Configuring The Source; Defining A Match; Configuring Destination Address Objects And Services; Setting Operation - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Defining a Match

Setting Operation

Setting Response Options

Setting Notification

Copyright © 2010, Juniper Networks, Inc.
NOTE: Honeypot rulebase is not supported in IDP 4.2. If the assigned policy
has honeypot rule included, NSM will remove it before pushing the policy to
the device and provide a warning in the Job manager.
You specify the traffic you want IDP to monitor for network anomalies.

Configuring the Source

Set the Source object to Any.

Configuring Destination Address Objects and Services

Set the Destination Address and Service to the service that will appear to be available
on the indicated address object.
Right-click the cell in the Operation column and select Impersonate. This tells the IDP
Sensor to impersonate the indicated services on the indicated device.
The IP Action column governs what action the IDP Sensor takes when it finds a matching
condition.
Right-click the rulebase cell in the IP Action column and select Configure. The Configure
IP Action dialog displays.
Configure your IP Action settings as appropriate for your network.
You can choose to log an attack and create log records with attack information that you
can view real-time in the Log Viewer. For more critical attacks, you can also set an alert
flag to appear in the log record.
To log an attack for a rule, right-click the Notification column of the rule and select
Configure. The Configure Notification dialog box appears.

Setting Logging

In the Configure Notification dialog box, select Logging and then click OK. Each time the
rule is matched, the IDP system creates a log record that appears in the Log Viewer.
You can choose to log an attack and create log records with attack information that you
can view real-time in the Log Viewer. For more critical attacks, however, you might want
to be notified immediately by e-mail, have IDP run a script in response to the attack, or
set an alarm flag to appear in the log record. Your goal is to fine-tune the attack
notifications in your security policy to your individual security needs.
Chapter 9: Configuring Security Policies
507