Juniper NETWORK AND SECURITY MANAGER 2010.4 - API GUIDE REV 1, Руководство пользователя

Страница: 47 / 170

Table 12: Backdoor Rulebase Data Elements (continued)
Description Data Element
For each attack that matches a rule, you can choose an action
that will occur if the IDP detects interactive traffic. The
following actions are possible:
• Accept = IDP accepts the interactive traffic
• Drop Connection = IDP drops the interactive connection
without sending an RST packet to the sender. This prevents
the traffic from reaching its destination. This action is
selected to drop connections from traffic that is not prone
to spoofing.
• Close Client = IDP closes the interactive connection to the
client but not to the server.
• Close Server = IDP closes the interactive connection to the
server but not to the client.
• Close Client and Server = IDP closes the interactive
connection and sends a RST packet to both the client and
the server. If IDP is operating in an inline tap mode, IDP sends
a RST packet to both the client and the server but does not
close the connection.
action
Sets the operation to detect or ignore. If you select detect,
choose an action to perform if backdoor traffic is detected. op
If this parameter is enabled, the API logs an attack and creates
log records with attack information. You can display this
information real time in the Log Viewer. For more critical
attacks, you can set an alert flag that will appear in the log
record. log
This parameter configures a rule that only applies to messages
in specified VLANs. The possible settings are:
• Any (default) = Any rule will be applied to messages in any
VLAN and to messages without a VLAN tag. This setting has
the same effect as not specifying a VLAN. Any can be sent
to devices that do not support VLAN tagging.
• None = A rule will be applied only to messages that do not
have a VLAN tag. Rules with this value set cannot be sent
to devices that do not support VLAN tagging.
• vlan_list_collection = Specifies the VLAN tags to which the
rule applies. You must create VLAN objects before applying
them to the rules. Rules with this value set cannot be sent
to devices that do not support VLAN tagging.
vlan
Action to be taken on the log. This can include configuring
SNMP, Syslog, CSV, XML, script, and e-mail settings. log-actions
29 Copyright © 2010, Juniper Networks, Inc.
Chapter 5: Security Data Model