Juniper NETWORK AND SECURITY MANAGER 2010.3 - ADMINISTRATION GUIDE REV1 Administration Manual page 406

Network and Security Manager Administration Guide
356
Context—Specify the context in which to locate the pattern. The context displays only
contexts that are appropriate for the specified Service. If you selected a service binding
of Any, you are restricted to the service contexts packet and first packet.
Direction—Specify whether the security device should match the pattern in traffic
flowing in any direction, from client to server, or from server to client.
Adding a Predefined Protocol Anomaly Attack Object
To add a protocol anomaly to the compound attack object, click the Add icon and select
protocol anomaly. In the Attack Properties area, select an anomaly from the Key menu.
The menu only displays protocol anomalies appropriate for the Service you selected.
If you selected a service binding of any, you are restricted to the IP-based protocol anomaly
attack objects.
Configuring an Attack Object Ordered Match
Use ordered match to create a compound attack object that must match each member
signature or protocol anomaly in the order you specify. If you do not specify an ordered
match, the compound attack object still must match all members, but the attack pattern
or protocol anomalies can appear in the attack in random order.
To configure an ordered match, enable Ordered Match and use the arrow keys to reorder
members.
Or, use the Boolean Expression field match a more complex arrangement of attack
patterns.
Configuring a Boolean Expression
Using the Boolean Expression field disables the Ordered Match function for standalone
IDP devices. For ISG devices, the Boolean Expression field is ignored and the Ordered
Match check box is used, if it is checked.
The Boolean Expression field makes use of the Member Names created in the lower part
of the dialog.
NSM supports three Boolean operators: or, and, and oand (ordered and). NSM also
supports the use of parenthesis to determine precedence.
Boolean operators:
or - if either of the member name patterns match, the expression matches.
and - if both of the member name patterns match, the expression matches. It does
not matter which order the members appear in.
oand - if both of the member name patterns match, and if they appear in the same
order as in the Boolean Expression, the expression matches.
Example: Boolean Expression
Suppose you have created six signature members, labelled s1 - s5.
Copyright © 2010, Juniper Networks, Inc.