Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - POLICY MANAGEMENT CONFIGURATION GUIDE 2010-10-04 Configuration Manual page 142

JunosE 11.3.x Policy Management Configuration Guide
118
A packet that matches both the input policies and auxiliary input policies is subject to
both sets of policy actions.
E Series routers allow four input and two output policies per IP interface:
One secure input policy
Three nonsecure input policies
One secure output policy
One nonsecure output policy
Each classifier-group has a set of associated actions that is taken if it is the highest priority
match. The system performs only one set of actions per policy attachment. By using an
input and secondary-input policy, you can have overlapping classification with multiple
policy actions on ingress. Overlapping classification on egress is not supported.
An additional policy attachment point enables overlapping classification within the input
classification stage, between the input and secondary-input stages. There are five
attachment points for IP policies that are executed in series:
input
secondary-input
secure-input
output
secure-output
An explicit filter action, a forward action with a null next-interface, or a rate-limit action
can cause an immediate packet discard at any stage. Other actions, such are marking
and coloring can be done at each stage, with the last of each of these actions taking
precedence over the others.
For example, unique policies can be attached at each stage, all of which mark the IP TOS
field differently. The packet then exits the router with the TOS value that was set in the
output policy stage. However, if TOS is also used as a classification (input) term for each
of these policies, three different TOS values are presented to the classifier:
Original TOS received
TOS modified by the input policy
TOS value modified by the secondary-input policy
Figure 7 on page 119 shows the input policy stage after the addition of the auxiliary
substage. It is divided into three steps:
Apply classification for both substages.
1.
Perform policy actions (if any) for the primary attachment.
2.
Perform policy actions (if any) for the auxiliary attachment.
3.
Copyright © 2010, Juniper Networks, Inc.