pre-id-default-policy
Syntax
pre-id-default-policy {
then {
log {
session-init;
session-close;
}
session-timeout {
icmp seconds;
icmp6 seconds;
ospf seconds;
others seconds;
tcp seconds;
udp seconds;
}
}
}
Hierarchy Level
[edit security policies]
Description
Configure pre-ID default policy settings.
Pre-ID default policy denies the flow before performing application identification (AppID) when there are no potential policies to permit the flow.
When the device receives the first packet of a traffic flow, it performs basic
5-tuple matching and checks the defined potential policies to determine how to treat
the packet. If all potential policies have action as deny, and the
default policy action is also set to deny, then the device denies
the traffic and does not perform application identification.
If any policy has action as other than deny then the device
performs DPI to identify the application.
The device checks for potential policies on both zone context and global context.
In the Junos OS Release prior to 23.4R1, the pre-ID default policy temporarily allows the session to get created so that DPI can get the packet and perform application identification (AppID).
Configuring session-init logging for the pre-id-default-policy can generate a large amount of logs.
Each session that enters the SRX that initially matches the pre-id-default-policy will generate an event. We recommend only using this option for
troubleshooting purposes.
Options
| then | Specifies the policy action that has to be taken when the packet matches the criteria. |
| log | Specifies the log details at session close time and session initialization time.
|
| session-timeout | When you update a session, the session timeout is configured, which specifies the session timeout details in seconds.
|
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 18.2R1.