Juniper NETWORK AND SECURITY MANAGER 2010.4 - API GUIDE REV 1 Manual page 65

Table 17: SYN Protector Rulebase Data Elements (continued)
Data Element
comments
customOptions_collection
enabled
src_addr_collection
src_addr_negate
dst_addr_coillection
dst_addr_negate
service
mode
severity
log
vlan
Copyright © 2010, Juniper Networks, Inc.
Description
Comments about the SYN Protector collection.
Custom options.
Collection enabled.
Traffic source address.
Negates the specified source address.
Traffic destination address.
Negates the specified destination address.
The default service, , looks for SYN floods in all TCP-based traffic.
TCP-any
NOTE: Always set the SYN Protector service value to
can cause unpredictable interactions with other rulebases.
Select the mode that indicates how IDP handles TCP traffic. The possible values are:
None = no action taken.
Relay = IDP acts as the middleman or relay for the established connection.
Passive = IDP handles the transfer of packets between the client host and the server but
does not prevent the connection from being established.
Severity of the attack. Within the IDP rulebase, you can override the ordinary attack severity
on a per-rule basis. Possible settings:
Default
Info
Warning
Minor
Major
Critical
You can configure the system to log an attack and create log records with attack information.
This logged information can be viewed in real-time through the Log Viewer.
This parameter configures a rule that only applies to messages in specified VLANs. The possible
settings are:
Any (default) = Any rule will be applied to messages in any VLAN and to messages without
a VLAN tag. This setting has the same effect as not specifying a VLAN. Any can be sent to
devices that do not support VLAN tagging.
None = A rule will be applied only to messages that do not have a VLAN tag. Rules with this
value set cannot be sent to devices that do not support VLAN tagging.
vlan_list_collection = Specifies the VLAN tags to which the rule applies. You must create
VLAN objects before applying them to the rules. Rules with this value set cannot be sent to
devices that do not support VLAN tagging.
Chapter 5: Security Data Model
. Selecting individual services
TCP-any
47