Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Manuals

Manuals and User Guides for Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1. We have 1 Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 manual available for free PDF download: Administration Manual

Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual (1000 pages)

Brand: Juniper | Category: Software | Size: 13.05 MB

Table of Contents
7
About this Guide
45
Audience
45
Objectives
45
Conventions
46
Table 1: Notice Icons
46
Table 2: Text Conventions
46
About this Guide
47
Documentation
47
Table 3: Syntax Conventions
47
Table 4: Network and Security Manager Publications
47
Requesting Technical Support
49
- Self-Help Online Tools and Resources
  49
- Opening a Case with JTAC
  50
Getting Started with NSM
51
Chapter 1 Introduction to Network and Security Manager

53
- About NSM
  53
  - Security Integration
    54
    
    Device Configuration
    54
    
    Network Organization
    54
    
    Role-Based Administration
    54
    
    Centralized Device Configuration
    55
    
    Introduction to Network and Security Manager
    55
  - Device Management
    56
    
    Device Modeling
    56
    
    Importing Devices
    56
    
    Policy-Based Management
    56
    
    Rapid Deployment
    56
  - Error Prevention, Recovery, and Auditing
    57
    
    Atomic Configuration and Updating
    57
    
    Device Configuration Validation
    57
    
    Introduction to Network and Security Manager
    57
    
    Policy Validation
    57
    
    Auditing
    58
    
    Device Image Updates
    58
  - Complete System Management
    58
    
    VPN Abstraction
    58
    
    Integrated Logging and Reporting
    59
    
    Job Management
    59
    
    Monitoring Status
    59
- Technical Overview
  60
- Working in the User Interface
  73
  - Characters Not Supported in Login Passwords
    73
  - Managing Blocked Login Attempts
    73
  - Configuring UI Preferences
    73
  - UI Overview
    73
    
    Common Tasks Pane
    74
    
    Figure 3: Overview of the User Interface
    74
    
    Navigation Tree
    74
    
    Main Display Area
    75
    
    Menu Bar
    75
    
    Status Bar
    75
    
    Toolbar
    75
  - NSM Modules
    75
    
    Investigate Modules
    75
    
    Configure Modules
    77
    
    Administer Modules
    81
  - Validation Icons in the User Interface
    81
  - Table 13: Validation Status for Devices
    81
  - Validation and Data Origination Icons
    82
  - Table 14: Validation Icons
    82
  - Working with Other NSM Administrators
    83
  - Searching in the User Interface
    83
    
    Contains String [C] Search Mode
    84
    
    Figure 4: UI Search Modes
    84
    
    Figure 5: "Contains String" Search Mode Example
    84
    
    Starts with [S] Search Mode
    84
    
    Figure 6: "Starts With" Search Mode Example
    85
    
    Figure 7: "Regular Expression" Search Mode Details
    85
    
    Regular Expression [R] Search Mode
    85
    
    Figure 8: "Regular Expression" Search Mode Example
    86
    
    IP [I] Search Mode
    86
    
    Figure 9: "IP Address" Search Mode Example
    87
    
    Search for an Exact Match (E)
    87
  - Global Search
    88
  - Figure 10: Exact String Search Mode Example
    88
- New Features in 2010.2
  89
Chapter 2 Planning Your Virtual Network

91
- Configuring Devices Overview
  91
- Configuring IDP-Capable Devices Overview
  95
  - Common Criteria EAL2 Compliance
    95
    
    Guidance for Intended Usage
    95
    
    Guidance for Personnel
    95
    
    Guidance for Physical Protection
    95
    
    Supported IDP-Capable Devices
    95
  - Enabling Jumbo Frames (ISG1000 Only)
    96
  - Enabling IDP Functionality
    97
    
    Installing Advanced License Keys
    97
    
    Module
    97
    
    Updating Attack Objects
    97
    
    Adding Objects (Optional)
    98
    
    Configuring a Security Policy for IDP
    98
    
    Reviewing IDP Logs
    103
  - Maintaining IDP
    104
  - Creating IDP-Only Administrators
    104
- Simplifying Management
  104
  - Using Device Groups
    105
    
    Using Configuration Groups
    105
    
    Using Device Templates
    105
    
    Merging Policies
    106
  - Using a Naming Convention
    106
    
    Example: Using a Naming Convention for Address Objects
    106
    
    Example: Using a Naming Convention for Devices
    106
- Creating an Information Banner
  107
Chapter 3 Configuring Role-Based Administration

111
Chapter 4 Adding Devices

147
- About Device Creation
  148
  - Adding Devices
    149
  - Determine Device Status
    149
  - Managing the Device
    150
  - Verifying Device Configuration
    150
- Before You Begin Adding Devices
  150
  - Importing Versus Modeling
    151
    
    Importing Device Configurations
    151
    
    Modeling Device Configurations
    151
    
    Device Add Process
    152
  - Selecting the Domain
    152
  - Figure 24: Connecting Devices from Different Domains in Vpns
    153
  - Adding Single or Multiple Devices
    153
  - Specifying the os and Version
    154
  - Determining Port Mode (Screenos Devices Only)
    154
    
