Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 389 / 1026

To create a DI Profile:
1.
In the navigation tree, select Object Manager > Attack Objects > DI Objects .
2.
Select the Profile tab.
3.
Click the Add icon to add a new Profile object.
4.
Configure the name, color, and comments for the profile object.
To add members to the profile object, configure the following:
• DI Severity Setting—Select a DI Severity setting for the profile object. The DI Severity
setting overrides the severity setting of the attack objects included in each profile
member.
• Signature Category—Select a category of DI signatures. You can only select categories
for which you have a license.
Categories are as follows:
•
Server Protection Pack—Designed to protect servers.
• Client Protection Pack—Designed to protect remote and home offices.
•
Worm Mitigation Pack—Designed to protect against worms.
•
Base (Default) Pack—All signatures. Might be too large for some devices.
• DI Attack Objects and Groups—Add a profile member to the profile object. Each profile
member can contain attack object groups, and you can add multiple profile members
to the profile object. Within each profile member:
• Select the attack object groups you want to include in this profile member.
• Configure the action you want the security device to take when an attack object
within the profile member matches traffic. Table 32 on page 339 lists DI profile actions.
Table 32: Deep Inspection Profile Actions
Description Action
The security device takes no action against the connection. none
The security device ignores the remainder of a connection after an attack object
is matched. ignore
The security device drops a matching packet before it can reach its destination
but does not close the connection. Use this action to drop packets for attacks in
traffic that is prone to spoofing, such as UDP traffic. Dropping a connection for
such traffic could result in a denial of service that prevents you from receiving traffic
from a legitimate source IP address.
For TCP connections, dropping a single packet will result in the same packet being
resent. So, Drop Packet settings are translated to Drop Connection settings for
TCP connections.
drop
packet
339 Copyright © 2010, Juniper Networks, Inc.
Chapter 8: Configuring Objects