Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary

Navigation

Table of Contents

Guide That Contains This Content

[+] Expand All

[-] Collapse All

IDP Series Feature Documentation

The topics in these pathway pages can also be found in the IDP Concepts and Examples Guide and IDP Administration Guide, which can be downloaded using the links to the right.

Overview
Examples
Configuration
Administration
Monitoring
Troubleshooting

Solution Overview

Juniper Networks IDP Solutions

IDP Series Features Overview

IDP Series Operating System Overview

IDP Series Network Interfaces Overview

Centralized Management with NSM Overview

J-Security Center Updates Overview

Profiler and Monitoring Features Overview

Profiler Overview

Application Volume Tracking Overview

IDP Logs Overview

NSM Reports Overview

IDP Reporter Overview

Simulation Mode
Simulation Mode Overview

Security Policy Basics

Understanding Non-Policy-Based Drops

Understanding the Components of an IDP Security Policy

Understanding the Number of Available and Installed Policies

Using Application Identification

Understanding the Rule-Matching Algorithm

Using the Recommended Security Policy

Using Other Security Policy Templates

Example: Fine-Tuning a Security Policy

The IDP Rulebase

Understanding the IDP Rulebase

Understanding IDP Rulebase Rule Match Settings

User-Role-Based Policy Feature Overview

Using Attack Objects

Understanding IDP Rulebase Actions

Understanding IDP Rulebase Notification Options

The Exempt Rulebase
Understanding the Exempt Rulebase

The APE Rulebase

Understanding the APE Rulebase

Understanding APE Rulebase Match Conditions

Using Application Objects

Understanding APE Rulebase Actions

Understanding APE Rulebase Notification Options

The Backdoor Rulebase

Understanding the Backdoor Rulebase

Understanding Backdoor Rulebase Match Settings

Understanding the Backdoor Rulebase Operation Setting

Understanding Backdoor Rulebase Actions

Understanding Backdoor Rulebase Notification Options

The SYN Protector Rulebase

Understanding the SYN Protector Rulebase

Understanding SYN Protector Rulebase Match Settings

Understanding SYN Protector Rulebase Modes

Understanding SYN Protector Rulebase Notification Options

The Traffic Anomalies Rulebase

Understanding the Traffic Anomalies Rulebase

Understanding Traffic Anomalies Rulebase Match Conditions

Understanding Traffic Anomalies Rulebase Detection Settings

Understanding Traffic Anomalies Rulebase IP Actions

Understanding Traffic Anomalies Rulebase Notification Options

The Network Honeypot Rulebase

Understanding the Network Honeypot Rulebase

Understanding Network Honeypot Rulebase Match Settings

Understanding Network Honeypot Operation Setting

Understanding Network Honeypot Rulebase IP Actions

Understanding Network Honeypot Rulebase Notification Options

Additional Security Features
IP Spoof Attack Prevention Overview

Inspection of Encapsulated and Encrypted Traffic

Inspection of GRE Traffic Overview

Inspection of GTP Traffic Overview

Inspection of IPsec VPN Traffic Overview

Inspection of MPLS Traffic Overview

Inspection of SSL Traffic Overview

Simulation Mode
Example: Getting Started with Simulation Mode

Using Profiler and Application Volume Tracking

Example: Using Profiler to Set a Baseline

Example: Using Profiler to Alert You to New Hosts and Port Activity

Example: Identifying Services That Use Nonstandard Ports

Example: Responding to Vulnerability Announcements with Due Diligence

Example: Using Profiler to Investigate Unanticipated Attacks

Example: Using Profiler to Mitigate Risks from Laptops

Example: Using NSM to Enable and View Application Volume Tracking

Logging

Example: Using NSM Log Viewer Features

Example: Packet Logging Workflow

Example: Querying the IDP Series Device MIB

IDP Rulebase Examples

IDP Rulebase Example: Using Application Identification

IDP Rulebase Example: Specifying the Default Service

