[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Configuring IDS Rules

IDS rules identify traffic for which you want the router software to count events. Because IDS is based on stateful firewall properties, you must configure at least one stateful firewall rule and include it in the service set with the IDS rules; for more information, see Stateful Firewall Services Configuration Guidelines.

To configure an IDS rule, include the rule rule-name statement at the [edit services ids] hierarchy level:

[edit services ids]
rule rule-name {
match-direction (input | output | input-output);
term term-name {
from {
application-sets set-name;
applications [ application-names ];
destination-address (address | any-unicast) <except>;
destination-address-range low minimum-value high maximum-value <except>;
destination-prefix-list list-name <except>;
source-address (address | any-unicast) <except>;
source-address-range low minimum-value high maximum-value <except>;
source-prefix-list list-name <except>;
}
then {
aggregation {
destination-prefix prefix-value | destination-prefix-ipv6 prefix-value;
source-prefix prefix-value | source-prefix-ipv6 prefix-value;
}
(force-entry | ignore-entry);
logging {
syslog;
threshold rate;
}
session-limit {
by-destination {
hold-time seconds;
maximum number;
packets number;
rate number;
}
by-pair {
hold-time seconds;
maximum number;
packets number;
rate number;
}
by-source {
hold-time seconds;
maximum number;
packets number;
rate number;
}
}
syn-cookie {
mss value;
threshold rate;
}
}
}
}

Each IDS rule consists of a set of terms, similar to a filter configured at the [edit firewall] hierarchy level. A term consists of the following:

The following sections describe IDS rule content in more detail:

Configuring Match Direction for IDS Rules

Each rule must include a match-direction statement that specifies whether the match is applied on the input or output side of the interface. To configure where the match is applied, include the match-direction (input | input-output | output) statement at the [edit services ids rule rule-name] hierarchy level:

[edit services ids rule rule-name]
match-direction (input | output | input-output);

If you configure match-direction input-output, bidirectional rule creation is allowed.

The match direction is used with respect to the traffic flow through the AS or MultiServices PIC. When a packet is sent to the PIC, direction information is carried along with it.

With an interface service set, packet direction is determined by whether a packet is entering or leaving the interface on which the service set is applied.

With a next-hop service set, packet direction is determined by the interface used to route the packet to the AS or MultiServices PIC. If the inside interface is used to route the packet, the packet direction is input. If the outside interface is used to direct the packet to the PIC, the packet direction is output. For more information on inside and outside interfaces, see Configuring Service Sets to be Applied to Services Interfaces.

On the AS or MultiServices PIC, a flow lookup is performed. If no flow is found, rule processing is performed. All rules in the service set are considered. During rule processing, the packet direction is compared against rule directions. Only rules with direction information that match the packet direction are considered.

Configuring Match Conditions in IDS Rules

To configure IDS match conditions, include the from statement at the [edit services ids rule rule-name term term-name] hierarchy level:

[edit services ids rule rule-name term term-name]
from {
application-sets set-name;
applications [ application-names ];
destination-address (address | any-unicast) <except>;
destination-address-range low minimum-value high maximum-value <except>;
destination-prefix-list list-name <except>;
source-address (address | any-unicast) <except>;
source-address-range low minimum-value high maximum-value <except>;
source-prefix-list list-name <except>;
}

If you omit the from statement, the software accepts all events and places them in the IDS cache for processing.

The source address and destination address can be either IPv4 or IPv6. You can use the destination address, a range of destination addresses, a source address, or a range of source addresses as a match condition, in the same way that you would configure a firewall filter; for more information, see the JUNOS Policy Framework Configuration Guide.

Alternatively, you can specify a list of source or destination prefixes by including the prefix-list statement at the [edit policy-options] hierarchy level and then including either the destination-prefix-list or source-prefix-list statement in the IDS rule. For an example, see Examples: Configuring Stateful Firewall Rules.

You can also include application protocol definitions that you have configured at the [edit applications] hierarchy level; for more information, see Applications Configuration Guidelines.

If a match occurs on an application, the application protocol is displayed separately in the show services ids command output. For more information, see the JUNOS System Basics and Services Command Reference.

Configuring Actions in IDS Rules

To configure IDS actions, include the then statement at the [edit services ids rule rule-name term term-name] hierarchy level:

[edit services ids rule rule-name term term-name]
then {
aggregation {
destination-prefix prefix-value | destination-prefix-ipv6 prefix-value;
source-prefix prefix-value | source-prefix-ipv6 prefix-value;
}
(force-entry | ignore-entry);
logging {
syslog;
threshold rate;
}
session-limit {
by-destination {
hold-time seconds;
maximum number;
packets number;
rate number;
}
by-pair {
hold-time seconds;
maximum number;
packets number;
rate number;
}
by-source {
hold-time seconds;
maximum number;
packets number;
rate number;
}
}
syn-cookie {
mss value;
threshold rate;
}
}

You can configure the following possible actions:

[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

[an error occurred while processing this directive]