Setting Severity; Setting An Alert; Logging Packets; Specifying Vlans - Juniper NETWORK AND SECURITY MANAGER 2010.3 - ADMINISTRATION GUIDE REV1 Administration Manual

Table of Contents

Advertisement

Network and Security Manager Administration Guide

Setting Severity

Specifying VLANs

Setting Target Devices

Entering Comments

498

Setting an Alert

In the Configure Notification dialog box, select Alert and then click OK. If Alert is selected
and the rule is matched, IDP places an alert flag in the alert column of the Log Viewer
for the matching log record.

Logging Packets

You can record the individual packets in the network traffic that matched a rule by
capturing the packet data for the attack. Viewing the packets used in an attack on your
network can help you determine the extent of the attempted attack and its purpose,
whether or not the attack was successful, and any possible damage to your network.
NOTE: To improve IDP performance, log only the packets after the attack.
If multiple rules with packet capture enabled match the same attack, IDP captures the
maximum specified number of packets. For example, you configure Rule 1 to capture 10
packets before and after the attack, and Rule 2 to capture 5 packets before and after
the attack. If both rules match the same attack, IDP attempts to capture 10 packets
before and after the attack.
NOTE: Packet captures are restricted to 256 packets before and after the attack.
You can override the inherent attack severity on a per-rule basis within the SYN Protector
rulebase. You can set the severity to either Default, Info, Warning, Minor, Major, or Critical.
To change the severity for a rule, right-click the Severity column of the rule and select a
severity.
You can specify that the rule be applied only to packets from particular VLANs. See
"Setting VLAN Tags for IDP Rules" on page 473 for more information.
For each rule in the rulebase, you can select the IDP-capable device that will use that
rule to detect and prevent attacks. Alternatively, you can use Device Manager to assign
policies to devices.
You can enter notations about the rule in the Comments column. Anything you enter in
the Comments column is not pushed to the target devices. To enter a comment, right-click
the Comments column and select Edit Comments. The Edit Comments dialog box
appears. You can enter up to 1024 characters in the Comments field.
Copyright © 2010, Juniper Networks, Inc.

Advertisement

Table of Contents
loading

This manual is also suitable for:

Network and security manager 2010.3

Table of Contents