Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 501 / 1026

•
When installing the rule on devices running ScreenOS 5.3 and later, you can add multiple
MIPs and VIPs.
• When installing the rule on devices running ScreenOS 5.0 and later, you can add a
single MIP object per rule. To use multiple MIP objects for these devices, you must use
a separate rule for each global MIP object.
If you select multiple MIP or VIP objects in the source or destination column of a rule that
includes devices running non-ScreenOS 5.3 and later in the Install On column, a validation
message appears, indicating that those devices do not support multiple MIPs or VIPs
within a single rule.
To control incoming Internet traffic to your trusted network, set the From Zone to Untrust
and the To Zone to
Trust . Set the source address as any and the destination to the
address object that represents your trusted network.
To create a broader rule that controls traffic between multiple network components,
create address object groups and use them in your firewall rules as you would other
address objects. However, because security devices running ScreenOS 5.0 and later
apply firewall rules to each address object separately, using address object groups can
quickly decrease the number of available internal logical rules. If you must use address
groups for both the source and destination, ensure that these groups are as small and
as specific as possible.
To control traffic from your Marketing servers to your Engineering Servers, set the To
Zone to Engineering and the From Zone to Marketing. Set the source address as the
address group object that represents your Marketing servers, and the destination address
to the address group object that represents your Engineering servers.
The more specific you are in defining the source and destination address in a firewall rule,
the better your firewall performance will be.
To permit incoming traffic to your Engineering department network from any network
except the Sales network, set the From Zone to Untrust and the From Zone to Trust. Set
the source address group as the address group that represents Outside Sales network,
and the destination address to the address group the represents your Engineering server
network. Finally, right-click inside the source address column for the rule and select
Negate .
Support for Any-IPv6 as a Source Address
With NSM support for any IPv6, you can now configure ISG devices running ScreenOS
6.2–IDP and later, and devices running Junos 10.2 and later to inspect data containing
IPv6 addresses. The keyword "Any-IPv6" has been added to the IDP and firewall policies.
In the context of source and destination addresses, the previous keyword "Any" will be
treated as "Any-IPv4" on the device. You can continue to configure policies for IPv4
addresses.
To enable IPv6 functionality, you should set the environment variable IPv6 on the device
to "yes" and then reboot the device. Since NSM does not manage environment variables,
you cannot set this in NSM.
451 Copyright © 2010, Juniper Networks, Inc.
Chapter 9: Configuring Security Policies