Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 295 / 1026

1.
Using the NSM monitoring tools, you learn of the attack and locate the cause of the
event. Using NSM modules such as the Realtime Monitor and Log Viewer, you
determine the exact attack that penetrated the device. From the Report Manager,
you also determine what rule in the security policy was ineffective in blocking the
attack.
2.
You update the modeled device configuration, editing the security policy to detect
and prevent the attack from entering your network again.
3.
Before updating the running configuration, you review the modeled device
configuration. Using a delta configuration summary, compare the modeled
configuration with the running configuration on the device to confirm the differences.
Fine-tune the modeled configuration, if needed.
4.
When you are confident that the modeled configuration is valid, update the device.
NSM updates the running configuration with only the new changes (delta). During
the update, you track the update progress using Job Manager in real time and observe
the transfer of the configuration from NSM to the device.
If the update is unsuccessful, use the information in the Job information window to
correct the problems in the modeled configuration.
5.
After updating, run a second Delta Configuration Summary to identify any remaining
differences between the modeled configuration and the running configuration on the
device. When the Delta Configuration Summary reveals no differences between the
new configuration and the old configuration on the device, you have successfully
updated the running configuration.
About Atomic Configuration—ScreenOS Devices
NSM uses atomic configuration, a fail-safe feature for updating devices. Atomic
configuration ensures that a current valid configuration is not overwritten by a flawed
configuration in flash memory. The update must finish without errors and the device
connection to the management system must remain active, or the update is aborted to
prevent an invalid, error-prone, or flawed configuration from being installed on the device.
Atomic configuration is always on. During an update:
1.
NSM saves and locks the active configuration on the device, and then starts a timer
for the update process. While the active configuration is locked, it cannot be changed.
2.
NSM sends the modeled configuration to the device.
3.
As the device receives the modeled configuration, it updates its existing active
configuration with each command as the command is received:
• If the device executes the entire modeled configuration (all commands) and the
connection to the management system remains up, NSM unlocks the active
configuration and saves the new active configuration.
•
If the device cannot execute a command, NSM resets the device, unlocks the active
configuration, and restores the saved active configuration to the device (the device
reboots). After rebooting, the device sends a final error message to the management
245 Copyright © 2010, Juniper Networks, Inc.
Chapter 6: Updating Devices