Juniper NETWORK AND SECURITY MANAGER 2010.4 - API GUIDE REV 1, Manual

Page: 65 / 170

Table 17: SYN Protector Rulebase Data Elements (continued)
Description Data Element
Comments about the SYN Protector collection. comments
Custom options. customOptions_collection
Collection enabled. enabled
Traffic source address. src_addr_collection
Negates the specified source address. src_addr_negate
Traffic destination address. dst_addr_coillection
Negates the specified destination address. dst_addr_negate
The default service,
TCP-any
, looks for SYN floods in all TCP-based traffic.
NOTE: Always set the SYN Protector service value to
TCP-any
. Selecting individual services
can cause unpredictable interactions with other rulebases.
service
Select the mode that indicates how IDP handles TCP traffic. The possible values are:
• None = no action taken.
• Relay = IDP acts as the middleman or relay for the established connection.
• Passive = IDP handles the transfer of packets between the client host and the server but
does not prevent the connection from being established.
mode
Severity of the attack. Within the IDP rulebase, you can override the ordinary attack severity
on a per-rule basis. Possible settings:
•
Default
• Info
•
Warning
• Minor
•
Major
• Critical
severity
You can configure the system to log an attack and create log records with attack information.
This logged information can be viewed in real-time through the Log Viewer. log
This parameter configures a rule that only applies to messages in specified VLANs. The possible
settings are:
• Any (default) = Any rule will be applied to messages in any VLAN and to messages without
a VLAN tag. This setting has the same effect as not specifying a VLAN. Any can be sent to
devices that do not support VLAN tagging.
• None = A rule will be applied only to messages that do not have a VLAN tag. Rules with this
value set cannot be sent to devices that do not support VLAN tagging.
• vlan_list_collection = Specifies the VLAN tags to which the rule applies. You must create
VLAN objects before applying them to the rules. Rules with this value set cannot be sent to
devices that do not support VLAN tagging.
vlan
47 Copyright © 2010, Juniper Networks, Inc.
Chapter 5: Security Data Model