Index

Symbols

#, comments in configuration statements    1

( ), in syntax descriptions    1

3DES    1

< >, in syntax descriptions    1

[ ], in configuration statements    1

{ }, in configuration statements    1

| (pipe), in syntax descriptions    1

A

AAA    1

Access Manager    

adding firewall connection to    1

auto-upgrading    1

client-side files    1

downloading to user’s computers    1

error messages    1

launching from client    1

logging    1

overview    1

system requirements    1

Windows registry changes    1

Access Point Name     See APN    

access profile    

configuring    

dynamic VPN    1

accommodating end-to-end TCP communication    

end-to-end TCP communication    1

address sweep    1

Advanced Encryption Standard (AES)    1

AES    1

agentless access     See UAC, Infranet agent    

agents, zombie    1

aggressive mode    1

AH (authentication header) protocol    

overview    1

ALGs    

MS RPC    1

SIP    1

SIP NAT    1

Sun RPC    1

antireplay    

group VPN    1

antispam filtering    1

local list    1

message handling    1

server-based    1

verifying    1

antivirus    

verifying    1

antivirus, express    1

EICAR file    1

limitations    1

testing    1

updating antivirus patterns    1

antivirus, full    1

application protocol scanning    1

content size limits    1

decompression layer limit    1

file extension scanning    1

intelligent prescreening    1

notification options    1, 2, 3, 4

scan session throttling    1

scanning timeout    1

signature database support    1

updating antivirus patterns    1

APN    

filtering    1

selection mode    1

appDDoS    

application-level DDoS protection overview    1

AppDDoS    

understanding logging    1

AppDDoS Protection    

enabling example    1

application binding    1, 2

application identification    1, 2,  See also IDP    

application binding    1

application package manual download    1

configuring policies (IDP)    1

custom application definitions    1

disable    1, 2

memory limit    1

nested applications    1, 2

overview    1

service binding    1

session limit    1

system cache    1, 2

system caching for nested application identification    1, 2

understanding application package    1

verifying application package    1

verifying cache statistics    1, 2

verifying counters    1

application identification (JUNOS)    

