[an error occurred while processing this directive]

JUNOS Software Security Configuration Guide Techpubs Home Report an Error Collapse TOC Index Entire manual as PDF		About This Guide Objectives Audience Supported Routing Platforms Document Conventions JUNOS Software Documentation for J-series Services Routers and SRX-series Services Gateways Documentation Feedback Requesting Technical Support Support for Security Features on Different Device Types Introducing JUNOS Software with Enhanced Services for J-series Services Routers Stateful and Stateless Data Processing Flow-Based Processing Zones and Policies Flows and Sessions Packet-Based Processing Changing Session Characteristics Controlling Session Termination Disabling TCP Packet Security Checks Accommodating End-to-End TCP Communication Following the Data Path Part 1—Forwarding Processing Part 2—Session-Based Processing Session Lookup First-Packet Path Processing Fast-Path Processing Part 3—Forwarding Features Understanding Secure and Router Contexts Secure and Router Context Support On Different Device Types Secure Context Router Context Introducing JUNOS Software for SRX-series Services Gateways Overview of SRX-series Services Gateways Running JUNOS Software Overview of Stateful and Stateless Data Processing Understanding Flow-Based Processing Zones and Policies Flows and Sessions Understanding Packet-Based Processing Changing Session Characteristics Controlling Session Termination Disabling TCP Packet Security Checks Setting the Maximum Segment Size for All TCP Sessions Understanding Sessions Following the Data Path for a Unicast Session Session Lookup and Packet Match Criteria Understanding Session Creation: First-Packet Processing Understanding Fast-Path Processing Step 1. A Packet Arrives at the Device and the NPU Processes It. Step 2. The SPU for the Session Processes the Packet. Step 3. The SPU Forwards the Packet to the NPU. Step 4. The Interface Transmits the Packet From the Device. Step 5. A Reverse Traffic Packet Arrives at the Egress Interface and the NPU Processes It. Step 6. The SPU for the Session Processes the Reverse Traffic Packet. Step 7. The SPU Forwards the Reverse Traffic Packet to the NPU. 8. The Interface Transmits the Packet From the Device. Obtaining Information About Sessions By Using the Configuration show Command Obtaining Information About Sessions By Using the Operational show Command Displaying a Summary of Sessions Displaying Session and Flow Information About Sessions Displaying Session and Flow Information About a Specific Session Using Filters to Display Session and Flow Information Using the Operational clear Command to Terminate Sessions Terminating All Sessions Terminating a Specific Session Using Filters to Specify the Sessions to Be Terminated Security Zones and Interfaces Zone Support on Different Device Types Understanding Security Zones Functional Zone Security Zone Related Topics Creating Security Zones J-Web Configuration CLI Configuration Related Topics Configuring Security Zones—Quick Configuration Configuring Host Inbound Traffic System Services J-Web Configuration CLI Configuration Related Topics Configuring Protocols J-Web Configuration CLI Configuration Related Topics Configuring the TCP-Reset Parameter J-Web Configuration CLI Configuration Related Topics Understanding Security Zone Interfaces Understanding Interface Ports Related Topics Configuring Interfaces—Quick Configuration Configuring a Gigabit Ethernet Interface—Quick Configuration Security Policies Security Policy Support on Different Device Types Security Policies Overview Understanding Policies Understanding Policy Rules Understanding Policy Elements Understanding Policy Configuration Related Topics Understanding Policy Ordering Related Topics Configuring Policies—Quick Configuration Configuring Policies J-Web Configuration CLI Configuration Related Topics Verifying Policy Configuration Example: Configuring Security Policies—Detailed Configuration Configuring a Policy to Permit Traffic J-Web Configuration CLI Configuration Related Topics Configuring a Policy to Deny Traffic J-Web Configuration CLI Configuration Related Topics Reordering Policies After They Have Been Created Related Topics Troubleshooting Policy Configuration Checking Commit Failure Verifying Commit