    Figure 25: Trust-Untrust Port Mode Bindings
    155
    
    Figure 26: Home-Work Port Mode Bindings
    155
    
    Combined Port Mode
    156
    
    Figure 27: Dual-Untrust Port Mode Bindings
    156
    
    Figure 28: Combined Port Mode Bindings
    157
    
    Trust-Untrust-DMZ Port Mode
    157
    
    Figure 29: Trust-Untrust-DMZ Port Mode Bindings
    158
    
    Figure 30: Extended Port-Mode Interface to Zone Bindings
    158
    
    Table 19: Extended Bindings
    158
    
    Figure 31: DMZ Dual Untrust Port Mode
    159
    
    Table 20: Security Device Port Mode Summary (Part 1)
    160
    
    Table 21: Security Device Port Mode Summary (Part 2)
    160
    
    Changing the Port Mode
    161
    
    Table 22: Supported Add Device Workflows by Device Family
    161
    
    Importing Devices
    162
  - Requirements
    163
  - Adding and Importing Devices with Static IP Addresses
    163
    
    Screenos Devices
    163
    
    IDP Sensors
    165
    
    JUNOS Devices
    166
    
    SA and IC Devices
    167
  - Adding Devices with Dynamic IP Addresses
    168
    
    IDP Sensors
    170
    
    Device
    171
    
    Adding and Importing a JUNOS Device with a Dynamic IP Address
    174
  - Verifying Imported Device Configurations
    177
    
    Using Device Manager
    178
    
    Using Configuration Summaries
    179
- Modeling Devices
  180
  - Modeling a Device
    180
  - Requirements
    180
  - Creating a Device Configuration
    181
  - Activating a Device
    182
    
    Devices with Static IP Addresses
    182
    
    Devices with Dynamic IP Addresses
    185
- Using Rapid Deployment (Screenos Only)
  188
  - Creating the Configlet
    190
  - Installing the Configlet
    193
    
    Preparing the Device
    193
  - Updating the Device Configuration
    195
    
    Delta Option
    195
    
    Summarize Delta Configuration
    195
    
    But Has no Admin Privileges
    196
    
    Fails
    196
    
    Option
    196
- Adding Vsys Devices
  196
- Adding an Extranet Device
  200
- Adding Clusters
  201
- Adding Many Devices Using CSV Files
  218
- Adding Device Groups
  229
  - Example: Creating a Device Group
    230
- Setting up NSM to Work with Infranet Controller and Infranet Enforcer
  231
  - Avoiding Naming Conflicts of the Authorization Server Object
    231
  - Avoiding NACN Password Conflicts
    233
Chapter 5 Configuring Devices

235
Chapter 6 Updating Devices

291
- About Updating
  291
  - How the Update Process Works
    292
  - Updating Devices
    293
  - Devices
    295
- Knowing When to Update
  296
  - Verifying Device Status in Device Monitor
    297
    
    Configuration Status
    297
    
    Connection Status
    297
  - Verifying Device Status in Device Manager
    299
  - Reviewing Logs
    299
  - Identifying Administrative Changes
    300
  - Reviewing Reports
    300
- Using Preview Tools
  300
- Performing an Update
  304
  - Retrying a Failed Update
    305
  - Configuring Update Options
    305
    
    Update Options for DMI-Compatible Devices
    306
- Tracking Device Updates
  306
Chapter 7 Managing Devices

313
Chapter 8 Configuring Objects

369
- About Objects
  370
  - Configuring Objects
    371
  - Replacing Objects
    372
  - Using Objects Across Domains
    372
  - Working with Object Versions
    373
  - Working with Unused Shared Objects
    373
    
    Deleting an Unused Shared Object
    373
    
    Searching for Unused Shared Objects
    373
  - Configuring Address Objects
    374
  - Searching for and Deleting Duplicate Objects
    374
  - Creating Address Objects
    375
    
    Adding an Address Object Group
    377
    
    Editing and Deleting Address Objects
    377
    
    Replacing Address Objects
    377
    
    Adding a Multicast Group Address Object
    378
    
    Adding Static DNS Host Addresses
    379
    
    Table 31: Application Table Tab Information
    380
  - Viewing Address Objects
    375
  - Blocked Hosts
    380
- Configuring Application Objects
  380
- Configuring Schedule Objects
  382
  - Creating Schedule Objects
    382
- Configuring Access Profile Objects
  382
- Configuring Quality of Service Profiles
  383
- Working with DI Attack Objects
  385
- Working with IDP Attack Objects
  388
- Configuring Custom DI and IDP Attack Objects
  390
- Creating Custom DI Attack Groups
  409
- Creating Custom IDP Attack Groups
  409
  - Creating Static Attack Groups
    410
  - Creating Dynamic Attack Groups (IDP Only)
    410
  - Figure 78: New Dynamic Group
    412
  - Figure 79: New Dynamic Group Members
    413
  - Updating Dynamic Groups
    413
  - Editing a Custom Attack Group
    414
  - Deleting a Custom Attack Group
    414
- Unified Threat Management
  414
  - Creating UTM Profiles
    414
  - Creating an Antivirus Profile
    415
  - Creating an Antispam Profile
    416
  - Creating a Content Filtering Profile
    416
  - Creating a URL Filtering Profile
    417
    
