Selecting Devices For Firewall Rules - Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual

Selecting Devices for Firewall Rules

Copyright © 2010, Juniper Networks, Inc.
Deny—The managed device does not permit the traffic to pass through the firewall
and drops all associated packets. No notification is returned to the sender.
Reject—The managed device does not permit the traffic to pass through the firewall
and drops all associated packets. For TCP and UDP packets, the device returns a
notification message to the packet sender:
When the device drops a TCP packet, it returns a TCP RST packet to the sender.
When the device drops a UDP packet, it returns an ICMP port unreachable error to
the sender.
For non-TCP and non-UDP packets, no notification is returned to the sender.
When you permit traffic, you can also:
Use logging to monitor suspicious or abnormal uses of permitted traffic (such as
excessive Web surfing).
Use Antivirus to detect viruses in permitted traffic.
Use Web Profiles to detect and prevent access to malicious or undesirable URLs.
Use DI Profiles to detect and prevent attacks in permitted traffic.
For J Series and SRX Series devices, you can also use the NSM GUI to enable or disable
DI IDP and Application Services. To use this feature:
Select a zone based firewall policy and right-click on the Rule Options column.
1.
When the DI/Enable IDP/Appl Srvcs dialog box appears, select the applicable options.
2.
Attack Profile Settings — Select an option.
IDP Option — Keep the Enabled setting or select Disabled.
Enabled — Keep Inline or select Inline Tap.
Application Services — Keep None, select Redirect WX, or select Reverse Redirect
WX.
Click OK to save your settings.
3.
The new settings (for example, "RWX") appear next to the Rule Option entry.
In the install on column, select the devices that receive and use this rule. You can select
multiple security devices on which to install the firewall rule. After you have created the
security policy and assigned it to a device, NSM installs the rule only on the devices
specified in the Install Column of the rule, enabling you to use a single security policy for
multiple security devices.
To see the exact rules that are applied to a specific device, in Device Manager, right-click
a device and select Policy > View Pending Device Policy.
Chapter 9: Configuring Security Policies
443