idp (Security)
構文
idp {
active-policy policy-name;
custom-attack attack-name {
attack-type (Security IDP) {
anomaly {
direction (any | client-to-server | server-to-client);
service service-name;
shellcode (all | intel | no-shellcode | sparc);
test test-condition;
}
chain {
expression boolean-expression;
member member-name {
attack-type (Security IDP) {
(anomaly ...same statements as in [edit security idp custom-attack attack-name attack-type anomaly] hierarchy level | signature ...same statements as in [edit security idp custom-attack attack-name attack-type signature] hierarchy level);
}
}
order;
protocol-binding {
application application-name;
icmp;
icmpv6;
ip (Security IDP Custom Attack) {
protocol-number transport-layer-protocol-number;
}
ipv6 {
protocol-number transport-layer-protocol-number;
}
rpc {
program-number rpc-program-number;
}
tcp (Security IDP Signature Attack) {
minimum-port port-number <maximum-port port-number>;
}
udp (Security IDP Signature Attack) {
minimum-port port-number <maximum-port port-number>;
}
}
reset;
scope (session | transaction);
}
signature (Security IDP) {
context context-name;
direction (any | client-to-server | server-to-client);
negate;
pattern signature-pattern;
protocol (Security IDP Signature Attack) {
icmp {
code {
match (equal | greater-than | less-than | not-equal);
value code-value;
}
data-length {
match (equal | greater-than | less-than | not-equal);
value data-length;
}
identification {
match (equal | greater-than | less-than | not-equal);
value identification-value;
}
sequence-number {
match (equal | greater-than | less-than | not-equal);
value sequence-number;
}
type {
match (equal | greater-than | less-than | not-equal);
value type-value;
}
}
ipv4 {
destination {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
identification {
match (equal | greater-than | less-than | not-equal);
value identification-value;
}
ip-flags {
(df | no-df);
(mf | no-mf);
(rb | no-rb);
}
protocol {
match (equal | greater-than | less-than | not-equal);
value transport-layer-protocol-id;
}
source {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
tos {
match (equal | greater-than | less-than | not-equal);
value type-of-service-in-decimal;
}
total-length {
match (equal | greater-than | less-than | not-equal);
value total-length-of-ip-datagram;
}
ttl {
match (equal | greater-than | less-than | not-equal);
value time-to-live;
}
}
ipv6 {
destination {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
flow-label {
match (equal | greater-than | less-than | not-equal);
value flow-label-value;
}
hop-limit {
match (equal | greater-than | less-than | not-equal);
value hop-limit-value;
}
next-header {
match (equal | greater-than | less-than | not-equal);
value next-header-value;
}
payload-length {
match (equal | greater-than | less-than | not-equal);
value payload-length-value;
}
source {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
traffic-class {
match (equal | greater-than | less-than | not-equal);
value traffic-class-value;
}
tcp {
ack-number {
match (equal | greater-than | less-than | not-equal);
value acknowledgement-number;
}
data-length {
match (equal | greater-than | less-than | not-equal);
value tcp-data-length;
}
destination-port {
match (equal | greater-than | less-than | not-equal);
value destination-port;
}
header-length {
match (equal | greater-than | less-than | not-equal);
value header-length;
}
mss {
match (equal | greater-than | less-than | not-equal);
value maximum-segment-size;
}
option {
match (equal | greater-than | less-than | not-equal);
value tcp-option;
}
sequence-number {
match (equal | greater-than | less-than | not-equal);
value sequence-number;
}
source-port {
match (equal | greater-than | less-than | not-equal);
value source-port;
}
tcp-flags {
(ack | no-ack);
(fin | no-fin);
(psh | no-psh);
(r1 | no-r1);
(r2 | no-r2);
(rst | no-rst);
(syn | no-syn);
(urg | no-urg);
}
urgent-pointer {
match (equal | greater-than | less-than | not-equal);
value urgent-pointer;
}
window-scale {
match (equal | greater-than | less-than | not-equal);
value window-scale-factor;
}
window-size {
match (equal | greater-than | less-than | not-equal);
value window-size;
}
}
udp {
data-length {
match (equal | greater-than | less-than | not-equal);
value data-length;
}
destination-port {
match (equal | greater-than | less-than | not-equal);
value destination-port;
}
source-port {
match (equal | greater-than | less-than | not-equal);
value source-port;
}
}
}
protocol-binding {
application application-name;
icmp;
icmpv6;
ip {
protocol-number transport-layer-protocol-number;
}
ipv6 {
protocol-number transport-layer-protocol-number;
}
rpc {
program-number rpc-program-number;
}
tcp {
minimum-port port-number <maximum-port port-number>;
}
udp {
minimum-port port-number <maximum-port port-number>;
}
}
regexp regular-expression;
shellcode (all | intel | no-shellcode | sparc);
}
}
recommended-action (close | close-client | close-server | drop | drop-packet | ignore | none);
severity (critical | info | major | minor | warning);
time-binding {
count count-value;
scope (destination | peer | source);
}
}
custom-attack-group custom-attack-group-name {
group-members [attack-or-attack-group-name];
}
default-policy default-policy;
dynamic-attack-group dynamic-attack-group-name {
filters {
category {
values [category-value];
}
direction {
