Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

unified-access-policy (Protocols)

Syntax

Hierarchy Level

Description

Configure unified access policy (UAP). Unified access policy is also known as Zero Trust Inline Segmentation (ZTIS). ZTIS extends Group-Based Policy (GBP) support to Mist access points (APs). This allows wireless clients to participate in GBP microsegmentation alongside wired clients in a network.

Options

if-name Configures the specified interface for Zero Trust Inline Segmentation.
all Configures all interfaces on the switch for Zero Trust Inline Segmentation.
role (optional)

One of:

  • access-point - Configures the specified interface or all interfaces to be a ZTIS access-point interface. An access-point interface connects to Mist APs.

    Note:

    This is the default when you don't explicitly specify a role.

  • inter-switch-link - Configures the specified interface or all interfaces to be a ZTIS inter-switch-link interface. An inter-switch-link interface connects to other ZTIS-enabled switches.

  • auto-detect - Configures the specified interface or all interfaces to auto-detect their roles.

Note: Where a conflict occurs between the role configuration on the specified interface and the role configuration on all interfaces, the role configuration on the specified interface prevails.
key Secret key to sign GBP messages.
mac Multicast MAC address for GBP messages. When the switch receives an Ethernet multicast frame that matches this multicast MAC address, the switch passes the frame up the stack for GBP message parsing and processing, You typically don't need to configure this address. The supplied default works under most situations.
robust-count Number of times that the switch sends out the same GBP lookup message before giving up. This is the total number of times and includes the initial sending and any subsequent resending due to lack of response.
source-mac Source MAC address for GBP lookup messages. When the switch wants to discover the GBP tag associated with the received Ethernet frame, the switch sends a GBP lookup message with the configured MAC address as the source MAC address. Configure this only in a multi-homing scenario.
Note: Adding or removing interfaces under unified-access-policy or changing their roles will flush all MAC address entries from the MAC address table for the affected interfaces. MAC addresses will have to be relearned and GBP assignments rebuilt for the affected interfaces.

Required Privilege Level

routing—To view this statement in the configuration.

routing-control—To add this statement to the configuration.

Release Information

Statement introduced in Junos OS Release 25.4R1.

interface all, access-point, and auto-detect options introduced in Junos OS Release 26.2R1.

Related Documentation