    Miscellaneous UTM Features
    418
    
    Multipurpose Internet Mail Extension (MIME) Lists
    418
    
    Command Lists
    419
    
    Extension Lists
    419
    
    URL Patterns
    419
    
    URL Categories
    420
    
    Configuring External AV Profiles
    421
    
    Configuring Internal AV Profiles
    422
    
    Configuring ICAP AV Servers and Profiles
    423
    
    Configuring ICAP AV Profiles
    424
    
    Configuring Web Filtering Objects
    425
- Configuring Custom Policy Fields
  426
  - Defining Metadata
    427
    
    Instantiating New Objects
    427
  - Adding Custom Detail Object to Rules
    427
    
    Open Log Viewer
    428
- Configuring GTP Objects
  428
  - Configuring Info
    428
    
    Limiting GTP Message Length
    428
    
    Limiting GTP Message Rate
    429
    
    Limiting GTP Tunnels
    429
    
    Removing Inactive GTP Tunnels
    429
    
    Validating Sequence Numbers
    429
    
    Filtering GTP-In-GTP Packets
    430
    
    Inspecting Tunnel Endpoint Ids
    430
    
    Removing GTP R6 Informational Elements
    430
  - Configuring Traffic Logging and Counting
    430
    
    Traffic Counting
    430
    
    Traffic Logging
    430
  - Configuring IMSI Prefix and APN Filtering
    431
    
    Creating an APN Filter
    431
    
    Creating an IMSI Prefix Filter
    432
  - Configuring GTP Message Filtering
    433
  - Configuring Subscriber Tracing (Lawful Interception)
    433
    
    Example: Creating a GTP Object
    433
- Configuring Service Objects
  434
- Configuring SCTP Objects
  442
  - Configuring an SCTP Object
    442
- Configuring Authentication Servers
  442
- Configuring User Objects
  451
  - Configuring Local Users
    451
  - Configuring Local User Groups
    452
  - Configuring External Users
    452
  - Configuring External User Groups
    452
- Configuring VLAN Objects
  455
- Configuring IP Pools
  455
  - Using Multiple IP Ranges
    456
- Configuring Group Expressions
  456
- Table 40: Group Expression Operators
  457
- Figure 80: Configure External User Groups for Sales and Marketing
  459
- Figure 81: Configure Group Expression for Sales and Marketing
  459
- Configuring Remote Settings
  459
- Configuring Routing Instance Objects
  460
  - Viewing Routing Instance Objects
    460
  - Creating Routing Instance Objects
    460
- Configuring NAT Objects
  461
  - Configuring DIP Objects
    461
  - Configuring MIP Objects
    462
  - Configuring VIP Objects
    462
- Configuring Certificate Authorities
  462
  - Using Certificate Authorities
    463
  - Configuring Certificate Authorities
    463
- Configuring CRL Objects
  465
  - Using Crls
    465
  - Configuring Crls
    465
- Configuring Extranet Policies
  465
- Configuring Binary Data Objects
  466
  - Adding Binary Data Objects
    467
  - Viewing, Editing, and Deleting Binary Data Objects
    467
  - Configuring Protected Resources
    467
  - Creating Protected Resources
    468
  - Editing Protected Resources
    468
  - Configuring IKE Proposals
    469
  - Creating Custom IKE Phase1 Proposals
    469
  - Creating Custom IKE Phase 2 Proposals
    470
- Configuring Dial-In Objects
  471
- Configuring Border Signaling Gateway Objects
  472
Chapter 9 Configuring Security Policies

475
- About Security Policies
  476
  - Viewing Rulebase Columns for a Security Policy
    476
    
    Configuring Security Policies
    477
    
    Figure 82: Displaying the Select Visible Columns Dialog Box
    477
    
    Viewing and Editing Custom Policy Fields
    477
  - About Rulebases
    478
    
    Rule Execution Sequence
    479
  - About Rules
    480
  - About Firewall Rulebases
    480
    
    VPN Links and Rules
    481
    
    About Rule Groups
    482
  - About the Multicast Rulebase
    482
  - About IDP Rulebases on ISG Family Devices
    482
  - About IDP Rulebases on Standalone IDP Sensors
    483
  - Enabling Ipsec Null Encryption for IDP Inspection
    484
  - Managing Security Policies
    484
- Creating a Security Policy
  484
- Configuring Firewall Rules
  488
- Configuring Multicast Rules
  505
- Configuring Antivirus Rules
  507
- Configuring Antispam Rules
  508
- Configuring IDP Rules
  508
- Configuring Application Policy Enforcement (APE) Rules
  522
- Configuring Exempt Rules
  530
  - Adding the Exempt Rulebase
    530
  - Defining a Match
    531
    