Debugging Policy Lookup Monitoring Policy Statistics Security Policy Address Books and Address Sets Address Books and Address Sets Overview Understanding Address Books Understanding Address Sets Configuring Addresses and Address Sets—Quick Configuration Configuring Address Books J-Web Configuration CLI Configuration Related Topics Verifying Address Book Configuration Security Policy Schedulers Configuring a Scheduler—Quick Configuration Configuring Schedulers J-Web Configuration CLI Configuration Related Topics Associating a Policy to a Scheduler J-Web Configuration CLI Configuration Related Topics Verifying Scheduled Policies Security Policy Applications Policy Application Sets Overview Related Topics Understanding the ICMP Predefined Policy Application Handling ICMP Unreachable Errors Related Topics Understanding Internet-Related Predefined Policy Applications Related Topics Understanding Microsoft Predefined Policy Applications Related Topics Understanding Dynamic Routing Protocols Predefined Policy Applications Related Topics Understanding Streaming Video Predefined Policy Applications Related Topics Understanding Sun RPC Predefined Policy Applications Related Topics Understanding Security and Tunnel Predefined Policy Applications Related Topics Understanding IP-Related Predefined Policy Applications Related Topics Understanding Instant Messaging Predefined Policy Applications Related Topics Understanding Management Predefined Policy Applications Related Topics Understanding Mail Predefined Policy Applications Related Topics Understanding UNIX Predefined Policy Applications Related Topics Understanding Miscellaneous Predefined Policy Applications Related Topics Understanding Custom Policy Applications Custom Application Mappings Related Topics Configuring Applications and Application Sets—Quick Configuration Example: Configuring Applications and Application Sets J-Web Configuration CLI Configuration Related Topics Example: Adding a Custom Policy Application J-Web Configuration CLI Configuration Related Topics Example: Modifying a Custom Policy Application J-Web Configuration CLI Configuration Related Topics Example: Defining a Custom Internet Control Message Protocol Application J-Web Configuration CLI Configuration Related Topics Understanding Policy Application Timeouts Application Timeout Configuration and Lookup Contingencies Related Topics Setting a Policy Application Timeout Related Topics Firewall User Authentication Firewall Authentication Support on Different Device Types Firewall User Authentication Overview Authentication, Authorization, and Accounting (AAA) Servers Types of Firewall User Authentication Related Topics Understanding Authentication Schemes Pass-Through Authentication Web Authentication Related Topics Configuring for Pass-Through Authentication J-Web Configuration CLI Configuration Related Topics Configuring for Web Authentication J-Web Configuration CLI Configuration Related Topics Understanding Client Groups for Firewall Authentication J-Web Configuration CLI Configuration J-Web Configuration CLI Configuration Related Topics Configuring for External Authentication Servers J-Web Configuration CLI Configuration Related Topics Understanding SecurID User Authentication Related Topics Configuring the SecurID Server Configuring SecurID as the External Authentication Server CLI Configuration Deleting the Node Secret File Related Topics Displaying the Authentication Table J-Web Configuration CLI Configuration Related Topics Understanding Banner Customization Related Topics Customizing a Banner J-Web Configuration CLI Configuration Related Topics Configuring Firewall Authentication—Quick Configuration Verifying Firewall User Authentication Attack Detection and Prevention Attack Detection and Prevention Support for Different Device Types Reconnaissance Deterrence Overview Related Topics Understanding IP Address Sweeps Related Topics Blocking IP Address Sweeps Related Topics Understanding Port Scanning Related Topics Blocking Port Scans Related Topics Understanding Network Reconnaissance Using IP Options Uses for IP Packet Header Options SCREEN Options for Detecting IP Options Used For Reconnaissance Related Topics Detecting Packets That Use IP Options for Reconnaissance Understanding Operating System Probes TCP Headers