Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 343 / 1016

NOTE: Unlike the GUI-based attack object updates, Scheduled Security Updates
automatically pushes any new IDP detector engine that has been downloaded.
Using the command-line utility
/usr/netscreen/GuiSvr/utils/guiSvrCli.sh
, direct the
management system to obtain the latest attack objects from the attack database server
(managed by Juniper Networks), then specify the action you want the server to take.
For a successful update, the device configuration must be “In-Sync”, meaning that the
device is connected and that no configuration differences exist between the configuration
on the physical device and the modeled configuration in NSM, or “Sync Pending”, meaning
that the device is unconnected and that the physical device will be updated with the
modeled configuration when the device reconnects to the management system. If a
device is connected but its configuration is not “In-Sync”, the update process skips that
device to avoid installing unexpected changes.
To handle unconnected devices during the update, you must also specify additional
post-action options, shown in Table 30 on page 293.
Table 30: Scheduled Security Update (SSU) Command Line Parameters
Definition Parameter
Directs the system to download attacks for devices running
Junos OS. --dmi
Lists command-line options for guiSvrCli.sh . --help
Directs the system to update its attack database by connecting
to and downloading the latest attack database, if newer.
Requires post-action parameter.
--update-attacks
Indicates that a post-action instruction will follow (none or
update-devices).
Requires none or update-devices parameter.
--post-action
No post-action. SSU updates the attack database, but does not
push the new attacks to devices.
No other parameters needed.
--none
Updates managed security devices with newly updated attack
objects.
Requires an unconnected devices handling option (skip or retry).
--update-devices
Directs the server to skip any unconnected device (server does
not try to update attack objects on that device.)
No other parameters needed.
--skip
293 Copyright © 2010, Juniper Networks, Inc.
Chapter 7: Managing Devices