Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Manuals

Manuals and User Guides for Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1. We have 1 Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 manual available for free PDF download: Administration Manual

Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual (1026 pages)

Brand: Juniper | Category: Software | Size: 13 MB

Table of Contents
7
About this Guide
45
Audience
45
Objectives
45
Conventions
46
Table 1: Notice Icons
46
Table 2: Text Conventions
46
About this Guide
47
Documentation
47
Table 3: Syntax Conventions
47
Table 4: Network and Security Manager Publications
47
Requesting Technical Support
49
- Self-Help Online Tools and Resources
  49
- Opening a Case with JTAC
  50
Getting Started with NSM
51
Chapter 1 Introduction to Network and Security Manager

53
- About NSM
  53
  - Security Integration
    54
    
    Device Configuration
    54
    
    Network Organization
    54
    
    Role-Based Administration
    54
    
    Centralized Device Configuration
    55
  - Device Management
    55
    
    Introduction to Network and Security Manager
    55
    
    Device Modeling
    56
    
    Importing Devices
    56
    
    Policy-Based Management
    56
    
    Rapid Deployment
    56
  - Error Prevention, Recovery, and Auditing
    57
    
    Atomic Configuration and Updating
    57
    
    Device Configuration Validation
    57
    
    Introduction to Network and Security Manager
    57
    
    Policy Validation
    57
    
    Auditing
    58
    
    Device Image Updates
    58
  - Complete System Management
    58
    
    VPN Abstraction
    58
    
    Integrated Logging and Reporting
    59
    
    Job Management
    59
    
    Monitoring Status
    59
- Technical Overview
  60
- Working in the User Interface
  73
  - Characters Not Supported in Login Passwords
    73
  - Managing Blocked Login Attempts
    73
  - Configuring UI Preferences
    73
  - UI Overview
    74
    
    Figure 3: Overview of the User Interface
    74
    
    Navigation Tree
    74
    
    Common Tasks Pane
    75
    
    Main Display Area
    75
    
    Menu Bar
    75
    
    Status Bar
    75
    
    Toolbar
    75
  - NSM Modules
    75
    
    Investigate Modules
    75
    
    Configure Modules
    77
    
    Administer Modules
    81
  - Validation Icons in the User Interface
    81
  - Validation and Data Origination Icons
    82
  - Table 13: Validation Status for Devices
    82
  - Table 14: Validation Icons
    82
  - Working with Other NSM Administrators
    83
  - Searching in the User Interface
    83
    
    Contains String [C] Search Mode
    84
    
    Figure 4: UI Search Modes
    84
    
    Figure 5: "Contains String" Search Mode Example
    84
    
    Starts with [S] Search Mode
    84
    
    Figure 6: "Starts With" Search Mode Example
    85
    
    Figure 7: "Regular Expression" Search Mode Details
    85
    
    Regular Expression [R] Search Mode
    85
    
    Figure 8: "Regular Expression" Search Mode Example
    86
    
    IP [I] Search Mode
    86
    
    Figure 9: "IP Address" Search Mode Example
    87
    
    Search for an Exact Match (E)
    87
  - Global Search
    88
  - Figure 10: Exact String Search Mode Example
    88
Chapter 2 Planning Your Virtual Network

91
- Configuring Devices Overview
  91
- Configuring IDP-Capable Devices Overview
  95
  - Common Criteria EAL2 Compliance
    95
  - Guidance for Intended Usage
    95
  - Guidance for Personnel
    95
    
    Guidance for Physical Protection
    95
    
    Supported IDP-Capable Devices
    95
  - Enabling Jumbo Frames (ISG1000 Only)
    96
  - Enabling IDP Functionality
    97
    
    Installing Advanced License Keys
    97
    
    Module
    97
    
    Updating Attack Objects
    97
    
    Adding Objects (Optional)
    98
    
    Configuring a Security Policy for IDP
    98
    
    Reviewing IDP Logs
    103
  - Maintaining IDP
    104
  - Creating IDP-Only Administrators
    104
- Simplifying Management
  105
  - Using Device Groups
    105
    
    Using Device Templates
    105
    
    Merging Policies
    106
    
    Using Configuration Groups
    106
  - Using a Naming Convention
    106
    
    Example: Using a Naming Convention for Address Objects
    107
    
    Example: Using a Naming Convention for Devices
    107
    
    Figure 11: Selecting the GUI Server in Central Manager
    108
- Creating an Information Banner
  108
Chapter 3 Configuring Role-Based Administration

111
Chapter 4 Adding Devices

147
- About Device Creation
  148
  - Adding Devices
    149
  - Determine Device Status
    149
  - Managing the Device
    150
  - Verifying Device Configuration
    150
- Before You Begin Adding Devices
  150
  - Importing Versus Modeling
    151
    
    Modeling Device Configurations
    151
    
    Device Add Process
    152
  - Selecting the Domain
    152
  - Figure 24: Connecting Devices from Different Domains in Vpns
    153
  - Adding Single or Multiple Devices
    153
  - Specifying the os and Version
    154
  - Determining Port Mode (Screenos Devices Only)
    154
    
