Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Intrusion Detection and Prevention

Enhance network security by applying Intrusion Detection and Prevention (IDP) profiles.

Getting Started with IDP Profiles

Intrusion detection involves monitoring network events and identifying incidents and threats. Intrusion prevention follows up on the findings of the detection process by taking countermeasures. IDP profiles consist of many attack signatures, each with their own severity and recommended actions. When you apply a profile to an application policy, you enable that appropriate safeguards.

With the required licenses, IDP is available for all WAN Edge devices that are configured as spokes. IDP is also supported on SRX devices that are configured as hubs (SRX only).

Note:
Warning:

When you activate the IDP feature for the first time on a spoke-device, we recommend you to plan it in a maintenance window. The start of the IDP engine and inclusion into the path from LAN to WAN (that is, service-chaining) might take a few minutes and might also interrupt ongoing communications.

Add an IDP Profile to an Application Policy

To enable intrusion detection and prevention, apply an IDP profile to an application policy.

Before You Begin: Configure your networks, templates, profiles, devices, and application policies. For help, see WAN Assurance Configuration Overview.

To add an IDP profile to an application policy:

  1. Navigate to your WAN Edge template, hub profile, or standalone WAN Edge device.
  2. In the Applications Policies section, click Add Application Policy (for a new policy), or scroll to an existing policy.
    Note: For help with a new application policy, see Application Policies.
  3. In the IDP column, select an IDP profile.

    Options include:

    • Standard

    • Strict

    • Alert

    • Critical Only - SRX

    • Recommended - SRX—Contains only the attack objects tagged as recommended by Juniper Networks. All rules have their Actions column set to take the recommended action for each attack object.

    • Server-Protection - SRX—Designed to protect servers. To be used on high memory devices with 2 GB or more of memory.

    • Client-Protection - SRX—Designed to protect clients. To be used on high memory devices with 2 GB or more of memory.

    • Client-And-Server-Protection - SRX—Designed to protect both clients and servers. To be used on high memory devices with 2 GB or more of memory.

    Note: If you've created bypass profiles, they also appear in the Custom Profiles section of the IDP drop-down list. For help, see Customize IDP with Bypass Profiles(later in this topic).
  4. Click Save at the top-right corner of the template.

The selected IDP profile is applied.

Running a Simulator to Test Your IDP Settings

You can test the effects of your IDP-based policies by launching sample attacks. You can use tools such as Nikto in Kali Linux, which has a variety of options available for security-penetration testing.

Before You Begin: Set up a virtual machine (VM) desktop (desktop1) in a sandbox or lab environment, and install a simple security scanner for web servers, such as Nikto. Nikto is an open-source webserver and web application scanner. For example, you can run Nikto against an unhardened Apache Tomcat webserver (or its equivalent) that is local to your lab. In this test, you can send plain or unencrypted HTTP requests for IDP inspection.

The following sample shows a process where you install the tool, check the presence of the HTTP server, and then launch the attacks.

Run the security scanner. You'll notice that the scanner takes longer to run because it detects more errors and less events.

Viewing Event Information

You can view the generated events by navigating to Site > WAN > Security Events.

On the Security Events page, you'll see all generated events, as shown in this example.

The Security Events page includes these helpful features:

  • To filter the table—Above the table, click a button to filter the list by severity level, such as Critical or Minor.

  • To view attack details—Click the hyperlink in the Attack Name column to see information about the attack and the default actions.

You can view more information about an event and the IDP actions by clicking the hyperlink.

In the previous example, you used passive logging for the events by using IDP profile type Alerts. Next, use IDP profile type Strict to stop or mitigate the events. When you use the Strict profile, the IDP engine closes TCP connections against the detected attacks.

You can follow the same process as shown in the sample. However, this time you change the spoke device template and change the IDP profile from Alert to Strict, as shown in this example.

This example shows that for some events, the action is to close the session to mitigate the threats (under the Action field ).

Customize IDP with Bypass Profiles

If you're seeing unnecessary alarms ("false positives"), you can create IDP bypass profiles as a counter-measure. For example, exclude a specific destination or attack type from IDP.

An IDP profile can have multiple bypass profiles, each with multiple bypass rules.

To create an IDP bypass profile:

  1. From the left menu, select Organization > WAN > Application Policy.
  2. In the Profiles section, click the IDP Bypass tab, and then click Add Bypass Profile.
  3. In the Create Bypass Profile window, enter the information for this profile:
    Table 1: Settings
    Field Description
    Name Enter a unique name for this profile. It can include letters, numbers, underscores, and dashes. It can contain up to 63 characters maximum.
    Base Profile

    You need a base IDP profile to create an IDP bypass profile. The supported types are:

    • Standard—Standard profile is the default profile and represents the set of IDP signatures and rules recommended by Juniper Networks. The actions include:

      Close the client and server TCP connection.

      Drop current packet and all subsequent packets.

    • Strict—Strict profile contains a similar set of IDP signatures and rules as the standard profile. However, when the system detects an attack, profile actively blocks any malicious traffic or other attacks detected in the network.
    • Critical Only (SRX)—The Critical-Only profile is suitable for critical-severity attacks. When the system detects a critical attack, this profile takes appropriate action. We recommend the Critical – Only SRX profile for SRX300 line of firewalls.
  4. Click Next at the bottom of the Create Bypass Profile window.
    The IDP Bypass Profiles page appears, showing your profile's name at the top of the page.User interface for managing IDP Bypass Profiles. Profile name MyNewProfile1. No rules defined yet. Options include searching for rules, creating bypass rules, saving or canceling changes, and deleting the profile. Table columns are Name, Destination IP, Attack Name, and Action, currently empty.
  5. Click Create Bypass Rule.
  6. Enter the settings for your rule.
    Table 2: Settings
    Field Description
    Name Enter a descriptive name for this rule. Can contain letters, numbers, underscores, and dashes. Must start and end with a letter or number. Cannot exceed 32 characters.
    Action Select a traffic action:

    • Alert—Sends an alert about the event but doesn't discard

    • Drop—Discards packets without sending a response

    • Close—Discards packets and sends a response

    • None—Takes no action
    Destination IP IP address of the destination for traffic you want to exempt. You can select one or more destination IP addresses from the populated list or click Add Destination IP. Format must follow: <IP Address>/<Network Mask>. After adding an IP, click the check mark at the top of the Destination IP section to save it.
    Attack Name Click Add Attack Name to specify the attacks to exempt for the specified destination addresses. The attack you enter must be of type supported by Juniper Networks IPS Signature. After adding an attack name, click the check mark at the top of the Attack Name section to save it.
  7. When you're done adding IP addresses and attacks, click Add at the bottom of the Create Bypass Rule window.
  8. Repeat the above steps if you want to add more bypass rules to the profile.
  9. When you're done configuring the profile, click Save at the top-right corner of the IDP Bypass Profiles page.
  10. Apply the custom IDP profile to your application policies as needed.
    For help, see Add an IDP Profile to an Application Policy (earlier in this topic). Your custom profiles appear in the same IDP drop-down menu where you can select built-in profiles.