overview    1

application identification services    

memory limit    1

session limit    1

application package    

automatic update    1

manually update    1

understanding    1

updating, overview    1

verifying    1

application sets    

IDP, configuring    1

overview    1

application system cache    1, 2

overview    1, 2

application tracking    

AppTrack    1

application-level DDoS    1

application-level DDoS protection overview    1

configuring statistic reporting    1

statistics reporting overview    1

Application-Level DDoS    

understanding logging    1

application-level DDoS protection    

configuration    1

applications    

IDP, configuring    1

AppTrack    

application tracking    1

associating policy to schedulers    1

attack detection    

overview    1

attack object groups    1

predefined    1

attack objects    

predefined    1

attacks    

DOS    1, 2, 3

ICMP    

floods    1, 2

fragments    1

IP packet fragments    1

Land    1, 2

large ICMP packets    1

Ping of Death    1

replay    1

session table floods    1, 2

SYN floods    1, 2

SYN fragments    1

Teardrop    1, 2

UDP floods    1, 2

unknown protocols    1

WinNuke    1, 2

auth users    

groups    1

authenticating users    

pass-through authentication    1

authentication    

administrative    1

algorithms    1

client groups    1

configuring    

external authentication servers    1, 2

SecurID server    1

pass-through    1

Web    1

authentication tables     See UAC, authentication tables    

authentication, authorization, and accounting servers    1, 2

AutoKey IKE VPN    1

management    1

B

banners    1

braces, in configuration statements    1

brackets    

angle, in syntax descriptions    1

square, in configuration statements    1

C

CA certificates    1

captive portal    

captive portal policy creating    1

configuration    1

overview    1

redirect URL configure    1

redirect URL options    1

certificates    1

CA    1

loading    1

local    1

revocation    1

self-signed    1

UAC deployments     See UAC, device authentication    

changing session characteristics    1, 2

chassis cluster    

ISSU upgrading    1

chassis clusters    

about    1

control interfaces    1

creating a J Series cluster    1

creating an SRX Series cluster    1

disabling    1

enabling    1

fabric interfaces    1

formation    1

hardware setup for J Series devices    1

hardware setup for SRX Series devices    1

management interfaces on J Series devices    1

management interfaces on SRX Series devices    1

node interfaces on J Series devices    1

node interfaces on SRX Series devices    1

redundancy groups    1

setting node and cluster IDs    1

verifying    1

verifying interfaces    1

verifying redundancy group status    1

verifying statistics    1

verifying status    1

client groups for firewall authentication    1

cold sync    

monitoring    1

colocation mode    1

comments, in configuration statements    1

compiling IDP policy    1

compound attack sample    1

conditional route advertising configuration    1

configuring    

anomaly attack objects    1

application identification services, memory limit    1

application identification services, session limit    1

application identification, memory limit    1

application identification, session limit    1

AutoKey IKE    1

chassis cluster information    1

conditional route advertising    1

control link recovery    1

control ports    1

dampening time between back-to-back redundancy group failovers    1

DSCP in IDP policy    1

dynamic VPN client configurations    1

dynamic VPN global settings    1

exempt rulebase    1

external authentication servers    1

fabric    1

group VPN    1

group VPN colocation mode    1

group VPN multicast rekey    1

group VPN unicast rekey    1

group VPNs    1

host inbound traffic    1

protocols    1

IDP application sets    1

IDP applications    1

IDP in security policy    1

IDP policy, application identification    1

IDP services    1

IKE gateway and peer authentication    1

IKE policy, authentication, and proposal    1

interface monitoring    1

interface source NAT for incoming SIP calls    1

interface source NAT pool for incoming SIP calls    1

IPS rulebase    1

IPsec policy    1

IPsec tunnel overview    1

log suppression    1

management interfaces    1

Phase 2 proposals    1

redundancy groups    1

redundant Ethernet interfaces    1

SCCP DoS attack protection    1

signature attack objects    1

signature database automatic download    1

signature database manual download    1

SIP DoS attack protection    1

SIP proxy    

private zone    1

public zone    1

static NAT for incoming SIP calls    1

TCP-reset parameter    1

terminal rules    1

three-zone SIP scenario    1

VPN global settings    1

