About the Policy Sync Settings Page

To access this page, click Administration > Policy Sync Settings.

Starting in Junos Space Security Director Release 19.2R1, use the Policy Sync Settings page to automatically synchronize out-of-band firewall policy changes from a device to Security Director. The device must be discovered by Security Director. The out-of-band configuration changes are changes you make to a device configuration through any method other than deploying the configuration change from Security Director. By default, the automatic synchronization is disabled.

This page is displayed only in the global domain and applicable for only device-specific firewall policies. Out-of-band firewall policy changes are applicable for both standard firewall and unified firewall policies.

Starting in Junos Space Security Director Release 19.4R1, you can import or reject out-of-band changes for an IPS policy from a device to Security Director manually or automatically. For devices running Junos OS Release 18.2 and later, you can synchronize the changes from standard or unified firewall policies page. For devices with Junos OS Release 18.1 and earlier, you can synchronize the IPS policy changes from the IPS Policies page.

When a device is discovered in Security Director, the Managed Status is displayed as Managed in the Security Devices page. For automatic synchronization of out-of-band policy changes, the managed status of the device must be SD Changed, Device Changed, or In Sync. For this, you must update the device atleast once from Security Director. In case of logical system (LSYS), root device may show the status as Device Changed if a policy is assigned to it. Update the root device so that the status is In Sync.

Note Out-of-band changes are not supported if more than one policy is assigned to a device or if rules are configured in All Devices Policy Pre/Post policies.

Tasks You Can Perform

You can perform the following tasks from this page:

Enable automatic synchronization of out-of-band firewall and IPS policy changes in the device.
Choose an option to automatically accept or reject the out-of-band firewall and IPS policy changes.

Field Descriptions

Policy Sync Settings provides guidelines on using the fields on the Policy Sync Settings page.

Table 349: Fields on the Policy Sync Settings Page

Field	Description
Auto Sync Policy Changes	By default, the automatic synchronization of out-of-band firewall and IPS policy changes is disabled. Enable this option to automatically synchronize out-of-band firewall and IPS policy changes from a device to Security Director. When automatic synchronization of out-of-band firewall and IPS policy changes is disabled, you can import the out-of-band changes from a device manually.
Policy Source of Truth	The policy “source of truth” is where the device is synchronized to Security Director. All device side out of sync changes will be rejected to match Security Director. Select Security Director to automatically reject all out-of-band firewall and IPS policy changes from a device to Security Director. Select Device to automatically synchronize all out-of-band firewall and IPS policy changes from a device to Security Director. Select Firewall Policy, IPS Policy, or both. This triggers Auto Policy Sync job in the Job Management page. After the job is successful, the out-of-band changes are synchronized from the device to Security Director. Before synchronizing the out-of-band changes automatically, Security Director automatically takes snapshot of the policy so that you can revert/rollback to older version of the policy. To roll back a policy version, see Create and Manage Policy Versions.

Field

Description

Auto Sync Policy Changes

By default, the automatic synchronization of out-of-band firewall and IPS policy changes is disabled. Enable this option to automatically synchronize out-of-band firewall and IPS policy changes from a device to Security Director.

When automatic synchronization of out-of-band firewall and IPS policy changes is disabled, you can import the out-of-band changes from a device manually.

Policy Source of Truth

The policy “source of truth” is where the device is synchronized to Security Director. All device side out of sync changes will be rejected to match Security Director.

Select Security Director to automatically reject all out-of-band firewall and IPS policy changes from a device to Security Director.
Select Device to automatically synchronize all out-of-band firewall and IPS policy changes from a device to Security Director. Select Firewall Policy, IPS Policy, or both.
This triggers Auto Policy Sync job in the Job Management page. After the job is successful, the out-of-band changes are synchronized from the device to Security Director.
Before synchronizing the out-of-band changes automatically, Security Director automatically takes snapshot of the policy so that you can revert/rollback to older version of the policy. To roll back a policy version, see Create and Manage Policy Versions.

About the Policy Sync Settings Page

Tasks You Can Perform

Field Descriptions

Related Documentation

Help us to improve. Rate this article.