2

Will the inactivity timeout set for the application "TCP-ALL" of 900 trump the default value of 1800 for junos-ssh if the application-set were matched in a security policy? Does it matter if the order of the applications in this application set were reversed?

A1-1500# show applications application-set MANAGEMENT  
application TCP-ALL;  
application junos-ssh;  

A1-1500# show applications application TCP-ALL  
protocol tcp;  
source-port 1-65535;  
destination-port 1-65535;  
inactivity-timeout 900;  

1 Answer 1

1

Will the inactivity timeout set for the application "TCP-ALL" of 900 trump the default value of 1800 for junos-ssh if the application-set were matched in a security policy?

Assuming you had both applications are configured in the same security policy, yes order matters (see below).

Does it matter if the order of the applications in this application set were reversed?

Yes, the applications (for the same security policy) will be checked in order, from top to bottom. Juniper doesn't recommend that applications be configured this way, you could just use the default or a wildcard to say "then everything else".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.