> -----Original Message----- > From: [email protected] [mailto:juniper-nsp- > [email protected]] On Behalf Of Scott T. Cameron > Sent: Wednesday, May 18, 2011 3:20 PM > To: [email protected] > Subject: [j-nsp] SRX policy logging > > Does anyone have a trick for logging all policies? I'm not > particularly > fond of going and tagging each policy with "log".
You can do it with apply-groups: set groups global-logging security policies from-zone <*> to-zone <*> policy <*> then log session-init set security policies apply-groups global-logging > Worse, is there a way to flag the default-policy with a log statement? > I > have deny-all and no options that follow, would be nice to catch them > all > with a log as well. Again, you can do this with an apply-group: set groups default-log security policies from-zone <*> to-zone <*> policy log-all-else match source-address any set groups default-log security policies from-zone <*> to-zone <*> policy log-all-else match destination-address any set groups default-log security policies from-zone <*> to-zone <*> policy log-all-else match application any set groups default-log security policies from-zone <*> to-zone <*> policy log-all-else then deny set groups default-log security policies from-zone <*> to-zone <*> policy log-all-else then log session-init set security policies apply-groups default-log HTHs. Stefan Fouant, CISSP, JNCIEx2 www.shortestpathfirst.net GPG Key ID: 0xB4C956EC _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