with SYN and FIN Flags Set TCP Headers With FIN Flag and Without ACK Flag TCP Header Without Flags Set Related Topics Blocking Packets with SYN and FIN Flags Set Related Topics Blocking Packets with FIN Flag/No ACK Flag Set Related Topics Blocking Packets with No Flags Set Related Topics Understanding Attacker Evasion Techniques FIN Scan Non-SYN Flags IP Spoofing IP Source Route Options Related Topics Thwarting a FIN Scan Related Topics Setting TCP SYN Checking Related Topics Blocking IP Spoofing Related Topics Blocking Packets with Either a Loose or Strict Source Route Option Set Related Topics Detecting Packets with Either a Loose or Strict Source Route Option Set Related Topics Suspicious Packet Attributes Overview Related Topics Understanding ICMP Fragment Protection Related Topics Blocking Fragmented ICMP Packets Related Topics Understanding Large ICMP Packet Protection Related Topics Blocking Large ICMP Packets Related Topics Understanding Bad IP Option Protection Related Topics Detecting and Blocking IP Packets with Incorrectly Formatted Options Related Topics Understanding Unknown Protocol Protection Related Topics Dropping Packets Using an Unknown Protocol Related Topics Understanding IP Packet Fragment Protection Related Topics Dropping Fragmented IP Packets Related Topics Understanding SYN Fragment Protection Related Topics Dropping IP Packets Containing SYN Fragments Related Topics Denial-of-Service Attack Overview Related Topics Firewall DoS Attacks Overview Related Topics Understanding Session Table Flood Attacks Source-Based Session Limits Destination-Based Session Limits Related Topics Setting Source-Based Session Limits Related Topics Setting Destination-Based Session Limits Related Topics Understanding SYN-ACK-ACK Proxy Flood Attacks Related Topics Enabling Protection Against a SYN-ACK-ACK Proxy Flood Attack Related Topics Network DoS Attacks Overview Related Topics Understanding SYN Flood Attacks SYN Flood Protection SYN Flood Options Related Topics Example: SYN Flood Protection Related Topics Enabling SYN Flood Protection Related Topics Understanding SYN Cookie Protection Related Topics Enabling SYN Cookie Protection Related Topics Understanding ICMP Flood Attacks Related Topics Enabling ICMP Flood Protection Related Topics Understanding UDP Flood Attacks Related Topics Enabling UDP Flood Protection Related Topics Understanding Land Attacks Related Topics Enabling Protection Against a Land Attack Related Topics OS-Specific DoS Attacks Overview Related Topics Understanding Ping of Death Attacks Related Topics Enabling Protection Against a Ping of Death Attack Related Topics Understanding Teardrop Attacks Related Topics Enabling Protection Against a Teardrop Attack Related Topics Understanding WinNuke Attacks Related Topics Enabling Protection Against a WinNuke Attack Related Topics Configuring Firewall Screen Options—Quick Configuration Verifying Application Security Information Using Trace Options Setting Security Trace Options J-Web Configuration CLI Configuration Example: Show Security Traceoptions Output Verifying Application Security Flow Information Network Address Translation NAT Support On Different Device Types Support Information: NAT Understanding NAT Inbound and Outbound NAT Traffic Related Topics NAT Configuration on Different Devices Destination IP Address Translation Overview Related Topics Understanding Static NAT on J-series Services Routers Related Topics Configuring Static NAT CLI Configuration Related Topics Understanding NAT-Dst Policy-Based NAT on J-series Services Routers Related Topics Example: Configuring Destination NAT on J-series Services Routers CLI Configuration Related Topics Understanding Rule-Based Destination NAT on SRX-series Services Gateways Example: Configuring Destination NAT on SRX-series Services Gateways CLI Configuration Understanding NAT-Dst Allow-Incoming Table Related Topics Example: Configuring NAT-Dst Allow-Incoming Table J-Web Configuration CLI Configuration Related Topics Verifying NAT Incoming-table Source IP Address Translation Overview Related Topics Understanding NAT Interface Source Pools Related Topics Understanding NAT Source Pools with PAT Port Ranges Address Persistent Related Topics Understanding NAT Source Pools Without PAT Source Pool Utilization Alarm Related