Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 683 / 1026

Prerule and Postrule Updates during Global Policy Install
Pre/post rules exist on the Central Manager server under a separate policy object in the
Policy Manager. When updating to the regional server during the Global Policy Install
these rules are created in the regional server under a new global policy in the global
domain. All global policies existing on the regional server prior to the Global Policy Install
are removed, and replaced completely with the new global policies from Central Manager.
Only those global rules which have the regional server object included in the Install On
column, as well as rules with the Any entry in the Install On column, will be updated to
that regional server.
Global Policy Install is a directive that is dispatched as a job with many tasks. Each task
represents an install operation to a specific server. Job manager reports the status of
each task. Each task is executed independently of other task’s status. If one task fails,
as well as Job Manager entries, this failure does not prevent another task from finishing
successfully. Audit log entries are generated on both the Central Manager and regional
servers.
Shared Objects Update During Global Policy Install
All shared objects (both polymorphic and regular) existing on the Central Manager server
are updated to regional servers during the Global Policy Install if they are referenced in
a pre/post rule. Note that objects are updated only if they are actually being used by the
pre/post rules on the Central Manager server. All new shared objects are
replicated/inserted into the global domain of the regional server. Objects that are not
used are not updated.
Name Space Conflict Resolution for Shared Objects
When a regular shared object is replicated to a regional server during the Global Policy
Install, the following name conflict scenarios could occur:
• Conflict with a regional server shared object of the same name and same type
content—Existing shared objects will be kept and the incoming shared object will be
discarded. The incoming global policy rules use the existing shared object.
• Conflict with a regional server shared object of the same name, but different
content—An attempt is made to match the content of an incoming shared object with
another shared object named “objname_n” where “n” is a sequentially increasing integer.
The incoming global policy rules use the newly created shared object.
• Conflict with the previously replicated polymorphic object of the same type—The
incoming shared object is renamed “objname_n” where “n” is a sequentially increasing
integer and is inserted into the regional server’s global domain.
Since polymorphic objects cannot be deleted by the regional server administrator, some
of the polymorphic objects that exist in the global domain of the regional server are
deleted as a first step in the Global Policy Install transaction.
All polymorphic objects are deleted if they are not used by any of the local policies in the
regional server.
633 Copyright © 2010, Juniper Networks, Inc.
Chapter 13: Central Manager