3

Assumption:

Your interest lies in logging each and every session

Approach 1

You configure the session logging within each and every policy, for example:

set security policies from-zone trust to-zone untrust policy policy-1 match source-address any
set security policies from-zone trust to-zone untrust policy policy-1 match destination-address any
set security policies from-zone trust to-zone untrust policy policy-1 match application any
set security policies from-zone trust to-zone untrust policy policy-1 then permit
set security policies from-zone trust to-zone untrust policy policy-1 then log session-init
set security policies from-zone trust to-zone untrust policy policy-1 then log session-close

Approach 2

You configure session logging in the groups stanza and omit logging in policies:

set groups log-all security policies from-zone <*> to-zone <*> policy <*> then log session-init
set groups log-all security policies from-zone <*> to-zone <*> policy <*> then log session-close

Question

What are the performance effects to be gained by approaching session logging in two different manners within JUNOS like showed above, if any?

I'm thinking that there will be less configuration to read/write which would effect the performance when commiting and transfering the configuration. Listing all effects on the two different scenarios would be a great reference.

3

If we are assuming you want to log every session on your device then the apply-groups statement itself will as you thought only impact the performance of commit's.

This is because the system will need to calculate the effect of the applied groups across the rest of the config. The bigger your config gets and the more groups you are applying the longer your commits will start to take.

Once you have committed your config any groups that have been applied are essentially merged into a compiled configuration file:

/var/run/db/juniper.data

Once that is done there is no performance impact from the apply-groups statement on the running system.

Obviously logging itself will have an impact on the performance of the device. (check out the CPU use for eventd)

I personally use both methods. If the device is a low end device or processing jitter sensitive traffic then I tend to only log in the required policies rather than everything. On other devices I will use the apply-groups method to globally log everything and then use the apply-groups-except method where I don't want to log certain traffic.

set security policies from-zone trust to-zone untrust policy policy-1 apply-groups-except log-all

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.