Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Руководство администратора

Страница: 99 / 1026

When creating a new security policy for your IDP deployment, we highly recommend you
use a security policy template. Each security policy template contains the IDP rulebase
and IDP rules that use the default actions associated with the attack object severity and
protocol groups. You can customize these rules to work on your network as needed, such
as selecting your own address objects as the Destination IP and choosing IDP actions
and notifications that reflect your security needs.
If you do not use a security policy template, you must add the IDP rulebase manually, as
detailed in “Adding the IDP Rulebases” on page 50.
Configure Firewall Rules (ISG Only)
You can enable IDP within an existing rule, or create a new rule. Configure the firewall
rule as you would normally, setting the source and destination zones, address objects,
services, and so on to define the type of network traffic you want to permit.
When configuring the firewall rule, consider the following:
• Traffic that is denied by a firewall rule cannot be passed to IDP rules. To enable IDP in
a firewall rule, the action must be permitted.
•
When deploying the ISG2000 or ISG1000 device as a dedicated IDP system, configure
a single firewall rule that directs all traffic to the IDP rules. (By default, the firewall
denies all traffic.)
NOTE: When operating the security device in a nontransparent mode, you
must have configured basic security device settings, such as assigning
interfaces to zones, setting the administrative password, and configuring
default routes. For details about configuring these settings, see the user
guide that shipped with the device.
When operating the security device in transparent mode and using it as a
dedicated IDP system, you do not need to configure additional firewall
settings.
• For firewall rules that pass traffic to the IDP rulebases, the Install On column must
include IDP-capable devices only.
Setting the IDP Mode (ISG Only)
Because the security module is part of the inline security device, IDP protects your network
while directly in the path of traffic coming and going on your network.
To set the IDP mode:
1.
In the Configure panel of the main navigation tree, select Policy Manager > Security
Policies , and then double-click the policy name in the Security Policies window to
open the firewall rulebase.
2.
In the Rule Options column of a firewall rule, select IDP .
3.
Select one of the following modes:
49 Copyright © 2010, Juniper Networks, Inc.
Chapter 2: Planning Your Virtual Network