expression (and | or);
values [any client-to-server exclude-any exclude-client-to-server exclude-server-to-client server-to-client];
}
false-positives {
values [frequently occasionally rarely unknown];
}
performance {
values [fast normal slow unknown];
}
products {
values [product-value];
}
recommended;
service {
values [service-value];
}
severity {
values [critical info major minor warning];
}
type {
values [anomaly signature];
}
}
}
idp-policy (Security) policy-name {
rulebase-exempt {
rule rule-name {
description text;
match {
attacks {
custom-attack-groups [attack-group-name];
custom-attacks [attack-name];
dynamic-attack-groups [attack-group-name];
predefined-attack-groups [attack-group-name];
predefined-attacks [attack-name];
}
destination-address ([address-name] | any | any-ipv4 | any-ipv6);
destination-except [address-name];
from-zone (zone-name | any );
source-address ([address-name] | any | any-ipv4 | any-ipv6);
source-except [address-name];
to-zone (zone-name | any);
}
}
}
rulebase-ips {
rule rule-name {
description text;
match {
application (application-name | any | default);
attacks {
custom-attack-groups [attack-group-name];
custom-attacks [attack-name];
dynamic-attack-groups [attack-group-name];
predefined-attack-groups [attack-group-name];
predefined-attacks [attack-name];
}
destination-address ([address-name] | any | any-ipv4 | any-ipv6);
destination-except [address-name];
from-zone (zone-name | any );
source-address ([address-name] | any | any-ipv4 | any-ipv6);
source-except [address-name];
to-zone (zone-name | any);
}
terminal;
then {
action {
class-of-service {
dscp-code-point number;
forwarding-class forwarding-class;
}
(close-client | close-client-and-server | close-server |drop-connection | drop-packet | ignore-connection | mark-diffserv value | no-action | recommended);
}
ip-action {
(ip-block | ip-close | ip-notify);
log;
log-create;
refresh-timeout;
target (destination-address | service | source-address | source-zone | source-zone-address | zone-service);
timeout seconds;
}
notification {
log-attacks {
alert;
}
packet-log {
post-attack number;
post-attack-timeout seconds;
pre-attack number;
}
}
severity (critical | info | major | minor | warning);
}
}
}
}
security-package {
automatic {
download-timeout minutes;
enable;
interval hours;
start-time start-time;
}
install {
ignore-version-check;
ignore-appid-failure;
}
proxy-profile proxy-profile;
source-address address;
url url-name;
}
sensor-configuration {
application-identification {
max-packet-memory value;
max-tcp-session-packet-memory value;
max-udp-session-packet-memory value;
}
detector {
protocol-name protocol-name {
tunable-name tunable-name {
tunable-value protocol-value;
}
}
}
flow (Security IDP) {
(allow-icmp-without-flow | no-allow-icmp-without-flow);
fifo-max-size value;
hash-table-size value;
(log-errors | no-log-errors);
max-session-offset value;
max-timers-poll-ticks value;
reject-timeout value;
(reset-on-policy | no-reset-on-policy);
udp-anticipated-timeout value;
}
global (Security IDP) {
(enable-all-qmodules | no-enable-all-qmodules);
(enable-packet-pool | no-enable-packet-pool);
gtp (decapsulation | no-decapsulation);
memory-limit-percent value;
(policy-lookup-cache | no-policy-lookup-cache);
}
high-availability (Security IDP) {
no-policy-cold-synchronization;
}
ips {
content-decompression-max-memory-kb value;
content-decompression-max-ratio value;
(detect-shellcode | no-detect-shellcode);
fifo-max-size value;
(ignore-regular-expression | no-ignore-regular-expression);
log-supercede-min minimum-value;
pre-filter-shellcode;
(process-ignore-s2c | no-process-ignore-s2c);
(process-override | no-process-override);
process-port port-number;
}
log (Security IDP Sensor Configuration) {
cache-size size;
suppression {
disable;
(include-destination-address | no-include-destination-address);
max-logs-operate value;
max-time-report value;
start-log value;
}
}
packet-log (Security IDP Sensor Configuration) {
host ip-address <port number>;
max-sessions percentage;
source-address ip-address;
total-memory percentage;
}
re-assembler {
action-on-reassembly-failure (drop | drop-session | ignore);
(force-tcp-window-checks | no-force-tcp-window-checks);
(ignore-memory-overflow | no-ignore-memory-overflow);
(ignore-reassembly-memory-overflow | no-ignore-reassembly-memory-overflow);
ignore-reassembly-overflow;
max-flow-mem value;
max-packet-mem value;
(tcp-error-logging | no-tcp-error-logging);
}
ssl-inspection {
cache-prune-chunk-size number;
key-protection;
maximum-cache-size number;
session-id-cache-timeout seconds;
sessions number;
}
}
traceoptions {
file {
filename;
files number;
match regular-expression;
size maximum-file-size;
(world-readable | no-world-readable);
}
flag all;
level (all | error | info | notice | verbose | warning);
no-remote-trace;
}
}
階層レベル
[edit security]
説明
侵入検出および防止(IDP)を設定して、ネットワーク上でさまざまなIDP攻撃検出および防止技術を選択的に適用します。
オプション
残りのステートメントについては、個別に説明します。 CLIエクスプローラを参照してください。
必要な権限レベル
セキュリティ—設定でこのステートメントを表示します。
セキュリティ管理ー設定にこのステートメントを追加します。
リリース情報
Junos OS リリース 9.3 で修正されたステートメント。 expression Junos OSリリース11.4で追加されたオプション。
Junos OSリリース18.3R1以降、SRXシリーズファイアウォールが統合ポリシーで構成されている場合、複数のIDPポリシーを設定し、そのうちの1つをデフォルトのIDPポリシーとして設定できます。セッションに複数のIDPポリシーが設定されていて、ポリシーの競合が発生した場合、デバイスはそのセッションにデフォルトのIDPポリシーを適用し、ポリシーの競合を解決します。
メモ：
統合セキュリティポリシーで2つ以上のIDPポリシーを設定した場合は、デフォルトのIDPポリシーを設定する必要があります。