- play_arrow Downloading and Updating the IDP Signature Database
- play_arrow Configuring IDP Policies
- play_arrow Understanding Custom Attacks Objects Service Contexts
- play_arrow Configuring IDP Features
- play_arrow Monitoring IDP
- play_arrow Configuration Statements and Operational Commands
ON THIS PAGE
Intrusion Detection and Prevention Overview
The Juniper Networks IDP system detects and prevents network threats by monitoring traffic for malicious activity. It uses a signature database to identify attacks and applies security policies for real-time mitigation. It enhances network security and provides proactive threat detection and response.
Intrusion detection is the process of monitoring the events occurring in your network and analyzing the events for signs of possible incidents, violations, or imminent threats to your security policies. Intrusion prevention is the process of performing intrusion detection and then stopping the detected incidents. These security measures are available as intrusion detection systems (IDS) and intrusion prevention systems (IPS), which become part of your network to detect and stop potential incidents.
Benefits of IDP
By leveraging IDP, you can significantly enhance your network's security posture, protecting against a wide range of known and emerging threats. The following are some of the benefits:
Proactive Threat Prevention—Stops attacks before they can cause damage.
Network Visibility—Provides insights into potential security issues.
Customizable Protection—Allows tailoring of security policies to specific network needs.
Compliance Support—Helps meet regulatory requirements for network security.
Automated Response and Remediation—The IDP system can automatically respond to detected threats by blocking malicious traffic, quarantining affected firewalls, and alerting administrators. This helps in minimizing the impact of security incidents.
IDP Workflow
The IDP system inspects traffic to detect and mitigate threats. The traffic inspection engine analyzes packets using signature-based detection, protocol anomaly detection, and behavioral analysis. If a threat is found, a decision is taken at the policy enforcement and actions stage whether to block, alert, or log the activity. The events are logged and reported back to the administrators for further analysis. Threat intelligence and updates continuously improves detection by adding new threat data and ensures real-time protection against evolving cyberthreats.
Figure 1 outlines the core components and flow of Juniper's IDP system.
Table 1: IDP Process Flow lists the details of the IDP workflow.
| Step | Description |
|---|---|
| Traffic Inspection Engine (Or IDP Inspection Process) | Examines packets for potential security risks (matches known attack patterns). |
| Detection Mechanisms | Signature-based detection, Protocol anomaly detection (identifies deviations from expected network behavior), and Behavioral analysis (detects unusual patterns based on historical data) |
| Policy Enforcement and Actions | Once a threat is identified, the system enforces policies and decides whether to block, alert, or log the activity. |
| Logging and Reporting | Detected events are logged or reported. Administrators analyze and respond |
| Threat Intelligence and Updates | Continuously feed new threat data into the system. |
Get Started with IDP
To implement IDP on your SRX Series Firewalls:
IDP functionality is enabled by default on all SRX Series Firewalls. If you plan to use only custom attack signatures, no additional license is required. You need a separate license if you want to access and install updates to the regularly updated signature database.
See IDP license information about the Software Licenses for SRX Series Firewalls page.
Download and install the IDP signature database. Ensure you have a valid IDP license before proceeding, as it is required to access and install the signature database from the Juniper Networks website. The database includes attack object and attack object groups used in IDP policies to match traffic against known attacks.
See Updating the IDP Signature Database.Download and install IDP Policy Templates and customize a policy for your environment. Juniper Networks provides predefined templates to use as a starting point. The Recommended template is a good starting point, but we recommend that you review and modify it to meet specific security needs.
See IDP Policies Overview.Enable a security policy for IDP inspection. For transit traffic to pass through IDP inspection, you configure a security policy and enable IDP application services on all traffic that you want to inspect. See Enabling IDP in a Security Policy.
