Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 97 / 1016

Enabling IDP Functionality
To enable IDP functionality on a managed device and deploy that functionality to protect
your network, you must perform the steps described in the following sections:
•
Adding an ISG2000/ISG1000 Security Device with a Security Module on page 47
• Installing Advanced License Keys on page 47
• Updating Attack Objects on page 47
•
Adding Objects (Optional) on page 48
•
Configuring a Security Policy for IDP on page 48
• Reviewing IDP Logs on page 53
Adding an ISG2000/ISG1000 Security Device with a Security Module
You must add an ISG2000 or ISG1000 security device with at least one security module
to the NSM UI before you can enable the IDP functionality in the security module.
NSM automatically detects the security module when you:
• Import an ISG2000 or ISG1000 device running ScreenOS 5.0.0-IDP1 and the security
module is already installed.
•
Install a security module in an existing ISG2000 or ISG1000 device that is currently
managed by NSM, then upgrade the device firmware to ScreenOS 5.0.0-IDP1.
NOTE: After you have upgraded the firmware, you must reimport the device
configuration.
To view the security module in the UI, open the device configuration and select Network
> Chassis .
Installing Advanced License Keys
To access the IDP functionality on a security module, you must install both an Advanced
license key and an IDP license key on the security device. For details on obtaining and
installing a license key, see “Managing License Keys (ScreenOS Only)” on page 266.
NOTE: Installing the IDP license key disables the Deep Inspection (DI) feature.
Updating Attack Objects
You must update the attack object database before you can use IDP functionality. To
update the IDP and DI databases and the IDP detector engine, download new attack
objects from the attack object database server to the GUI Server.
NOTE: You must have DNS enabled on the NSM GUI server before you can update your
attack objects.
47 Copyright © 2010, Juniper Networks, Inc.
Chapter 2: Planning Your Virtual Network