sorry bit confused now-
if you deactivate/rename/DELETE a policy that has an existing session the default behaviour is to drop, even if you have the policy re-match enabled it still drops the active session
if you change the src/dest/app default behaviour is "continue to open session" with policy re-match it re-evaluates
if you change action from permit to deny - default behaviour is "continue to open session" with policy re-match it drops the active session
The details of the session flow are placed in a session table which is a real time list of current sessions on the srx. Only connections that are active or havent timed out show up in the session table.
which means if the policy is deleted the active sessions are still in the session table and eventually will time out
B is correct -
To solve this you have to enable "policy-rematch" under security policies... otherwise existing sessions are kept open until they time out. Enabling policy-rematch existing sessions will be reevaluated with the newly updated ruleset.
When a security policy is deleted in a Juniper SRX device, the default behavior for active sessions that were allowed by that policy is that they continue to flow as long as the session remains active. New flows will not be created under the deleted policy, but existing flows stay active until they age out. The "policy-rematch" feature can be configured to cause all active sessions to be re-evaluated against the security policies upon a commit, and sessions will be torn down if they are no longer permitted
D is Correct
Traffic matching an established session will continue to flow as long as that session remains active. You need to configure "set security policies policy-rematch" if you want to delete the active sessions.
see : https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/security-edit-policy-rematch.html
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
quraitulain
6 months agomasterkingkhan
8 months agomasterkingkhan
8 months agomasterkingkhan
8 months, 1 week ago66dc178
8 months, 3 weeks agoRickyB
8 months, 4 weeks agoOkoJun
10 months, 1 week agoOkoJun
10 months, 3 weeks agoTECH3K3
10 months, 2 weeks agolonganghi
1 year agoChillingAgain
1 year agogondaliya
1 year, 1 month ago