Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 525 / 1026

Table 43: IDP Rule Actions (continued)
Description Action
IDP takes the action recommended by Juniper Networks. With IDP 4.1
and later, attack objects have a recommended action associated with
them. If a packet triggers more than one attack object, IDP applies the
most secure of the recommended actions. Available with IDP 4.1 and
later.
This setting has no meaning for IDP 4.0 or earlier. Rules with this setting
will not be loaded onto devices running earlier versions of IDP.
Recommended
Configuring Attack Objects in IDP Rules
Attack objects represent specific patterns of malicious activity within a connection, and
are a method for detecting attacks. Each attack object detects a known or unknown
attack that can be used to compromise your network. .
To add attack objects to a rule, right-click the Attacks column of the rule and select
Select Attacks . In the Add Attacks dialog box, you can add attacks using one or both of
the following options:
• Attack List—Select this option to add individual attack objects from an alphabetically
list of all predefined and custom attack objects. Attack objects are listed alphabetically
by name of attack.
Selecting individual attacks is a good option if you know the exact name of the attack
you want to add to a rule. To locate a specific word or string in the attack object name,
use the integrated search function in NSM.
•
Attack Groups—Select this option to add attack object groups from three predefined
dynamic attack groups (Category, OS, Severity); if you have created a custom dynamic
group, that group is also listed.
Selecting attack groups is a good option when you are unsure of the exact attack you
want to add to a rule, but you know the type of attack protection you want the security
device to provide. Within the Attack Groups, you can:
• Add all attack objects (select All Attacks). Consider carefully before selecting this
option; using all attack objects in a rule can severely impact performance on the
security device.
•
Add one or more attack groups (hold down CTL to select multiple groups). Predefined
dynamic groups might contain subgroups as well.
•
Add individual attack objects (hold down CTL to select multiple objects)
The following sections detail each predefined dynamic attack group.
Adding IDP Attack Object Groups by Category
The Category group includes attack objects organized by services. Services are application
layer protocols that define how data is structured as it travels across the network. A
475 Copyright © 2010, Juniper Networks, Inc.
Chapter 9: Configuring Security Policies