Predefined Policy Applications

America Online Internet service provider (ISP) provides Internet, chat, and instant messaging applications.

Dynamic Host Configuration Protocol.

Dynamic Host Configuration Protocol allocates network addresses and delivers configuration parameters from server to hosts.

Domain Name System translates domain names into IP addresses.

File Transfer Protocol (FTP) allows the sending and receiving of files between machines. You can choose to deny or permit ANY or to selectively permit or deny.

We recommend denying FTP applications from untrusted sources (Internet).

Gopher organizes and displays Internet servers' contents as a hierarchically structured list of files.

We recommend denying Gopher access to avoid exposing your network structure.

HyperText Transfer Protocol is the underlying protocol used by the World Wide Web (WWW).

Denying HTTP application disables your users from viewing the Internet.

Permitting HTTP application allows your trusted hosts to view the Internet.

Hypertext Transfer Protocol with extended nonstandard ports

Hypertext Transfer Protocol with Secure Sockets Layer (SSL) is a protocol for transmitting private documents through the Internet.

Denying HTTPS disables your users from shopping on the Internet and from accessing certain online resources that require secure password exchange.

Permitting HTTPS allows your trusted hosts to participate in password exchange, shop online, and visit various protected online resources that require user login.

Internet Locator Service includes LDAP, User Locator Service, and LDAP over TSL/SSL.

Internet Relay Chat (IRC) allows people connected to the Internet to join live discussions.

Lightweight Directory Access Protocol is a set of protocols used to access information directories.

PC-Anywhere is a remote control and file transfer software.

Trivial File transfer Protocol (TFTP) is a protocol for simple file transfer.

Wide Area Information Server is a program that finds documents on the Internet.

Microsoft remote procedure call (RPC) Endpoint Mapper (EPM) Protocol.

Any Microsoft remote procedure call (RPC) applications.

Microsoft Exchange application group includes:

• Junos-MS-RPC-MSEXCHANGE-DATABASE

• Junos-MS-RPC-MSEXCHANGE-DIRECTORY

• Junos-MS-RPC-MSEXCHANGE-INFO-STORE

Microsoft Exchange Database application.

Microsoft Exchange Directory application.

Microsoft Exchange Information Store application.

Microsoft Transmission Control Protocol (TCP) application.

Microsoft User Datagram Protocol (UDP) application.

Microsoft Structured Query Language (SQL).

Microsoft Network Messenger application.

RIP is a common distance-vector routing protocol.

OSPF is a common link-state routing protocol.

BGP is an exterior/interdomain routing protocol.

H.323 is a standard approved by the International Telecommunication Union (ITU) that defines how audiovisual conference data is transmitted across networks.

Microsoft NetMeeting uses TCP to provide teleconferencing (video and audio) applications over the Internet.

Real Media is streaming video and audio technology.

Real-Time Streaming Protocol (RTSP) is for streaming media applications

Session Initiation Protocol (SIP) is an Application-Layer control protocol for creating, modifying, and terminating sessions.

VDOLive is a scalable, video streaming technology.

Sun RPC Portmapper protocol

Any Sun RPC applications

Sun RPC Mount Daemon

Sun RPC Network File System

Sun RPC Network Lock Manager

Sun RPC Remote Quota Daemon

Sun RPC Remote Status Daemon

Sun RPC Remote User Daemon

Sun RPC System Administration Daemon

Sun RPC Spray Daemon

Sun RPC Status

Sun RPC Wall Daemon

SUN RPC Yellow Page Bind application

Internet Key Exchange is the protocol that sets up a security association in the IPsec protocol suite.

Internet Key protocol (IKE) is a protocol to obtain authenticated keying material for use with ISAKMP.

IKE-Network Address Translation (NAT) performs Layer 3 NAT for S2C IKE traffic.

L2TP combines PPTP with Layer 2 Forwarding (L2F) for remote access.

Point-to-Point Tunneling Protocol allows corporations to extend their own private network through private tunnels over the public Internet.

Any application

Any protocol using the TCP

Any protocol using the UDP

Gnutella is a public domain file sharing protocol that operates over a distributed network. You can assign any port, but the default is 6346.

Microsoft Network Messenger is a utility that allows you to send instant messages and talk online.

Network News Transport Protocol is a protocol used to post, distribute, and retrieve USENET messages.

Server Message Block (SMB) over IP is a protocol that allows you to read and write files to a server on a network.

Yahoo! Messenger is a utility that allows you to check when others are online, send instant messages, and talk online.

NetBIOS Name application displays all NetBIOS name packets sent on UDP port 137.

NetBIOS Datagram application, published by IBM, provides connectionless (datagram) applications to PCs connected with a broadcast medium to locate resources, initiate sessions, and terminate sessions. It is unreliable and the packets are not sequenced.

Network File System uses UDP to allow network users to access shared files stored on computers of different types. SUN RPC is a building block of NFS.

NS-Global is the central management protocol for Juniper Networks Firewall/VPN devices.

NS Global-PRO is the scalable monitoring system for the Juniper Networks Firewall/VPN device family.

Network and Security Manager

Network Time Protocol provides a way for computers to synchronize to a time reference.

RLOGIN starts a terminal session on a remote host.

RSH executes a shell command on a remote host.

Simple Network Management Protocol is a set of protocols for managing complex networks.

SQL*Net Version 1 is a database language that allows for the creation, access, modification, and protection of data.

SQL*Net Version 2 is a database language that allows for the creation, access, modification, and protection of data.

Microsoft SQL is a proprietary database server tool that allows for the creation, access, modification, and protection of data.

