Related Documentation
- J Series
- Security Policies Configuration Overview
- Example: Configuring a Security Policy to Permit or Deny All Traffic
- Example: Configuring a Security Policy to Permit or Deny Selected Traffic
- SRX Series
- Security Policies Configuration Overview
- Example: Configuring a Security Policy to Permit or Deny All Traffic
- Example: Configuring a Security Policy to Permit or Deny Selected Traffic
- Additional Information
- Junos OS Feature Support Reference for SRX Series and J Series Devices
Understanding Security Policy Ordering
Junos OS offers a tool for verifying that the order of policies in the policy list is valid.
It is possible for one policy to eclipse, or shadow, another policy. Consider the following examples:
Example 1
Example 2
In examples 1 and 2, where policy permit-mail is configured after policy permit-all from zone trust to zone untrust. All traffic coming from zone untrust matches the first policy permit-all and is allowed by default. No traffic matches policy permit-mail.
Because Junos OS performs a policy lookup starting from the top of the list, when it finds a match for traffic received, it does not look any lower in the policy list. To correct the previous example, you can simply reverse the order of the policies, putting the more specific one first:
In cases where there are dozens or hundreds of policies, the eclipsing of one policy by another might not be so easy to detect. To check if policies are being shadowed, enter the following command:
This command reports the shadowing and shadowed policies. It is then the administrator's responsibility to correct the situation.
 | Note: The concept of policy shadowing refers to the situation where a policy higher in the policy list always takes effect before a subsequent policy. Because the policy lookup always uses the first policy it finds that matches the five-part tuple of the source and destination zone, source and destination address, and application type, if another policy applies to the same tuple (or a subset of the tuple), the policy lookup uses the first policy in the list and never reaches the second one. |
Related Documentation
- J Series
- Security Policies Configuration Overview
- Example: Configuring a Security Policy to Permit or Deny All Traffic
- Example: Configuring a Security Policy to Permit or Deny Selected Traffic
- SRX Series
- Security Policies Configuration Overview
- Example: Configuring a Security Policy to Permit or Deny All Traffic
- Example: Configuring a Security Policy to Permit or Deny Selected Traffic
- Additional Information
- Junos OS Feature Support Reference for SRX Series and J Series Devices