    Figure 25: Trust-Untrust Port Mode Bindings
    155
    
    Figure 26: Home-Work Port Mode Bindings
    155
    
    Combined Port Mode
    156
    
    Figure 27: Dual-Untrust Port Mode Bindings
    156
    
    Figure 28: Combined Port Mode Bindings
    157
    
    Trust-Untrust-DMZ Port Mode
    157
    
    Figure 29: Trust-Untrust-DMZ Port Mode Bindings
    158
    
    Figure 30: Extended Port-Mode Interface to Zone Bindings
    158
    
    Table 19: Extended Bindings
    158
    
    Figure 31: DMZ Dual Untrust Port Mode
    159
    
    Table 20: Security Device Port Mode Summary (Part 1)
    160
    
    Table 21: Security Device Port Mode Summary (Part 2)
    160
    
    Changing the Port Mode
    161
    
    Table 22: Supported Add Device Workflows by Device Family
    161
    
    Importing Devices
    162
  - Requirements
    163
  - Adding and Importing Devices with Static IP Addresses
    163
    
    Screenos Devices
    163
    
    IDP Sensors
    165
    
    Junos Devices
    166
    
    SA and IC Devices
    167
  - Adding Devices with Dynamic IP Addresses
    168
    
    Screenos Devices
    168
    
    IDP Sensors
    170
    
    Device
    171
    
    Adding and Importing a Junos Device with a Dynamic IP Address
    175
  - Verifying Imported Device Configurations
    178
    
    Using Device Manager
    178
    
    Using Device Monitor
    178
    
    Using Configuration Summaries
    179
    
    Using Job Manager
    179
- Modeling Devices
  180
  - Modeling a Device
    181
  - Requirements
    181
  - Creating a Device Configuration
    182
  - Activating a Device
    182
    
    Devices with Static IP Addresses
    182
    
    Devices with Dynamic IP Addresses
    185
- Using Rapid Deployment (Screenos Only)
  189
  - Creating the Configlet
    191
    
    Installing the Configlet
    193
    
    Preparing the Device
    194
  - Installing the Configlet
    194
  - Updating the Device Configuration
    195
    
    Delta Option
    196
    
    Fails
    196
    
    Summarize Delta Configuration
    196
    
    But Has no Admin Privileges
    197
    
    Option
    197
- Adding Vsys Devices
  197
- Adding an Extranet Device
  201
- Adding Clusters
  201
- Adding Many Devices Using CSV Files
  219
- Adding Device Groups
  231
  - Example: Creating a Device Group
    232
- Setting up NSM to Work with Infranet Controller and Infranet Enforcer
  233
  - Avoiding Naming Conflicts of the Authorization Server Object
    233
  - Avoiding NACN Password Conflicts
    235
Chapter 5 Configuring Devices

237
Chapter 6 Updating Devices

293
- About Updating
  293
  - How the Update Process Works
    294
  - Updating Devices
    295
  - Devices
    297
- Knowing When to Update
  298
  - Verifying Device Status in Device Monitor
    299
    
    Configuration Status
    299
    
    Connection Status
    299
  - Verifying Device Status in Device Manager
    301
  - Reviewing Logs
    301
  - Identifying Administrative Changes
    302
  - Reviewing Reports
    302
- Using Preview Tools
  302
- Performing an Update
  306
  - Retrying a Failed Update
    307
  - Configuring Update Options
    307
    
    Update Options for DMI-Compatible Devices
    308
- Tracking Device Updates
  308
Chapter 7 Managing Devices

315
Chapter 8 Configuring Objects

371
- About Objects
  372
  - Configuring Objects
    373
  - Replacing Objects
    374
  - Using Objects Across Domains
    374
  - Working with Object Versions
    375
  - Working with Unused Shared Objects
    375
    
    Deleting an Unused Shared Object
    375
    
    Searching for Unused Shared Objects
    375
  - Configuring Address Objects
    376
  - Searching for and Deleting Duplicate Objects
    376
  - Creating Address Objects
    377
    
    Adding a Network Address Object
    378
    
    Adding an Address Object Group
    379
    
    Editing and Deleting Address Objects
    379
    
    Replacing Address Objects
    379
    
    Adding a Multicast Group Address Object
    380
    
    Adding Static DNS Host Addresses
    381
    
    Table 31: Application Table Tab Information
    382
  - Viewing Address Objects
    377
  - Blocked Hosts
    382
- Configuring Application Objects
  382
- Configuring Schedule Objects
  384
  - Creating Schedule Objects
    384
- Configuring Access Profile Objects
  385
- Configuring Quality of Service Profiles
  385
- Working with DI Attack Objects
  387
- Working with IDP Attack Objects
  391
- Configuring Custom DI and IDP Attack Objects
  393
- Creating Custom DI Attack Groups
  412
- Creating Custom IDP Attack Groups
  413
  - Creating Static Attack Groups
    413
  - Creating Dynamic Attack Groups (IDP Only)
    414
  - Figure 78: New Dynamic Group
    415
  - Figure 79: New Dynamic Group Members
    416
  - Updating Dynamic Groups
    416
  - Editing a Custom Attack Group
    417
  - Deleting a Custom Attack Group
    417
- Unified Threat Management
  417
  - Creating UTM Profiles
    417
  - Creating an Antivirus Profile
    418
  - Creating an Antispam Profile
    419
  - Creating a Content Filtering Profile
    419
  - Creating a URL Filtering Profile
    420
    
