idp (Security)
Syntax
idp {
active-policy policy-name;
custom-attack attack-name {
attack-type (Security IDP) {
anomaly {
direction (any | client-to-server | server-to-client);
service service-name;
shellcode (all | intel | no-shellcode | sparc);
test test-condition;
}
chain {
expression boolean-expression;
member member-name {
attack-type (Security IDP) {
(anomaly ...same statements as in [edit security idp custom-attack attack-name attack-type anomaly] hierarchy level | signature ...same statements as in [edit security idp custom-attack attack-name attack-type signature] hierarchy level);
}
}
order;
protocol-binding {
application application-name;
icmp;
icmpv6;
ip (Security IDP Custom Attack) {
protocol-number transport-layer-protocol-number;
}
ipv6 {
protocol-number transport-layer-protocol-number;
}
rpc {
program-number rpc-program-number;
}
tcp (Security IDP Signature Attack) {
minimum-port port-number <maximum-port port-number>;
}
udp (Security IDP Signature Attack) {
minimum-port port-number <maximum-port port-number>;
}
}
reset;
scope (session | transaction);
}
signature (Security IDP) {
context context-name;
direction (any | client-to-server | server-to-client);
negate;
pattern signature-pattern;
protocol (Security IDP Signature Attack) {
icmp {
code {
match (equal | greater-than | less-than | not-equal);
value code-value;
}
data-length {
match (equal | greater-than | less-than | not-equal);
value data-length;
}
identification {
match (equal | greater-than | less-than | not-equal);
value identification-value;
}
sequence-number {
match (equal | greater-than | less-than | not-equal);
value sequence-number;
}
type {
match (equal | greater-than | less-than | not-equal);
value type-value;
}
}
ipv4 {
destination {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
identification {
match (equal | greater-than | less-than | not-equal);
value identification-value;
}
ip-flags {
(df | no-df);
(mf | no-mf);
(rb | no-rb);
}
protocol {
match (equal | greater-than | less-than | not-equal);
value transport-layer-protocol-id;
}
source {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
tos {
match (equal | greater-than | less-than | not-equal);
value type-of-service-in-decimal;
}
total-length {
match (equal | greater-than | less-than | not-equal);
value total-length-of-ip-datagram;
}
ttl {
match (equal | greater-than | less-than | not-equal);
value time-to-live;
}
}
ipv6 {
destination {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
flow-label {
match (equal | greater-than | less-than | not-equal);
value flow-label-value;
}
hop-limit {
match (equal | greater-than | less-than | not-equal);
value hop-limit-value;
}
next-header {
match (equal | greater-than | less-than | not-equal);
value next-header-value;
}
payload-length {
match (equal | greater-than | less-than | not-equal);
value payload-length-value;
}
source {
match (equal | greater-than | less-than | not-equal);
value ip-address-or-hostname;
}
traffic-class {
match (equal | greater-than | less-than | not-equal);
value traffic-class-value;
}
tcp {
ack-number {
match (equal | greater-than | less-than | not-equal);
value acknowledgement-number;
}
data-length {
match (equal | greater-than | less-than | not-equal);
value tcp-data-length;
}
destination-port {
match (equal | greater-than | less-than | not-equal);
value destination-port;
}
header-length {
match (equal | greater-than | less-than | not-equal);
value header-length;
}
mss {
match (equal | greater-than | less-than | not-equal);
value maximum-segment-size;
}
option {
match (equal | greater-than | less-than | not-equal);
value tcp-option;
}
sequence-number {
match (equal | greater-than | less-than | not-equal);
value sequence-number;
}
source-port {
match (equal | greater-than | less-than | not-equal);
value source-port;
}
tcp-flags {
(ack | no-ack);
(fin | no-fin);
(psh | no-psh);
(r1 | no-r1);
(r2 | no-r2);
(rst | no-rst);
(syn | no-syn);
(urg | no-urg);
}
urgent-pointer {
match (equal | greater-than | less-than | not-equal);
value urgent-pointer;
}
window-scale {
match (equal | greater-than | less-than | not-equal);
value window-scale-factor;
}
window-size {
match (equal | greater-than | less-than | not-equal);
value window-size;
}
}
udp {
data-length {
match (equal | greater-than | less-than | not-equal);
value data-length;
}
destination-port {
match (equal | greater-than | less-than | not-equal);
value destination-port;
}
source-port {
match (equal | greater-than | less-than | not-equal);
value source-port;
}
}
}
protocol-binding {
application application-name;
icmp;
icmpv6;
ip {
protocol-number transport-layer-protocol-number;
}
ipv6 {
protocol-number transport-layer-protocol-number;
}
rpc {
program-number rpc-program-number;
}
tcp {
minimum-port port-number <maximum-port port-number>;
}
udp {
minimum-port port-number <maximum-port port-number>;
}
}
regexp regular-expression;
shellcode (all | intel | no-shellcode | sparc);
}
}
recommended-action (close | close-client | close-server | drop | drop-packet | ignore | none);
severity (critical | info | major | minor | warning);
time-binding {
count count-value;
scope (destination | peer | source);
}
}
custom-attack-group custom-attack-group-name {
group-members [attack-or-attack-group-name];
}
default-policy default-policy;
dynamic-attack-group dynamic-attack-group-name {
filters {
category {
values [category-value];
}
direction {
expression (and | or);
values [any client-to-server exclude-any exclude-client-to-server exclude-server-to-client server-to-client];
}
false-positives {
values [frequently occasionally rarely unknown];
}
performance {
values [fast normal slow unknown];
}
products {
values [product-value];
}
recommended;
service {
values [service-value];
}
severity {
values [critical info major minor warning];
}
type {
