FAQ

Which products are supported?

Only MX platforms are supported which are on 26.1.2 firmware or newer. As of this writing, this includes all variants of the following platforms: 

• MX: 67, 68, 75, 85, 95, 105, 250, 450
• Z4
• VMX

Please see this arcticle for up to date information on firmware restrictions by platform 

How do Enforcement Targets work?

The Enforcement Target defines the "who" or "what" the policy applies to. Please note that only the MX will enforce the rules created, so the MX has to route the traffic.  Two common questions that come up are: 

• What happens when VLAN(s) are selected?
• What happens when an SGT is selected?

Example: I configure a policy with enforcement target VLAN 10 for two of my networks. The following networks have VLAN 10 configured like this:

• Location 1:   10.10.1.0/24
• Location 2:  10.10.2.0/24

When I attach a ruleset, the rules that have an "Any" as the source, the Dashboard will automatically fill in the subnets. So if I have a rule like this: 

• Action: Deny
• Source: Any
• Destination: 208.67.222.222 

For Location 1, the MX will enforce the following: 

• Action: Deny
• Source:  10.10.1.0/24
• Destination: 208.67.222.222 

For Location 2, the MX will enforce the following: 

• Action: Deny
• Source:  10.10.2.0/24
• Destination: 208.67.222.222 

If other VLANs are added into the scope, then the same will occur. For example, if Location 1 also has VLAN 11 (10.11.1.0/24), then the the following would be enforced as Location 1

• Action: Deny
• Source:  10.10.1.0/24 OR 10.11.1.0/24
• Destination: 208.67.222.222 

For SGT's the same idea applies. The MX would enforce the following: 

• Action: Deny
• Source:  SGT X
• Destination: 208.67.222.222