    Configuring Source and Destination Address Objects
    531
    
    Configuring Source and Destination Zones
    531
  - Setting Attack Objects
    531
  - Specifying Vlans
    532
  - Setting Target Devices
    532
  - Entering Comments
    532
  - Creating an Exempt Rule from the Log Viewer
    532
- Configuring Backdoor Rules
  532
  - Adding the Backdoor Rulebase
    533
    
    Configuring Services
    534
    
    Configuring Source and Destination Address Objects
    534
    
    Configuring Source and Destination Zones
    534
    
    Defining a Match
    534
    
    Setting Operation
    535
    
    Table 44: Actions for Backdoor Rule
    535
  - Setting Actions
    535
  - Setting Notification
    535
    
    Setting Logging
    535
    
    Logging Packets
    536
    
    Setting an Alert
    536
    
    Setting Severity
    536
    
    Setting Target Devices
    536
    
    Specifying Vlans
    536
    
    Entering Comments
    537
- Configuring SYN Protector Rules
  537
  - The TCP Handshake
    537
    
    SYN-Floods
    537
  - Adding the SYN Protector Rulebase
    538
    
    Configuring Services
    538
    
    Configuring Source and Destination Address Objects
    538
    
    Defining a Match
    538
  - Setting Mode
    538
    
    Setting Logging
    539
    
    Setting Notification
    539
    
    Entering Comments
    540
    
    Logging Packets
    540
    
    Setting an Alert
    540
    
    Setting Severity
    540
    
    Setting Target Devices
    540
    
    Specifying Vlans
    540
  - Detecting TCP and UDP Port Scans
    541
    
    Detecting Other Scans
    541
    
    Example: Traffic Anomalies Rule
    541
    
    Example: Session Limiting
    542
    
    Example: Traffic Anomalies Rule
    542
    
    Session Limiting
    542
  - Adding the Traffic Anomalies Rulebase
    542
  - Defining a Match
    542
    
    Configuring Source and Destination Address Objects
    542
    
    Configuring Services
    543
  - Setting Detect Options
    543
  - Setting Response Options
    543
  - Setting Notification
    543
    
    Setting Logging
    543
  - Setting Severity
    544
    
    Logging Packets
    544
    
    Setting an Alert
    544
  - Specifying Vlans
    544
  - Setting Target Devices
    544
  - Entering Comments
    544
- Configuring Network Honeypot Rules
  545
  - Impersonating a Port
    545
  - Adding the Network Honeypot Rulebase
    545
  - Defining a Match
    545
    
    Configuring Destination Address Objects and Services
    545
    
    Configuring the Source
    545
  - Setting Response Options
    546
  - Setting Operation
    546
  - Setting Notification
    546
    
    Logging Packets
    546
    
    Setting an Alert
    546
    
    Setting Logging
    546
    
    Setting Target Devices
    547
  - Setting Severity
    547
    
    Entering Comments
    547
    
    Specifying Vlans
    547
- Installing Security Policies
  547
  - Assigning a Security Policy to a Device
    547
  - Validating Security Policies
    548
    
    Rule Duplication
    549
    
    Table 45: Rule Shadowing Example
    549
    
    Unsupported Options
    550
  - Installing New Security Policies
    550
  - Configuring IDP Policy Push Timeout
    551
  - Updating Existing Security Policies
    551
    
    Updating Only the IDP Rulebases on ISG Devices
    552
- Managing Rules and Policies
  553
- Pre and Post Rules
  565
  - Rule Application Sequence
    566
    
    Validation of Prerules and Postrules
    566
    
    Install-On Column for Prerules and Postrules
    567
  - Managing Prerules and Postrules
    567
    
    Add Prerules and Postrules
    567
    
    Push Prerules and Postrules to Regional Server
    567
    
    Delete Prerules and Postrules
    568
    
    Modify Prerules and Postrules
    568
- Polymorphic Objects
  568
  - Customizing Polymorphic Objects
    568
    
    Access Control of Polymorphic Object
    569
    
    Supported Polymorphic Object Categories
    569
    
    Table 46: Polymorphic Objects
    569
    
    Validation of Polymorphic Object
    569
  - Manage Polymorphic Objects
    570
    
    Add a Polymorphic Object to a Pre/Post Rule
    570
    
    Create a Polymorphic Object
    570
    
    Devices
    571
    
    Map a Polymorphic Object to a Real Value
    571
Chapter 10 Configuring Voice Policies

573
- Adding a BSG Transaction Rulebase
  573
- Adding Rules to the BSG Transaction Rulebase
  574
Chapter 11 Configuring Vpns

577
- About Vpns
  578
- Planning for Your VPN
  579
  - Determining Your VPN Members and Topology
    580
    
    Site-To-Site
    580
    
    Using Network Address Translation (NAT)
    580
    
    Creating Redundancy
    581
    
    Full Mesh
    581
    
    Hub and Spoke
    581
  - Protecting Data in the VPN
    582
    
    Using Ipsec
    582
    
    Using L2TP
    584
  - Choosing a VPN Tunnel Type
    584
    
    About Policy-Based Vpns
    584
    
    About Route-Based Vpns
    585
  - VPN Checklist
    585
    
    Define Members and Topology
    585
    
    Define Method: VPN Manager or Device-Level
    586
    
    Define Security Protocol (Encryption and Authentication)
    586
    
    Define VPN Type: Policy-Based, Route-Based, or Mixed-Mode
    586
- Preparing VPN Components
  588
- Creating Vpns with VPN Manager
  594
  - Adding the VPN
    595
    
