How can I temporarily disable the ThreatSTOP service

To temporarily disable the ThreatSTOP service issue the following commands and configuration changes.

1. Turn off the crontab jobs
2. Remove the ThreatSTOP filter from the interfaces
3. Turn off log upload.

1. Turn off the crontab jobs.
1. Log into your Juniper via ssh or console and run:
   

   root@SRX-210% crontab -e

   The output will look similar to

    

2. Add a pound / hash sign (#) in front of the tsupdate.sh so it looks like:
   

   

    

   This will prevent the update script from running.

    

2. Remove the ThreatSTOP filter from the interfaces
   1. First find which interfaces are protected with the ThreatSTOP service. To do so, issue the commands:
      

      root@SRX-210% cli
      root@SRX-210> show interfaces filters

      Which will bring up the list of interfaces and the filters assigned to them. The below example has the ThreatSTOP filter applied to interface ge-0/0/0.0 

      

       

   2. Using the above example, the command 
      

      root@SRX-210> configure
      root@SRX-210# delete interfaces ge-0/0/0.0 family inet filter input ThreatSTOP
      root@SRX-210# commit

      removes ThreatSTOP protection from you device.

       

3. Turn off log upload
   
   1. You must find the name of the log file in order to deactivate it. To do so, run the commands:

      root@SRX-210% cli
      root@SRX-210> configure
      root@SRX-210# edit system syslog
      [edit system syslog]
      root@SRX-210# show

      Which will bring up something similar to:

      

       

   2. In the above example, the log file is named 12.12.12.13.log. To deactivate the log upload, deactivate the log file with the following commands:
      

      root@SRX-210# deactivate file 12.12.12.13.log
      root@SRX-210# commit

       

   3. Once changes have been made, it's suggested that you save the configuration by running the command:
      

      root@SRX-210# save TSDeactivated

Back to Top