0

Any thoughts on why ::/0 is accepted in this example?

Per these documents, the accept in the sub policy means it will match the condition in the parent and action in the parent will apply. But this clearly isn't the outcome in the example.

"The action specified in a subroutine is used to provide a match condition to the calling policy. If the subroutine specifies an action of accept, the calling policy considers the route to be a match. If the subroutine specifies an action of reject, the calling policy considers the route not to match."

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/concept/policy-configuring-subroutines-in-routing-policy-match-conditions.html

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/concept/policy-routing-policies-subroutine-evaluation-method.html

group xx {
    ...
    import [ test1 test2 ];
    ...
}

policy-statement test1 {
    term deny {
        from policy [ default ];
        then reject;
    }
}

policy-statement default {
    term match {
        from {
            family inet6;
            route-filter ::/0 exact;
        }
        then accept;
    }
    term no-match {
        then reject;
}

policy-statement test2 {
    term allow {
        from {
            family inet6;
        }
        then accept;
    }
    then reject;
}
4
  • ::/0 matches all IPv6 addresses, making the test like if true then - so what is it you're trying to do?
    – Zac67
    Dec 18, 2022 at 8:45
  • 1
    ::/0 exact - should match only the default route. policy-statement default works correctly when referenced directly in import statement but does not when nested like the example.
    – Dan
    Dec 18, 2022 at 16:48
  • It would appear that policy test1 will reject a default route as defined by policy default (::/0). Are you saying that policy test1 is not rejecting the default route?
    – Ron Maupin
    Dec 18, 2022 at 17:00
  • Correct, it is not rejecting the default route.
    – Dan
    Dec 20, 2022 at 2:47

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.