Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE REV1 Manual page 68

Configuring Intrusion Detection and Prevention Devices Guide
52
Click New in the upper right corner of the policy viewer and select Add Traffic
3.
Anomalies Rulebase.
Click the New button within the rules viewer to add a rule.
4.
Modify the property of the rule by right-clicking the table cell for the property and
5.
making your modifications.
Configure or modify the rule using the settings described in Table 32 on page 52.
6.
Table 32: Traffic Anomalies Rulebase Rule Properties
Option
No
Match > Source
Match > Destination
Match > Service
Traffic Anomaly
Function
Specifies if you want to add,
delete, copy, or reorder rules.
Specifies the address object
that is the source of the
traffic.
Specifies the address object
that is the destination of the
traffic, typically a server or
other device on your network.
Specifies service objects in
rules to service an attack to
access your network.
Specifies how IDP is to treat
the matching traffic.
Your Action
Right-click the table cell for the
rule number and make your
required modifications.
Select any to monitor network
traffic originating from any IP
address.
NOTE: You can also negate one
or more address objects to specify
all sources except the excluded
object.
Select the destination object.
NOTE: You can also negate one
or more address objects to specify
all destinations except the
excluded object.
Set a service by selecting any of
the available options.
NOTE: We recommend that you
do not change the default value,
TCP-ANY.
Select any of the following
options:
Ignore—IDP ignores this traffic.
This option excludes traffic from
trusted sources that might be
falsely construed as a scan.
Detect—IDP matches this traffic
and takes the IP action that you
have set.
When you select this option, the
Traffic Anomalies dialog box
appears. Select the scans or
sweep you want to detect and
enter values for Port Count and
Time Threshold (in seconds) or
Session Count.
Copyright © 2010, Juniper Networks, Inc.