    Adding RAS Users
    598
    
    Adding Routing-Based Members
    598
  - Configuring Topology
    600
    
    Configuring Common VPN Topologies
    600
    
    Configuring Gateway Properties
    602
    
    Configuring Gateways
    602
    
    Defining Termination Points
    602
    
    Configuring Gateway Security
    604
    
    Configuring IKE Ids
    605
    
    Configuring IKE
    606
    
    IKE Properties
    606
    
    Configuring Security Level
    607
  - Autogenerating VPN Rules
    608
  - Configuring Overrides
    608
    
    Editing Policy Rules
    608
    
    Editing Device Configuration
    609
    
    Viewing the Device Tunnel Summary
    610
  - Adding the VPN Link
    610
  - Editing Vpns
    610
    
    Editing the VPN Configuration
    611
    
    Editing Users
    611
    
    Editing VPN Overrides
    611
    
    Editing VPN Protected Resources
    611
- VPN Manager Examples
  611
- Creating Device-Level Vpns
  626
  - Supported Configurations
    627
  - Creating Autokey IKE Vpns
    627
    
    Ikev2 and EAP Support
    627
    
    Configuring Gateways
    628
    
    Configuring Routes (Route-Based Only)
    632
    
    Configuring the VPN
    632
    
    Adding a VPN Rule
    635
  - Creating Manual Key Vpns
    635
    
    Adding Xauth Users
    636
    
    Configuring Routes (Route-Based Only)
    636
    
    Configuring the VPN
    636
    
    Adding a VPN Rule
    638
  - Creating L2TP Vpns
    639
    
    Adding L2TP Users
    639
    
    Configuring L2TP
    639
  - Creating L2TP over Autokey IKE Vpns
    640
    
    Adding a VPN Rule
    640
  - Adding VPN Rules
    640
    
    Configuring the VPN
    640
    
    Assign and Install the Security Policy
    641
    
    Configuring the Security Policy
    641
- Device-Level VPN Examples
  641
- Auto-Connect Virtual Private Network
  650
  - Configuring ACVPN
    650
- IVE VPN Monitoring
  652
Chapter 12 Central Manager

653
- Central Manager Overview
  653
  - Regional Server and Central Manager Self-Sufficiency
    653
    
    Self-Sufficient Central Manager
    653
    
    Self-Sufficient Regional Server
    654
  - Super Admin User
    654
  - Regional Server Management
    654
  - Management Modes for J Series and SRX Series Devices
    654
    
    Central Management Mode
    654
  - Using Central Manager
    655
    
    Deleting a Regional Server Object
    656
    
    Logging into a Regional Server
    656
- Installing Global Policy to a Regional Server
  656
  - Prerule and Postrule Updates During Global Policy Install
    657
    
    Name Space Conflict Resolution for Shared Objects
    657
    
    Shared Objects Update During Global Policy Install
    657
    
    Name Space Conflict Resolution for Polymorphic Objects
    658
Chapter 13 Topology Manager

659
- Overview of the NSM Topology Manager
  659
  - About the NSM Topology Manager
    659
  - Requirements for a Topology Discovery
    659
- About the NSM Topology Manager Toolbar
  660
- Initiating a Topology Discovery
  661
- Viewing a Network Topology
  662
- About the NSM Topology Map Views
  662
  - Subnets View
    662
  - Groups View
    663
  - Menu Options in the Topology Map View
    663
- About the NSM Topology Table Views
  664
  - Devices View
    664
  - Endpoint Devices View
    665
  - Free Ports View
    665
  - Links View
    665
- About Topology Manager Preferences
  665
  - Default Credentials Tab
    666
  - Refresh Interval Tab
    666
  - Preferred Subnets Tab
    666
- Adding Discovered Devices to NSM
  666
Chapter 14 Role-Based Port Templates

669
- Using Role-Based Port Templates
  669
  - Managing Port Template Associations
    670
  - Apply or Edit a Port Template
    670
  - Detect and Resolve Configuration Conflicts
    672
  - Clone a Port Template
    672
  - Edit a Port Template
    673
Chapter 15 Unified Access Control Manager

675
Chapter 16 Realtime Monitoring

683
- About the Realtime Monitor
  683
  - Realtime Monitor Views
    684
- Monitoring Managed Devices
  684
  - Viewing Device Status
    684
  - Realtime Monitoring
    685
  - Table 47: Device Status Information
    685
  - Device Polling Intervals
    687
  - Table 48: Device Polling Intervals
    688
  - Viewing Device Monitor Alarm Status
    688
  - Setting the Polling Interval for Device Alarm Status
    688
  - Table 49: Device Detail Status Items
    689
  - Viewing Additional Device Detail and Statistics
    689
    
