Configuring Network Honeypot Rules; Impersonating A Port; Adding The Network Honeypot Rulebase; Defining A Match - Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual

Configuring Network Honeypot Rules

Impersonating a Port

Adding the Network Honeypot Rulebase

Defining a Match

Copyright © 2010, Juniper Networks, Inc.
The Network Honeypot protects your network by impersonating open ports on existing
servers on your network, alerting you to attackers performing port scans and other
information-gathering activities.
Attackers view ports as entry points into your network. You can create counterfeit ports
on existing servers to trick attackers who are attempting to break into your network. A
counterfeit port can appear to offer notoriously vulnerable services to make the port
attractive to attackers.
You create a counterfeit port in the Network Honeypot Rulebase by specifying an
existing network object and choosing a port and service to impersonate. You can also
set an IP Action to perform against the Source IP. If an attacker attempts to
communicate with your counterfeit port, the rule matches and the IP action triggers.
Before you can configure a rule in the Network Honeypot rulebase, you need to add the
Network Honeypot rulebase to a security policy.
In the main navigation tree, select Policies. Open a security policy by double-clicking
1.
the policy name in the Security Policies window or click the policy name and then
select the Edit icon.
Click the Add icon in the upper right corner of the Security Policy window and select
2.
Add Network Honeypot Rulebase. The Network Honeypot rulebase tab appears.
Configure a Network Honeypot rule by clicking the Add icon on the left side of the
3.
Security Policy window. A default Network Honeypot rule appears. You can modify
this rule as needed.
NOTE: Honeypot rulebase is not supported in IDP 4.2. If the assigned policy has honeypot
rule included, NSM will remove it before pushing the policy to the device and provide a
warning in the Job manager.
You specify the traffic you want IDP to monitor for network anomalies.

Configuring the Source

Set the Source object to Any.

Configuring Destination Address Objects and Services

Set the Destination Address and Service to the service that will appear to be available
on the indicated address object.
Chapter 9: Configuring Security Policies
495