SSH is a program to log in to another computer over a network through strong authentication and secure communications on an unsecure channel.

Syslog is a UNIX program that sends messages to the system logger.

Talk is a visual communication program that copies lines from your terminal to that of another user.

Telnet is a UNIX program that provides a standard method of interfacing terminal devices and terminal-oriented processes to each other.

WinFrame is a technology that allows users on non-Windows machines to run Windows applications.

X-Windows is the windowing and graphics system that Motif and OpenLook are based on.

Internet Message Access Protocol is used for retrieving messages.

Simple Mail Transfer Protocol is used to send messages between servers.

Post Office Protocol is used for retrieving e-mail.

Finger is a UNIX program that provides information about the users.

UNIX-to-UNIX Copy Protocol (UUCP) is a UNIX utility that enables file transfers between two computers over a direct serial or modem connection.

Character Generator Protocol is a UDP- or TCP-based debugging and measurement tool.

Discard protocol is an Application Layer protocol that describes a process for discarding TCP or UDP data sent to port 9.

Identification protocol is a TCP/IP Application Layer protocol used for TCP client authentication.

Line Printer Daemon protocol is a TCP-based protocol used for printing applications.

Remote Authentication Dial-In User Service application is a server program used for authentication and accounting purposes.

A RADIUS Accounting server receives statistical data about users logging in to or out of a LAN.

SQL monitor (Microsoft)

Virtual Network Computing facilitates viewing and interacting with another computer or mobile Juniper Networks device connected to the Internet.

Network Directory Application Protocol is a way to look up domain names.

Cisco Station Call Control Protocol (SCCP) uses the signaling connection control port to provide high availability and flow control.

ICMP-ANY affects any protocol using ICMP.

Denying ICMP-ANY impairs any attempt to ping or monitor a network using ICMP.

Permitting ICMP-ANY allows all ICMP messages.

ICMP address mask query is used for systems that need the local subnet mask from a bootstrap server.

Denying ICMP address mask request messages can adversely affect diskless systems.

Permitting ICMP address mask request messages might allow others to fingerprint the operating system of a host in your network.

ICMP destination unreachable error message indicates that the destination host is configured to reject the packets.

Codes 0, 1, 4, or 5 can be from a gateway. Codes 2 or 3 can be from a host (RFC 792).

Denying ICMP destination unreachable error messages can remove the assumption that a host is up and running behind an SRX Series Firewall.

Permitting ICMP destination unreachable error messages can allow some assumptions, such as security filtering, to be made about the network.

ICMP fragmentation error message indicates that fragmentation is needed but the don't fragment flag is set.

We recommend denying these messages from the Internet to an internal network.

ICMP fragment reassembly time exceeded error indicates that a host reassembling a fragmented message ran out of time and dropped the packet. This message is sometimes sent.

We recommend denying these messages from the Internet (external) to the trusted (internal) network.

ICMP host unreachable error messages indicate that routing table entries do not list or list as infinity a particular host. Sometimes this error is sent by gateways that cannot fragment when a packet requiring fragmentation is received.

We recommend denying these messages from the Internet to a trusted network.

Permitting these messages allows others to be able to determine your internal hosts IP addresses by a process of elimination or make assumptions about gateways and fragmentation.

ICMP-INFO query messages allow diskless host systems to query the network and self-configure.

Denying ICMP address mask request messages can adversely affect diskless systems.

Permitting ICMP address mask request messages might allow others to broadcast information queries to a network segment to determine computer type.

ICMP parameter problem error messages notify you when incorrect header parameters are present and have caused a packet to be discarded

We recommend denying these messages from the Internet to a trusted network.

Permitting ICMP parameter problem error messages allows others to make assumptions about your network.

ICMP port unreachable error messages indicate that gateways processing datagrams requesting certain ports are unavailable or unsupported in the network.

We recommend denying these messages from the Internet to a trusted network.

Permitting ICMP port unreachable error messages can allow others to determine which ports you use for certain protocols.

ICMP protocol unreachable error messages indicate that gateways processing datagrams requesting certain protocols are unavailable or unsupported in the network.

We recommend denying these messages from the Internet to a trusted network.

Permitting ICMP protocol unreachable error messages can allow others to determine what protocols your network is running.

ICMP redirect network error messages are sent by an SRX Series Firewall.

We recommend denying these messages from the Internet to a trusted network.

ICMP redirect messages indicate datagrams destined for the specified host to be sent along another path.

ICMP redirect type of service (TOS) and host error is a type of message.

ICMP redirect TOS and network error is a type of message.

ICMP source quench error message indicates that a device does not have the buffer space available to accept, queue, and send the packets on to the next hop.

Denying these messages will not help or impair internal network performance.

Permitting these messages can allow others to know that a device is congested, making it a viable attack target.

ICMP source route failed error message

We recommend denying these messages from the Internet (external).

ICMP time-to-live (TTL) exceeded error message indicates that a packet's TTL setting reached zero before the packet reached its destination. This ensures that older packets are discarded before resent ones are processed.

We recommend denying these messages from a trusted network out to the Internet.

ICMP-TIMESTAMP query messages provide the mechanism to synchronize time and coordinate time distribution in a large, diverse network.

Ping is a utility to determine whether a specific host is accessible by its IP address.

Denying ping functionality removes your ability to check to see if a host is active.

Permitting ping can allow others to execute a denial-of-service (DoS) or Smurf attack.

ICMP fragment echo reassembly time expired error message indicates that the reassembly time was exceeded.

We recommend denying these messages.

Traceroute is a utility to indicate the path to access a specific host.

We recommend denying this utility from the Internet (external) to your trusted network (internal).