Monitoring Security Policies

Destination Address

Specifies the destination address of the route.

Enter the destination address.

Protocol

Specifies the protocol from which the route was learned.

Enter the protocol name.

Next hop address

Specifies the network layer address of the directly reachable neighboring system (if applicable) and the interface used to reach it.

Enter the next hop address.

Receive protocol

Specifies the dynamic routing protocol using which the routing information was received through a particular neighbor.

Enter the routing protocol.

Best route

Specifies only the best route available.

Select the view details of the best route.

Inactive routes

Specifies the inactive routes.

Select the view details of inactive routes.

Exact route

Specifies the exact route.

Select the view details of the exact route.

Hidden routes

Specifies the hidden routes.

Select the view details of hidden routes.

Search

Applies the specified filter and displays the matching messages.

To apply the filter and display messages, click Search.

Reset

Resets selected options to default

To reset the filter, click Reset.

Static Route Addresses

The list of static route addresses.

–

Protocol

Protocol from which the route was learned: Static, Direct, Local, or the name of a particular protocol.

–

Preference

The preference is the individual preference value for the route.

The route preference is used as one of the route selection criteria.

Next-Hop

Network Layer address of the directly reachable neighboring system (if applicable) and the interface used to reach it.

If a next hop is listed as Discard, all traffic with that destination address is discarded rather than routed. This value generally means that the route is a static route for which the discard attribute has been set.

If a next hop is listed as Reject, all traffic with that destination address is rejected. This value generally means that the address is unreachable. For example, if the address is a configured interface address and the interface is unavailable, traffic bound for that address is rejected.

If a next hop is listed as Local, the destination is an address on the host (either the loopback address or Ethernet management port 0 address, for example).

Age

How long the route has been active.

–

State

Flags for this route.

There are many possible flags.

AS Path

AS path through which the route was learned. The letters of the AS path indicate the path origin:

• I—IGP.

• E—EGP.

• ?—Incomplete. Typically, the AS path was aggregated.

–

Protocol Name

The RIP protocol name.

–

Port number

The port on which RIP is enabled.

–

Hold down time

The interval during which routes are neither advertised nor updated.

–

Global routes learned

Number of RIP routes learned on the logical interface.

–

Global routes held down

Number of RIP routes that are not advertised or updated during the hold-down interval.

–

Global request dropped

Number of requests dropped.

–

Global responses dropped

Number of responses dropped.

–

Details

Tab used to view the details of the interface on which RIP is enabled.

–

Neighbor

Name of the RIP neighbor.

This value is the name of the interface on which RIP is enabled. Click the name to see the details for this neighbor.

State

State of the RIP connection: Up or Dn (Down).

–

Source Address

Local source address.

This value is the configured address of the interface on which RIP is enabled.

Destination Address

Destination address.

This value is the configured address of the immediate RIP adjacency.

Send Mode

The mode of sending RIP messages.

–

Receive Mode

The mode in which messages are received.

–

In Metric

Value of the incoming metric configured for the RIP neighbor.

–

Details

Tab used to view the details of the selected OSPF.

–

Interface

Name of the interface running OSPF.

–

State

State of the interface: BDR, Down, DR, DRother, Loop, PtToPt, or Waiting.

The Down state, indicating that the interface is not functioning, and PtToPt state, indicating that a point-to-point connection has been established, are the most common states.

Area

Number of the area that the interface is in.

–

DR ID

ID of the area's designated device.

–

BDR ID

ID of the area's backup designated device.

–

Neighbors

Number of neighbors on this interface.

–

Sent

Displays the total number of packets sent.

–

Received

Displays the total number of packets received.

–

Flood Queue Depth

Number of entries in the extended queue.

–

Total Retransmits

Number of retransmission entries enqueued.

–

Total Database Summaries

Total number of database description packets.

–

Address

Address of the neighbor.

–

Interface

Interface through which the neighbor is reachable.

–

State

State of the neighbor: Attempt, Down, Exchange, ExStart, Full, Init, Loading, or 2way.

Generally, only the Down state, indicating a failed OSPF adjacency, and the Full state, indicating a functional adjacency, are maintained for more than a few seconds. The other states are transitional states that a neighbor is in only briefly while an OSPF adjacency is being established.

ID

ID of the neighbor.

–

Priority

Priority of the neighbor to become the designated router.

–

Activity Time

The activity time.

–

Area

Area that the neighbor is in.

–

Options

Option bits received in the hello packets from the neighbor.

–

DR Address

Address of the designated router.

–

BDR Address

Address of the backup designated router.

–

Uptime

Length of time since the neighbor came up.

–

Adjacency

Length of time since the adjacency with the neighbor was established.

–

Total Groups

Number of BGP groups.

–

Total Peers

Number of BGP peers.

