This article explains how to determine whether an IDP policy on an SRX device has finished compiling, and is now processing traffic.

 

Compiling an IDP policy can take a while, depending on the processing power of the SRX device and the IDP policy size. Given these factors, customers may be concerned that they do not see the new policy inspecting traffic. 

 

If the show security idp status command is issued immediately after changing the IDP policy, the active policy appears to be unchanged. This is because the IDP policy compilation is not complete yet.

 

To determine whether the IDP policy has finished compiling, the steps must be performed in the following order:​

1. Change the policy in the configuration.

2. Use show|compare to verify the configuration change.

3. Issue show security idp status to check whether the old policy has loaded before committing. 

4. Commit the configuration change:

 

Notice that the Old_Policy is still active:

   

When the show security idp policy-commit-status command is executed within a few seconds of changing the policy, you will observe that the policy is still compiling, which is why the policy hasn't changed yet. The SRX device will unload the previous IDP policy only when the new policy is ready.