Associating subnets with a policy

Once you have configured a decision policy, you can associate subnets with it.

With the exception of automatically generated subnets, policies are not inherited by a more specific subnet from a more general subnet. For example, to apply a policy to both the 172.42.0.0/16 and the 172.42.1.0/24 subnets, you must explicitly associate each subnet with the policy, as shown in Examples.

Automatically generated subnets, on the other hand, inherit the policy of the more general subnet it is a part of, unless it is overridden by a dynamic decision policy. For more information on auto-created subnets, see auto-create-prefixes.

To associate subnets with a decision policy:

1. Access Engine command mode. For information on how to access this command mode, see Engine command mode.
2. Enter the following command to access an existing decision policy and associate a subnet with it:

set-decision-policy <name> {subnet <address> | group <group-name> | active-measurement-group <am-group-name>}

where

<name> is the policy name

<address> is the IP address of the subnet. Enter the IP address in the format of a.b.c.d/n.

Such user-defined subnets--a more specific subnet representing one of your VPN endpoints, for example--are added to the CNA database and are indicated by the link code in snapshot reports and show prefix command output.

3. Repeat Step 2 for each subnet that you want associated with the decision policy.