Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 529 / 1016

NOTE: You can select either a user role or a source IP address for the APE rule, but not
both.
To detect incoming attacks that target your internal network, set the From Zone to
Untrust, and the Source IP to any IP. Then set the To Zone to dmz and trust. Next, select
the address object that represents the host or server you want to protect from attacks
as the Destination IP.
To detect attacks between two network, select multiple address objects for the Source
and Destination.
The more specific you are in defining the source and destination of an attack, the more
you reduce false positives.
Configuring User Roles for APE Rules
User roles are configured in conjunction with source IP addresses. You select either a
user role or a source IP address for the APE rule. If you configure a user role in a APE rule,
you must also set the source address to “any”. NSM does not automatically set the source
address to “any” when a user role is configured in the rule but displays a message that
only a user role or a source address can be specified in a rule.
1.
To select or configure a user role, right-click the User Role column of a rule and select
Select User Role .
2.
From the Select User Roles dialog box, select a device from the Device drop down
menu.
3.
Use the Add or Remove button to add or remove user roles.
4.
Click OK .
Configuring Services for APE Rules
Services are application layer protocols that define how data is structured as it travels
across the network. Because the services you support on your network are the same
services that attackers must use to attack your network, you can specify which services
are supported by the destination IP to make your rule more efficient.
NOTE: All services rely on a transport layer protocol to transmit data. IDP includes
services that use TCP, UDP, RPC, and ICMP transport layer protocols.
Service objects represent the services running on your network. NSM includes predefined
service objects that are based on industry-standard services. You use these service
objects in rules to specify the service an attack uses to access your network. You can
also create custom service objects to represent protocols that are not included in the
predefined services.
In the Service column you select the service of the traffic you want IDP to match:
479 Copyright © 2010, Juniper Networks, Inc.
Chapter 9: Configuring Security Policies