Topics Understanding NAT Static Source Pools Related Topics Understanding NAT Allow-Incoming Source Pools Related Topics Understanding NAT Source Pool Sets Related Topics Example: Configuring Source NAT on J-series Services Routers CLI Configuration Related Topics Example: Configuring Source NAT on SRX-series Services Gateways CLI Configuration Verifying Static NAT Summary Example: Configuring a Persistent Address and Pool Sets CLI Configuration Related Topics Configuring Proxy ARP (Address Resolution Protocol) on SRX-series Services Gateways CLI Configuration Verifying NAT Configuration on SRX–series Services Gateways CLI Configuration Configuring Source NAT—Quick Configuration Configuring Destination NAT—Quick Configuration Configuring Interface NAT—Quick Configuration Configuring Firewall/NAT Flow—Quick Configuration Configuring Stateful Firewall or NAT Screen—Quick Configuration Chassis Cluster Understanding Chassis Cluster Related Topics Understanding Chassis Cluster Formation Related Topics Understanding Redundancy Groups About Redundancy Groups Redundancy Group 0: Routing Engines Redundancy Groups 1 Through 255 Redundancy Group Interface Monitoring Related Topics Understanding Redundant Ethernet Interfaces Related Topics Understanding the Control Plane About the Control Link About Heartbeats About Control Link Failure and Recovery Related Topics Understanding the Data Plane About Session RTOs About the Fabric Data Link About Data Forwarding About Fabric Data Link Failure and Recovery Related Topics Understanding Failover About Redundancy Group Failover About Manual Failover Hardware Setup for J-series Services Routers Hardware Setup for SRX-series Services Gateways What Happens When You Enable Chassis Cluster Node Interfaces on Services Routers Node Interfaces on Services Gateways Management Interfaces on Services Routers Management Interfaces on Services Gateways Fabric Interface Control Interfaces Related Topics Creating a Services Router Chassis Cluster—Overview Related Topics Creating a Services Gateway Chassis Cluster—Overview Related Topics Setting the Node ID and Cluster ID CLI Configuration Related Topics Configuring the Management Interface CLI Configuration Related Topics Configuring a Chassis Cluster and Redundancy Groups—Quick Configuration Related Topics Configuring Redundant Ethernet Interfaces—Quick Configuration Configuring a Gigabit Interface—Quick Configuration Configuring Chassis Cluster Information CLI Configuration Related Topics Configuring the Fabric CLI Configuration Related Topics Configuring Redundancy Groups CLI Configuration Configuring Redundant Ethernet Interfaces CLI Configuration Related Topics Configuring Interface Monitoring CLI Configuration Related Topics Initiating a Manual Redundancy Group Failover CLI Configuration Configuring Conditional Route Advertising CLI Configuration Related Topics Verifying the Chassis Cluster Configuration Verifying the Chassis Cluster Related Topics Verifying Chassis Cluster Interfaces Verifying Chassis Cluster Statistics Verifying Chassis Cluster Status Verifying Chassis Cluster Redundancy Group Status Upgrading Chassis Cluster Related Topics Disabling Chassis Cluster Related Topics Internet Protocol Security (IPsec) IPsec Support on Different Device Types Virtual Private Networks (VPNs) Security Associations (SAs) Key Management Related Topics Understanding IPsec Operational Modes Transport Mode Tunnel Mode Related Topics Understanding IPsec Security Protocols Authentication Header (AH) Protocol Encapsulating Security Payload (ESP) Protocol Related Topics Understanding IPsec Security Associations (SAs) Related Topics Understanding IPsec Key Management Manual Key AutoKey IKE AutoKey IKE with Preshared Keys AutoKey IKE with Certificates Related Topics Understanding IKE and IPsec Packets IKE Packets IPsec Packets Related Topics Understanding IPsec Tunnel Negotiation Phase 1 of IKE Tunnel Negotiation Main and Aggressive Modes Diffie-Hellman Exchange Phase 2 of IKE Tunnel Negotiation Perfect Forward Secrecy Replay Protection Related Topics Configuring VPN Global Settings J-Web Configuration CLI Configuration Related Topics Configuring VPN Global Settings—Quick Configuration Configuring an IKE IPsec Tunnel—Overview Related Topics Configuring an IKE Phase 1 Proposal