IDP Rulebase Example: Using Recommended Attack Objects

IDP Rulebase Example: Using Recommended Actions

IDP Rulebase Example: User-Role-Based Policies

Example: Fine-Tuning a Security Policy

APE Rulebase Examples

APE Rulebase Example: Using Extended Application Objects

APE Rulebase Example: Aggregate and Per-Subscriber Rate Limits

APE Rulebase Example: Matching Custom Application Objects

Exempt and Backdoor Rulebase Examples

Exempt Rulebase Example: Exempting a Source Destination Pair

Exempt Rulebase Example: Exempting an Attack Object

Backdoor Rulebase Example: netcat

Inspection of HTTPS Traffic

Example: Implementing Inspection of Outbound SSL Traffic

Example: Exempting Outbound SSL Traffic from Inspection

Getting Started

Supported Tools for Management Tasks

Connecting to ACM

Connecting to the Command-Line Interface (CLI Procedure)

Configuring Virtual Routers (ACM Procedure)

Getting Started with the Default Configuration

Developing Security Policies Task Summary

Using Predefined Security Policies

Using the New Policy Wizard (NSM Procedure)

Simulation Mode
Enabling Simulation Mode

Configuring Profiler

Profiler Task Summary

Configuring Profiler Options (NSM Procedure)

Modifying Profiler Settings

Configuring the IDP Rulebase

Modifying IDP Rulebase Rules (NSM Procedure)

Specifying Rule Match Conditions (NSM Procedure)

Specifying IDP Rulebase Attack Objects (NSM Procedure)

Specifying Rule Session Action (NSM Procedure)

Specifying IP Action (NSM Procedure)

Specifying Rule Notification Options (NSM Procedure)

Specifying Rule VLAN Matches (NSM Procedure)

Specifying Rule Targets (NSM Procedure)

Specifying Rule Severity (NSM Procedure)

Specifying Rule Comments (NSM Procedure)

Configuring Additional Security Policy Rulebases

Configuring Exempt Rulebase Rules (NSM Procedure)

Configuring the APE Rulebase (NSM Procedure)

Configuring Backdoor Rulebase Rules (NSM Procedure)

Configuring SYN Protector Rulebase Rules (NSM Procedure)

Configuring Traffic Anomalies Rulebase Rules (NSM Procedure)

Configuring Network Honeypot Rulebase Rules (NSM Procedure)

Working with Attack Objects

Using Attack Objects

Attack Objects Task Summary

Viewing Predefined Attack Objects (NSM Procedure)

Working with Attack Groups (NSM Procedure)

Creating a Signature Attack Object

Creating a Compound Attack Object

Working with Application Objects

Using Application Objects

Application Objects Task Summary

Viewing Predefined Application Objects (NSM Procedure)

Viewing Predefined Extended Application Objects (NSM Procedure)

Creating Application Groups (NSM Procedure)

Creating a Custom Application (NSM Procedure)

Configuring Logging Features

IDP Series Logs and Reports in NSM Task Summary

Configuring Interface Aliasing (ACM Procedure)

Configuring Log Storage Limits

Configuring Log Suppression (NSM Procedure)

Configuring an SNMP Agent (NSM Procedure)

Configuring Syslog Collection (NSM Procedure)

Enabling Collection of Packet Data in NSM Logs (NSM Procedure)

Using the scio Command to Implement Advanced Features

scio Configuration Commands Task Summary

Using the SSL Private Server Key to Enable Inspection of SSL Traffic

Using the SSL Forward Proxy Feature to Enable Inspection of HTTPS Traffic

Exempting HTTPS Traffic from Inspection

Enabling Inspection of GRE Traffic

Enabling Inspection of GTP Traffic

Enabling Inspection of IPsec VPN Traffic

Enabling Inspection of MPLS Traffic

Enabling the Flow Bypass Feature

Configuring a Default Rate Limit

Enabling Per-User Rate Limiting for User-Role-Based Rules

Configuring Advanced Settings for the User-Role-Based Policy Feature

Managing the Profiler

Profiler Task Summary

Starting and Stopping the Profiler (NSM Procedure)

Managing the Profiler Database (NSM Procedure)

Logging

Developing a Logging Strategy

Developing a Log Storage Strategy

Managing Security Policies

Managing Security Policies Task Summary

Assigning a Security Policy to a Device (NSM Procedure)