    Extension Lists
    421
    
    Miscellaneous UTM Features
    421
    
    Multipurpose Internet Mail Extension (MIME) Lists
    421
    
    Command Lists
    422
    
    URL Categories
    422
    
    URL Patterns
    422
    
    Configuring External AV Profiles
    424
    
    Configuring Internal AV Profiles
    425
    
    Configuring ICAP AV Servers and Profiles
    426
    
    Configuring ICAP AV Profiles
    427
    
    Configuring Web Filtering Objects
    428
- Configuring Custom Policy Fields
  429
  - Defining Metadata
    430
    
    Instantiating New Objects
    430
  - Adding Custom Detail Object to Rules
    430
    
    Open Log Viewer
    431
- Configuring GTP Objects
  431
  - Configuring Info
    431
    
    Limiting GTP Message Length
    431
    
    Limiting GTP Message Rate
    432
    
    Limiting GTP Tunnels
    432
    
    Removing Inactive GTP Tunnels
    432
    
    Validating Sequence Numbers
    432
    
    Filtering GTP-In-GTP Packets
    433
    
    Inspecting Tunnel Endpoint Ids
    433
    
    Removing GTP R6 Informational Elements
    433
  - Configuring Traffic Logging and Counting
    433
    
    Traffic Counting
    433
    
    Traffic Logging
    433
  - Configuring IMSI Prefix and APN Filtering
    434
    
    Creating an APN Filter
    434
    
    Creating an IMSI Prefix Filter
    435
  - Configuring GTP Message Filtering
    436
  - Configuring Subscriber Tracing (Lawful Interception)
    436
    
    Example: Creating a GTP Object
    436
- Configuring Service Objects
  437
- Configuring SCTP Objects
  445
  - Configuring an SCTP Object
    445
- Configuring Authentication Servers
  445
- Configuring User Objects
  454
  - Configuring Local Users
    454
  - Configuring Local User Groups
    455
  - Configuring External Users
    455
  - Configuring External User Groups
    456
- Configuring VLAN Objects
  458
- Configuring IP Pools
  458
  - Using Multiple IP Ranges
    459
  - Table 40: Group Expression Operators
    460
- Configuring Group Expressions
  460
- Figure 80: Configure External User Groups for Sales and Marketing
  462
- Figure 81: Configure Group Expression for Sales and Marketing
  462
- Configuring Remote Settings
  463
- Configuring Routing Instance Objects
  463
  - Viewing Routing Instance Objects
    464
  - Creating Routing Instance Objects
    464
- Configuring NAT Objects
  464
  - Configuring Legacy NAT Objects
    465
    
    Configuring DIP Objects
    465
    
    Configuring Destination NAT Objects
    466
    
    Configuring MIP Objects
    466
    
    Configuring VIP Objects
    466
  - Configuring Junos os NAT Objects
    467
    
    Configuring Source NAT Objects
    467
    
    Table 41: Source NAT Configuration Options
    468
    
    Configuring Destination NAT Objects
    469
    
    Table 42: Destination NAT Configuration Options
    470
- Configuring Certificate Authorities
  472
  - Using Certificate Authorities
    473
  - Configuring Certificate Authorities
    473
- Configuring CRL Objects
  474
  - Using Crls
    474
  - Configuring Crls
    475
- Configuring Extranet Policies
  475
- Configuring Binary Data Objects
  476
  - Adding Binary Data Objects
    476
  - Viewing, Editing, and Deleting Binary Data Objects
    477
  - Configuring Protected Resources
    477
  - Creating Protected Resources
    478
  - Editing Protected Resources
    478
  - Configuring IKE Proposals
    478
  - Creating Custom IKE Phase1 Proposals
    479
  - Creating Custom IKE Phase 2 Proposals
    480
- Configuring Dial-In Objects
  481
- Configuring Border Signaling Gateway Objects
  482
Chapter 9 Configuring Security Policies

485
- About Security Policies
  486
  - Viewing Rulebase Columns for a Security Policy
    486
  - Configuring Security Policies
    487
  - Figure 82: Displaying the Select Visible Columns Dialog Box
    487
  - About Rulebases
    488
    
    Rule Execution Sequence
    489
  - About Rules
    490
  - About Firewall Rulebases
    490
    
    Firewall Rules (Zone and Global)
    490
    
    VPN Links and Rules
    491
    
    About Rule Groups
    492
  - About the Multicast Rulebase
    492
  - About IDP Rulebases on ISG Family Devices
    492
  - About IDP Rulebases on Standalone IDP Sensors
    493
  - Enabling Ipsec Null Encryption for IDP Inspection
    494
  - Managing Security Policies
    494
- Creating a Security Policy
  494
  - Configuring Objects for Rules
    495
    
