Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 528 / 1026

Figure 83: Configure IP Action
Choosing an IP Action
For each IP action option, an IP action is generated by NSM. The IP action instructs the
security device to perform the specified task. Select from the following options:
•
IDP Notify—The security device does not take any action against future traffic, but logs
the event. This is the default.
• IDP Drop—The security device drops the matching connection and blocks future
connections that match the criteria set in the Block list.
•
IDP Close—The security device closes future connections that match the criteria in the
Block list.
Choosing a Block Option
Each block option follows the criteria you set in the Actions box. Block options can be
based on the following matches of the attack traffic:
• Source, Destination, Destination Port and Protocol—The security device blocks future
traffic based on the source, destination, destination port, and protocol of the attack
traffic. This is the default.
•
Source—The security device blocks future traffic based on the source of the attack
traffic.
• Destination—The security device blocks future traffic based on the destination of the
attack traffic.
•
From Zone, Destination, Destination Port and Protocol—The security device blocks
future traffic based on the source zone, destination, destination port, and protocol of
the attack traffic.
•
From Zone—The security device blocks future traffic based on the source zone of the
attack traffic.
Setting Logging Options
When the security device detects attack traffic that matches a rule and an IP action is
triggered, the device can log information about the IP action that was taken or create an
alert in the Log Viewer. By default, there are no logging options set.
Copyright © 2010, Juniper Networks, Inc. 478
Network and Security Manager Administration Guide