Technical Documentation

Download Software

Research a Problem

Case Management

Contract & Product Management

Documentation Archive

Guidelines and Policies

Security Resources

IDP Series Intrusion Detection and Prevention Pathway Pages

The topics in these pathway pages can also be found in the IDP Concepts and Examples Guide and IDP Administration Guide.

Overview
Examples
Configuration
Administration
Monitoring
Troubleshooting

Solution Overview

Juniper Networks IDP Solutions

IDP Series Features Overview

IDP Series Operating System Overview

IDP Series Network Interfaces Overview

Centralized Management with NSM Overview

J-Security Center Updates Overview

Deployment Mode Overview

Sniffer Mode Overview

Transparent Mode Overview

Mixed Mode Overview

Profiler and Monitoring Features Overview

Profiler Overview

Application Volume Tracking Overview

IDP Logs Overview

NSM Reports Overview

IDP Reporter Overview

Security Policy Basics

Understanding the Components of an IDP Security Policy

Understanding the Number of Available and Installed Policies

Understanding the Rule-Matching Algorithm

Using the Recommended Security Policy

Using Other Security Policy Templates

Example: Fine-Tuning a Security Policy

The IDP Rulebase

Understanding the IDP Rulebase

Understanding IDP Rulebase Rule Match Settings

User-Role-Based Policy Feature Overview

Using Application Identification

Using Attack Objects

Understanding IDP Rulebase Actions

Understanding IDP Rulebase Notification Options

The Exempt Rulebase
Understanding the Exempt Rulebase

The APE Rulebase

Understanding the APE Rulebase

Understanding APE Rulebase Match Conditions

Understanding APE Rulebase Actions

Understanding APE Rulebase Notification Options

The Backdoor Rulebase

Understanding the Backdoor Rulebase

Understanding Backdoor Rulebase Match Settings

Understanding the Backdoor Rulebase Operation Setting

Understanding Backdoor Rulebase Actions

Understanding Backdoor Rulebase Notification Options

The SYN Protector Rulebase

Understanding the SYN Protector Rulebase

Understanding SYN Protector Rulebase Match Settings

Understanding SYN Protector Rulebase Modes

Understanding SYN Protector Rulebase Notification Options

The Traffic Anomalies Rulebase

Understanding the Traffic Anomalies Rulebase

Understanding Traffic Anomalies Rulebase Match Conditions

Understanding Traffic Anomalies Rulebase Detection Settings

Understanding Traffic Anomalies Rulebase IP Actions

Understanding Traffic Anomalies Rulebase Notification Options

The Network Honeypot Rulebase

Understanding the Network Honeypot Rulebase

Understanding Network Honeypot Rulebase Match Settings

Understanding Network Honeypot Operation Setting

Understanding Network Honeypot Rulebase IP Actions

Understanding Network Honeypot Rulebase Notification Options

Additional Security Features
IP Spoof Attack Prevention Overview

Inspection of Encapsulated and Encrypted Traffic

Inspection of GRE Traffic Overview

Inspection of GTP Traffic Overview

Inspection of IPsec VPN Traffic Overview

Inspection of MPLS Traffic Overview

Inspection of SSL Traffic Overview

Using Profiler and Application Volume Tracking

Example: Using Profiler to Set a Baseline

Example: Using Profiler to Alert You to New Hosts and Port Activity

Example: Identifying Services That Use Nonstandard Ports

Example: Responding to Vulnerability Announcements with Due Diligence

Example: Using Profiler to Investigate Unanticipated Attacks

Example: Using Profiler to Mitigate Risks from Laptops

Example: Using NSM to Enable and View Application Volume Tracking

Logging

Example: Using NSM Log Viewer Features

Example: Packet Logging Workflow

Using Security Policy Rulebase Features

Example: Fine-Tuning a Security Policy

