Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

blocklists (Security IKE)

Syntax

Hierarchy Level

Description

Defines the remote peer IKE identity blocklist(s) configuration.

In the configuration hierarchy, you can configure different blocklists for blocking IKE IDs during IKE SA negotiation authentication phase. Once you configure the blockslists, you can use a blocklist in the corresponding IKE policy at the [edit security ike policy policy-name blocklist blocklist-name] hierarchy level.

Options

blocklists blocklist-name

Specify the blocklist name.

  • Value: upto 32 characters

  • Max allowed: Upto 1000 blocklists
rule rule-name

Specify the rule name.

  • Value: upto 32 characters

  • Max allowed: Upto 1000 rules per blocklist
description text-description

(Optional) Specify the text description.
match

Match criteria.
id-type (inet | inet6 | hostname | distinguished-name | user-at-hostname | key-id)

Specify the remote peer IKE identity type with one of the following:

  • inet—Specify to use the IPv4 address.

  • inet6—Specify to use the IPv6 address.

  • hostname —Specify to use the hostname.

  • distinguished-name—Specify to use the distinguished name.

  • user-at-hostname—Specify to use the email address

  • key-id—Specify to use the Key ID
id-pattern <value>

Specify a valid remote peer IKE identity value based on the id-type selection. Use the standard regular expression for the value.
role (initiator|responder)

Specify the remote peer role as the initiator or the responder.

  • Default: initiator
then

Action for the match criteria.
discard

Discard the peer connection immediately without sending back a response.
reject

Discard the connection immediately and send back a failure response.
backoff timeout-value

(Optional) Discard the connection immediately and set a backoff timer. If you do not configure the option explicitly, the auth-phase-failure value option at the [edit security ike session half-open backoff-timeouts] hierarchy level, enables backoff action.

  • Value: Range is 1-180 seconds.

  • Default: 60 seconds

For other statements, see CLI Explorer.

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

blocklists statement introduced in Junos OS Release 23.4R1.

Related Documentation