Validating a Security Policy (NSM Procedure)

Loading J-Security Center Updates (NSM Procedure)

Pushing Security Policy Updates to an IDP Series Device (NSM Procedure)

Disabling Rules (NSM Procedure)

Exporting Security Policies (NSM Procedure)

Managing the IDP Device Configuration with NSM

NSM Device Configuration Management Task Summary

Adding IDP Series Devices to NSM Device Manager

Activating Devices (NSM Procedure)

Pulling or Pushing Configuration Updates

Modifying the IDP Series Device Configuration

Deleting an IDP Series Device Configuration from NSM Device Manager (NSM Procedure)

Managing IDP Processes

Restarting the IDP Engine

Rebooting and Shutting Down the IDP Series Appliance

idp.sh Command Reference

Updating IDP Software

Upgrading Software (CLI Procedure)

Updating IDP OS Software (NSM Procedure)

Loading J-Security Center Updates (NSM Procedure)

Installing Traffic Interface I/O Modules
Installing an I/O Module

Enabling Bypass and Peer Port Modulation

Enabling Bypass and PPM During Configuration of Virtual Routers

Enabling the Flow Bypass Feature

Configuring the Management Interface
Changing the Management Interface IP Address

Overview

Supported Tools for Monitoring Tasks

Developing a Logging Strategy

Developing a Log Storage Strategy

Using SNMP

SNMP Statistic Reporting and Traps Task Summary

Configuring SNMP Reporting for the Interface Category of Statistics

Configuring SNMP Reporting for the Resource Category of Statistics

Configuring SNMP Reporting for the Rule Category of Statistics

Configuring SNMP Reporting for the Sensor Category of Statistics

Configuring SNMP Reporting for the Traffic Category of Statistics

Using NSM Logs and Reports

IDP Series Logs and Reports in NSM Task Summary

Viewing Device Status (NSM Procedure)

Viewing Simulation Mode Logs

Using Profiler Viewer (NSM Procedure)

Viewing NSM Predefined Reports (NSM Procedure)

Creating NSM Custom Reports (NSM Procedure)

Packet Logging

Example: Packet Logging Workflow

Using tcpdump to Capture Packets

Using jnetTcpdump to Capture Packets

Using the bypassStatus Utility to Monitor the Internal Bypass Daemon

bypassStatus Utility Task Summary

bypassStatus Command Reference

Using the sctop Utility to Monitor Session Flow

sctop Task Summary

Using the sctop Utility (CLI Procedure)

Understanding sctop Flow Table Reports

Using the scio Utility to Verify Feature Implementation

scio Monitoring Commands Task Summary

Verifying the APE Rulebase

Verifying Integration with an IC Series Unified Access Control Appliance

Verifying MPLS Decapsulation

Verifying the Flow Bypass Feature

scio Commands

scio agentconfig

scio app sig list

scio idp-cpu-utlization

scio napp sig list

IDP MIB Object ID Reference

IDP Series MIB Object ID Reference

Troubleshooting References

Troubleshooting Tools Overview

IDP Processes Reference

Troubleshooting NSM Log Collection Issues

Simulation Mode
Example: Using Simulation Mode to Maximize Uptime

Troubleshooting Feature Implementation

Tuning the JNET Driver Failure Count

Viewing Auto-Recovery Logs

Disabling the Auto-Recovery Feature

Tuning the Auto-Recovery Policy Reload Setting

Troubleshooting SNMP Statistic Reporting

Viewing CPU Utilization

Troubleshooting High CPU Usage

Troubleshooting Erroneous CPU Utilization Reports

Displaying Service Session Count

Troubleshooting Configuration Push Errors (NSM Procedure)

Troubleshooting Security Policy Validation Errors (NSM Procedure)

Troubleshooting Application Identification

Disabling the APE Rulebase

Disabling the User Role-Based Policy Feature

Disabling Support for Jumbo Frames

Troubleshooting SSL Inspection

Disabling SSL Inspection

Disabling MPLS Decapsulation

Downloads

Previous Page Next Page