values [anomaly signature];
}
}
}
idp-policy (Security) policy-name {
rulebase-exempt {
rule rule-name {
description text;
match {
attacks {
custom-attack-groups [attack-group-name];
custom-attacks [attack-name];
dynamic-attack-groups [attack-group-name];
predefined-attack-groups [attack-group-name];
predefined-attacks [attack-name];
}
destination-address ([address-name] | any | any-ipv4 | any-ipv6);
destination-except [address-name];
from-zone (zone-name | any );
source-address ([address-name] | any | any-ipv4 | any-ipv6);
source-except [address-name];
to-zone (zone-name | any);
}
}
}
rulebase-ips {
rule rule-name {
description text;
match {
application (application-name | any | default);
attacks {
custom-attack-groups [attack-group-name];
custom-attacks [attack-name];
dynamic-attack-groups [attack-group-name];
predefined-attack-groups [attack-group-name];
predefined-attacks [attack-name];
}
destination-address ([address-name] | any | any-ipv4 | any-ipv6);
destination-except [address-name];
from-zone (zone-name | any );
source-address ([address-name] | any | any-ipv4 | any-ipv6);
source-except [address-name];
to-zone (zone-name | any);
}
terminal;
then {
action {
class-of-service {
dscp-code-point number;
forwarding-class forwarding-class;
}
(close-client | close-client-and-server | close-server |drop-connection | drop-packet | ignore-connection | mark-diffserv value | no-action | recommended);
}
ip-action {
(ip-block | ip-close | ip-notify);
log;
log-create;
refresh-timeout;
target (destination-address | service | source-address | source-zone | source-zone-address | zone-service);
timeout seconds;
}
notification {
log-attacks {
alert;
}
packet-log {
post-attack number;
post-attack-timeout seconds;
pre-attack number;
}
}
severity (critical | info | major | minor | warning);
}
}
}
}
security-package {
automatic {
download-timeout minutes;
enable;
interval hours;
start-time start-time;
}
install {
ignore-version-check;
ignore-appid-failure;
}
proxy-profile proxy-profile;
source-address address;
url url-name;
}
sensor-configuration {
application-identification {
max-packet-memory value;
max-tcp-session-packet-memory value;
max-udp-session-packet-memory value;
}
detector {
protocol-name protocol-name {
tunable-name tunable-name {
tunable-value protocol-value;
}
}
}
flow (Security IDP) {
(allow-icmp-without-flow | no-allow-icmp-without-flow);
fifo-max-size value;
hash-table-size value;
(log-errors | no-log-errors);
max-session-offset value;
max-timers-poll-ticks value;
reject-timeout value;
(reset-on-policy | no-reset-on-policy);
udp-anticipated-timeout value;
}
global (Security IDP) {
(enable-all-qmodules | no-enable-all-qmodules);
(enable-packet-pool | no-enable-packet-pool);
gtp (decapsulation | no-decapsulation);
memory-limit-percent value;
(policy-lookup-cache | no-policy-lookup-cache);
}
high-availability (Security IDP) {
no-policy-cold-synchronization;
}
ips {
content-decompression-max-memory-kb value;
content-decompression-max-ratio value;
(detect-shellcode | no-detect-shellcode);
fifo-max-size value;
(ignore-regular-expression | no-ignore-regular-expression);
log-supercede-min minimum-value;
pre-filter-shellcode;
(process-ignore-s2c | no-process-ignore-s2c);
(process-override | no-process-override);
process-port port-number;
}
log (Security IDP Sensor Configuration) {
cache-size size;
suppression {
disable;
(include-destination-address | no-include-destination-address);
max-logs-operate value;
max-time-report value;
start-log value;
}
}
packet-log (Security IDP Sensor Configuration) {
host ip-address <port number>;
max-sessions percentage;
source-address ip-address;
total-memory percentage;
}
re-assembler {
action-on-reassembly-failure (drop | drop-session | ignore);
(force-tcp-window-checks | no-force-tcp-window-checks);
(ignore-memory-overflow | no-ignore-memory-overflow);
(ignore-reassembly-memory-overflow | no-ignore-reassembly-memory-overflow);
ignore-reassembly-overflow;
max-flow-mem value;
max-packet-mem value;
(tcp-error-logging | no-tcp-error-logging);
}
ssl-inspection {
cache-prune-chunk-size number;
key-protection;
maximum-cache-size number;
session-id-cache-timeout seconds;
sessions number;
}
}
traceoptions {
file {
filename;
files number;
match regular-expression;
size maximum-file-size;
(world-readable | no-world-readable);
}
flag all;
level (all | error | info | notice | verbose | warning);
no-remote-trace;
}
}
Hierarchy Level
[edit security]
Description
CAUTION:
Enabling tracing can adversely impact scale and performance and may increase security risk. We strongly recommend using the trace, tracing, or traceoptions commands only under the guidance of a JTAC support engineer. After collecting the debug information, immediately disable tracing to minimize risk and restore normal system performance.
Configure Intrusion Detection and Prevention (IDP) to selectively enforce various IDP attack detection and prevention techniques on the network.
Options
The remaining statements are explained separately. See CLI Explorer.
Required Privilege Level
security—To view this statement in the configuration.
security-control—To add this statement to the configuration.
Release Information
Statement modified in Junos OS Release
9.3. The expression option added in Junos OS Release 11.4.
Starting in Junos OS Release 18.3R1, when an SRX Series Firewall is configured with unified policies, you can configure multiple IDP policies and set one of those policies as the default IDP policy. If multiple IDP policies are configured for a session and when policy conflict occurs, the device applies the default IDP policy for that session and thus resolves any policy conflicts.
Note:
If you have configured two or more IDP policies in a unified security policy, then you must configure the default IDP policy.