    Viewing Device Details
    689
    
    Table 50: Device Statistics Summary
    690
    
    Viewing Device Statistics
    690
    
    Table 51: Device-Specific Views
    691
    
    Table 52: Policy Distribution Items
    693
    
    Table 53: Protocol Distribution Items
    694
    
    Table 54: VPN Monitor Table
    696
    
    Table 55: Active VPN Table
    697
    
    Table 56: Ethernet Statistics View Data
    699
    
    Table 57: Flow Statistics View Data
    701
    
    Table 58: Attack Counters
    701
    
    Table 59: Resource Statistics Items
    705
    
    Table 60: Administrators View
    705
    
    Table 61: Authenticated Users View
    706
    
    Table 62: Active Sessions Items
    706
    
    Table 63: HA Statistics View
    709
    
    Table 64: Device Status Information
    710
- Monitoring IDP Sensors
  710
- Monitoring Vpns
  714
  - Viewing the VPN Status Summary
    714
  - Configuring a VPN Filter
    715
  - Modifying a VPN Filter
    715
  - Deleting a VPN Filter
    716
  - Configuring a VPN Display Filter
    716
  - Viewing Active VPN Details
    716
  - Viewing Device-Specific VPN Information
    716
- Monitoring NSRP Statistics
  716
  - Viewing NSRP Summary Information
    716
  - Table 69: NSRP Device Summary
    717
  - Viewing VSD/RTO Information
    717
    
    Table 70: VSD/RTO Summary
    718
    
    Table 71: VSD Counter Details
    718
    
    Table 72: RTO Counters Details
    719
    
    Table 73: IDP Cluster Monitor
    719
    
    Viewing RTO Counter Details
    719
- Monitoring IDP Clusters
  719
- Using the Realtime Monitor
  721
- Monitoring the Management System
  721
  - Configuring Servers
    722
    
    Configuring Device Servers
    722
    
    Configuring the GUI Server
    723
    
    Table 77: GUI Server Table
    723
  - Table 76: Server Information
    722
  - Using Server Monitor
    724
    
    Figure 99: Server Monitor (Machine-Wide Info)
    725
    
    Table 78: Server Monitor (Machine-Wide Info) Data
    725
    
    Table 79: Server Detail Status
    726
    
    Viewing Additional Server Status Details
    726
    
    Viewing Process Status
    727
    
    Figure 100: Process Status for the Device Server
    728
    
    Figure 101: Process Status for the GUI Server
    728
    
    Table 80: Process Status
    728
    
    Table 81: Management System Utilities
    729
  - Using Schema Information
    730
  - Viewing Device Schema
    731
Chapter 17 Analyzing Your Network

733
- About the Dashboard
  733
- About the Profiler
  733
  - Example of Unique Events
    734
  - Analyzing Your Network
    735
- Setting up the Profiler
  735
  - Configuring the Profiler
    736
  - Table 82: General IDP Profiler Settings
    736
  - Enabling os Fingerprinting
    737
    
    Configuring Context Profiles
    737
    
    Configuring Alerts
    738
  - Updating Profiler Settings
    738
  - Customizing Profiler Preferences
    739
  - Starting Profiler Operations on ISG Devices Without IDP Rules
    739
  - Starting the Profiler
    739
  - Stopping the Profiler
    739
- About Profiler Views
  740
  - About the Protocol Profiler
    741
  - Table 83: Protocol Profiler Data
    741
  - About the Network Profiler
    742
  - Table 84: Network Profiler Data
    742
  - About the Violation Viewer
    743
    
    Configuring Permitted Objects
    743
    
    Table 85: Applciation Profiler Data
    745
  - About the Application Profiler
    745
  - Using Profiler Views
    746
    
    Violation Viewer
    746
    
    Filtering and Sorting from the Application Profiler
    747
    
    Refreshing Profiler Data
    748
    
    Viewing Database Information
    748
    
    Table 86: Detailed Network Information Data
    749
    
    Purging the Database
    750
- Recommended Profiler Options
  750
  - Configuring a Network Baseline
    751
    
    Identifying a Baseline
    751
    
    Setting a Baseline
    751
  - Keeping Your Network Current
    751
  - Proactively Updating Your Network
    752
  - Reacting to Vulnerability Announcements
    752
    
    Example: Identifying Vulnerable Components
    752
  - Stopping Worms and Trojans
    753
    
    Example: SQL Worm
    753
    
    Example: Blaster Worm
    754
- Accessing Data in the Profiler Database
  754
- About Security Explorer
  755
  - Figure 102: Security Explorer
    756
  - Security Explorer Main Graph
    756
    
    Graph Types
    757
  - Connections Detail Pane
    757
  - Log Viewer
    758
  - Reference Point Pane
    758
  - Reports Viewer
    758
- Using Security Explorer
  758
  - Permissions
    759
  - Analyzing Relationships
    759
    
    Viewing Data
    759
    
    Setting a Time Duration
    760
    
    Table 87: Transitional Graphs
    760
    
    Transitioning to Other Relational Graphs
    760
    
    Viewing Predefined Reports
    760
    
    Adding and Removing Panels
    761
    
    Refreshing Data
    761
  - Exporting to HTML
    761
  - Logging
    763
Chapter 18 Logging

