Problem is that I DO NOT have any global policies or default polices configured. When testing I find that although I can ping from my trust zone across my VPN any test ping from VPN to trust fails. This is contra to my configured polices (see below)
root@dig-srx1.haiti.bitek.com# show security policies
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone trust to-zone vpn {
policy smnp-colo {
match {
source-address any;
destination-address colo;
application [ junos-snmp-agentx snmp ];
}
then {
permit;
log {
session-init;
}
}
}
policy zeroMQ {
match {
source-address any;
destination-address CMngt;
application CTL;
}
then {
permit;
log {
session-init;
}
}
}
policy NOC {
match {
source-address any;
destination-address NOC;
application any;
}
then {
permit;
log {
session-init;
}
}
}
}
from-zone vpn to-zone trust {
policy Colo {
match {
source-address colo;
destination-address any;
application any;
}
then {
permit;
log {
session-init;
}
}
}
policy NOC {
match {
source-address NOC;
destination-address any;
application any;
}
then {
permit;
log {
session-init;
}
}
}
}
from-zone trust to-zone trust {
policy interzone {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
When looking at the trace options output it can be seen that the check inbound from 192.168.100.1 to 192.168.102.1 we can see that the packet passes my configured policy but fails a second default polices that is listed as a global polcy. (This is shown below)
Nov 25 15:06:54 15:06:53.929207:CID-0:RT: routed (x_dst_ip 192.168.102.1) from vpn (st0.0 in 0) to irb.0, Next-hop: 192.168.102.1
Nov 25 15:06:54 15:06:53.929207:CID-0:RT:flow_first_policy_search: policy search from zone vpn-> zone trust (0x0,0x7d84d,0xd84d)
Nov 25 15:06:54 15:06:53.929207:CID-0:RTolicy lkup: vsys 0 zone(8:vpn) -> zone(6:trust) scope:0
Nov 25 15:06:54 15:06:53.929207:CID-0:RT: 192.168.100.1/2048 -> 192.168.102.1/52529 proto 1
Nov 25 15:06:54 15:06:53.929207:CID-0:RTolicy lkup: vsys 0 zone(5:global) -> zone(5:global) scope:0
Nov 25 15:06:54 15:06:53.929207:CID-0:RT: 192.168.100.1/2048 -> 192.168.102.1/52529 proto 1
Nov 25 15:06:54 15:06:53.929207:CID-0:RT: app 0, timeout 60s, curr ageout 60s
Nov 25 15:06:54 15:06:53.929207:CID-0:RT: packet dropped, denied by policy
Nov 25 15:06:54 15:06:53.929207:CID-0:RT: denied by policy default-policy-logical-system-00(2), dropping pkt
Problem is "how is this default policy in the system? I do apprantly not have it configured in my config file, however its in the system. I either need to remove it or reorder it. How can this be done?
Thanks in advance