    Applying the same Object to Multiple Rules
    495
    
    Running Screenos or Junos os
    496
  - Using the Policy Filter Tool
    496
    
    Filtering the Comment Field
    496
  - Using a Predefined IDP Policy
    496
  - Using the Policy Creation Wizard
    497
  - Adding Rulebases
    498
- Configuring Firewall Rules
  498
- Configuring Multicast Rules
  516
- Configuring Antivirus Rules
  517
- Configuring Antispam Rules
  518
- Configuring IDP Rules
  518
- Configuring Application Policy Enforcement (APE) Rules
  533
- Configuring Exempt Rules
  541
  - Adding the Exempt Rulebase
    542
  - Defining a Match
    542
    
    Configuring Source and Destination Address Objects
    542
    
    Configuring Source and Destination Zones
    542
  - Setting Attack Objects
    543
  - Specifying Vlans
    543
  - Setting Target Devices
    543
  - Entering Comments
    543
  - Creating an Exempt Rule from the Log Viewer
    543
- Configuring Backdoor Rules
  544
  - Adding the Backdoor Rulebase
    545
  - Defining a Match
    545
    
    Configuring Source and Destination Address Objects
    545
    
    Configuring Source and Destination Zones
    545
    
    Configuring Services
    546
    
    Setting Operation
    546
    
    Table 46: Actions for Backdoor Rule
    546
  - Setting Actions
    546
    
    Setting Notification
    546
    
    Logging Packets
    547
    
    Setting an Alert
    547
    
    Setting Logging
    547
    
    Setting Severity
    547
    
    Entering Comments
    548
    
    Setting Target Devices
    548
    
    Specifying Vlans
    548
- Configuring SYN Protector Rules
  548
  - The TCP Handshake
    548
    
    SYN-Floods
    548
  - Adding the SYN Protector Rulebase
    549
    
    Configuring Source and Destination Address Objects
    549
    
    Defining a Match
    549
  - Setting Mode
    550
    
    Configuring Services
    550
    
    Setting Notification
    550
    
    Setting an Alert
    551
    
    Setting Severity
    551
    
    Entering Comments
    552
    
    Setting Target Devices
    552
    
    Specifying Vlans
    552
- Configuring Traffic Anomalies Rules
  552
  - Detecting TCP and UDP Port Scans
    552
    
    Example: Traffic Anomalies Rule
    552
    
    Detecting Other Scans
    553
    
    Example: Session Limiting
    553
    
    Example: Traffic Anomalies Rule
    553
    
    Session Limiting
    553
  - Adding the Traffic Anomalies Rulebase
    553
    
    Configuring Services
    554
    
    Configuring Source and Destination Address Objects
    554
    
    Defining a Match
    554
  - Setting Detect Options
    554
  - Setting Response Options
    554
  - Setting Notification
    554
    
    Logging Packets
    555
    
    Setting an Alert
    555
    
    Setting Logging
    555
  - Setting Severity
    555
  - Entering Comments
    556
  - Specifying Vlans
    556
  - Setting Target Devices
    556
- Configuring Network Honeypot Rules
  556
  - Impersonating a Port
    556
  - Adding the Network Honeypot Rulebase
    556
    
    Configuring the Source
    557
  - Defining a Match
    557
    
    Configuring Destination Address Objects and Services
    557
  - Setting Operation
    557
  - Setting Response Options
    557
  - Setting Notification
    557
    
    Setting Logging
    557
  - Setting Severity
    558
    
    Logging Packets
    558
    
    Setting an Alert
    558
  - Specifying Vlans
    558
  - Setting Target Devices
    558
  - Entering Comments
    558
- Installing Security Policies
  559
- Managing Rules and Policies
  564
- Pre and Post Rules
  576
  - Rule Application Sequence
    578
    
    Install-On Column for Prerules and Postrules
    578
    
    Screenos Devices
    578
    
    Validation of Prerules and Postrules
    578
  - Managing Prerules and Postrules
    579
    
    Add Prerules and Postrules
    579
    
    Modify Prerules and Postrules
    579
    
    Push Prerules and Postrules to Regional Server
    579
    
    Delete Prerules and Postrules
    580
- Polymorphic Objects
  580
  - Customizing Polymorphic Objects
    580
    
    Access Control of Polymorphic Object
    581
    
    Supported Polymorphic Object Categories
    581
    
    Table 48: Polymorphic Objects
    581
    
    Validation of Polymorphic Object
    581
  - Manage Polymorphic Objects
    581
    
    Add a Polymorphic Object to a Pre/Post Rule
    582
    
    Create a Polymorphic Object
    582
    
    Devices
    583
    
    Map a Polymorphic Object to a Real Value
    583
Chapter 10 Configuring Voice Policies

585
- Adding a BSG Transaction Rulebase
  585
- Adding Rules to the BSG Transaction Rulebase
  586
Chapter 11 Configuring Junos NAT Policies

589
Chapter 12 Configuring Vpns

601
- About Vpns
  602
- Planning for Your VPN
  603
  - Determining Your VPN Members and Topology
    604
    