J-Web Configuration CLI Configuration Related Topics Configuring an IKE Phase 1 Proposal—Quick Configuration Configuring an IKE Policy, Authentication, and Proposal J-Web Configuration CLI Configuration Related Topics Configuring an IKE Policy, Authentication, and Proposal—Quick Configuration Configuring an IKE Gateway and Peer Authentication J-Web Configuration CLI Configuration Related Topics Configuring an IKE Gateway and Peer Authentication—Quick Configuration Configuring an IPsec Phase 2 Proposal J-Web Configuration CLI Configuration Related Topics Configuring an IPsec Phase 2 Proposal—Quick Configuration Configuring an IPsec Policy J-Web Configuration CLI Configuration Related Topics Configuring an IPsec Policy—Quick Configuration Configuring IPsec AutoKey J-Web Configuration CLI Configuration Related Topics Configuring IPsec Autokey—Quick Configuration Configuring an IPsec Manual Key VPN J-Web Configuration CLI Configuration Related Topics Configuring an IPsec Manual Key VPN—Quick Configuration Public Key Cryptography for Certificates PKI Support on Different Device Types Understanding Public Key Cryptography Related Topics Understanding Certificates Certificate Signatures Certificate Verification Internet Key Exchange Related Topics Understanding Certificate Revocation Lists Related Topics Understanding Public Key Infrastructure PKI Hierarchy for a Single CA Domain or Across Domains PKI Management and Implementation Related Topics Understanding Self-Signed Certificates About Generating Self-Signed Certificates Related Topics Understanding Automatically Generated Self-Signed Certificates Related Topics Understanding Manually Generated Self-Signed Certificates Related Topics Using Digital Certificates Obtaining Digital Certificates Online Obtaining Digital Certificates Manually Verifying the Validity of a Certificate Deleting a Certificate Generating a Public-Private Key Pair CLI Operation Related Topics Configuring a Certificate Authority Profile CLI Configuration Related Topics Enrolling a CA Certificate Online CLI Operation Related Topics Enrolling a Local Certificate Online CLI Configuration Related Topics Generating a Local Certificate Request Manually CLI Operation Related Topics Loading CA and Local Certificates Manually CLI Operation Related Topics Re-enrolling Local Certificates Automatically CLI Configuration Related Topics Manually Loading a CRL onto the Device CLI Operation Related Topics Verifying Certificate Validity CLI Operation Related Topics Checking Certificate Validity Using CRLs J-Web Configuration CLI Configuration Related Topics Using Automatically Generated Self-Signed Certificates J-Web Configuration CLI Configuration Related Topics Manually Generating Self-Signed Certificates J-Web Configuration CLI Configuration Related Topics Deleting Certificates CLI Operation Related Topics Deleting a Loaded CRL CLI Operation Related Topics Application Layer Gateways (ALGs) ALG Support on Different Device Types Understanding Application Layer Gateways Related Topics Configuring Application Layer Gateways—Quick Configuration Understanding the H.323 ALG Related Topics Configuring the H.323 ALG—Quick Configuration Setting H.323 Endpoint Registration Timeout J-Web Configuration CLI Configuration Related Topics Setting H.323 Media Source Port Range J-Web Configuration CLI Configuration Related Topics Configuring H.323 Denial of Service (DoS) Attack Protection J-Web Configuration CLI Configuration Related Topics Allowing Unknown H.323 Message Types J-Web Configuration CLI Configuration Related Topics Verifying the H.323 Configuration Verifying H.323 Counters Related Topics Passing H.323 ALG Traffic to a Gatekeeper in the Internal Zone J-Web Configuration CLI Configuration Related Topics Passing H.323 ALG Traffic to a Gatekeeper in the External Zone J-Web Configuration CLI Configuration Related Topics Using NAT and the H.323 ALG to Enable Outgoing Calls CLI Configuration Related Topics Using NAT and the H.323 ALG to Enable Incoming Calls CLI Configuration Related Topics Understanding the SIP ALG SIP ALG Operation SDP Session Descriptions Pinhole Creation SIP ALG Request Methods Overview Related Topics Configuring the SIP ALG—Quick Configuration Understanding SIP ALG Call Duration and Timeouts Related Topics Setting SIP Call