Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 382 / 1026

NOTE: If an address object is used in multiple zones, NSM pushes the
address object into the zones without changing its name. When you import
a device, NSM combines address objects with the same name and same
content from different zones into a single address object.
Blocked Hosts
NSM can block the IP address of hosts where login attempts fail consecutively for a
specified number of times. The default value is 5 times. NSM saves a list of these blocked
IP addresses. Select
Tools > Managed Blocked Hosts to display a list of blocked hosts
or to clear the blocked IP addresses. If the local host is blocked, you must use another
computer to use this option to unblock the host IP address.
Configuring Application Objects
You can view all application objects and create new custom application objects from
the Object Manager.
Viewing Predefined Application Objects
The Predefined Application Objects tab in the Application Objects window lists all the
predefined application objects in NSM. You can view the predefined Application objects
in a table format with the following details.
Table 31: Application Table Tab Information
Description Field
The name of the application object. Name
The hierarchical category to which the application belongs. Application Category
The TCP/UDP port ranges to be matched with application signatures. Specifying a small range
improves system performance. You must configure either a TCP or UDP field; while optionally,
you can configure both. Port Range
The type of application-predefined or custom type.
Port Binding
is required for a custom type
application while it is not required for a predefined type.
Application Type
The default TCP/UDP port bindings required for custom application types only. You must configure
either TCP or UDP or optionally, both of them. Port Binding
An integer value used to resolve conflict when multiple application signatures are matched for a
session. In that case, the application signature with the highest order (smallest value) is taken. It
is assumed that no two signatures have the same order value, in which case the first application
signature IDP sees (not necessarily the first one in policy) is taken. Match Order
You can double-click on an application object to view its settings which include the
following additional information:
Copyright © 2010, Juniper Networks, Inc. 332
Network and Security Manager Administration Guide