IDP Basic Configuration

This topic provides details enabling IDP on SRX Series Firewalls. Key steps include obtaining licenses, downloading signature updates, and applying predefined policies. It also highlights integrating IDP with security policies for effective traffic inspection and threat prevention.

Juniper Networks periodically provides a file containing attack database updates on website. You can download this file to protect your network from new threats. The security package, which you can download from Juniper Networks, also includes IDP policy templates to help you implement IDP policy on SRX Firewalls.

The procedures in this topic show you how to download and configure initial IDP functionality on your firewall.

Ensure to perform the following steps before you configure IDP functionality on an SRX Series Firewall:

Download and Install the licenses.
Verify the network access to your firewall.
Download and install IDP signature package (also referred as security package or attack objects).
Download policy templates (optional).
Configure recommended policy as the IDP policy (optional).
Enable IDP inspection in a security policy.

Download and Install IDP Licenses

Juniper Networks maintain a database of attack signatures for use with the IDP feature. You need a valid license to retrieve updates for downloading and installing daily signature database updates provided by Juniper Networks. The IDP signature license key does not provide grace period support.

For license details, see Junos OS Feature License Keys.

Verify Network Access

You must connect the SRX Series Firewalls to the Internet to update a device directly.

Use the following operational mode command to check the server connection from SRX Series Firewalls.

This command verifies network connectivity and provides the remote database version. Comparing this version with the previous command output is useful for identifying differences.

Download IDP Signature Package

You can download the Juniper Networks security package manually or automatically at specified time intervals. The following steps illustrate the operational mode commands to download the security package and check the status of the download.

Download the security package.
Downloading the database might take some time depending on the database size and the speed of your Internet connection.

Check the security package download status.

Install IDP Signature Package

Once you complete the download of IDP signature package, you must install the IDP signature package before they are actually used in a policy. If you already have a policy configured, you do not need to recommit the policy—installing the updates adds them to the existing policy.

Install the security package.

Installing the attack database might take some time depending on the security package size.

Check the attack database install status.

The command output displays information about the downloaded and installed versions of the attack database.

The system displays following message if no active IDP policies are configured on the devices.

IDP Policy Templates

The IDP signature package download includes various policy templates. After you install the templates, you can use the predefined template policies, or you can customize them for your network environment.

Use the following steps to download and install the latest policy templates provided by Juniper Networks.

Download the predefined IDP policy templates.

Check the security package download status.

Install the IDP policy templates.

Verify the installation status update.

Apply the Recommended IDP Policy

The Junos OS downloads the policy templates in the form of a commit script. Once you download and install the policy templates, you must activate the template commit script with the configuration mode commands with the following steps:

Enable the templates.xsl scripts file.
The downloaded templates are saved to the Junos OS configuration database, and they are available in the CLI at the [edit security idp idp-policy] hierarchy level.
You must commit the configuration to activate a commit script.

Display the list of downloaded templates.

Activate the predefined policy as the active policy. In this example, you use Recommended policy as active policy.
The IDP signature database offers templates for various network scenarios. See Predefined IDP Policy Templates.

Confirm the active policy enabled on your device.

Deactivate the Commit Script File

We recommend you to delete or deactivate the commit script file. By deleting or deactivating the commit script file, you can avoid the risk of overwriting modifications to the predefined policies (created using the templates) when you commit the configuration.

Use the following command to delete or deactivate the commit script file:

Enable IDP in a Security Policy

The final step to activate the recommended IDP policy is to apply the IDP action to a security policy.

Enable the security policy for IDP inspection.

Commit the changes once you are done with configuration.

Verify the IDP configuration in security policy using the

show security
              policies policy-name idp-policy-1 detail

command.

The sample output confirms that you have enabled IDP for the security policy.

You can proceed with configuring other IDP policies. See Example: Configuring Multiple IDP Policies and a Default IDP Policy for Unified Security Policies.

ON THIS PAGE