Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 538 / 1016

2.
Click the Add icon in the upper right corner of the Security Policy window and select
Add Backdoor Rulebase . The Backdoor rulebase tab appears.
3.
Configure a backdoor rule by clicking the Add icon on the left side of the Security
Policy window. A default backdoor rule appears. You can modify this rule as needed.
Defining a Match
You specify the traffic you want to IDP to monitor for indications of backdoors. The Match
columns From Zone, Source, To Zone, Destination, and Service are required for all rules
in the Backdoor rulebase.
The following sections detail the Match columns of a backdoor rule.
Configuring Source and Destination Zones
You can select multiple zones for the source and destination, however these zones must
be available on the security devices on which you will install the policy. You can specify
“ any” for the source or destination zones to monitor network traffic originating or destined
for any zone.
NOTE: You can create custom zones for some security devices. The list of zones from
which you can select source and destination zones includes the predefined and custom
zones that have been configured for all devices managed by NSM. Therefore, you should
only select zones that are applicable for the device on which you will install the security
policy.
Configuring Source and Destination Address Objects
In NSM, address objects are used to represent components on your network: hosts,
networks, servers, and so on. Typically, a server or other device on your network is the
destination IP for incoming attacks, and can sometimes be the source IP for interactive
attacks. You can specify "any" to monitor network traffic originating from any IPv4 address
and " AnyIPv6 " to monitor network traffic originating from any IPv6 address. You can
also negate the address objects listed in the Source or Destination column to specify all
sources or destinations except the excluded address object.
You can create address objects either before you create a backdoor rule or while creating
or editing an backdoor rule. To select or configure an address object, right-click either
the Source or Destination column of a rule and select Select Address. In the Select Source
Addresses dialog box, you can either select an already-created address object or click
the Add icon to create a new host, network, or group object.
Configuring Services
Select interactive service objects. Be sure to include services that are offered by the
source or destination IP as well as interactive services that are not; attackers can use a
backdoor to install any interactive service. Do not include telnet, SSH, RSH, netmeeting,
or VNC, as these services are often used to remotely control a system legitimately and
their inclusion might generate false positives.
Copyright © 2010, Juniper Networks, Inc. 488
Network and Security Manager Administration Guide