Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 102 / 1026

•
Destination
•
Service
For details on configuring match criteria within the IDP rulebase, see “Defining Match
For IDP Rules” on page 469.
•
Add attack objects—Add the attacks you want the IDP security module to match in
the monitored network traffic. Each attack is defined as an attack object, which
represents a known pattern of attack. Whenever this known pattern of attack is
encountered in the monitored network traffic, the attack object is matched. You can
add attack objects by groups (category, operating system, severity, and so on) or
individually.
You configure attack objects within the Attack column of the IDP rule:
•
For details on selecting attacks within IDP rules, see “Configuring Attack Objects in
IDP Rules” on page 475
• For details on IDP attack objects, see “Working with IDP Attack Objects” on page 341.
•
For details on creating your own custom IDP attack objects, see “Configuring Custom
DI and IDP Attack Objects” on page 343.
•
Configure Action— Define the action the IDP security module takes when a particular
attack is detected. You can define an IDP action (action that the security module takes
against the current connection) and an IP action (action that the security module takes
against the current and future connections to or from the same IP address).
You configure IDP actions in the Action column of an IDP rule. For details, see “Defining
Actions For IDP Rules” on page 473.
You configure IP actions in the IP Action column of an IDP rule. For details, see
“Configuring IP Actions in IDP Rules” on page 477. (The IP Action column appears only
when viewing the security policy in Expanded Mode. To change the view mode of a
policy, from the menu bar, select
View > Show Expanded Mode , View > Show
Compact Mode , or View > Show Custom Mode ).
•
Configure Notification—Define the logging and notification activities you want the IDP
security module to take when the IDP rule is matched. You can configure the module
to generate log entries, trigger alarms, and log captured packets.
NOTE: J Series routers and SRX Series gateways do not send packet data
to NSM. If your policy rules attempt to do so, then no data is logged.
Configure Notification settings in the Notification column of an IDP rule. For details,
see “Configuring Notification in IDP Rules” on page 479.
Assign, Validate, and Install the Security Policy
After you have created the necessary firewall and IDP rules within the security policy, you
must perform the following steps to apply the policy to your network traffic:
1.
Assign the policy to a device.
Copyright © 2010, Juniper Networks, Inc. 52
Network and Security Manager Administration Guide