763
- About Logging
  763
  - About Log Entries
    764
    
    About Log Events
    764
    
    About Log Severity
    765
    
    Table 89: Log Entry Severity Levels for DMI Devices
    765
    
    Table 90: Log Entry Severity Levels for Screenos and IDP Devices
    765
  - Table 88: Event-Generated Log Entries
    764
- Viewing Logs
  766
  - Device Limitations for Viewing Logs
    767
- Configuring the Device for Logging
  767
  - Configuring Severity Settings
    768
  - Table 91: Destinations of Log Entry Severities
    768
  - Configuring E-Mail Server Settings
    769
    
    Forwarding Self Log Entries (Firewall Options)
    769
    
    Table 92: Self Log Entry Settings
    769
    
    Table 93: Email Server Settings for Log Entries
    769
  - Configuring Events Reporting Settings
    770
    
    Deep Inspection Alarm Log Entries
    771
    
    Event Alarm Log Entries
    771
    
    Traffic Alarm Log Entries
    771
    
    Configuration Log Entries
    772
    
    Information Log Entries
    772
    
    Self Log Entries
    773
    
    Traffic Log Entries
    773
    
    Attack Statistics
    774
    
    Ethernet Statistics
    774
    
    Flow Statistics
    774
    
    Policy Statistics
    774
    
    Protocol Distribution
    774
    
    Atomic Updating Events
    775
  - Configuring SNMP Reporting Settings
    775
  - Directing Logs to a Syslog Server
    776
  - Directing Data to a Webtrends Server
    777
  - Managing Packet Data in Logs
    777
  - Table 94: Syslog Settings for Log Entries
    777
  - Table 95: Webtrends Settings for Log Entries
    777
  - Figure 103: View Packet Data in a Log
    779
  - Figure 104: Sample Packet Data
    780
- Using the Log Viewer
  780
  - Using Log Views
    781
    
    Table 96: EX Series Switch Predefined Log Views
    781
    
    Table 97: SSL/UAC Predefined Log Views
    782
    
    Creating Custom Views and Folders
    783
    
    Table 98: Predefined Log Views
    783
    
    Creating Per-Session Views
    784
    
    Table 99: Log Viewer Columns
    784
    
    Log Viewer Detail Panes
    787
    
    Figure 105: View Category and Severity Filters
    788
    
    Log Viewer Status Bar
    788
    
    Navigating the Log Viewer
    788
    
    Table 100: Log Viewer Navigation Controls
    788
  - Searching Log Entries
    788
    
    Log Timeline
    789
    
    Table 101: Search Tools for Log Viewer
    789
    
    Figure 106: Log Viewer Time Slider
    790
    
    Figure 107: Log Viewer Time Display
    790
    
    Table 102: Log Viewer Flags
    791
    
    Using Flags
    791
    
    Using Log ID Number
    792
    
    Using the Find Utility
    792
  - Filtering Log Entries by Event and Time
    792
    
    Setting a Category Filter
    792
    
    Setting a Flag Filter
    793
    
    Setting a Protocol Filter
    793
    
    Setting an Address Filter
    793
    
    Setting an Alert Filter
    793
    
    Setting a Domain Filter
    794
    
    Setting a Time-Based Filter
    794
  - Filtering Log Entries by Range
    794
    
    Setting a Bytes in or Bytes out Range Filter
    795
    
    Setting a Port Number Range Filter
    795
  - Customizing Columns
    796
    
    Hide, Unhide, and Move Columns
    796
    
    Using Column Settings
    796
  - Filtering Log Entries by Column
    798
  - Figure 108: Filter Summary Dialog Box
    799
  - Using Log Viewer Integration
    800
    
    Jump to Device Configuration
    800
    
    Jump to Policy
    800
    
    Figure 109: Viewing Summary Panel
    801
    
    Table 103: Irrelevant Versus Relevant Attacks
    801
  - Identifying Irrelevant Attacks
    801
- Using the Log Investigator
  802
  - About the Log Investigator UI
    803
  - Figure 110: Log Investigator UI Overview
    803
  - Configuring Log Investigator Options
    804
    
    Configuring a Time Period
    804
    
    Configuring Axes
    805
    
    Figure 111: Configure Time Period Filter
    805
    
    Figure 112: Changing Time Period Filter
    805
    
    Setting a Log Entry Limit
    806
    
    Table 104: Log Investigator Filters
    807
    
    Example: Setting Filters in the Log Investigator
    808
    
    Figure 113: View Log Investigator Results
    809
  - Investigating Log Entry Data
    809
    
    Using Rows and Columns
    809
    
    Table 105: Log Investigator Analysis
    810
    
    Using Cells
    810
  - Zoom Details
    811
  - Excluding Data
    812
  - Jumping to the Log Viewer
    812
- Using the Audit Log Viewer
  812
- Managing Log Volume
  816
  - Automatic Device Log Cleanup
    817
  - Archiving Logs
    818
  - Log Archival Mechanism
    818
  - Setting Log Storage Limits
    818
    