–

Down Peers

Number of unavailable BGP peers.

–

Unconfigured Peers

Address of each BGP peer.

–

RIB Name

Name of the RIB group.

–

Total Prefixes

Total number of prefixes from the peer, both active and inactive, that are in the routing table.

–

Active Prefixes

Number of prefixes received from the EBGP peers that are active in the routing table.

–

Suppressed Prefixes

Number of routes received from EBGP peers currently inactive because of damping or other reasons.

–

History Prefixes

History of the routes received or suppressed.

–

Dumped Prefixes

Number of routes currently inactive because of damping or other reasons. These routes do not appear in the forwarding table and are not exported by routing protocols.

–

Pending Prefixes

Number of pending routes.

–

State

Status of the graceful restart process for this routing table: BGP restart is complete, BGP restart in progress, VPN restart in progress, or VPN restart is complete.

–

Details

Click this button to view the selected BGP neighbor details.

–

Peer Address

Address of the BGP neighbor.

–

Autonomous System

AS number of the peer.

–

Peer State

Current state of the BGP session:

• Active—BGP is initiating a TCP connection in an attempt to connect to a peer. If the connection is successful, BGP sends an open message.

• Connect—BGP is waiting for the TCP connection to become complete.

• Established—The BGP session has been established, and the peers are exchanging BGP update messages.

• Idle—This is the first stage of a connection. BGP is waiting for a Start event.

• OpenConfirm—BGP has acknowledged receipt of an open message from the peer and is waiting to receive a keepalive or notification message.

• OpenSent—BGP has sent an open message and is waiting to receive an open message from the peer.

Generally, the most common states are Active, which indicates a problem establishing the BGP connection, and Established, which indicates a successful session setup. The other states are transition states, and BGP sessions normally do not stay in those states for extended periods of time.

Elapsed Time

Elapsed time since the peering session was last reset.

–

Description

Description of the BGP session.

–

Zone Context (Total #)

Displays a list of all from and to zone combinations for the configured policies. The total number of active policies for each context is specified in the Total # field. By default, the policies from the first Zone Context are displayed.

To display policies for a different context, select a zone context and click Filter. Both inactive and active policies appear for each context. However, the Total # field for a context specifies the number of active policies only.

Default Policy action

Specifies the action to take for traffic that does not match any of the policies in the context:

• permit-all—Permit all traffic that does not match a policy.

• deny-all—Deny all traffic that does not match a policy.

–

From Zone

Displays the source zone to be used as match criteria for the policy.

–

To Zone

Displays the destination zone to be used as match criteria for the policy.

–

Name

Displays the name of the policy.

–

Source Address

Displays the source addresses to be used as match criteria for the policy. Address sets are resolved to their individual names. (In this case, only the names are given, not the IP addresses).

–

Destination Address

Displays the destination addresses (or address sets) to be used as match criteria for the policy. Addresses are entered as specified in the destination zone’s address book.

–

Source Identity

Displays the name of the source identities set for the policy.

To display the value of the source identities, hover the mouse on this field. Unknown source identities are also displayed.

Application

Displays the name of a predefined or custom application signature to be used as match criteria for the policy.

–

Dynamic App

Displays the dynamic application signatures to be used as match criteria if an application firewall rule set is configured for the policy.

For a network firewall, a dynamic application is not defined.

The rule set appears in two lines. The first line displays the configured dynamic application signatures in the rule set. The second line displays the default dynamic application signature.

If more than two dynamic application signatures are specified for the rule set, hover over the output field to display the full list in a tooltip.

Action

Displays the action portion of the rule set if an application firewall rule set is configured for the policy.

• permit—Permits access to the network services controlled by the policy. A green background signifies permission.

• deny—Denies access to the network services controlled by the policy. A red background signifies denial.

The action portion of the rule set appears in two lines. The first line identifies the action to be taken when the traffic matches a dynamic application signature. The second line displays the default action when traffic does not match a dynamic application signature.

NW Services

Displays the network services permitted or denied by the policy if an application firewall rule set is configured. Network services include:

• gprs-gtp-profile—Specify a GPRS Tunneling Protocol profile name.

• idp—Perform intrusion detection and prevention.

• redirect-wx—Set WX redirection.

• reverse-redirect-wx—Set WX reverse redirection.

• uac-policy—Enable unified access control enforcement of the policy.

–

Policy Hit Counters Graph

Provides a representation of the value over time for a specified counter. The graph is blank if Policy Counters indicates no data. As a selected counter accumulates data, the graph is updated at each refresh interval.

To toggle a graph on and off, click the counter name below the graph.

