Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Reordering Security Policies

Reordering security policy allows to move the policies around after they have been created. Junos OS offers a tool for verifying that the order of policies in the policy list is valid.

Understanding Security Policy Ordering

Junos OS offers a tool for verifying that the order of policies in the policy list is valid.

It is possible for one policy to eclipse, or shadow, another policy. Consider the following examples:

Example 1

Example 2

In examples 1 and 2, where policy permit-mail is configured after policy permit-all from zone trust to zone untrust. All traffic coming from zone untrust matches the first policy permit-all and is allowed by default. No traffic matches policy permit-mail.

Because Junos OS performs a policy lookup starting from the top of the list, when it finds a match for traffic received, it does not look any lower in the policy list. To correct the previous example, you can simply reverse the order of the policies, putting the more specific one first:

In cases where there are dozens or hundreds of policies, the eclipsing of one policy by another might not be so easy to detect. To check if policies are being shadowed, enter any of the following commands:

This command reports the shadowing and shadowed policies. It is then the administrator's responsibility to correct the situation.

Note:

The concept of policy shadowing refers to the situation where a policy higher in the policy list always takes effect before a subsequent policy. Because the policy lookup always uses the first policy it finds that matches the five-part tuple of the source and destination zone, source and destination address, and application type, if another policy applies to the same tuple (or a subset of the tuple), the policy lookup uses the first policy in the list and never reaches the second one.

Example: Reordering Security Policies

This example shows show how to move policies around after they have been created.

Requirements

Before you begin:

Overview

To reorder policies to correct shadowing, you can simply reverse the order of the policies, putting the more specific one first.

Configuration

Procedure

Step-by-Step Procedure

To reorder existing policies:

  1. Reorder two existing policies by entering the following command:

  2. If you are done configuring the device, commit the configuration.

Verification

To verify the configuration is working properly, enter the show security policies command.