Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 411 / 1016

Figure 79: New Dynamic Group Members
5.
Click OK to save the dynamic group.
Updating Dynamic Groups
When you are satisfied with the group criteria and its members, use the group in a security
policy. The next time you update your attack objects, the update automatically performs
the following:
• For all new attack objects, compares the predefined attributes of each attack object
to each dynamic group criteria and adds the attack objects that match.
•
For all updated attack objects, removes attack objects that no longer meet their
dynamic group criteria. The update also reviews updated attack objects to determine
if they now meet any other dynamic group criteria, and adds them to those groups if
necessary.
•
For all deleted attack objects, removes the attack objects from their dynamic groups.
You can also edit a dynamic group manually, adding new filters or adjusting existing
filters to get exactly the type of attack objects your want.
NOTE: You can edit a custom dynamic attack group from within an IDP rule in a security
policy. Double-click the group icon in the Attack Objects column of an IDP rule to display
the Dynamic Group dialog box, make the desired changes, then click
OK to save your
edits.
361 Copyright © 2010, Juniper Networks, Inc.
Chapter 8: Configuring Objects