Example: Using Multiple Device Templates - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Copyright © 2010, Juniper Networks, Inc.

Example: Using Multiple Device Templates

In this example, you create two templates that each configure different values for the
same firewall SCREEN option for the untrust zone. The first template, DoS, sets several
values in the SCREEN options, including setting the source-based IP session threshold
limit to 128 for the untrust zone. The second template, DoS2, sets the source-based IP
session threshold limit to 256 for the untrust zone. When you apply these templates to
a device, the template with the highest priority overrides the values in the lower-priority
template.
Create a template that sets SCREEN options for the untrust zone, and then apply the
1.
template to a NetScreen-208 device running ScreenOS 5.0:
a. In the navigation tree, select Device Templates, click the Add icon, and then select
ScreenOS/IDP Template. The New Device Template dialog box appears.
b. In the Info screen, enter DoS in the Name field.
c. In the template navigation tree, select Network > Zone. The Zone configuration
screen appears.
d. Click the Add icon in the Zone configuration screen and select Pre-Defined Security
Zone — trust|untrust|dmz|global. The Predefined Zone dialog box appears.
NOTE: Because the untrust security zone is predefined for the device,
you must select the Predefined Security Zone option. You can select
the Security Zone or Tunnel Zone option only when adding or configuring
a user-defined zone.
e. In the General Properties screen, enter untrust in the Name field.
f. In the zone navigation tree, select Screen > Denial of Service Defense. The Denial
of Service Defense screen appears.
g. Select and configure the following options:
Select Ping of Death Attack Protection, Teardrop Attack Protection, and Land
Attack Protection.
Select SYN-ACK-ACK Proxy Protection and set the Threshold to 512.
Select Source IP Based Session Limit and set the Threshold to 128.
Select Destination IP Based Session Limit and set the Threshold to 4000.
Click OK to save the new zone.
h. Click OK to save the new device template.
Apply the DoS template to a device configuration for a NetScreen-208 running
2.
ScreenOS 5.0:
Chapter 5: Configuring Devices
205