Providing Threat Mitigation Services with IDP > Sample Implementation

Sample Implementation

The SDX application library provides a robust sample implementation for integrating IDP into an SDX-managed network. It illustrates configurations for a network that contains only JUNOSe routers, and for a network that contains JUNOSe routers as subscriber access routers with JUNOS routing platforms as core routers.

You can also customize the sample data and applications to integrate IDP into your network, or you can use the samples as a guide to create your own implementation.

Sample Network Topologies

Figure 1 shows the network topology that serves as the basis for the configuration in the sample data for a network that contains only JUNOSe routers.

Figure 1: Sample Network Topology with a JUNOSe Router

Figure 2 shows the network topology that serves as the basis for the configuration in the sample data for a network that contains JUNOSe routers and JUNOS routing platforms.

Figure 2: Sample Network Topology with a JUNOSe Router and JUNOS Routing Platforms

Components in Sample Data

The sample implementation includes:

• Policies, services, router definitions, and SAE configurations in the sample data. Sample entries for IDP integration have the prefix IDP

For information about installing sample data, see Chapter 1, Installing the SDX Applications.

• IDP captive portal application (a Web page that receives redirected HTTP requests in response to a problem detected by IDP) with policies and services to limit bandwidth and direct Web requests to the sample portal
• IDP E-Mailer application
• Script to enable subscriber actions from IDP Manager

You can use the sample data and applications to create a demonstration implementation. The IDP router definitions, identified as IDP<routername> in the sample data, can be configured to act as simulated routers for a demonstration environment. For information about setting up a simulated router, see SDX Components Guide, Vol. 1, Chapter 2, Configuring the SAE.

The sample data uses the following terminology:

• Subscriber-facing router—Subscriber access router
• Core-facing router—Router that transmits subscriber traffic to the network core