IDP Rulebase Example: User-Role-Based Policies

IDP Rulebase Example: Using Application Identification

IDP Rulebase Example: Specifying the Default Service

IDP Rulebase Example: Using Recommended Attack Objects

IDP Rulebase Example: Using Recommended Actions

Exempt Rulebase Example: Exempting a Source Destination Pair

Exempt Rulebase Example: Exempting an Attack Object

APE Rulebase Example: Using Extended Application Objects

APE Rulebase Example: Aggregate and Per-Subscriber Rate Limits

Backdoor Rulebase Example: netcat

Inspection of HTTPS Traffic

Example: Implementing Inspection of Outbound SSL Traffic

Example: Exempting Outbound SSL Traffic from Inspection

Deployments with Other Juniper Networks Appliances

Understanding Communication Between IDP Series and IC Series Appliances

Coordinated Threat Control Overview

Deploying IDP Series and SA Series Appliances for Coordinated Threat Control

IDP Series Configuration Requirements for Deployments with SA Series SSL VPN and IC Series Unified Access Control Appliances

Getting Started

Supported Tools for Management Tasks

Connecting to ACM

Connecting to the Command-Line Interface (CLI Procedure)

Configuring Virtual Routers (ACM Procedure)

Getting Started with the Default Configuration

Developing Security Policies Task Summary

Using Predefined Security Policies

Using the New Policy Wizard (NSM Procedure)

Configuring Profiler

Profiler Task Summary

Configuring Profiler Options (NSM Procedure)

Modifying Profiler Settings

Configuring the IDP Rulebase

Modifying IDP Rulebase Rules (NSM Procedure)

Specifying Rule Match Conditions (NSM Procedure)

Specifying IDP Rulebase Attack Objects (NSM Procedure)

Specifying Rule Session Action (NSM Procedure)

Specifying IP Action (NSM Procedure)

Specifying Rule Notification Options (NSM Procedure)

Specifying Rule VLAN Matches (NSM Procedure)

Specifying Rule Targets (NSM Procedure)

Specifying Rule Severity (NSM Procedure)

Specifying Rule Comments (NSM Procedure)

Working with Attack Objects

Attack Objects Task Summary

Viewing Predefined Attack Objects (NSM Procedure)

Working with Attack Groups (NSM Procedure)

Creating Custom Attack Objects

Configuring Additional Security Policy Rulebases

Configuring Exempt Rulebase Rules (NSM Procedure)

Configuring the APE Rulebase (NSM Procedure)

Configuring Backdoor Rulebase Rules (NSM Procedure)

Configuring SYN Protector Rulebase Rules (NSM Procedure)

Configuring Traffic Anomalies Rulebase Rules (NSM Procedure)

Configuring Network Honeypot Rulebase Rules (NSM Procedure)

Configuring Logging Features

IDP Series Logs and Reports in NSM Task Summary

Configuring Interface Aliasing (ACM Procedure)

Configuring Log Storage Limits

Configuring Log Suppression (NSM Procedure)

Configuring an SNMP Agent (NSM Procedure)

Configuring Syslog Collection (NSM Procedure)

Enabling Collection of Packet Data in NSM Logs (NSM Procedure)

Using the scio Command to Implement Advanced Features

scio Configuration Commands Task Summary

Using the SSL Private Server Key to Enable Inspection of SSL Traffic

Using the SSL Forward Proxy Feature to Enable Inspection of HTTPS Traffic

Exempting HTTPS Traffic from Inspection

Enabling Inspection of GRE Traffic

Enabling Inspection of GTP Traffic

Enabling Inspection of IPsec VPN Traffic

Enabling Inspection of MPLS Traffic

Enabling the Flow Bypass Feature

Configuring a Default Rate Limit

Configuring Advanced Settings for the User-Role-Based Policy Feature

Configuring Interoperability with Other Juniper Networks Devices
Generating a One-Time Password for Communication with SA Series SSL VPN and IC Series Unified Access Control Appliances (ACM Procedure)

Managing the Profiler

Profiler Task Summary

Starting and Stopping the Profiler (NSM Procedure)