    Site-To-Site
    604
    
    Using Network Address Translation (NAT)
    604
    
    Full Mesh
    605
    
    Hub and Spoke
    605
    
    Creating Redundancy
    606
  - Protecting Data in the VPN
    606
    
    Using Ipsec
    606
    
    Using L2TP
    608
  - Choosing a VPN Tunnel Type
    608
    
    About Policy-Based Vpns
    609
    
    About Route-Based Vpns
    609
  - VPN Checklist
    609
    
    Define Members and Topology
    609
    
    Define Method: VPN Manager or Device-Level
    610
    
    Define Security Protocol (Encryption and Authentication)
    610
    
    Define VPN Type: Policy-Based, Route-Based, or Mixed-Mode
    610
- Preparing VPN Components
  612
- Creating Vpns with VPN Manager
  618
  - Adding the VPN
    619
    
    Adding RAS Users
    622
    
    Adding Routing-Based Members
    622
  - Configuring Topology
    624
    
    Configuring Common VPN Topologies
    624
    
    Configuring Gateway Properties
    626
    
    Configuring Gateways
    626
    
    Defining Termination Points
    626
    
    Configuring Gateway Security
    628
    
    Configuring IKE Ids
    629
  - Configuring IKE
    630
    
    IKE Properties
    630
    
    Configuring Security Level
    632
  - Autogenerating VPN Rules
    632
  - Configuring Overrides
    633
    
    Editing Policy Rules
    633
    
    Editing Device Configuration
    634
    
    Viewing the Device Tunnel Summary
    634
  - Adding the VPN Link
    635
  - Editing Vpns
    635
    
    Editing Users
    635
    
    Editing VPN Protected Resources
    635
    
    Editing the VPN Configuration
    636
    
    Editing VPN Overrides
    636
- VPN Manager Examples
  636
- Creating Device-Level Vpns
  651
  - Supported Configurations
    652
  - Creating Autokey IKE Vpns
    652
    
    Ikev2 and EAP Support
    652
  - Configuring Gateways
    653
    
    Configuring Routes (Route-Based Only)
    657
    
    Configuring the VPN
    657
    
    Adding a VPN Rule
    660
  - Creating Manual Key Vpns
    660
    
    Adding Xauth Users
    661
    
    Configuring Routes (Route-Based Only)
    661
    
    Configuring the VPN
    661
    
    Adding a VPN Rule
    663
  - Creating L2TP Vpns
    664
    
    Adding L2TP Users
    664
    
    Configuring L2TP
    664
  - Creating L2TP over Autokey IKE Vpns
    665
    
    Adding a VPN Rule
    665
  - Adding VPN Rules
    665
    
    Configuring the VPN
    665
    
    Assign and Install the Security Policy
    666
    
    Configuring the Security Policy
    666
- Device-Level VPN Examples
  666
- Auto-Connect Virtual Private Network
  675
  - Configuring ACVPN
    676
- IVE VPN Monitoring
  677
Chapter 13 Central Manager

679
- Central Manager Overview
  679
  - Regional Server and Central Manager Self-Sufficiency
    679
    
    Self-Sufficient Regional Server
    680
  - Super Admin User
    680
  - Regional Server Management
    680
  - Management Modes for J Series and SRX Series Devices
    680
    
    Central Management Mode
    680
    
    Device Management Mode
    681
  - Using Central Manager
    681
    
    Adding a Regional Server Object
    681
    
    Deleting a Regional Server Object
    682
    
    Logging into a Regional Server
    682
- Installing Global Policy to a Regional Server
  682
  - Prerule and Postrule Updates During Global Policy Install
    683
    
    Name Space Conflict Resolution for Shared Objects
    683
    
    Shared Objects Update During Global Policy Install
    683
    
    Name Space Conflict Resolution for Polymorphic Objects
    684
Chapter 14 Topology Manager

685
- Overview of the NSM Topology Manager
  685
  - About the NSM Topology Manager
    685
  - Requirements for a Topology Discovery
    685
- About the NSM Topology Manager Toolbar
  686
- Initiating a Topology Discovery
  687
- Viewing a Network Topology
  688
- About the NSM Topology Map Views
  688
  - Subnets View
    689
  - Groups View
    689
  - Menu Options in the Topology Map View
    689
- About the NSM Topology Table Views
  690
  - Devices View
    690
  - Endpoint Devices View
    691
  - Free Ports View
    691
  - Links View
    691
- About Topology Manager Preferences
  692
  - Default Credentials Tab
    692
  - Refresh Interval Tab
    692
  - Preferred Subnets Tab
    692
- Adding Discovered Devices to NSM
  692
Chapter 15 Role-Based Port Templates

695
- Using Role-Based Port Templates
  695
  - Managing Port Template Associations
    696
  - Apply or Edit a Port Template
    696
  - Detect and Resolve Configuration Conflicts
    698
  - Clone a Port Template
    698
  - Edit a Port Template
    699
Chapter 16 Unified Access Control Manager

701
Chapter 17 Realtime Monitoring

709
- About the Realtime Monitor
  709
  - Realtime Monitor Views
    710
- Monitoring Managed Devices
  710
  - Viewing Device Status
    710
  - Realtime Monitoring
    711
  - Table 49: Device Status Information
    711
  - Device Polling Intervals
    713
  - Table 50: Device Polling Intervals
    714
  - Viewing Device Monitor Alarm Status
    714
  - Setting the Polling Interval for Device Alarm Status
    714
  - Table 51: Device Detail Status Items
    715
  - Viewing Additional Device Detail and Statistics
    715
    
