For a very brief amount of time, packets may wrongly matched to unexpected security policy while reordering security policies. This occurs when a security policy position is changed, followed by a series of swaps. The security policies are momentarily deactivated when undergoing swaps. This behavior is expected from day 1 without execute the command "set security policies lookup-intact-on-commit" which introduced in Junos release 24.4R1.
Without enable the command "set security policies lookup-intact-on-commit":
root@jtac-srx5400-r2010# run show chassis hardware detail
Mar 25 07:19:46
Hardware inventory:
Item Version Part number Serial number Description
Chassis JN125B784AGF SRX5400
Midplane REV 03 760-067811 ACRF7191 SRX5400 Midplane
FPM Board REV 04 760-061987 CAFJ1652 Front Panel Display
PEM 0 Rev 10 740-029970 QCS1340U18W PS 1.4-2.52kW; 90-264V AC in
PEM 1 Rev 02 740-063041 QCS1609091HR PS 1.4-2.6kW; 90-264V AC in
PEM 3 Rev 04 740-034701 QCS15260904R PS 1.4-2.6kW; 90-264V AC in
Routing Engine 0 REV 07 750-095568 EBAL8112 SRX5k RE-2000x6
vtbd0 17408 MB Virtio Block Disk
vtbd1 57344 MB Virtio Block Disk
ada0 511 MB QEMU HARDDISK QM00002 Emulated IDE Disk
CB 0 REV 03 750-062257 CAEW3489 SRX5k SCB3
FPC 1 REV 38 750-073435 EBAL3296 SPC3
CPU BUILTIN BUILTIN SRX5k vCPP Broadwell
PIC 0 BUILTIN BUILTIN SPU Cp-Flow
PIC 1 BUILTIN BUILTIN SPU Flow
FPC 2 REV 14 750-043157 CADX0837 SRX5k IOC II
CPU REV 05 711-043360 CADY8999 SRX5k MPC PMB
MIC 0 REV 07 750-055732 CAJA3348 20x 1GE(LAN) SFP
PIC 0 BUILTIN BUILTIN 10x 1GE(LAN) SFP
Xcvr 0 REV 02 740-013111 I301561 SFP-T
Xcvr 1 REV 01 740-038291 I380386 SFP-T
PIC 1 BUILTIN BUILTIN 10x 1GE(LAN) SFP
Fan Tray 0 REV 02 760-061989 CAKG4917 Enhanced Fan Tray
[edit]
root@jtac-srx5400-r2010# run show version
Mar 25 07:19:54
Hostname: jtac-srx5400-r2010
Model: srx5400
Family: junos-es
Junos: 24.4R1.9
root@jtac-srx5400-r2010# run show security policies hit-count from-zone CORE to-zone FRI | no-more
Logical system: root-logical-system
Index From zone To zone Name Policy count Action
1 all-zone all-zone default-policy 3 Deny
2 all-zone all-zone default-http-mux 0 Permit
3 CORE FRI SR20191016000296_21807_0_0 0 Permit
4 CORE FRI CH20190821000338 0 Permit
5 CORE FRI CH20190812000112 0 Permit
6 CORE FRI CH20190819000051 0 Permit
7 CORE FRI CH20190819000051_1 0 Permit
17450 CORE FRI policy_14990 0 Permit
17451 CORE FRI policy_14991 0 Permit
17452 CORE FRI policy_14992 0 Permit
17453 CORE FRI policy_14993 0 Permit
17454 CORE FRI policy_14994 0 Permit
17455 CORE FRI policy_14995 0 Permit
17456 CORE FRI policy_14996 0 Permit
17457 CORE FRI policy_14997 0 Permit
17458 CORE FRI policy_14998 0 Permit
17459 CORE FRI policy_14999 0 Permit
17460 CORE FRI policy_15000 0 Permit
17461 CORE FRI policy_02833 0 Permit
17462 CORE FRI policy_02834 0 Permit
17463 CORE FRI deny-all 14064118 Deny
17464 CORE FRI permit-all 0 Permit ---------------------------------- match counter is 0 before reordering the security policies.
