When a security policy is modified, which statement is correct about the default behavior for active sessions allowed by that policy?

By default, when a security policy on a Juniper SRX Series device is modified and committed, the changes only apply to new sessions. Existing, active sessions that were permitted by the original policy are not affected and will continue to pass traffic until they time out or are closed normally. This default behavior ensures stateful session continuity and prevents service disruption for established connections. The device does not re-evaluate active sessions against the modified policy rules; those rules are only consulted for session initiation requests that occur after the policy change.

A. The active sessions allowed by the policy will be dropped. This is incorrect. Dropping all active sessions is a disruptive action and is not the default behavior for a policy modification.

B. Only policy changes that involve modification of the action field will cause the active sessions affected by the change to be dropped. This is incorrect. By default, no part of a policy modification, including a change to the action, will cause active sessions to be dropped.

C. Only policy changes that involve modification of the application will cause the active sessions affected by the change to be dropped. This is incorrect. Similar to other modifications, changing the application in a policy does not, by default, affect existing sessions.

1. Juniper Networks TechLibrary

Junos OS Security Guide. In the section "Understanding Session Management for Security Policies

" it states

"When you modify a security policy

the changes affect new sessions only. Existing sessions are not affected by the policy change."

2. Juniper Networks TechLibrary

Security Policies Configuration Guide for SRX Series Devices. The "Understanding Security Policy Processing" section clarifies the default behavior: "By default

when you modify a security policy

the changes affect new sessions only. Existing sessions are not affected by the policy change." This confirms that established flows are preserved.