Policy Merging Restrictions; Resolving Merge Conflicts - Juniper E320 Configuration Manual

JUNOSe 7.2.x Policy Management Configuration Guide

Policy Merging Restrictions

Resolving Merge Conflicts

Example 1
46 !
Merging Policies
The following restrictions apply to policy merging:
! Classifier lists cannot be merged.
! Secure policies cannot be merged.
Policies created using ascend-data-filters cannot be merged.
!
! Existing policy VSAs in RADIUS are not changed; attachments created by this
method cannot be merged. Ascend data filter policies can be attached at input
and output attachment points.
! SNMP support for polling statistics based on component policy attachments is
not available.
The merge policy naming convention is not configurable.
!
The set of component policies are first ordered by their name to form the final
merged policy. For example, if the component policies sets contain cp_1, cp_3,
cp_9, cp_2, the order in which these policies are merged is cp_1, cp_2, cp_3, and
cp_9. The merge order is important for resolving merge conflicts.
Various conflicting combinations of component policies can result in a merged
policy that is not a perfect union of the component policies. These conflicts are
resolved as they currently are in policy CLI context, where, in any conflict, the most
recently executed command takes precedence.
More than one component policy can contain the same classifier group. If the
precedence does not match, the precedence of the classifier group defined in the
last component policy becomes the final precedence for this classifier group in the
merged policy, as in the following example:
host1(config)#ip policy-list p1
host1(config-policy)#classifier-group C1 precedence 90
host1(config-classifier-group)#forward
host1(config-classifier-group)#exit
host1(config)#ip policy-list p2
host1(config-policy)#classifier-group C1 precedence 100
host1(config-classifier-group)#forward
host1(config-classifier-group)#exit
host1(config)#ip policy-list p3
host1(config-policy)#classifier-group C1 precedence 130
host1(config-classifier-group)#forward
host1(config-classifier-group)#exit
If you combine p1, p2, and p3, you get the following with p1, p2, p3 as the merge
order for the set of component policies.
ip policy-list mpl_10
classifier-group C1 precedence 130
forward
exit