Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 294 / 1016

configuration, because update to the device does not get committed until the operation
finishes.
About Implicit Updates (Secure Access and Infranet Controller Devices Only)
Secure Access and Infranet Controller configuration data is structured such that the
creation or change of some configuration data can cause implicit change in other
configuration data. For example:
•
Resource policies can be automatically created as a result of Resource Profile
configuration.
• Encrypted passwords are created on a Secure Access device as a result of cleartext
password configuration.
•
Bookmarks created in the Web Access Policies list (resource policies or allow rules for
certain Web sites) are created when the "auto-allow" checkbox is checked when a
Role bookmark is created.
• Configuration of a HostChecker role restriction triggers automatic configuration of a
realm-level host checker evaluation setting.
As a result, an Update Device directive to a Secure Access or Infranet Controller device
can result in configuration data changing on the device which was not set in NSM. To
synchronize the configuration data, NSM imports the configuration after the update.
If an Update Device directive causes implicit configuration changes on one or more
devices, each device reports the event to NSM in the update device response. On receipt
of this message, NSM performs the following actions:
• Shows the Update Device job as “Done” in the Job window.
•
Changes the configuration state on devices with implicit changes to “Managed, Device
Changed”.
• Displays the Device Import Options popup that lists the devices with implicit
configuration changes and informs you that the configuration is being imported.
Click OK to close the dialog box.
•
Starts a job to import the configuration from each affected device.
Knowing When to Update
Typically, you update a device after changing the device configuration or after modifying
the security policy that is assigned to the device.
•
To overwrite the existing configuration on the physical device, update the physical
device with the modeled configuration in NSM.
• To overwrite the modeled configuration in NSM, import the existing configuration from
the physical device. NSM does not support delta updates from the device.
Copyright © 2010, Juniper Networks, Inc. 244
Network and Security Manager Administration Guide