    Viewing Device Details
    715
    
    Table 52: Device Statistics Summary
    716
    
    Viewing Device Statistics
    716
    
    Table 53: Device-Specific Views
    717
    
    Table 54: Policy Distribution Items
    719
    
    Table 55: Protocol Distribution Items
    720
    
    Table 56: VPN Monitor Table
    722
    
    Table 57: Active VPN Table
    724
    
    Table 58: Ethernet Statistics View Data
    725
    
    Table 59: Flow Statistics View Data
    727
    
    Table 60: Attack Counters
    728
    
    Table 61: Resource Statistics Items
    731
    
    Table 62: Administrators View
    732
    
    Table 63: Authenticated Users View
    732
    
    Table 64: Active Sessions Items
    732
    
    Table 65: HA Statistics View
    735
    
    Table 66: Device Status Information
    736
- Monitoring IDP Sensors
  736
- Monitoring Vpns
  740
  - Viewing the VPN Status Summary
    740
  - Configuring a VPN Filter
    741
  - Modifying a VPN Filter
    742
  - Deleting a VPN Filter
    742
  - Configuring a VPN Display Filter
    742
  - Viewing Active VPN Details
    742
  - Table 71: NSRP Device Summary
    743
  - Viewing Device-Specific VPN Information
    743
- Monitoring NSRP Statistics
  743
  - Viewing NSRP Summary Information
    743
  - Table 72: VSD/RTO Summary
    744
  - Viewing VSD/RTO Information
    744
    
    Viewing VSD Counter Details
    744
    
    Table 73: VSD Counter Details
    745
    
    Table 74: RTO Counters Details
    745
    
    Viewing RTO Counter Details
    745
    
    Table 75: IDP Cluster Monitor
    746
    
    Table 76: IDP Cluster Summary
    746
- Monitoring IDP Clusters
  746
- Using the Realtime Monitor
  747
- Table 78: Server Information
  748
- Monitoring the Management System
  748
  - Configuring Servers
    748
    
    Configuring Device Servers
    749
    
    Configuring the GUI Server
    750
    
    Table 79: GUI Server Table
    750
  - Using Server Monitor
    750
    
    Figure 99: Server Monitor (Machine-Wide Info)
    751
    
    Table 80: Server Monitor (Machine-Wide Info) Data
    751
    
    Viewing Additional Server Status Details
    752
    
    Table 81: Server Detail Status
    753
    
    Viewing Process Status
    753
    
    Figure 100: Process Status for the Device Server
    754
    
    Figure 101: Process Status for the GUI Server
    754
    
    Table 82: Process Status
    754
    
    Table 83: Management System Utilities
    755
  - Using Schema Information
    756
  - Viewing Device Schema
    757
Chapter 18 Analyzing Your Network

759
- About the Dashboard
  759
- About the Profiler
  759
  - Example of Unique Events
    760
  - Analyzing Your Network
    761
- Setting up the Profiler
  761
  - Configuring the Profiler
    762
  - Table 84: General IDP Profiler Settings
    762
  - Enabling os Fingerprinting
    763
    
    Configuring Context Profiles
    763
    
    Configuring Network Objects
    763
    
    Configuring Alerts
    764
  - Updating Profiler Settings
    764
  - Customizing Profiler Preferences
    765
  - Starting Profiler Operations on ISG Devices Without IDP Rules
    765
  - Starting the Profiler
    765
  - Stopping the Profiler
    765
- About Profiler Views
  766
  - About the Protocol Profiler
    767
  - Table 85: Protocol Profiler Data
    767
  - About the Network Profiler
    768
  - Table 86: Network Profiler Data
    768
  - About the Violation Viewer
    769
    
    Configuring Permitted Objects
    769
    
    Table 87: Applciation Profiler Data
    771
  - About the Application Profiler
    771
  - Using Profiler Views
    772
    
    Violation Viewer
    772
    
    Filtering and Sorting from the Application Profiler
    773
    
    Refreshing Profiler Data
    774
    
    Viewing Database Information
    774
    
    Table 88: Detailed Network Information Data
    775
    
    Purging the Database
    776
- Recommended Profiler Options
  776
  - Configuring a Network Baseline
    777
    
    Identifying a Baseline
    777
    
    Setting a Baseline
    777
  - Keeping Your Network Current
    777
  - Proactively Updating Your Network
    778
  - Reacting to Vulnerability Announcements
    778
    
    Example: Identifying Vulnerable Components
    778
  - Stopping Worms and Trojans
    779
    
    Example: SQL Worm
    779
    
    Example: Blaster Worm
    780
- Accessing Data in the Profiler Database
  780
- About Security Explorer
  781
  - Figure 102: Security Explorer
    782
  - Security Explorer Main Graph
    782
    
    Graph Types
    783
  - Connections Detail Pane
    783
  - Log Viewer
    784
  - Reference Point Pane
    784
  - Reports Viewer
    784
- Using Security Explorer
  784
  - Analyzing Relationships
    785
    