Content Filtering    1

filter types    1

protocol support    1

verifying    1

control link    1

failure and recovery    1

control link recovery    

configuring    1

control plane    

overview    1

control ports    

configuring    1

controlling session termination    1, 2

conventions    

notice icons    1

text and syntax    1

cookies, SYN    1

CoS features    1, 2

counters, verifying    

for application identification    1

creating a J Series chassis cluster    1

creating an SRX Series chassis cluster    1

curly braces, in configuration statements    1

custom attacks    

application binding    1

compound    1

configuring    1, 2

name    1

protocol anomaly    1

protocol binding    1

service binding    1

severity    1

signature    1

time binding    1

customer support    1

contacting JTAC    1

D

data    

fabric    1

fabric (dual)    1

fabric (dual), connecting    1

forwarding    1

plane    1

Data Encryption Standard (DES)    1

data path    1

fast-path processing    1

forward processing    1

session-based processing    1

data processing, stateful and stateless    1, 2

DDoS    1

application-level    1

defining    

exempt rulebase    1

IPS rulebase    1

DES    1

Diffie-Hellman    1, 2

Diffserv    

configuring in IDP policy    1

digital signature    1

disabling    

chassis clusters    1

disabling TCP packet security checks    1, 2

documentation    

comments on    1

DoS    

firewall    1

session table floods    1, 2

DoS attacks    1

download    

Access Manager    1

client configuration, dynamic VPN    1

signature database automatic    1

signature database manually    1

signature database overview    1

dual control links    

about    1

connecting    1

upgrading the second routing engine    1

dynamic auth table provisioning     See UAC, dynamic auth table provisioning    

dynamic packet filtering    1

dynamic policies     See group VPNs    

dynamic VPNs    

client configurations    1

configuration overview    1

downloading client configurations    1, 2

global settings    1

overview    1

E

enabling chassis clusters    1

encryption algorithms    1

ESP    1, 2, 3

ESP (Encapsulating Security Payload) protocol    

overview    1

exempt rulebase    

configuring    1

F

fabric configuration    1

fabric data link    1

fabric data link (dual)    1

connecting    1

fabric data-link failure    1

fabric interfaces    1

fast-path processing    1

filters, stateless firewall    1, 2

FIN scans    1

FIN without ACK flag attack detection    

overview    1

firewall users, pass-through    

authentication process    1

floods    

ICMP    1, 2

session table    1

SYN    1, 2, 3

UDP    1, 2

flow-based packet processing    

defined    1, 2

flow-based processing    

enabling    1

flowd    

monitoring    1

font conventions    1

forward processing    1

forwarding features    1

G

gatekeeper devices    1

GDOI protocol     See group VPNs    

Gi interface    1, 2

glossary    

IDP policy    1

Gp interface    1

gprs    

about    1

tunneling protocol    1

group keys    

KEK    1

TEK    1

group policies     See group VPNs    

group VPNs    

antireplay    1

colocation configuration    1

colocation mode    1

configuration    1

configuration overview    1

dynamic policies    1

GDOI protocol    1

group keys    1

group policies    1

heartbeat messages    1

IKE Phase 1 configuration    1

interoperability with GET VPN    1

IPsec SA configuration    1

key activation    1

limitations    1

member    1

member reregistration    1

multicast rekey configuration    1

overview    1

rekey messages    1

scope policies    1

server    1

server-member communication    1

unicast rekey configuration    1

VPN group configuration    1

GTP    

access point name (APN) filtering    1

IMSI prefix filtering    1

inspection objects    1

IP fragmentation    1

policy-based    1

GTP messages    1

length, filtering by    1

rate, limiting by    1

type, filtering by    1

types    1

versions 0 and 1    1

H

hardware    

supported platforms    1

hardware setup, chassis cluster    1, 2

hash-based message authentication code    1

heartbeats    1

group VPN    1

high availability    1

HMAC    1

Host Checker     See UAC, Host Checker policy enforcement    

hub-and-spoke    1

I

ICMP    

floods    1, 2

fragments    1

IPv6    1

large packets    1

Path MTU    1, 2

ICMP header flags    1

IDP    

application and services    1

application identification    1

application sets    1

application sets, configuring    1

custom attacks, properties    1, 2, 3

deactivating rules    1

defining exempt rulebase    1

defining IPS rulebase    1

detector    1

DSCP    1

enabling IDP    1

inserting rule    1

log suppression    1

logging, overview    1

maximize-idp-sessions    1

packet capture    1

