Juniper JSA3500, Руководство по оборудованию

Страница: 107 / 154

CHAPTER 15
Software Installation Overview
• JSA Components on page 91
• Browser Support on page 92
•
Preparing the Network Hierarchy on page 93
JSA Components
Juniper Secure Analytics (JSA) includes the following deployment components:
NOTE: When deploying a Juniper Secure Analytics (JSA) appliance with
image 2013.2.r3.607582, you must reimage the appliance to the common
image 2013.2.r3.615469 or above. For more information, see Installing JSA
Using a Bootable USB Flash-Drive Technical Note.
• Flow Processor
—Collects data from devices, and various live and recorded feeds, such
as network taps, span/mirror ports, NetFlow, and JSA flow logs. When the data is
collected, the Flow Processor groups related individual packets into a flow. JSA defines
these flows as a communication session between two pairs of unique IP address and
ports that use the same protocol.
A flow starts when the Flow Processor detects the first packet with a unique source
IP address, destination IP address, source port, destination port, and other specific
protocol options that determine the start of a communication. Each additional packet
is evaluated. Counts of bytes and packets are added to the statistical counters in the
flow record. At the end of an interval, a status record of the flow is sent to an Event
Collector and statistical counters for the flow are reset. A flow ends when no activity
for the flow is detected within the configured period of time.
Flow reporting generates records of all active or expired flows during a specified period
of time. If the protocol does not support port-based connections, JSA combines all
packets between the two hosts into a single flow record. However, a Flow Processor
does not record flows until a connection is made to another JSA component and data
is retrieved.
• Event Collector
—Collects security events from various types of security devices, known
as log sources, in your network. The Event Collector gathers events from local and
remote log sources. The Event Collector then normalizes the events and sends the
91 Copyright © 2018, Juniper Networks, Inc.