    Setting a Time Duration
    786
    
    Table 89: Transitional Graphs
    786
    
    Transitioning to Other Relational Graphs
    786
    
    Adding and Removing Panels
    787
    
    Refreshing Data
    787
    
    Viewing Predefined Reports
    787
  - Exporting to HTML
    787
Chapter 19 Logging

789
- About Logging
  789
  - About Log Entries
    790
    
    About Log Events
    790
    
    About Log Severity
    791
    
    Logging
    791
    
    Table 91: Log Entry Severity Levels for DMI Devices
    791
    
    Table 92: Log Entry Severity Levels for Screenos and IDP Devices
    791
  - Table 90: Event-Generated Log Entries
    790
- Viewing Logs
  792
  - Device Limitations for Viewing Logs
    793
- Configuring the Device for Logging
  793
  - Configuring Severity Settings
    794
  - Table 93: Destinations of Log Entry Severities
    794
  - Configuring E-Mail Server Settings
    795
    
    Forwarding Self Log Entries (Firewall Options)
    795
    
    Table 94: Self Log Entry Settings
    795
    
    Table 95: Email Server Settings for Log Entries
    795
  - Configuring Events Reporting Settings
    796
    
    Screen Alarm Log Entries
    796
    
    Event Alarm Log Entries
    797
    
    Traffic Alarm Log Entries
    797
    
    Configuration Log Entries
    798
    
    Deep Inspection Alarm Log Entries
    798
    
    Information Log Entries
    799
    
    Self Log Entries
    799
    
    Attack Statistics
    800
    
    Ethernet Statistics
    800
    
    Flow Statistics
    800
    
    Policy Statistics
    800
    
    Protocol Distribution
    800
    
    Traffic Log Entries
    800
    
    Atomic Updating Events
    801
  - Configuring SNMP Reporting Settings
    801
  - Directing Logs to a Syslog Server
    802
  - Directing Data to a Webtrends Server
    803
  - Managing Packet Data in Logs
    803
  - Table 96: Syslog Settings for Log Entries
    803
  - Table 97: Webtrends Settings for Log Entries
    803
  - Figure 103: View Packet Data in a Log
    805
  - Figure 104: Sample Packet Data
    806
- Using the Log Viewer
  806
  - Table 98: EX Series Switch Predefined Log Views
    807
  - Table 99: SSL/UAC Predefined Log Views
    808
  - Creating Custom Views and Folders
    809
  - Table 100: Predefined Log Views
    809
  - Creating Per-Session Views
    810
  - Table 101: Log Viewer Columns
    810
  - Log Viewer Detail Panes
    813
  - Figure 105: View Category and Severity Filters
    814
  - Log Viewer Status Bar
    814
  - Navigating the Log Viewer
    814
  - Searching Log Entries
    814
    
    Log Timeline
    815
    
    Table 103: Search Tools for Log Viewer
    815
    
    Figure 106: Log Viewer Time Slider
    816
    
    Figure 107: Log Viewer Time Display
    816
    
    Table 104: Log Viewer Flags
    817
    
    Using Flags
    817
    
    Using Log ID Number
    818
    
    Using the Find Utility
    818
  - Table 102: Log Viewer Navigation Controls
    814
  - Filtering Log Entries by Event and Time
    818
    
    Setting a Category Filter
    818
    
    Setting a Flag Filter
    819
    
    Setting a Protocol Filter
    819
    
    Setting an Address Filter
    819
    
    Setting an Alert Filter
    819
    
    Setting a Domain Filter
    820
    
    Setting a Time-Based Filter
    820
  - Filtering Log Entries by Range
    820
    
    Setting a Bytes in or Bytes out Range Filter
    821
    
    Setting a Port Number Range Filter
    821
  - Customizing Columns
    822
    
    Hide, Unhide, and Move Columns
    822
    
    Using Column Settings
    822
  - Filtering Log Entries by Column
    824
  - Figure 108: Filter Summary Dialog Box
    825
  - Using Log Viewer Integration
    826
    
    Jump to Device Configuration
    826
    
    Jump to Policy
    826
    
    Figure 109: Viewing Summary Panel
    827
    
    Table 105: Irrelevant Versus Relevant Attacks
    827
  - Identifying Irrelevant Attacks
    827
- Using the Log Investigator
  828
  - About the Log Investigator UI
    829
    
    Figure 110: Log Investigator UI Overview
    829
    
    Configuring Axes
    831
    
    Figure 111: Configure Time Period Filter
    831
    
    Figure 112: Changing Time Period Filter
    831
    
    Setting a Log Entry Limit
    832
    
    Table 106: Log Investigator Filters
    833
    
    Example: Setting Filters in the Log Investigator
    834
    
    Figure 113: View Log Investigator Results
    835
  - Investigating Log Entry Data
    835
    
    Using Rows and Columns
    835
    
    Table 107: Log Investigator Analysis
    836
    
    Using Cells
    836
  - Zoom Details
    837
  - Excluding Data
    838
  - Jumping to the Log Viewer
    838
- Using the Audit Log Viewer
  838
- Managing Log Volume
  843
  - Automatic Device Log Cleanup
    843
  - Archiving Logs
    844
  - Log Archival Mechanism
    844
  - Setting Log Storage Limits
    845
    
