Juniper NETWORK AND SECURITY MANAGER 2010.3 - CONFIGURING INTRUSION DETECTION AND PREVENTION GUIDE REV1 Manual page 71

Copyright © 2010, Juniper Networks, Inc.
Table 33: Network Honeypot Rulebase Rule Properties (continued)
Option
Impersonate > Destination
Impersonate > Service
Operation
IP Action
Notification
Function
Specifies the address object
that is the destination of the
traffic, typically a server or
other device on your network.
Specifies the services running
on your network.
Specifies whether or not IDP
fakes open ports.
Allows you to log, drop, or
close the current connection
for each attack that matches
a rule.
Allows you to create log
records with attack
information that you can view
real-time in the Log Viewer.
NOTE: For more critical
attacks, you can also set an
alert flag to appear in the log
record.
Chapter 4: Configuring Security Policies
Your Action
Select the destination object.
NOTE: You can also negate one
or more address objects to specify
all destinations except the
excluded object.
Select the services you want to
monitor.
Select any of the following
options:
Ignore—This option allows free
passage on your network when
creating rules for trusted traffic.
Impersonate—IDP creates a
fake port open to the public
based on the destination IP
addresses and service you
selected.
Select Configure to do any one of
the following actions:
Enabled—Enable IP actions.
Action—Specifies the action you
want the IDP to take.
Block—Specifies which
parameters IDP will use to close
or block further connections
from the drop-down list.
Logging—Specifies the log
action for a matching event.
Timeout (sec)—Specifies the
number of seconds that this
action remains in effect on IDP
after a traffic match.
Select Configure to create log
records.
NOTE: The Configure menu option
does not appear if the Mode
column is set to None.
Select Logging to have a log
record created each time the
rule is matched.
Select Alert to have an alert flag
placed in the Alert column of
the Log Viewer for the matching
log record.
In the Log Actions tab, select
desired log actions, if any.
55