performance and capacity tuning    1

policy    1

policy, manage    1

policy, overview    1

protocol decoder    1

rulebase, application-level DDoS    1

rulebase, DDoS    1

rulebase, exempt    1

rulebase, IPS    1

rulebase, overview    1

rules, actions    1

rules, IP actions    1

rules, match conditions    1

rules, objects    1

rules, overview    1

send attack logs to the IC    1

setting terminal rules    1

signature database    1

terminal rules, overview    1

verify load status    1

verify policy compilation    1

verify signature database version    1

IDP application-level DDoS    

configuring statistic reporting    1

statistics reporting overview    1

IDP policy    

application identification    1

overview    1

rulebase, exempt    1

IDP, inline tap mode    

configuring    1

overview    1

IKE    1

gateway and peer authentication    1

Phase 1 proposals    

group VPN    1

predefined    1

Phase 2 proposals    

configuring    1

predefined    1

proxy IDs    1

IMSI prefix filtering    1

in-service upgrade    

chassis cluster    1

Infranet agent     See UAC, Infranet agent    

Infranet Controller     See UAC, Infranet Controller    

Infranet Enforcer     See UAC, JUNOS Enforcer    

initiating manual redundancy group failover    1

inline tap mode    

overview    1

inline tap mode, configuring    1

inspections    1

interface monitoring configuration    1

interfaces    1

control    1

fabric    1

interfaces on J Series devices    

management    1

node    1

interfaces on SRX Series devices    

management    1

node    1

intrusion detection and prevention     See IDP    

IP options    

incorrectly formatted    1

loose source route    1

record route    1, 2

security    1, 2

source route    1

stream ID    1, 2

strict source route    1

timestamp    1, 2

IP packet fragments    1

IP protocol header    1

IP spoofing    1, 2

IPS rulebase    

configuring    1

IPsec    

digital signature    1

overview    1

SAs    1, 2, 3, 4,  See also group VPNs    

group VPN configuration    1

security protocols    

Authentication Header (AH)    1

Encapsulating Security Protocol (ESP)    1

tunnel    1

creating through dynamic VPN feature    1

tunnel mode    1

tunnel negotiation    1

UAC support    1

IPv6    

address examples    1

address format    1

address space    1

address types    1, 2

addressing    1

anycast addresses    1

basic packet header fields    1

enabling    1

features    1

flow module sanity checks    1

host-inbound traffic    1

ICMP overview    1

multicast addresses    1

overview    1

packet fragmentation    1

packet header extension fields    1

packet header overview    1

Path MTU    1

sessions    1

SRX Series high-end devices    1

unicast addresses    1

J

JUEP     See UAC, device authentication    

JUNOS Enforcer     See UAC, JUNOS Enforcer    

K

KEK     See group VPNs    

key activation    

group VPN    1

L

L2TP    1

land attack detection    

configuration    1

overview    1

local certificate    1

log suppression    1

configuring    1

logging    

IDP, overview    1

logging, traffic    1

loose source route IP detection    

configuration    1

M

main mode    1

management interfaces    1, 2

configuring    1

manual key management    

overview    1

manuals    

comments on    1

MD5    1, 2

Message Digest version 5 (MD5)    1

MGCP ALG    1

commands    1

entities    1

security    1

MGCP timeouts    

inactivity    1

media inactivity    1

Mobile Station (MS) mode    1

modes    

aggressive    1

main    1

tunnel    1

modes, operational    

NAT    1

route    1

transparent    1

modes, selection    

APN    1

Mobile Station (MS)    1

network    1

verified    1

modulus    1

MS RPC ALG, defined    1

multimedia sessions, SIP    1

N

NAT (Network Address Translation)    1

proxy ARP    1

rule-based    1

NAT mode    1

network mode    1

node interfaces on J Series devices    1

node interfaces on SRX Series devices    1

notice icons    1

O

Odyssey Access Client     See UAC, Infranet agent    

operational modes    

NAT    1

route    1

transparent    1

P

packet capture    

IDP    1

packet filtering    1, 2, 3, 4

packet fragmentation    

IPv6    1

packet processing    1, 2

stateful    1, 2

stateless    1, 2, 3, 4

packet-based processing    1, 2

parentheses, in syntax descriptions    1

pass-through authentication    1

Path MTU    

Path MTU    1

Perfect Forward Secrecy     See PFS    

PFS    1

Phase 1    1

proposals    1

proposals, predefined    1

Phase 2    1

proposals    1, 2

proposals, configuring    1

proposals, predefined    1

ping of death attack protection    

configuration    1

overview    1

pinholes    1

PKI    1

using SCEP    1

policies    1

application services processing order    1

core section    1