Policy Counters

Lists statistical counters for the selected policy if Count is enabled. The following counters are available for each policy:

• input-bytes

• input-byte-rate

• output-bytes

• output-byte-rate

• input-packets

• input-packet-rate

• output-packets

• output-packet-rate

• session-creations

• session-creation-rate

• active-sessions

To graph or to remove a counter from the Policy Hit Counters Graph, toggle the counter name. The names of enabled counters appear below the graph.

From Zone

Name or ID of the source zone. If a From Zone is specified by name, the name is translated to its ID internally.

To Zone

Name or ID of the destination zone. If a To Zone is specified by name, the name is translated to its ID internally.

Source Address

Address of the source in IP notation.

Source Port

Port number of the source.

Destination Address

Address of the destination in IP notation.

Destination Port

Port number of the destination.

Source Identity

Name of the source identity.

Protocol

Name or equivalent value of the protocol to be matched.

Result Count

(Optional) Number of policies to display. Default value is 1. Maximum value is 16.

From Zone

Name of the source zone.

To Zone

Name of the destination zone.

Total Policies

Number of policies retrieved.

Default Policy action

The action to be taken if no match occurs.

Name

Policy name

Source Address

Name of the source address (not the IP address) of a policy. Address sets are resolved to their individual names.

Destination Address

Name of the destination address or address set. A packet’s destination address must match this value for the policy to apply to it.

Source Identity

Name of the source identity for the policy.

Application

Name of a preconfigured or custom application of the policy match.

Action

Action taken when a match occurs as specified in the policy.

Hit Counts

Number of matches for this policy. This value is the same as the Policy Lookups in a policy statistics report.

Active Sessions

Number of active sessions matching this policy.

ICMP Flood

Internet Control Message Protocol (ICMP) flood counter.

An ICMP flood typically occurs when ICMP echo requests use all resources in responding, such that valid network traffic can no longer be processed.

UDP Flood

User Datagram Protocol (UDP) flood counter.

UDP flooding occurs when an attacker sends IP packets containing UDP datagrams with the purpose of slowing down the resources, such that valid connections can no longer be handled.

TCP Winnuke

Number of Transport Control Protocol (TCP) WinNuke attacks.

WinNuke is a denial-of-service (DoS) attack targeting any computer on the Internet running Windows.

TCP Port Scan

Number of TCP port scans.

The purpose of this attack is to scan the available services in the hopes that at least one port will respond, thus identifying a service to target.

ICMP Address Sweep

Number of ICMP address sweeps.

An IP address sweep can occur with the intent of triggering responses from active hosts.

IP Tear Drop

Number of teardrop attacks.

Teardrop attacks exploit the reassembly of fragmented IP packets.

TCP SYN Attack

Number of TCP SYN attacks.

–

IP Spoofing

Number of IP spoofs.

IP spoofing occurs when an invalid source address is inserted in the packet header to make the packet appear to come from a trusted source.

ICMP Ping of Death

ICMP ping of death counter.

Ping of death occurs when IP packets are sent that exceed the maximum legal length (65,535 bytes).

IP Source Route

Number of IP source route attacks.

–

TCP Land Attack

Number of land attacks.

Land attacks occur when attacker sends spoofed SYN packets containing the IP address of the victim as both the destination and source IP address.

TCP SYN Fragment

Number of TCP SYN fragments.

–

TCP No Flag

Number of TCP headers without flags set.

A normal TCP segment header has at least one control flag set.

IP Unknown Protocol

Number of unknown Internet protocols.

–

IP Bad Options

Number of invalid options.

–

IP Record Route Option

Number of packets with the IP record route option enabled.

This option records the IP addresses of the network devices along the path that the IP packet travels.

IP Timestamp Option

Number of IP timestamp option attacks.

This option records the time (in Universal Time) when each network device receives the packet during its trip from the point of origin to its destination.

IP Security Option

Number of IP security option attacks.

–

IP Loose route Option

Number of IP loose route option attacks.

This option specifies a partial route list for a packet to take on its journey from source to destination.

IP Strict Source Route Option

Number of IP strict source route option attacks.

This option specifies the complete route list for a packet to take on its journey from source to destination.

IP Stream Option

Number of stream option attacks.

This option provides a way for the 16-bit SATNET stream identifier to be carried through networks that do not support streams.

ICMP Fragment

Number of ICMP fragments.

Because ICMP packets contain very short messages, there is no legitimate reason for ICMP packets to be fragmented. If an ICMP packet is so large that it must be fragmented, something is amiss.

ICMP Large Packet

Number of large ICMP packets.

–

TCP SYN FIN Packet

Number of TCP SYN FIN packets.

–

TCP FIN without ACK

Number of TCP FIN flags without the acknowledge (ACK) flag.

–

TCP SYN-ACK-ACK Proxy

Number of TCP flags enabled with SYN-ACK-ACK.

