I85PREP
⌘ K
JNCIP-SEC study materials
JNCIP-SEC study resources

JNCIP-SEC: Advanced Policy-Based Routing (APBR)

JNCIP-SEC · Work through your exam, one topic at a time.

All guide sections

Advanced Policy-Based Routing (APBR)

APBR is the SRX's ability to override destination-based routing with an application- or URL-aware decision. The exam tests where APBR sits in the processing path, how a profile's rules are ordered, and what breaks when AppID is unavailable.

Core rules

  • Normal forwarding picks a next hop from the route table. APBR adds a match on AppID application objects, URL categories or addresses, and forwards matching sessions to a chosen next hop or interface - typically one of two ISP links or a specific tunnel.
  • Configuration is a named profile with ordered rules; each rule matches traffic and its action names the forwarding decision. Profiles take effect only when the security policy's then permit application-services references them.
  • Rules evaluate top-down, first match wins; traffic matching no rule follows the routing table as usual.
  • Application matching requires AppID (AppSecure) to be licensed and the traffic inspected; URL category matching requires web filtering and its category database. Without the licence, application matches never fire and the profile silently falls through.
  • Typical use: send SaaS and video traffic out ISP-2 while business applications traverse an IPsec tunnel and everything else uses the default route.
  • Verify by reading the session, not the route table: show security flow session shows the egress interface and NAT for the flow, and show security policies hit-count confirms which policy attached the profile.

Worked example

Two uplinks, ISP-1 as default and ISP-2 as backup. The profile's first rule matches the SaaS application group and forwards to the ISP-2 next hop; the second rule matches a streaming URL category and also uses ISP-2; no further rules. A SaaS session is steered to ISP-2, while a generic HTTPS session falls through and follows the default route out ISP-1. If the AppID licence is missing, both sessions leave via ISP-1 and the profile looks configured but idle.

Traps

  • Attaching the profile to nothing; an unbound APBR profile does nothing.
  • Expecting in-flight sessions to move when the profile changes; the path is fixed at session creation.
  • Asymmetric return: steering out one link while the return arrives elsewhere drops the session.
  • Rule order: a broad catch-all above a specific rule makes the specific rule dead.