schedulers    

associating    1

shadowing    1

policies, configuring    1

policy    

IDP     See IDP    

policy templates    

predefined    1

port scan attack protection    

overview    1

predefined attack objects    1

predefined policy templates    1

overview    1

preshared key    1

probes    

network    1

open ports    1

operating systems    1, 2

processing    

data    1, 2

flow-based    1, 2

packet-based    1, 2

proposals    

Phase 1    1

Phase 2    1

protocol anomaly    1

protocol anomaly attack    1

direction    1

expression (boolean expression)    1

member index    1

member index sample    1

order    1

reset    1

sample    1, 2

scope    1

test condition    1

protocol anomaly attack sample    1

protocol binding    1

sample format    1

proxy IDs    1

public/private key pair    1

R

rate limiting, GTP-C messages    1

reconnaissance    

address sweep    1

FIN scans    1

IP options    1

port scan    1

SYN and FIN flags set    1

TCP packet without flags    1

reconnaissance deterrence    

IP address sweeps    1

blocking    1

overview    1

record route IP option    1, 2

redundancy group    

configuring dampening time between back-to-back failovers    1

initiating manual failover    1

redundancy group configuration    1

redundancy groups    

about    1

group 0    1

groups 1 through 128    1

interface monitoring    1

IP address monitoring    1

redundant Ethernet interface LAG    1

configuration    1

redundant Ethernet interfaces    

configuring    1

understanding    1

registry changes, Access Manager    1

rekey messages    1,  See also group VPNs    

intervals    1

types    1

Remote Access Management Solution     See dynamic VPNs    

remote access server    

logging into for the first time    1

logging into subsequent sessions    1

overview    1

replay protection    1

reregistration    

group member    1

resource access policies     See UAC, resource access policies    

reth    

link aggregation group    1

link aggregation group configuration    1

RFCs    

0792, Internet Control Message Protocol    1

1038, Revised IP Security Option    1

791, Internet Protocol    1, 2

793, Transmission Control Protocol    1

roles     See UAC, user roles    

route mode    1

RPC    

Sun RPC    1

rulebase    

exempt, attack objects    1

exempt, match condition    1

exempt, overview    1

IPS, action    1

IPS, attack objects    1

IPS, IP action    1

IPS, match condition    1

IPS, notification    1

IPS, overview    1

IPS, terminal flag    1

overview    1

rules    1

rules    

actions    1

deactivating    1

inserting    1

IP actions    1

match conditions    1

objects    1

objects, address    1

objects, attack    1

objects, service    1

objects, zone    1

overview    1

terminal    1

S

SA parameters    1

SAs    1, 2,  See also group VPNs    

SCCP    

allowing unknown message types    1

configuring DoS attack protection    1

setting inactive media timeout    1, 2

SCEP    1, 2, 3

digital certificates    1

enrolling a local certificate    1

PKCS #10, PKCS #7    1

reenrolling certificates    1

RSA key    1

scope policies     See group VPNs    

screen    

address sweep    1

bad IP options, drop    1

FIN with no ACK    1

FIN without ACK flag, drop    1

ICMP    

fragments, block    1

ICMP floods    1, 2

IP options    1

IP packet fragments, block    1

IP spoofing    1, 2

Land attacks    1, 2

large ICMP packets, block    1

loose source route IP option, detect    1

Ping of Death    1

port scan    1

source route IP option, deny    1

strict source route IP option, detect    1

SYN and FIN flags set    1

SYN floods    1, 2

SYN fragments, detect    1

SYN-ACK-ACK proxy floods    1, 2

TCP packet without flags, detect    1

Teardrop    1, 2

UDP floods    1, 2

unknown protocols, drop    1

WinNuke attacks    1, 2

Secure Hash Algorithm-1    1

SecurID    1

security checks, disabling TCP packet    1, 2

security IP option    1, 2

security policy    

enabling IDP    1

security zones    1

creating    1

functional    1

host inbound traffic    1

protocols    1

interfaces    1

ports    1

TCP-reset parameter    1

selection modes    

APN    1

Mobile Station (MS)    1

Network    1

verified    1

self-signed certificates    

about    1

automatically generated    1, 2

manually generated    1, 2

sequence-number validation    1

service binding    1, 2

services    

IDP, configuring    1

timeout threshold    1

session    

changing characteristics    1, 2

controlling termination    1, 2

session limits    1

source-based    1, 2, 3

session lookup    1

session table floods    1, 2

session-based processing    1

setting the node and cluster IDs    1

SHA-1    1, 2

show security idp application-identification application-system-cache command    1