Duration and Inactive Media Timeout J-Web Configuration CLI Configuration Related Topics Configuring SIP Denial of Service (DoS) Attack Protection J-Web Configuration CLI Configuration Related Topics Allowing Unknown SIP Message Types J-Web Configuration CLI Configuration Related Topics Disabling SIP Call ID Hiding J-Web Configuration CLI Configuration Related Topics Retaining SIP Hold Resources J-Web Configuration CLI Configuration Related Topics Understanding SIP with Network Address Translation (NAT) Outgoing Calls Incoming Calls Forwarded Calls Call Termination Call Re-INVITE Messages Call Session Timers Call Cancellation Forking SIP Messages SIP Headers SIP Body SIP NAT Scenario Classes of SIP Responses Related Topics Understanding Incoming SIP Call Support Using the SIP Registrar Related Topics Configuring Interface Source NAT for Incoming SIP Calls CLI Configuration Related Topics Configuring a Source NAT Pool for Incoming SIP Calls J-Web Configuration CLI Configuration Related Topics Configuring Static NAT for Incoming SIP Calls J-Web Configuration CLI Configuration Related Topics Configuring the SIP Proxy in the Private Zone CLI Configuration Related Topics Configuring the SIP Proxy in the Public Zone J-Web Configuration CLI Configuration Related Topic Configuring a Three-Zone SIP Scenario J-Web Configuration CLI Configuration Related Topics Verifying the SIP Configuration Verifying the SIP ALG Related Topics Verifying SIP Calls Related Topics Verifying SIP Call Detail Related Topics Verifying SIP Transactions Related Topics Verifying SIP Counters Related Topics Verifying the Rate of SIP Messages Related Topics Understanding the SCCP ALG SCCP Security SCCP Components SCCP Client CallManager Cluster SCCP Transactions Client Initialization Client Registration Call Setup Media Setup SCCP Control Messages and RTP Flow SCCP Messages Related Topics Configuring the SCCP ALG—Quick Configuration Setting SCCP Inactive Media Timeout J-Web Configuration CLI Configuration Related Topics Allowing Unknown SCCP Message Types J-Web Configuration CLI Configuration Related Topics Configuring SCCP Denial of Service (DoS) Attack Protection J-Web Configuration CLI Configuration Related Topics Configuring Call Manager/TFTP Server in the Private Zone CLI Configuration Related Topics Verifying the SCCP Configuration Verifying the SCCP ALG Related Topics Verifying SCCP Calls Related Topics Verifying SCCP Call Details Related Topics Verifying SCCP Counters Related Topics Understanding the MGCP ALG MGCP Security Entities in MGCP Endpoint Connection Call Call Agent Commands Response Codes Related Topics Configuring the MGCP ALG—Quick Configuration Understanding MGCP ALG Call Duration and Timeouts Related Topics Setting MGCP Call Duration J-Web Configuration CLI Configuration Related Topics Setting MGCP Inactive Media Timeout J-Web Configuration CLI Configuration Related Topics Setting the MGCP Transaction Timeout J-Web Configuration CLI Configuration Related Topics Configuring MGCP Denial of Service (DoS) Attack Protection J-Web Configuration CLI Configuration Related Topics Allowing Unknown MGCP Message Types J-Web Configuration CLI Configuration Related Topics Configuring a Media Gateway in Subscribers' Homes J-Web Configuration CLI Configuration Related Topics Configuring Three-Zone ISP-Hosted Service Using Source and Static NAT CLI Configuration Related Topics Verifying the MGCP Configuration Verifying the MGCP ALG Related Topics Verifying MGCP Calls Related Topics Verifying MGCP Endpoints Related Topics Verifying MGCP Counters Related Topics Understanding the RPC ALG Sun RPC ALG Typical RPC Call Scenario Sun RPC Services CustomizingSun RPC Services Microsoft RPC ALG MS RPC Services in Security Policies Predefined Microsoft RPC Services Related Topics Disabling and Enabling RPC ALG J-Web Configuration CLI Configuration Related Topics Verifying the RPC ALG Tables Display the Sun RPC Port Mapping Table Display the MS RPC UUID Mapping Table Related Topics NetScreen-Remote VPN Client Netscreen Remote Support on Different Device Types System Requirements for NetScreen-Remote Client Installation Installing the NetScreen-Remote Client on a PC or Laptop Starting NetScreen-Remote Client Installation Starting Installation from a CD-ROM Starting Installation from a