Juniper NETWORK AND SECURITY MANAGER 2010.4 - API GUIDE REV 1, Руководство пользователя

Страница: 61 / 170

Table 15: IDP Rulebase Data Elements (continued)
Description Data Element
Specifies the security devices or templates that will receive and use this rule. You can select
multiple security devices on which to install the rule. target_collection
Multicast (rb_multicast_collection)
The multicast (rb_multicast_collection) rulebase includes multicast rules. Multicast rules
are statements that define specific types of multicast control traffic. When multicast
control traffic passes through a security device, the device attempts to match that traffic
against its list of rules. If a rule is matched, the device performs the action defined in the
rule against the matching traffic.
By default, security devices do not permit multicast control traffic (such as IGMP and
PIM-SM messages) to cross security devices. However, you can secure device multicast
control traffic through access lists. You can create an access list that defines the multicast
groups that hosts can join or to restrict the sources from which traffic is received, then
reference these access lists in multicast rules. To enable multicast control traffic to pass
between zones, you must configure multicast rules that specify the source zone (that
sends out multicast traffic), multicast group sending out the traffic, destination zone for
the traffic, and optionally, the destination group (source multicast group mapped to
another multicast group address).
These data elements are illustrated and described in Figure 11 on page 44 and Table 16
on page 44.
43 Copyright © 2010, Juniper Networks, Inc.
Chapter 5: Security Data Model