    Archive Location
    845
    
    Date Limits
    845
    
    Obsolete Logs
    845
    
    Required Disk Space
    845
    
    System-Wide Retention Policy
    845
- Forwarding Logs
  846
  - Sending E-Mail Notification of Downed Device
    846
  - Using the Action Manager to Forward Logs by Domain
    847
    
    Configuring Action Parameters
    847
    
    Setting Device Log Action Criteria
    848
  - Using the Log2Action Utility to Export Logs
    850
    
    Using Filters
    850
    
    Table 109: Common Filters
    851
    
    Exporting to CSV
    853
    
    Exporting to XML
    853
    
    Using XML Required and Optional Format-Specific Filters
    853
    
    Viewing XML Format Output
    853
    
    Exporting to SNMP
    854
    
    Using CSV Required and Optional Format-Specific Filters
    854
    
    Viewing CSV Format Output
    854
    
    Exporting to E-Mail
    855
    
    Using SNMP Required and Optional Format-Specific Filters
    855
    
    Viewing SNMP Format Output
    855
    
    Exporting to Syslog
    856
    
    Using E-Mail Required and Optional Format-Specific Filters
    856
    
    Using Syslog Required and Optional Format-Specific Filters
    856
    
    Exporting to a Script
    857
    
    Viewing Syslog Format Output
    857
    
    Using Script Required and Optional Format-Specific Filters
    858
    
    Reporting
    859
Chapter 20 Reporting

859
- About Reporting
  859
  - Report Type Groupings
    859
  - Graphical Data Representation
    860
  - Integration with Logs
    860
  - Central Access to Management Information
    860
- Report Types
  861
  - Predefined Reports
    861
    
    Table 110: Firewall and VPN Reports
    861
    
    Table 111: DI/IDP Reports
    862
    
    Table 112: Screen Reports
    863
    
    Table 113: Administrative Reports
    864
    
    Table 114: UAC Reports
    864
    
    SSL/VPN Reports
    865
    
    Table 115: Profiler Reports
    865
    
    Table 116: AVT Reports
    865
    
    EX Series Switches Report
    866
    
    Table 117: SSL/VPN Reports
    866
    
    Table 118: EX-Switch Reports
    866
  - My Reports
    866
  - Shared Reports
    866
- Working with Reports
  866
  - Generating a Predefined Report
    867
  - Creating a Custom Report
    867
    
    Example: Creating a Custom Report
    867
  - Deleting Reports
    868
  - Organizing Reports in Folders
    868
  - Generating Reports Automatically
    868
    
    Creating and Editing Action Scripts
    869
    
    Running Reports Using the Guisvrcli.sh Utility
    869
    
    Using Cron with Scheduled Reports
    871
  - Exporting Reports to HTML
    872
- Setting Report Options
  872
  - Naming a Report
    872
  - Setting the Report Type
    873
  - Configuring Report Source Data
    873
  - Configuring a Report Time Period
    873
  - Configuring the Data Point Count
    873
  - Configuring the Chart Type
    873
  - Sharing Your Custom Report
    874
  - Modifying Report Filters
    874
  - Configuring Report Processing Warnings
    874
  - Saving Your Report Settings
    874
- Log Viewer Integration
  874
- Using Reports
  875
- Using the Watch List
  879
Appendix A Glossary

883
Appendix B Unmanaged Screenos Commands

909
- Table 121: Surfcontrol Web Categories
  911
Appendix D Common Criteria EAL2 Compliance

919
- Guidance for Intended Usage
  919
- Guidance for Personnel
  919
- Guidance for Physical Protection
  919
Appendix E Log Entries

921
- Table 122: Screen Alarm Log Entries
  921
- Table 123: Alarm Log Entries
  923
- Deep Inspection Alarm Log Entries
  924
- Table 124: Deep Inspection Alarm Log Entries
  925
- Table 125: Configuration Log Entries
  999
- Information Log Entries
  1001
- Table 126: Information Log Entries
  1002
- Self Log Entries
  1003
- Traffic Log Entries
  1003
- GTP Log Entries
  1004
- Index
  1007

Juniper Categories

Network Router

Switch Gateway Software Network Hardware

More Juniper Manuals

Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Manuals

Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual (1026 pages)

Table of Contents

Chapter 1 Introduction to Network and Security Manager

Chapter 2 Planning Your Virtual Network

Chapter 3 Configuring Role-Based Administration

Chapter 4 Adding Devices

Chapter 5 Configuring Devices

Chapter 6 Updating Devices

Chapter 7 Managing Devices

Chapter 8 Configuring Objects

Chapter 9 Configuring Security Policies

Chapter 10 Configuring Voice Policies

Chapter 11 Configuring Junos NAT Policies

Chapter 12 Configuring Vpns

Chapter 13 Central Manager

Chapter 14 Topology Manager

Chapter 15 Role-Based Port Templates

Chapter 16 Unified Access Control Manager

Chapter 17 Realtime Monitoring

Chapter 18 Analyzing Your Network

Chapter 19 Logging

Chapter 20 Reporting

Appendix A Glossary

Appendix B Unmanaged Screenos Commands

Appendix D Common Criteria EAL2 Compliance

Appendix E Log Entries

Related Products

Juniper Categories