Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 484 / 1016

About Rules
A rule is a statement that defines a specific type of network traffic. Traffic must meet
the rule requirements before it is permitted to pass through the security device. By default,
all security devices deny all traffic.
When traffic passes through the security device, the device attempts to match that traffic
against its list of rules. Network traffic that matches this list of requirements is considered
to “match” the rule, and the device performs the action specified in the rule. If any
requirement is not met, the network traffic does not match, and is denied.
Using the NSM UI, you can create intrazone firewall rules, global firewall rules, multicast
rules, VPN rules, and VPN links for all security devices. For ISG gateways, you can create
IDP rules, APE rules, exempt rules, and backdoor detection rules. For standalone IDP
appliances, you can create IDP rules, APE rules, exempt rules, backdoor detection rules,
SYN protector rules, traffic anomalies rules, and network honeypot rules. NSM also
supports J Series, SRX Series, and MX Series devices running Junos OS that support both
firewalls and IDP policies. Each security policy (all rulebases combined) can contain a
maximum of 40,000 rules.
About Firewall Rulebases
You create rules in the firewall rulebases to enable access across your networks by
permitting or denying specific network traffic flowing from one zone to another zone.
After you have added a device in NSM, you can create rules in the firewall rulebases of
your security policy.
You can build multiple firewall rules in both firewall rulebases for a single device; these
rules combine to create a security policy that determines how that device handles traffic.
To simplify your security policy, use device groups to build access rules that apply to all
your perimeter security devices, then apply the entire policy to the perimeter device group.
NOTE: When a firewall policy with network address objects is applied to Junos devices,
the device update operation in NSM fails, because DMI devices do not support network
address objects.
Firewall Rules (Zone and Global)
Within a firewall rule, you specify where the traffic is coming from, where it is going, and
what service it is using. You can also use firewall rules to authenticate users, monitor
network traffic flowing between zones, or set a schedule on a firewall rule that controls
the time period that the rule is applied to network traffic.
NOTE: On Juniper Networks vsys devices, rules defined in the root system do not affect
rules defined in virtual systems.
When creating firewall rules, consider the type, location, and functionality of each device
in your network. Typically, a single security policy for multiple devices works well for
devices that perform similar functions, such as perimeter firewalls. However, you might
Copyright © 2010, Juniper Networks, Inc. 434
Network and Security Manager Administration Guide