Related Documentation
- J Series
- IDP Policies Overview
- Understanding IDP Policy Rulebases
- Understanding IDP Policy Rules
- SRX Series
- IDP Policies Overview
- Understanding IDP Policy Rulebases
- Understanding IDP Policy Rules
- IDP Application-Level DDoS Attack Overview
- IDP Application-Level DDoS Protection Overview
- Example: Enabling IDP Protection Against Application-Level DDoS Attacks
- Additional Information
- Junos OS Feature Support Reference for SRX Series and J Series Devices
Understanding IDP Application-Level DDoS Rulebases
The application-level DDoS rulebase defines parameters used to protect servers, such as DNS or HTTP, from application-level distributed denial-of-service (DDoS) attacks. You can set up custom application metrics based on normal server activity requests to determine when clients should be considered an attack client. The application-level DDoS rulebase is then used to defines the source match condition for traffic that should be monitored, then takes the defined action: close server, drop connection, drop packet, or no action. It can also perform an IP action: ip-block, ip-close, ip-notify, ip-connection-rate-limit, or timeout. Table 1 summarizes the options that you can configure in the application-level DDoS rulebase rules.
Table 1: Application-Level DDoS Rulebase Components
Term | Definition |
|---|---|
Match condition | Specify the network traffic you want the device to monitor for attacks. |
Action | Specify the actions you want Intrusion Detection and Prevention (IDP) to take when the monitored traffic matches the application-ddos objects specified in the application-level DDoS rule. |
IP Action | Enables you to implicitly block a source address to protect the network from future intrusions while permitting legitimate traffic. You can configure one of the following IP action options in application-level DDoS: ip-block, ip-close, ip-notify, and ip-connection-rate-limit. |
Related Documentation
- J Series
- IDP Policies Overview
- Understanding IDP Policy Rulebases
- Understanding IDP Policy Rules
- SRX Series
- IDP Policies Overview
- Understanding IDP Policy Rulebases
- Understanding IDP Policy Rules
- IDP Application-Level DDoS Attack Overview
- IDP Application-Level DDoS Protection Overview
- Example: Enabling IDP Protection Against Application-Level DDoS Attacks
- Additional Information
- Junos OS Feature Support Reference for SRX Series and J Series Devices
