Adding The Syn Protector Rulebase; Defining A Match; Configuring Source And Destination Address Objects; Configuring Services - Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

Adding the SYN Protector Rulebase

Defining a Match

Setting Mode

488
By default, the SYN Protector rulebase is only activated when the number of SYN packets
per second is greater than 1020. This number is the sum of two parameters that you can
set in the Sensor Settings Run-Time Parameters:
Lower SYN's-per-second threshold below which SYN Protector will be deactivated
(the default value is 1000)
Upper SYN's-per-second threshold above which SYN Protector will be activated (the
default value is 20)
Once the SYN Protector rulebase is activated, it remains active until the number of SYN
packets per second is less than the Lower SYN's-per-second threshold (which is 1000
by default).
Before you can configure a rule in the SYN Protector rulebase, you need to add the SYN
Protector rulebase to a security policy.
In the main navigation tree, select Policies. Open a security policy by double-clicking
1.
the policy name in the Security Policies window or click the policy name and then
select the Edit icon.
Click the Add icon in the upper right corner of the Security Policy window and select
2.
Add SYN Protector Rulebase to open the SYN Protector rulebase tab.
Configure a SYN Protector rule by clicking the Add icon on the left side of the Security
3.
Policy window to open a default SYN Protector rule. You can modify this rule as
needed.
Specify the traffic you want IDP to monitor for SYN floods.

Configuring Source and Destination Address Objects

Set the Source Object to Any. Set the Destination Object to any address objects you want
to protect.

Configuring Services

The default service, TCP-any, looks for SYN floods in all TCP-based traffic.
Always set the SYN Protector service value to TCP-any. Selecting individual services can
cause unpredictable interactions with other rulebases.
Select the mode that indicates how IDP handles TCP traffic:
None. IDP takes no action, and does not participate in the three-way handshake.
Copyright © 2010, Juniper Networks, Inc.