Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 259 / 1026

c. Verify the origin of each value by pressing the Shift key and moving the mouse
cursor over the field name.
For the Source IP Based Session Limit, the message “From template: DoS2” appears,
as shown in Figure 52 on page 209.
Figure 52: View DoS2 Value for Source IP Based Session Limit
For the SYN-ACK-ACK Proxy Protection and for Destination IP Based Session Limit,
the message “From template: DoS” appears, as shown in Figure 53 on page 209.
Figure 53: View DoS Value for SYN-ACK-ACK Proxy Protection Setting
8.
Manually override the SYN-ACK-ACK Proxy Protection value that is set by the template
DoS:
•
Clear the SYN-ACK-ACK Proxy Protection check box.
• Select and set the SYN-ACK-ACK Proxy Protection threshold to be 1000 .
•
The override icon appears next to the field name. Verify that the setting is derived
from the device configuration itself and not a template by moving the cursor over
the field name. The message “From object” appears, as shown in Figure 54 on
page 209.
Figure 54: View Default SYN-ACK-ACK Proxy Protection Setting
Template Limitations
When configuring and using templates in NSM, be aware of the following limitations.
Maximum of 63 Templates
You can apply a maximum of 63 templates to a single device. However, configuring
certain features reduces the maximum number of templates you can apply to a device:
• Cluster or vsys member—Configuring a device as a vsys device or as a member of a
cluster reduces the maximum number of templates by one.
•
VPNs—Each centrally managed VPN that the device belongs to also reduces the
maximum number of templates by one.
• Referenced templates—Each referenced template (a template referred to by another
template) reduces the maximum number of templates by one. For example, a device
209 Copyright © 2010, Juniper Networks, Inc.
Chapter 5: Configuring Devices