When are Unified Threat Management services performed in a packet flow?

On Juniper SRX Series devices, the packet processing order is a well-defined sequence. Unified Threat Management (UTM) services, such as antivirus, web filtering, and content filtering, are applied during the services processing stage of the packet flow. This stage occurs after a security policy has permitted the session and after Network Address Translation (NAT) has been performed on the packet. Applying UTM after NAT ensures that the security services inspect the traffic with its final, post-translation IP addresses, which is crucial for accurate policy enforcement and logging.

A: Security policies are evaluated before UTM services. A policy must first permit the traffic before it can be inspected by UTM.

B: This is too early in the process. Initial packet processing involves basic sanity checks and screen options, not the application-layer inspection performed by UTM.

C: UTM inspection is applied to the data packets of an entire session, not exclusively during the first path process which primarily establishes the session.

1. Juniper Networks TechLibrary

Junos OS Security Configuration Guide: The packet flow sequence for SRX Series devices is detailed here. It explicitly shows that services processing

which includes UTM

occurs after NAT. While a direct link to a single diagram changes

the concept is fundamental in the "Understanding Packet Flow in SRX Series Devices" sections.

2. Juniper Networks TechLibrary

Understanding Unified Threat Management (UTM): "UTM is a feature that you can enable in a security policy... When traffic matches the policy

a UTM profile is applied to that traffic." This confirms UTM is a service applied after the policy match

which itself follows initial processing and routing. The overall flow places this service application post-NAT. (See "Security Policies Overview" and related flow documentation).