Using Guided Setup for Juniper ATP Cloud
Guided Setup is the most efficient way to complete your initial configuration. Locate Guided Setup from the Configuration > Guided Setup > Threat Prevention menu.
The ATP Cloud Configuration type you select on the Policy Enforcer Settings page determines the guided setup process. Guided setup provides all the configuration items you need for your chosen type. See Juniper ATP Cloud Configuration Type Overview for details on each configuration type.
Before you begin the guided setup process, you must enter the IP address and login credentials for the policy enforcer virtual machine on the Policy Enforcer Settings page. If you haven’t yet done that, go to Administration > Policy Enforcer > Settings and enter the necessary information. See Policy Enforcer Settings for more information.
Juniper ATP Cloud license and account are needed for all Juniper ATP Cloud Configuration Types. (Juniper ATP Cloud with Juniper Connected Security, Juniper ATP Cloud, and Cloud Feeds only). If you do not have a Juniper ATP Cloud license, contact your local sales office or Juniper Networks partner to place an order for a Juniper ATP Cloud premium or basic license. If you do not have a Juniper ATP Cloud account, when you configure Juniper ATP Cloud, you are redirected to the Juniper ATP Cloud server to create one. Please obtain a license before you try to create a Juniper ATP Cloud account. Refer to Obtaining a Juniper ATP Cloud License for instructions on obtaining a Juniper ATP Cloud license.
There are some concepts you should understand before you begin the configuration. Read Juniper ATP Cloud Overview for further information.
Click Start Setup from Configuration > Guided Setup > Threat Prevention to begin.
- Add ATP Cloud Realm—If you have not created
a realm from within your Juniper ATP Cloud account, you can create
it here by clicking the + sign. Once you add a realm, you
can enroll SRX Series devices into the realm. A security realm is
a group identifier for an organization used to restrict access to
Web applications. You can create one or multiple realms. See Juniper ATP Cloud Realm Overview for information.
A realm has the following configuration fields
Username and Password—These are credentials you must provide, obtained through your Juniper ATP Cloud account.
Realm—This is the name of the realm you are creating.
- Click Add devices to enroll them in threat prevention before proceeding to the next step. Devices designated as perimeter firewalls are automatically enrolled with Juniper ATP Cloud.
- Create a Policy—You create a name for
the policy, choose one or more profile types depending on the type
of threat prevention this policy provides (C&C Server, Infected
Host, Malware), and select a log setting.
Once configured, threat prevention policies are located under Configure > Threat Prevention > Policies. A policy has the following fields:
Name and Description.
Profiles—The type of threat this policy manages:
C&C Server (Command and Control Server)—A C&C server is a centralized computer that issues commands to botnets (compromised networks of computers) and receives reports back from them. A C&C profile provides information on C&C servers that have attempted to contact and compromise hosts on your network. Information such as IP address, threat level, and country of origin are gathered.
Infected Host—An infected host profile provides information on compromised hosts and their associated threat levels. Host information includes IP address, threat level, blocked status, when the threat was seen, command and control hits, and malware detections.
Malware—A malware profile provides information on files downloaded by hosts and found to be suspicious based on known signatures or URLs. The filename, file type, signature, date and time of download, download host, URL, and file verdict are gathered.
Logging—All traffic is logged by default. Use the pulldown to narrow the types of traffic to be logged.
- Geo IP—Geo IP refers to the method of
locating a computer terminal's geographic location by identifying
that terminal's IP address. A Geo IP feed is an up-to-date mapping
of IP addresses to geographical regions. By mapping IP address to
the sources of attack traffic, geographic regions of origin can be
determined, giving you the ability to filter traffic to and from specific
locations in the world. For Geo IP, you configure the following:
Name and Description
Countries—Select the check box beside the countries in the Available list and click the > icon to move them to the Selected list. The countries in the Selected list will be included in the policy and action will be taken according to their threat level.
Block Traffic—Choose what traffic to block from the selected countries. Incoming traffic, Outgoing traffic, or Incoming and Outgoing traffic.
- The last page is a summary of the items you have configured. Click OK to be taken to the Policies page under Configure > Threat Prevention, and your policy is listed there.
When you are using Juniper ATP Cloud without Policy Enforcer, you must assign the policy to a firewall rule before it can take affect. Navigate to Configure > Firewall Policy > Policies. In the Advanced Security column, click an existing item to access the Edit Advanced Security page and select the Threat Prevention Policy from the Threat Prevention pulldown list.