Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 559 / 1026

Installing Security Policies
After you have successfully verified your security policy, you must:
1.
Assign the policy to your managed devices.
2.
Validate the policy.
3.
Install the policy on your managed devices.
The following sections detail each step.
Assigning a Security Policy to a Device
New devices do not have an existing or default security policy. However, when you import
a device configuration, NSM automatically imports all existing policies for the device. To
simplify policy management, you can merge these multiple device policies into a single
security policy that you install on several devices at one time. For details, see “Merging
Policies” on page 518.
After you have created a security policy, you must assign that policy to a device. Assigning
a policy to a device links the device to that policy, enabling NSM to install the policy on
that device. To assign an existing policy to a device, use one of the following methods:
•
Right-click a device and select Policy > Assign Policy . Select the policy you want to
assign to the device.
• Double-click a device to open the device configuration. In the Info tab, under Policy for
device, select the policy you want to assign to the device.
You can use a single security policy to control multiple security devices. Each rule in a
security policy contains an Install On column that specifies the devices the rule is applied
to. This means that you can assign a security policy to a device, but only some of the
rules in that policy are actually installed on that device during a device update.
You can also create multiple policies for a single device, but only one security policy can
be active on the device. When you update a device configuration, NSM installs the active
policy on the security device. By default, NSM considers the active policy to be the policy
that was most recently edited.
NOTE: If you delete and then re-import a device, you must reassign a policy
to the device.
Validating Security Policies
You should validate a security policy to identify potential problems before you install it.
NSM contains a Policy Validation tool to help you locate common problems, such as:
509 Copyright © 2010, Juniper Networks, Inc.
Chapter 9: Configuring Security Policies