17465 CORE FRI base-icmp-000 0 Permit
17466 CORE FRI policy_02835 0 Permit
17467 CORE FRI CH20190830000454_01 0 Permit
root@jtac-srx5400-r2010> edit
Entering configuration mode
Users currently editing the configuration:
root terminal u0 (pid 28041) on since 2025-03-24 07:07:11 IST, idle 00:40:11
root terminal pts/0 (pid 63541) on since 2025-03-25 05:57:27 IST, idle 00:01:43
[edit security policies from-zone CORE to-zone FRI]
root@jtac-srx5400-r2010# edit security policies from-zone CORE to-zone FRI
root@jtac-srx5400-r2010# insert policy base-icmp-000 before policy SR20191016000296_21807_0_0 -------------------------- Insert security policy and trigger the policy reordering.
root@jtac-srx5400-r2010# show
policy SR20200703000685_68414_0_0 {
match {
source-address [ x.x.x.x/32 x.x.x.x/28 x.x.x.x/29 x.x.x.x/32 ];
destination-address x.x.x.x/32;
application [ TCP80 UDP8080-8090 ];
}
then {
permit;
policy CH20190830000454_01 {
source-address [ x.x.x.x/17 x.x.x.x/17 x.x.x.x/18 x.x.x.x/19 ];
destination-address [ x.x.x.x/19 x.x.x.x/19 x.x.x.x/18 x.x.x.x/24 ];
application any;
policy base-icmp-000 {
source-address any;
destination-address any;
application junos-icmp-all;
policy SR20191016000296_21807_0_0 {
source-address [ x.x.x.x/32 x.x.x.x/30 x.x.x.x/31 x.x.x.x/32 ];
destination-address [ x.x.x.x/32 x.x.x.x/32 ];
application [ TCP53 UDP53 ];
policy CH20190821000338 {
source-address [ x.x.x.x/28 x.x.x.x/32 ];
application [ TCP3872 TCP4889 TCP4900 ];
policy CH20190812000112 {
---(more)---[abort]
root@jtac-srx5400-r2010# exit
root@jtac-srx5400-r2010# show | compare
policy CH20190830000454_01 { ... }
! policy base-icmp-000 { ... }
root@jtac-srx5400-r2010# commit
commit complete
1 all-zone all-zone default-policy 1343 Deny
3 CORE FRI base-icmp-000 0 Permit
17459 CORE FRI policy_14998 0 Permit
17460 CORE FRI policy_14999 0 Permit
17461 CORE FRI policy_15000 0 Permit
17462 CORE FRI policy_02833 0 Permit
17463 CORE FRI policy_02834 0 Permit
17464 CORE FRI deny-all 38593182 Deny
17465 CORE FRI permit-all 158 Permit ----------------------------------------- You will see that some packets matched the unexpected security policy which will cause traffic matching issue.
17466 CORE FRI policy_02832 0 Permit
Enable the command "set security policies lookup-intact-on-commit" will fix this policy matching issue:
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/lookup-intact-on-commit-edit-security-policy.html
root@jtac-srx5400-r2010# set security policies lookup-intact-on-commit
Mar 25 06:43:38
Mar 25 06:43:42
[edit security policies]
+ lookup-intact-on-commit;
Mar 25 06:43:52
root@jtac-srx5400-r2010#
Mar 25 07:14:33
root@jtac-srx5400-r2010# run show security policies lookup-intact-on-commit status
Mar 25 07:14:46
FPC NAME Status
fpc1.pic1 Activated
fpc1.pic0 Activated
root@jtac-srx5400-r2010# run show security policies lookup-intact-on-commit eligibility
Mar 25 07:14:54
FPC NAME Eligibility
fpc1.pic1 Option activated already on PFE
fpc1.pic0 Option activated already on PFE
Mar 25 07:16:49
root@jtac-srx5400-r2010# insert policy base-icmp-000 before policy SR20191016000296_21807_0_0
Mar 25 07:17:19
Mar 25 07:17:23
Mar 25 07:17:34
Mar 25 07:17:39
Mar 25 07:17:49
Mar 25 07:18:06
1 all-zone all-zone default-policy 3677018 Deny
4 CORE FRI SR20191016000296_21807_0_0 0 Permit
5 CORE FRI CH20190821000338 0 Permit
6 CORE FRI CH20190812000112 0 Permit
7 CORE FRI CH20190819000051 0 Permit
8 CORE FRI CH20190819000051_1 0 Permit
9 CORE FRI SR20191014000660_21295_0_0 0 Permit
10 CORE FRI SR20191028000274_23564_1_0 0 Permit
11 CORE FRI SR20191031000648_24963_0_0 0 Permit
12 CORE FRI SR20191031000648_24975_0_0 0 Permit
13 CORE FRI SR20191031000648_24975_1_0 0 Permit
17454 CORE FRI policy_14993 0 Permit
17455 CORE FRI policy_14994 0 Permit
17456 CORE FRI policy_14995 0 Permit
17457 CORE FRI policy_14996 0 Permit
17458 CORE FRI policy_14997 0 Permit
17464 CORE FRI deny-all 102517061 Deny
17465 CORE FRI permit-all 0 Permit --------------------------------------- The packets will no longer to match this unexpected security policy during the policy reordering.
17466 CORE FRI policy_10642 0 Permit