Managing the Profiler Database (NSM Procedure)

Logging

Developing a Logging Strategy

Developing a Log Storage Strategy

Managing Security Policies

Managing Security Policies Task Summary

Assigning a Security Policy to a Device (NSM Procedure)

Validating a Security Policy (NSM Procedure)

Loading J-Security Center Updates (NSM Procedure)

Pushing Security Policy Updates to an IDP Series Device (NSM Procedure)

Disabling Rules (NSM Procedure)

Exporting Security Policies (NSM Procedure)

Managing the IDP Device Configuration with NSM

NSM Device Configuration Management Task Summary

Adding IDP Series Devices to NSM Device Manager

Activating Devices (NSM Procedure)

Pulling or Pushing Configuration Updates

Modifying the IDP Series Device Configuration

Deleting an IDP Series Device Configuration from NSM Device Manager (NSM Procedure)

Managing IDP Processes

Restarting the IDP Engine

Rebooting and Shutting Down the IDP Series Appliance

idp.sh Command Reference

Updating IDP Software

Upgrading Software (CLI Procedure)

Updating IDP OS Software (NSM Procedure)

Loading J-Security Center Updates (NSM Procedure)

Enabling Bypass and Peer Port Modulation

Configuring Virtual Routers (ACM Procedure)

Enabling the Flow Bypass Feature

Overview

Supported Tools for Monitoring Tasks

Developing a Logging Strategy

Developing a Log Storage Strategy

Using NSM Logs and Reports

IDP Series Logs and Reports in NSM Task Summary

Viewing Device Status (NSM Procedure)

Using NSM Logs

Using Profiler Viewer (NSM Procedure)

Viewing NSM Predefined Reports (NSM Procedure)

Creating NSM Custom Reports (NSM Procedure)

Packet Logging

Example: Packet Logging Workflow

Using tcpdump to Capture Packets

Using IDP Reporter Reports

IDP Reporter Task Summary

Accessing the IDP Reporter User Interface

Creating an IDP Reporter User

Troubleshooting IDP Reporter Access

Using the bypassStatus Utility to Monitor the Internal Bypass Daemon

bypassStatus Utility Task Summary

bypassStatus Command Reference

Using the sctop Utility to Monitor Session Flow

sctop Task Summary

Using the sctop Utility (CLI Procedure)

Understanding sctop Flow Table Reports

Using the scio Utility to Verify Feature Implementation

scio Monitoring Commands Task Summary

Verifying the APE Rulebase

Verifying Integration with an IC Series Unified Access Control Appliance

Verifying MPLS Decapsulation

Verifying the Flow Bypass Feature

scio Commands

scio idp-cpu-utlization

IDP MIB Object ID Reference
IDP Series MIB Object ID Reference

Troubleshooting References

Knowledge Base

Troubleshooting Tools Overview

IDP Processes Reference

Troubleshooting Feature Implementation

Tuning the JNET Driver Failure Count

Viewing Auto-Recovery Logs

Disabling the Auto-Recovery Feature

Tuning the Auto-Recovery Policy Reload Setting

Tuning the Auto-Recovery Bypass Setting

Viewing CPU Utilization

Troubleshooting High CPU Usage

Displaying Service Session Count

Troubleshooting Configuration Push Errors (NSM Procedure)

Troubleshooting Security Policy Validation Errors (NSM Procedure)

Disabling the APE Rulebase

Disabling the User Role-Based Policy Feature

Disabling Support for Jumbo Frames

Troubleshooting SSL Inspection

Disabling SSL Inspection

Disabling MPLS Decapsulation

Troubleshooting IDP Reporter Access

Downloads

Site Map / RSS Feeds / Careers / Accessibility / Feedback / Privacy & Policy / Legal Notices

Choose Country

North America

Europe

Asia Pacific

Technical Documentation

IDP Series Intrusion Detection and Prevention Pathway Pages

Downloads