close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

blocklists (Security IKE)

date_range 13-Dec-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
    blocklists {
        blocklist-name {
            description text-description;
            rule rule-name {    
            match {
                    role (initiator | responder);
                    id-type (inet | inet6 | hostname | distinguished-name | user-at-hostname | key-id);
                    id-pattern value;
             }
                then {
                    (discard | reject); 
                    backoff timeout-value;
                }
            }
      }
  }

Hierarchy Level

content_copy zoom_out_map
[edit security ike]

Description

Defines the remote peer IKE identity blocklist(s) configuration.

In the configuration hierarchy, you can configure different blocklists for blocking IKE IDs during IKE SA negotiation authentication phase. Once you configure the blockslists, you can use a blocklist in the corresponding IKE policy at the [edit security ike policy policy-name blocklist blocklist-name] hierarchy level.

Options

blocklists `blocklist-name`	Specify the blocklist name. Value: upto 32 characters Max allowed: Upto 1000 blocklists
rule `rule-name`	Specify the rule name. Value: upto 32 characters Max allowed: Upto 1000 rules per blocklist
description `text-description`	(Optional) Specify the text description.
match	Match criteria.
id-type (inet \| inet6 \| hostname \| distinguished-name \| user-at-hostname \| key-id)	Specify the remote peer IKE identity type with one of the following: `inet`—Specify to use the IPv4 address. `inet6`—Specify to use the IPv6 address. `hostname` —Specify to use the hostname. `distinguished-name`—Specify to use the distinguished name. `user-at-hostname`—Specify to use the email address `key-id`—Specify to use the Key ID
id-pattern `<value>`	Specify a valid remote peer IKE identity value based on the `id-type` selection. Use the standard regular expression for the value.
role (initiator\|responder)	Specify the remote peer role as the `initiator` or the `responder`. Default: `initiator`
then	Action for the match criteria.
discard	Discard the peer connection immediately without sending back a response.
reject	Discard the connection immediately and send back a failure response.
backoff `timeout-value`	(Optional) Discard the connection immediately and set a backoff timer. If you do not configure the option explicitly, the `auth-phase-failure value` option at the [`edit security ike session half-open backoff-timeouts`] hierarchy level, enables backoff action. Value: Range is 1-180 seconds. Default: 60 seconds

For other statements, see CLI Explorer.

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

blocklists statement introduced in Junos OS Release 23.4R1.

arrow_backward PREVIOUS block (Spanning Trees)

NEXT arrow_forward bmp

Junos CLI Reference

ON THIS PAGE

blocklists (Security IKE)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

blocklists (Security IKE)

Syntax

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Related Documentation

Stay in touch