pre-id-default-policy
Syntax
pre-id-default-policy {
then {
log {
session-init;
session-close;
}
session-timeout {
icmp seconds;
icmp6 seconds;
ospf seconds;
others seconds;
tcp seconds;
udp seconds;
}
}
}
Hierarchy Level
[edit security policies]
Description
Configure pre-ID default policy settings.
Starting in Junos OS Release 23.4R1, the flow process is optimized to deny the traffic (without AppID) when all the potential policies (including the default policy) would deny the traffic.
The flow does not proceed to the Pre-ID default policy (pre-id-default-policy) but is instead denied by the default policy or by the topmost rule in the unified policy. The sessions matching Pre-Id default Policy are denied if there is no potential permit policy before performing application identification (AppID).
When the device receives the first packet of a traffic flow, it performs basic
5-tuple matching and checks the defined potential policies to determine how to treat
the packet. If all potential policies have action as deny, and the
default policy action is also set to deny, then the device denies
the traffic and does not perform application identification.
If any policy has action as other than deny then the device
performs DPI to identify the application.
The device checks for potential policies on both zone context and global context.
In the Junos OS Release prior to 23.4R1, the pre-ID default policy temporarily allows the session to get created so that DPI can get the packet and perform application identification (AppID).
Configuring session-init logging for the pre-id-default-policy can generate a large amount of logs.
Each session that enters the SRX that initially matches the pre-id-default-policy will generate an event. We recommend only using this option for
troubleshooting purposes.
Options
| then | Specifies the policy action that has to be taken when the packet matches the criteria. |
| log | Specifies the log details at session close time and session initialization time.
|
| session-timeout | When you update a session, the session timeout is configured, which specifies the session timeout details in seconds.
|
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 18.2R1.