Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 517 / 1016

attack is an e-mail that uses the SMTP context Confidential. Rule 6 closes the server
when the attack is an SMTP attack.
• Rule 5 terminates the match algorithm when the source is the Internal Network and
the attack is a Critical, High, or Medium Trojan Backdoor. The rule ensures that IDP
closes both the client and server and does not continue to match the connection.
Defining Actions For IDP Rules
You can define actions for the security device to perform against attacks that match
rules in your security policy. For each attack that matches a rule, you can choose to either
take action on the packet containing the attack (permit or drop packet) or take action
on the connection or session (permit, ignore, drop or close connection). Refer Table 43
on page 467 for details.
Remember, that the device can drop the packet containing the attack only when IDP is
enabled in the inline mode.
When IDP is enabled in the inline tap mode on ISG-IDP devices, and the action defined
is
drop packet or drop connection , IDP causes the firewall to drop the session upon
detection of an attack. However, it cannot prevent the attack packet from reaching its
destination because in the inline tap mode, the IDP only receives a copy of the packet
while the original packet is sent to its destination.
When standalone IDP sensors are deployed in the inline tap or sniffer mode, IDP cannot
perform a drop action and there is no disruption to the session carrying attack traffic.
Table 43 on page 467 lists actions for IDP rules:
Table 43: IDP Rule Actions
Description Action
IDP inspects for attacks but takes no action against the connection if
an attack is found. If a rule that contains an action
None is matched,
the corresponding log record displays accept in the action column of
the Log Viewer.
None
IDP completely ignores the session if the rule does not specify an
attack. If an attack is specified in the rule, IDP inspects the session and
generates a log for the first attack detected. Subsequently, IDP ignores
the rest of that session and neither inspects the session for attacks
nor generates attack logs. Use with caution. Ignore
467 Copyright © 2010, Juniper Networks, Inc.
Chapter 9: Configuring Security Policies