Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[SRX-IDP] "set security idp sensor-configuration flow drop-on-limit" Command Operation



Article ID: KB28057 KB Last Updated: 04 Mar 2017Version: 2.0

This article documents the function of the "set security idp sensor-configuration flow drop-on-limit" command. 

In the 12.1X44-D20+ Junos code, there is a new command, "set security idp sensor-configuration flow drop-on-limit." What does this command do?
In the case when the SRX IDP hits a resource limit (e.g. memory allocation fails), the default behavior is to ignore the flow and let the flow pass without inspection. This is the documented default behavior since most customers do not enforce traffic dropping due to IDP limits.

The new knob (drop-on-limit) changes this behavior by dropping such flows. We suggest this knob to customers who require all traffic to be inspected by IDP or no traffic to be allowed without inspection. This knob ensures IDP attack inspection.
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search