signature attack sample    1

signature custom attack    1

context    1

direction    1

ICMP header    1

IP protocol flags    1

pattern    1

protocol-specific parameters    1

sample    1

TCP header    1

UDP header    1

signature database    1,  See also IDP    

attack object groups    1

automatic update    1

manually update    1

overview    1

predefined attack objects    1

predefined policy templates    1

updating, overview    1

verify    1

verify load status    1

verify policy compilation    1

verify version    1

version, overview    1

SIP    

connection information    1

defined    1

media announcements    1

messages    1

multimedia sessions    1

pinholes    1

request methods    1

response codes    1

RTCP    1

RTP    1

signaling    1

SIP ALG    1

call duration and timeouts    1

SIP NAT    

call setup    1

defined    1

SIP timeouts    

inactivity    1

media inactivity    1, 2, 3

session inactivity    1

signaling inactivity    1

SNMP failover traps    1

source IP route attack protection    

overview    1

SPUs    

monitoring    1

stateful    1

stateful and stateless data processing    1, 2

stateful inspection    1

stateful packet processing    1, 2

stateless firewall filters    1, 2

stateless packet processing    1, 2

statistics    

application-level DDoS configuring    1

application-level DDoS overview    1

statistics, verifying    

for application identification    1, 2

stream ID IP option    1, 2

strict source route IP option    1

Sun RPC ALG    1

call scenarios    1

defined    1

support, technical     See technical support    

SYN and FIN flags protection    

overview    1

SYN checking    1

asymmetric routing    1

reconnaissance hole    1

session table floods    1

SYN cookies    1

SYN floods    1, 2

alarm threshold    1

attack threshold    1

destination threshold    1

source threshold    1

SYN cookies    1

threshold    1

timeout    1

SYN fragment protection    

overview    1

SYN-ACK-ACK proxy floods    1

SYN-ACK-ACK-proxy flood protection    

configuration    1

syntax conventions    1

T

TCP header flag attack protection    

configuration    1

overview    1

teardrop attack protection    

configuration    1

overview    1

technical support    

contacting JTAC    1

TEK     See group VPNs    

terminal rules    

overview    1

setting    1

terminology    

IDP policy    1

three-way handshakes    1

time binding    1

count    1

scope    1

timestamp IP option    1, 2

traffic    

counting    1

logging    1

transparent mode    1

transport mode    1

Triple DES    1

tunnel mode    

overview    1

U

UAC    

authentication tables    

failover processing    1

overview    1

captive portal    1, 2,  See also captive portal    

certificates     See UAC, device authentication    

clustering     See UAC, failover processing    

device authentication    

configuring    1

overview    1

dynamic auth table provisioning    1

failover processing    

configuring timeout actions    1

connecting to cluster    1

overview    1

Host Checker policy enforcement    1

Infranet agent    

agentless access    1

Odyssey Access Client    1

overview    1, 2

support information    1

Infranet Controller    

communications with JUNOS Enforcer    1

configuring access to    1

overview    1

IPsec support    1

JUEP     See UAC, device authentication    

JUNOS Enforcer    

communications with Infranet Controller    1

enabling    1

overview    1

logging    1

overview    1

policies    

application services processing order    1

enforcement overview    1

resource access policies    

failover processing    1

overview    1

show commands    1

test-only mode    1

timeout actions     See UAC, failover processing    

user roles    1

UDP header attack protection    

configuration    1

Unified Access Control     See UAC    

Unified Threat Management    

antispam filtering    1

antivirus protection, express    1

antivirus protection, full    1

content filtering    1

licensing    1

overview    1

platform support    1

web filtering    1

unknown protocol attack protection    

overview    1

upgrading    

chassis cluster ISSU    1

user roles     See UAC, user roles    

UTM    

WELF support for log files    1

V

verification    

application system cache    1, 2, 3

verified mode    1

verifying    

chassis cluster interfaces    1

chassis cluster redundancy group status    1

chassis cluster statistics    1

chassis cluster status    1

chassis clusters    1

IDP policy compilation    1

IDP policy load status    1

signature database    1

signature database version    1

version    

signature database    1

VPNs    

aggressive mode    1

AutoKey IKE    1

Diffie-Hellman exchange    1

Diffie-Hellman groups    1

dynamic VPN     See dynamic VPNs    

global settings    1

group     See group VPNs    

group configuration    1

group VPN     See group VPNs    

main mode    1

Phase 1    1

Phase 2    1

replay protection    1

W

Web Filtering    1

cache    1

integrated    1

local    1

profiles    1, 2

verifying    1

wildcards    1

Windows registry changes, Access Manager    1

WinNuke attack protection    

configuration    1

overview    1

Z

zombie agents    1

zones    

functional    1

security    1