Persistent Configuration Differences For Merged Policies Through Service; Manager; Policy Attachment Sequence At Login Through Service Manager; Policy Attachment Rules For Merged Policies - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE 2010-10-04 Configuration Manual

JunosE 11.3.x Policy Management Configuration Guide
Persistent Configuration Differences for Merged Policies Through Service Manager

Policy Attachment Sequence at Login Through Service Manager

Policy Attachment Rules for Merged Policies

102
Service Manager can specify whether a component policy attachment is nonvolatile. If
the interface where the component policy is attached is volatile, then policy management
makes the attachment volatile even when the Service Manager specifies otherwise. A
nonvolatile interface can have both volatile and nonvolatile component policy
attachments. The merged policy that is created is the merge of all component policies
attached at a given attachment point regardless of their volatility. The merged policy
and its attachments are always volatile and reconstructed on each reload operation.
During a user login, you can specify policy attachments through Service Manager, RADIUS,
and Interface Profile. The order that is used to select the policy attachment source is
Service Manager, RADIUS, and Interface Profile.
For example, if you configure Ingress-Policy-Name VSA for a user in RADIUS and also
have a profile with an input policy reference applied to this user's interface column, when
the user logs in, the RADIUS VSA is selected as the source for the input policy attachment.
If you also have service profiles applied to the user's interface column, the service profiles
override both RADIUS VSA and the policy name specified in the interface profile.
NOTE: Policy merging is not supported with ascend data filter policies.
Policy management does not reselect the source if the policy attachment fails for the
selected source. If the policy attachment via service profiles fails, policy management
does not reselect RADIUS VSA as the next source. This means the interface does not
have any input policy attachment.
The attributes of a policy attachment are as follows:
Policy name—Name of policy to be attached.
Attachment type—Type of attachment.
Statistics enable/disable—Enable or disable statistics for the attachment.
Baseline enable/disable—Enable or disable baselining for the attachment.
Merge or Replace—Allow an attachment to become merge-capable and merge with
any other attachments that are merge-capable. If the merge keyword is not specified,
then it replaces any existing attachments with the new attachment. Merging always
preserves statistics.
Preserve—Preserve statistics from earlier attachment when replacing an attachment.
This keyword is mutually exclusive with merge keyword.
Copyright © 2010, Juniper Networks, Inc.