Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Use Case 1: Configure IPS Policy in a Firewall Policy

SUMMARY An intrusion prevention system (IPS) policy enables you to selectively enforce various attack detection and prevention techniques on the network traffic passing through an IPS-enabled device. In this section, you’ll learn how to create an IPS policy and then assign the IPS policy to a firewall policy rule that is assigned to a device running Junos OS Release 18.2 or later.

What's Next

To learn more about IPS features, see Junos Space Security Director User Guide.

Benefits

  • Assign a different IPS policy to each firewall policy rule.

  • IPS policy matches are handled within the standard or unified firewall policy to which the IPS policy is assigned.

  • Simplifies application-based security policy management at Layer 7.

  • Provides greater control and extensibility to manage dynamic applications traffic.

Before You Begin

Note:

  • Although this use case has been specifically validated against Junos Space Security Director Release 19.3 and an SRX Series device running Junos OS Release 18.2, you can use Junos OS Release 18.2 or later.

  • Only mandatory fields and other required fields are included in the procedures in this use case.

Overview

Starting in Junos Space Security Director Release 19.3, you cannot assign devices running Junos OS Release 18.2 and later to an IPS policy from the IPS Policies page. You’ll need to assign an IPS policy to a firewall policy rule for devices running Junos OS Release 18.2 and later. The CLI configuration for the IPS policy is generated along with the standard or unified firewall policy to which the IPS policy is assigned. When an IPS policy is configured in a firewall policy, the traffic that matches the specified criteria is checked against the IPS rule bases. This type of configuration can be used to monitor traffic to and from the secure area of an internal network as an added security measure for confidential communications.

In the following topology, we have an enterprise local area network behind a Layer 2 switch. The switch is connected to an SRX Series firewall that has IPS enabled and inspects all the traffic traveling in and out of the network. The SRX Series device can be in any form: hardware, virtual, or containerized.

Create an IPS Policy

Let’s first create an IPS policy that we will then configure on an SRX Series device running Junos OS Release 18.2:

  1. Select Configure > IPS Policy > Policies.

    The IPS Policies page is displayed.

  2. Click the + icon.

    The Create IPS Policy page is displayed.

  3. Enter the following IPS policy name: IPS_Policy

    A policy name can have a maximum of 255 characters, and can include alphanumeric characters, spaces, and periods.

  4. Select the Policy Type as Device Policy.
    Note:

    You can also select the group policy option. You can assign either a group policy or a device-specific policy to the firewall policy.

  5. Do not select any device from the list.
    Note:

    Only the devices running Junos OS Release 18.1 and earlier are listed. To configure an IPS policy on devices running Junos OS Release 18.2 or later, you’ll need to assign an IPS policy (without device assignment) to a firewall policy rule. The IPS policy is updated with firewall policy update.

  6. Click OK.

    The created IPS Policy (IPS_Policy) is displayed on the IPS Policies page.

Assign the IPS Policy to a Firewall Policy Rule

Now let’s assign the created IPS policy to a firewall policy rule:

  1. Select Configure > Firewall Policy > Standard Policies.

    The Standard Policies page is displayed.

  2. Click the + icon.

    The Create Firewall Policy page is displayed.

  3. Enter the following firewall policy name: Firewall_Policy
  4. Select the Policy Type as Device Policy.

    When you select the device policy option, the firewall policy is created for each device. If you select the group policy option, the firewall policy is shared with multiple devices.

  5. Select the vsrx-18.2 device.

    All the devices that are discovered by Junos Space Security Director are listed in the drop-down. To know more about device discovery in Junos Space Security Director, see Create Device Discovery Profiles in Security Director.

    Note:

    The device that you select must be running Junos OS Release 18.2 or later.

  6. Click OK to create the firewall policy.

    The firewall policy that you created (Firewall_Policy) is displayed on the Standard Policies page.

  7. Click Add Rule for the Firewall_Policy policy to add rules.

    The Create Rule page is displayed.

  8. On the General tab, enter the following rule name: Firewall_Policy_Rule

  9. Click Next until you reach the Advanced Security tab.
  10. On the Advanced Security tab:
    1. Select Permit from the Action drop-down list.
    2. Select the value IPS_Policy from the IPS Policy drop-down list.
      Note:

      Starting in Junos Space Security Director Release 20.1R1 V1 hot patch, you can assign a group IPS policy that is not assigned to any device to a firewall policy.

  11. Click Next until you reach the Rule Placement tab, and click Finish.

    You can view the IPS policy details in the firewall policy configuration summary.

  12. Click OK to create the rule.

    The rule is displayed on the Firewall_Policy/Rules page.

  13. Click Save to save the rule.

Similar to Firewall_Policy_Rule, we have created another rule Firewall_Policy_Rule2.

Verify the IPS Policy Assignment to Firewall Policy

Purpose

Let's verify that the firewall policy that you created includes the IPS policy that you created (IPS_Policy).

Action

  1. Select Configure > Firewall Policy > Standard Policies.

    The Standard Policies page is displayed.

  2. Click the rules for the firewall policy named (Firewall_Policy).

    The Firewall_Policy/Rules page is displayed. In the Advanced Security column, the IPS policy named IPS_Policy is displayed for both the rules that you created (Firewall_Policy_Rule and Firewall_Policy_Rule2).

CLI Configuration

You’ll see that the IPS_Policy policy is assigned to the Firewall_Policy_Rule and Firewall_Policy_Rule2 rules.

##Security Firewall Policy: global ##

set security policies global policy Firewall_Policy_Rule match application any

set security policies global policy Firewall_Policy_Rule match destination-address any

set security policies global policy Firewall_Policy_Rule match source-address any

set security policies global policy Firewall_Policy_Rule then permit application-services idp-policy IPS_Policy

set security policies global policy Firewall_Policy_Rule2 match application any

set security policies global policy Firewall_Policy_Rule2 match destination-address any

set security policies global policy Firewall_Policy_Rule2 match source-address any

set security policies global policy Firewall_Policy_Rule2 then permit application-services idp-policy IPS_Policy

##IDP Configurations##

set security idp idp-policy IPS_Policy rulebase-ips rule Device-1 match application default

set security idp idp-policy IPS_Policy rulebase-ips rule Device-1 match attacks predefined-attack-groups "Additional Web Services - Info"

set security idp idp-policy IPS_Policy rulebase-ips rule Device-1 match from-zone any

set security idp idp-policy IPS_Policy rulebase-ips rule Device-1 match to-zone any

set security idp idp-policy IPS_Policy rulebase-ips rule Device-1 then action recommended