To prevent flooding with SYN-ACK-ACK sessions, you can enable the SYN-ACK-ACK proxy protection screen option. After the number of connections from the same IP address reaches the SYN-ACK-ACK proxy threshold, Junos OS rejects further connection requests from that IP address.

IP Block Fragment

Number of IP block fragments.

–

Status of IDP

Displays the status of the current IDP policy.

–

Up Since

Displays the time from when the IDP policy first began running on the system.

–

Packets/Second

Displays the number of packets received and returned per second.

–

Peak

Displays the maximum number of packets received per second and the time when the maximum was reached.

–

Kbits/Second

Displays the aggregated throughput (kilobits per second) for the system.

–

Peak Kbits

Displays the maximum kilobits per second and the time when the maximum was reached.

–

Latency (Microseconds)

Displays the delay, in microseconds, for a packet to receive and return by a node .

–

Current Policy

Displays the name of the current installed IDP policy.

–

IDP Memory Statistics

Displays the status of all IDP data plane memory.

–

PIC Name

Displays the name of the PIC.

–

Total IDP Data Plane Memory (MB)

Displays the total memory space, in megabytes, allocated for the IDP data plane.

–

Used (MB)

Displays the used memory space, in megabytes, for the data plane.

–

Available (MB)

Displays the available memory space, in megabytes, for the data plane.

–

Hole

Range of flows permitted by the pinhole.

–

Translated

Tuples used to create the session if it matches the pinhole:

• Source address and port

• Destination address and port

–

Protocol

Application protocol, such as UDP or TCP.

–

Application

Name of the application.

–

Age

Idle timeout for the pinhole.

–

Flags

Internal debug flags for pinhole.

–

Zone

Incoming zone.

–

Reference count

Number of resource manager references to the pinhole.

–

Resource

Resource manager information about the pinhole.

–

Total users in table

Number of users in the authentication table.

–

ID

Authentication identification number.

–

Source Ip

IP address of the authentication source.

–

Age

Idle timeout for the user.

–

Status

Status of authentication (success or failure).

–

user

Name of the user.

–

Source Zone

Name of the source zone.

–

Destination Zone

Name of the destination zone.

–

profile

Name of the profile.

Users information.

Authentication method

Path chosen for authentication.

–

Policy Id

Policy Identifier.

–

Interface name

Name of the interface.

–

Bytes sent by this user

Number of packets in bytes sent by this user.

–

Bytes received by this user

Number of packets in bytes received by this user.

–

Client-groups

Name of the client group.

–

Entries from Source IP

IP address of the authentication source.

–

Source Zone

Name of the source zone.

–

Destination Zone

Name of the destination zone.

–

profile

Name of the profile.

–

Age

Idle timeout for the user.

–

Status

Status of authentication (success or failure).

–

user

Name of the user.

–

Authentication method

Path chosen for authentication.

–

Policy Id

Policy Identifier.

–

Interface name

Name of the interface.

–

Bytes sent by this user

Number of packets in bytes sent by this user.

–

Bytes received by this user

Number of packets in bytes received by this user.

–

Client-groups

Name of the client group.

–

Total authentications

Number of authentication.

–

ID

Identification number.

–

Source Ip

IP address of the authentication source.

–

Start Date

Authentication date.

–

Start Time

Authentication time.

–

Duration

Authentication duration.

–

Status

Status of authentication (success or failure).

–

User

Name of the user.

–

Authentication method

Path chosen for authentication.

–

Policy Id

Security policy identifier.

–

Source zone

Name of the source zone.

–

Destination Zone

Name of the destination zone.

–

Interface name

Name of the interface.

–

Bytes sent by this user

Number of packets in bytes sent by this user.

–

Bytes received by this user

Number of packets in bytes received by this user.

–

Client-groups

Name of the client group.

–

User

Name of the user.

–

Start Date

Authentication date.

–

Start Time

Authentication time.

–

Duration

Authentication duration.

–

Status

Status of authentication (success or failure).

–

Profile

Name of the profile.

–

Authentication method

Path chosen for authentication.

–

Policy Id

Security policy identifier.

–

Source zone

Name of the source zone.

–

Destination Zone

Name of the destination zone.

–

Interface name

Name of the interface.

–

Bytes sent by this user

Number of packets in bytes sent by this user.

–

Bytes received by this user

Number of packets in bytes received by this user.

–

Client-groups

Name of the client group.

–

Select Port

List of ports for selection.

–

Number of connected hosts

Total number of hosts connected to the port.

–

Number of authentication bypassed hosts

Total number of authentication-bypassed hosts with respect to the port.

–

MAC Address

MAC address of the connected host.

–

User Name

Name of the user.

–

Status

Information about the host connection status.

–

Authentication Due

Information about host authentication.

–

MAC Address

MAC address of the authentication-failed host.

–

User Name

Name of the authentication-failed user.

–