Intrusion Detection and Prevention (IDP)
■
IDP in an active/active chassis cluster
—This feature is supported on SRX3400,
SRX3600, SRX5600, and SRX5800 devices.
Intrusion Detection and Prevention (IDP) can now monitor traffic on active/active
chassis clusters. As in active/passive clusters, sessions already in progress that
fail over or fail back are not inspected by IDP in an active/active cluster. New
sessions created after a failover will, however, be inspected by IDP. There are
no changes to IDP deployment or logging as a result of extending support to
active/active high-end device clusters.
IDP also now supports chassis cluster in-service software upgrades (ISSUs), which
means that new sessions will continue to be inspected during the ISSU. However,
because ISSU requires the nodes to fail over and fail back as the upgrade
proceeds, IDP monitoring of any sessions that fail over will cease. It should not
be necessary to restart IDP once the ISSU is completed. Note that IDP ISSU
support is available on both active/passive and active/active chassis clusters.
[
JUNOS Software Security Configuration Guide
]
■
IDP application identification enhancement for extended applications with
threat prevention support
—This feature is supported on SRX3400, SRX3600,
SRX5600, and SRX5800 devices.
With the increased use of application protocol encapsulation, the need arises to
support the identification of multiple different applications running on the same
Layer 7 protocols. In order to do this, the current application identification layer
is split into two layers: application and protocol. New extended application
signatures have been added to identify these extended applications.
[
JUNOS Software Security Configuration Guide
]
■
CLI enhancements supported for J-Web
—This feature is supported on SRX
Series and J Series devices.
Additional functionality has been added to existing IDP J-Web pages for several
new CLI commands that perform tasks such as the following: list detailed security
download status information, list subscriber policies, add additional IDP packet
counters to differentiate a packet drop that is the result of a policy from a
legitimate drop or an error drop. There are several more newly added commands.
[
JUNOS CLI Reference Guide
]
■
SNMP MIB for IDP Monitoring
—This feature is now supported on SRX3400,
SRX3600, SRX5600, and SRX5800 devices in addition to existing support on
SRX100, SRX210, SRX240, and SRX650 devices.
[
JUNOS Software Security Configuration Guide
]
■
Application-level DDoS logging
—This feature is supported on SRX3400,
SRX3600, SRX5600, and SRX5800 devices with IDP enabled.
IDP now provides logging for application-level DDoS events. IDP generates three
types of application-level DDoS event logs: attack, state transition, and ip-action.
These event logs provide visibility into the application-level DDoS state and
provide notifications on occurrences of application-level DDoS attacks for each
protected application server.
New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers
■
107
New Features in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers
