Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

policies

 

Syntax

Hierarchy Level

Release Information

Statement introduced in Junos OS Release 8.5.

Support for the services-offload option added in Junos OS Release 11.4.

Support for the source-identitiy option added in Junos OS Release 12.1.

Support for the description option added in Junos OS Release 12.1.

Support for the ssl-termination-profile and web-redirect-to-https options are added starting from Junos OS Release 12.1X44-D10 and Junos OS Release 15.1X49-D40.

Support for the user-firewall option added in Junos OS Release 12.1X45-D10.

Support for the domain option, and for the from-zone and to-zone global policy match options, added in Junos OS Release 12.1X47-D10.

Support for the initial-tcp-mss and reverse-tcp-mss options added in Junos OS Release 12.3X48-D20. Support for the extensive option for policy-rematch added in Junos OS Release 15.1X49-D20.

Starting in Junos OS Release 18.2R1, an IDP policy is available within unified security policy. The IDP policy access is simplified and made available under the unified policy as one of the policy. When an IDP policy is available within a unified security policy, configuring source or destination address, source and destination-except, from and to zone, or application is not required, because the match happens in the security policy itself.

Starting in Junos OS Release 18.3R1, when an SRX Series device is configured with a unified policies, you can configure multiple IDP policies and set one of those policies as the default IDP policy. If multiple IDP policies are configured for a session and when policy conflict occurs, the device applies the default IDP policy for that session and thus resolves any policy conflicts.

Note

If you have configured two or more IDP policies in a unified security policy, then you must configure the default IDP policy.

Description

Configure a network security policies with IPv6 addresses only if flow support for IPv6 traffic is enabled on the device.

Options

default-policyConfigure a default action when no user-defined policy match.

Values:

  • deny-all—Deny all traffic if no policy match

  • permit-all—Permit all traffic if no policy match

policy-rematchRe-evaluate the policy when changed.

Values:

  • extensive—Perform policy extensive rematch

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Related Documentation