nat · ike/ipsec)rule inventory, ledger, VPN listget-commit-information · get-log messagescommit history · sign-insget-configuration format="text"configuration backupCluster node unhealthy or no primary, major/minor alarm, IPsec VPN down, RE CPU 85%+ or memory 90%+, session table 80%+, licence expired, expiring or needed, newer recommended Junos — each fires once when it starts, not every poll.
Nothing alerts or tickets on its own. A company builds a Workflow on “A Juniper firewall reports a problem” — open a ticket in its ITSM system, or create an Asana task for the engineer who owns the SRX.
Firmware advisories become tickets only where firmware ticketing is switched on (off by default). An engineer upgrades in the window; SmartTile reads the running version and closes the advisory.
| Objection | Answer |
|---|---|
| “You would have write access to our SRX.” | No. The login class is view-only and SmartTile's client refuses every non-get RPC. Firmware is never installed by SmartTile. |
| “Our passwords would end up in your backups.” | Not with the recommended class: without secret, Junos itself redacts them as /* SECRET-DATA */ before SmartTile sees the configuration. |
| “Is it ready?” | Beta. Built and unit-tested; it has not yet read a live SRX. SmartChoice switches it on for a company only with an engineer watching the first read. |
| “We manage SRX from Juniper Mist / Security Director.” | SmartTile reads the firewall directly today; the Juniper cloud API path is not built yet. |