Example: Configuring Udp Flooding Protection (Nsm Procedure); Http Components And Ms-Windows Defense Method - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Example: Configuring UDP Flooding Protection (NSM Procedure)

Related
Documentation

HTTP Components and MS-Windows Defense Method

Table 16: HTTP Components
HTTP Components
Java
Copyright © 2010, Juniper Networks, Inc.
In this example, enable UDP Flooding Protection and set a threshold of 80,000 per
second for the number of UDP packets that can be received on IP address 1.1.1.5 in the
Untrust zone. When this limit is reached, the device generates an alarm and drops
subsequent packets for the remainder of that second.
Add a NetScreen-208 security device. Choose Model when adding the device and
1.
configure the device as running ScreenOS 5.1 or later.
In the device navigation tree, select Network > Zone. Double-click the Untrust zone.
2.
The General Properties screen appears.
In the zone navigation tree, select Screen > Flood Defense, and then click the UDP
3.
Flood Defense tab.
Select UDP Flood Protection and ensure that the threshold is set to 1000.
4.
Click OK.
5.
Click the Add icon to display the New Destination IP based UDP Flood Protection
6.
dialog box. Configure the following options, and then click OK:
For Destination IP, enter 1.1.1.5.
For Threshold, enter 80000.
Click OK to save your changes to the zone, and then click OK again to save your changes
to the device.
Configuring Flood Defense Settings for Preventing Attacks on page 41
Predefined Screen Options Overview on page 40
Interface Types in ScreenOS Devices Overview on page 50
Attackers might use HTTP to send ActiveX controls, Java applets, .zip files, or .exe files
to a target system, enabling them to load and control applications on hosts in a protected
network. You can configure the security device to block the components (the device
monitors incoming HTTP headers for blocked content types) as described in Table 16
on page 43.
Description
Java applets enable Web pages to interact with other programs. The applet runs by
downloading itself to the Java Virtual Machine (VM) on a target system. Because attackers
can program Java applets to operate outside the VM you might want to block them from
passing through the security device.
Chapter 3: Network Settings
43