Network Share Drive Starting Installation from a Web Site Completing NetScreen-Remote Client Installation Configuring the Firewall on the Router Firewall Configuration Overview Configuring a Security Zone Configuring a Tunnel Interface Configuring an Access Profile for XAuth Configuring an IKE Gateway Configuring Policies Configuring the PC or Laptop Creating a New Connection Creating the Preshared Key Defining the IPsec Protocols Logging In to the NetScreen Remote Client IDP Policies IDP Policy Support on Different Device Types IDP Policies Overview IDP Policy Terms Working with IDP Policies Understanding IDP Policy Rulebases IPS Rulebase Exempt Rulebase Related Topics Understanding IDP Policy Rules Related Topics Understanding IDP Rule Match Conditions Related Topics Understanding IDP Rule Objects Zone Objects Address or Network Objects Application or Service Objects Attack Objects Signature Attack Objects Protocol Anomaly Attack Objects Compound Attack Objects Attack Object Groups Related Topics Understanding IDP Rule Actions Related Topics Understanding IDP Rule IP Actions Related Topics Understanding IDP Rule Notifications Related Topics Defining Rules for an IPS Rulebase CLI Configuration Related Topics Defining Rules for an Exempt Rulebase CLI Configuration Related Topics IDP Policies—Quick Configuration Configuring IDP Policies—Quick Configuration Adding a New IDP Policy—Quick Configuration Adding an IPS Rulebase—Quick Configuration Adding an Exempt Rulebase—Quick Configuration Inserting a Rule in the Rulebase CLI Configuration Related Topics Deactivating and Reactivating Rules in a Rulebase CLI Configuration Related Topics Understanding Application Sets Related Topics Configuring Applications or Services for IDP CLI Configuration Related Topics Configuring Application Sets for IDP CLI Configuration Related Topics Enabling IDP in a Security Policy CLI Configuration Related Topics Understanding IDP Terminal Rules Related Topics Setting Terminal Rules in Rulebases CLI Configuration Related Topics Understanding Custom Attack Objects Attack Name and Description Severity Service or Application Binding Protocol or Port Bindings Time Bindings Scope Count Recommended Attack Properties—Signature Attacks Attack Context Attack Direction Attack Flow Attack Pattern Attack Category Protocol-Specific Parameters Sample Signature Attack Definition Attack Properties—Protocol Anomaly Attacks Attack Direction Test Condition Sample Protocol Anomaly Attack Definition Attack Properties—Compound or Chain Attacks Scope Order Reset Expression (Boolean expression) Member Index Sample Compound Attack Definition Related Topics Configuring Custom Attack Objects CLI Configuration Related Topics Configuring DSCP in an IDP Policy CLI Configuration Related Topics IDP Signature Database IDP Signature Database Support on Different Device Types Understanding the IDP Signature Database Related Topics Using Predefined Policy Templates CLI Configuration Related Topics Understanding Predefined Attack Objects and Groups Predefined Attack Objects Predefined Attack Object Groups Related Topics Updating the Signature Database Overview Related Topics Updating the Signature Database Manually CLI Configuration Related Topics Configuring a Security Package Update—Quick Configuration Updating the Signature Database Automatically CLI Configuration Related Topics Understanding the Signature Database Version Related Topics Verifying the Signature Database Verifying the Policy Compilation and Load Status Verifying the Signature Database Version IDP Application Identification IDP Application Identification Support on Different Device Types Understanding Application Identification Related Topics Understanding Service and Application Bindings Related Topics Understanding Application System Cache Related Topics Configuring IDP Policies for Application Identification CLI Configuration Related Topics Disabling Application Identification CLI Configuration Related Topics Setting Memory and Session Limits CLI Configuration Related Topics Verifying Application Identification Verifying the Application System Cache Verifying Application Identification Counters IDP Logging Understanding IDP Logging Related Topics Configuring Log Suppression Attributes CLI Configuration Related Topics Index Index