Intrusion Detection and Prevention (IDP)
■
On SRX3400, SRX3600, SRX5600, and SRX5800 devices, application-level
distributed denial-of-service (application-level DDoS) detection does not work if
two rules with different application-level DDoS applications process traffic going
to a single destination application server. When setting up application-level DDoS
rules, make sure you do not configure rulebase-ddos rules that have two different
application-ddos objects while the traffic destined to one application server can
process more than one rule. Essentially, for each protected application server,
you have to configure the (application-level DDoS rules so that traffic destined
for one protected server only processes one application-level DDoS rule.
NOTE:
Application-level DDoS rules are terminal, which means that once traffic is
processed by one rule, it will not be processed by other rules.
The following configuration options can be committed, but they will not work
properly:
Application Server
application-ddos
service
destination-ip
destination-zone
source-zone
1.1.1.1:80
http-appddos1
http
any
dst-1
source–zone-1
1.1.1.1:80
http-appddos2
http
any
dst-1
source-zone-2
■
On SRX3400, SRX3600, SRX5600, and SRX5800 devices, the application-level
denial-of-service (application-level DDoS) rulebase (rulebase-ddos) does not
support port mapping. If you configure an application other than default, and if
the application is from either predefined JUNOS Software applications or a custom
application that maps an application service to a nonstandard port,
application-level DDoS detection will not work.
When you configure the application setting as
default
, IDP uses application
identification to detect applications running on standard and nonstandard ports,
hence the application-level DDoS detection would work properly.
■
On SRX210, SRX240, and SRX650 devices, the maximum number of IDP sessions
supported is 16,000.
■
On SRX Series devices, all IDP policy templates are supported except All Attacks.
There is a 100-MB policy size limit for integrated mode and a 150-MB policy size
limit for dedicated mode, and the current IDP policy templates supported are
dynamic, based on the attack signatures being added. Therefore, be aware that
supported templates might eventually grow past the policy-size limit.
On SRX Series devices, the following IDP policies are supported:
■
DMZ_Services
■
DNS_Service
■
File_Server
138
■
Known Limitations in JUNOS Release 10.1 for SRX Series Services Gateways and J Series Services Routers
JUNOS 10.1 Software Release Notes
