Juniper NETWORK AND SECURITY MANAGER 2010.3, Руководство администратора

Страница: 760 / 1016

For example, you want to detect internal traffic that uses a nonstandard port for its
service.
1.
From the Violation Viewer, click on the + icon that appears on the top of the right-hand
window. You can also right-click anywhere in the right-hand window and select Add .
A New Permitted Object window appears.
2.
Name the object "Non-Standard-Ports".
3.
Right-click on the Service column and select Add Service .
4.
Select all predefined services.
5.
Click OK to save the permitted object. After you have created and saved the permitted
object, the object automatically becomes available in the Profiler.
6.
From the Violation Viewer, select the new permitted object "Non-Standard-Ports".
The Profiler uses the object to filter the data collected from the devices. Traffic that
matches the object (uses a standard service port) is filtered out, leaving only the
traffic that does not match (uses a nonstandard service port).
You can now review the data in the Violation Viewer to see all traffic on your network
that uses non standard service ports.
Now that you can see the traffic you do not want on your network, take the appropriate
security measures, for example, remove the unauthorized network components,
incorporate the components/services into your existing corporate security policy, or
create rules in your security policy to restrict the traffic to specific network components.
Example: Detecting Traffic That Is Not Using Primary Services
For example, you want to detect internal traffic that is not using the primary services for
Web access, e-mail, ping, and DNS services. In the Object editor, create a permitted
object to permit all traffic that uses a standard service port. For Service, select the
following predefined services:
• dns
• http
•
https
•
ping
• pop3
• smtp
•
ssh
After you have created and saved the permitted object, the object automatically becomes
available in the Profiler.
1.
From the Violation Viewer, select the permitted object Internal Services . The Profiler
uses the permitted object to filter the data collected from the devices. Traffic that
matches the object (uses a service specified in the object) is filtered out, leaving only
the traffic that does not match (does not use a service specified in the object).
Copyright © 2010, Juniper Networks, Inc. 710
Network and Security Manager Administration Guide