    Obsolete Logs
    819
    
    Required Disk Space
    819
    
    System-Wide Retention Policy
    819
- Forwarding Logs
  820
  - Sending E-Mail Notification of Downed Device
    820
  - Using the Action Manager to Forward Logs by Domain
    820
    
    Configuring Action Parameters
    821
    
    Setting Device Log Action Criteria
    822
  - Using the Log2Action Utility to Export Logs
    824
    
    Using Filters
    824
    
    Table 107: Common Filters
    825
    
    Exporting to CSV
    827
    
    Exporting to XML
    827
    
    Using XML Required and Optional Format-Specific Filters
    827
    
    Viewing XML Format Output
    827
    
    Exporting to SNMP
    828
    
    Using CSV Required and Optional Format-Specific Filters
    828
    
    Viewing CSV Format Output
    828
    
    Exporting to E-Mail
    829
    
    Using SNMP Required and Optional Format-Specific Filters
    829
    
    Viewing SNMP Format Output
    829
    
    Exporting to Syslog
    830
    
    Using E-Mail Required and Optional Format-Specific Filters
    830
    
    Using Syslog Required and Optional Format-Specific Filters
    830
    
    Exporting to a Script
    831
    
    Using Script Required and Optional Format-Specific Filters
    831
    
    Viewing Syslog Format Output
    831
    
    Reporting
    833
Chapter 19 Reporting

833
- About Reporting
  833
  - Report Type Groupings
    833
  - Graphical Data Representation
    834
  - Integration with Logs
    834
  - Central Access to Management Information
    834
- Report Types
  835
  - Predefined Reports
    835
    
    Table 108: Firewall and VPN Reports
    835
    
    Table 109: DI/IDP Reports
    836
    
    Table 110: Screen Reports
    837
    
    Table 111: Administrative Reports
    838
    
    Table 112: UAC Reports
    838
    
    SSL/VPN Reports
    839
    
    Table 113: Profiler Reports
    839
    
    Table 114: AVT Reports
    839
    
    EX Series Switches Report
    840
    
    Table 115: SSL/VPN Reports
    840
    
    Table 116: EX-Switch Reports
    840
  - My Reports
    840
  - Shared Reports
    840
- Working with Reports
  840
  - Generating a Predefined Report
    841
  - Creating a Custom Report
    841
    
    Example: Creating a Custom Report
    841
  - Deleting Reports
    842
  - Organizing Reports in Folders
    842
  - Generating Reports Automatically
    842
    
    Running Reports Using the Guisvrcli.sh Utility
    842
    
    Creating and Editing Action Scripts
    843
    
    Using Cron with Scheduled Reports
    844
  - Exporting Reports to HTML
    845
- Setting Report Options
  846
  - Naming a Report
    846
  - Setting the Report Type
    846
  - Configuring Report Source Data
    847
  - Configuring a Report Time Period
    847
  - Configuring the Data Point Count
    847
  - Configuring the Chart Type
    847
  - Sharing Your Custom Report
    847
  - Modifying Report Filters
    847
  - Configuring Report Processing Warnings
    848
  - Saving Your Report Settings
    848
- Log Viewer Integration
  848
- Using Reports
  849
- Using the Watch List
  853
Appendix A Glossary

857
Appendix B Unmanaged Screenos Commands

883
- Table 119: Surfcontrol Web Categories
  885
Appendix D Common Criteria EAL2 Compliance

893
- Guidance for Intended Usage
  893
- Guidance for Personnel
  893
- Guidance for Physical Protection
  893
Appendix E Log Entries

895
- Table 120: Screen Alarm Log Entries
  895
- Table 121: Alarm Log Entries
  897
- Deep Inspection Alarm Log Entries
  898
- Table 122: Deep Inspection Alarm Log Entries
  899
- Table 123: Configuration Log Entries
  973
- Information Log Entries
  975
- Table 124: Information Log Entries
  976
- Traffic Log Entries
  977
- Self Log Entries
  977
- GTP Log Entries
  978
- Index
  981

Juniper Categories

Network Router

Switch Gateway Software Network Hardware

More Juniper Manuals

Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Manuals

Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE REV1 Administration Manual (1000 pages)

Table of Contents

Chapter 1 Introduction to Network and Security Manager

Chapter 2 Planning Your Virtual Network

Chapter 3 Configuring Role-Based Administration

Chapter 4 Adding Devices

Chapter 5 Configuring Devices

Chapter 6 Updating Devices

Chapter 7 Managing Devices

Chapter 8 Configuring Objects

Chapter 9 Configuring Security Policies

Chapter 10 Configuring Voice Policies

Chapter 11 Configuring Vpns

Chapter 12 Central Manager

Chapter 13 Topology Manager

Chapter 14 Role-Based Port Templates

Chapter 15 Unified Access Control Manager

Chapter 16 Realtime Monitoring

Chapter 17 Analyzing Your Network

Chapter 18 Logging

Chapter 19 Reporting

Appendix A Glossary

Appendix B Unmanaged Screenos Commands

Appendix D Common Criteria EAL2 Compliance

Appendix E Log Entries

Related Products

Juniper Categories