Errata

The policy zone match stated for the policy is trust > web-dmz but this should be trust > trust, since the example on the previous pages uses an incorrect route lookup which matches ge-0/0/0.0 as the outbound interface.

I believe the policy permit-to-internet-any that is designed to allow dept_b_users to access the internet would also give them full access to the mail server in the next policy (permit_b_to_mail).

This policy would work because mail traffic would be allowed but, it seems to me like it would also allow other traffic from Department B which is in compliance with the stated goal but, the policies seem to suggest that restricting traffic from Department B is the goal.

Chapter 5: Network Address Translation. Source NAT

james@SRX5800-1# show | compare

+ rule phypoolNAT {
+ match {
+ source-address 198.18.11.0/24;
+ }

--
should be:

+ rule phypoolNAT {
+ match {
+ source-address 10.2.0.0/16;
+ }

"Secure Hash Algorithm 1 - 168 bit" should be "160 bit"

The "set" command is missing before the configuration of the encryption-algorithm configuration

[edit security policies from-zone trust to-zone untrust policy
East-Branch-Inbound]
root@SRX5800# show
match {
source-address 192.168.1.0/24;
destination-address 10.0.0.0/8;
application junos-http;
}
then {
permit {
tunnel {
ipsec-vpn East-Branch;
pair-policy East-Branch-Outbound;
}
}
log {
session-close;
}
}

In the above from-zone trust to-zone untrust policy East-Branch-Inbound "match" is wrong, the match is meant for from-zone untrust to-zone trust East-Branch-Inbound

Text on page 497:

"Here, access to http://www.thenewnetworkishere.com/us/en/new_network/ is allowed because the URL belongs to the whitelist, whereas access to any other URL in the http://www.thenewnetworkishere.com domain is denied."


The text is refering to URL's listed on page 496:

[edit security utm custom-objects]
set url-pattern allowed-urls value http://www.thenewnetworkishere.com
set url-pattern blocked-urls value
http://www.thenewnetworkishere.com/us/en/new_network/


The author has swapped this whitelist item with the blacklist item.

Should read:

[edit security utm custom-objects]
set url-pattern allowed-urls value
http://www.thenewnetworkishere.com/us/en/new_network/
set url-pattern blocked-urls value http://www.thenewnetworkishere.com

These two paragrphs, and the next on the following page, were probably meant to show the output of a "show interfaces ......." command giving an example of increasing send and receive statistics. Now were are just given a copy of part of the configuration from the preceding page.

The text reads:

jamesq@SRX5800-1# show
term OrgXYZ {
from {
protocol rip;
route-filter 198.18.16.0/20 exact;
<snip>

although earlier (and later) what is implemented is not "rip" but "aggregate":

jamesq@SRX5800-1# set term OrgXYZ from protocol aggregate

In text:

get-interface-information

Should be:

get-software-information