IDP Basic Configuration

Juniper Networks periodically provides a file containing attack database updates on its Web site. You can download this file to protect your network from new threats. The security package, which you can download from Juniper Networks, also includes IDP policy templates to help you implement IDP policy on your Junos security platform.

The procedures in this topic show you how to download and configure initial IDP functionality on your security device.

You can use this procedure for your SRX Series Firewall running Junos OS Release 18.3R1. This configuration example is tested with Junos OS release 19.3R1.

You must complete the following steps before you configure IDP functionality on an SRX Series Firewall:

Download and Install the licenses
Verify the network access to your security device.
Download and install IDP signature package (also referred as security package or attack objects)
Download policy templates (optional).
Configure recommended policy as the IDP policy (optional)
Enable IDP inspection in a security policy

Download and Install IDP Licenses

Juniper Networks maintains a database of attack signatures for use with the IDP feature. You need a valid license to retrieve updates for downloading and installing daily signature database updates provided by Juniper Networks. The IDP signature license key does not provide grace period support.

For license details, see Junos OS Feature License Keys.

Checking Your Connection to the Update Server

You must connect the Junos security platform to the Internet to update a device directly.

Use the following operational mode command to check the server connection from your Junos security platform.

This command not only verifies network connectivity, but also provides the remote database version, which is useful for comparing version differences with the previous command output.

Download IDP Signature Package

You can download the Juniper Networks security package manually or automatically at specified time intervals. The following steps illustrate the operational mode commands to download the security package and check the status of the download.

Download the security package.
Downloading the database might take some time depending on the database size and the speed of your Internet connection.

Check the security package download status.

Install IDP Signature Package

Once you complete the download of IDP signature package, you must install the IDP signature package before they are actually used in a policy. If you already have a policy configured, you do not need to recommit the policy—installing the updates adds them to the existing policy.

Install the security package.

Installing the attack database might take some time depending on the security package size.

Check the attack database install status.

The command output displays information about the downloaded and installed versions of the attack database.

The system displays following message if there are no active IDP policies are configured on the devices.

Download and install IDP Policy Templates

The IDP signature package download includes various policy templates. Once you install the templates, you can use the template policies as they are, or you can customize them for your network environment.

Use the following steps to download and install the latest policy templates provided by Juniper Networks.

Download the predefined IDP policy templates.

Check the security package download status.

Install the IDP policy templates.

Verify the installation status update.

Applying the Recommended IDP Policy

The Junos OS downloads the policy templates in the form of a commit script. Once you download and install the policy templates, you must activate the template commit script with the configuration mode commands with the following steps:

Enable the templates.xsl scripts file.
The downloaded templates are saved to the Junos OS configuration database, and they are available in the CLI at the [edit security idp idp-policy] hierarchy level.
You must commit the configuration to activate a commit script.

Display the list of downloaded templates.

Activate the predefined policy as the active policy. In this example, you use Recommended policy as active policy.
IDP signature database provides templates a multitude of network scenarios. For more information, see Predefined IDP Policy Templates

Confirm the active policy enabled on your device

Deactivate the Commit Script File

We recommend you to delete or deactivate the commit script file. By deleting or deactivating the commit script file, you can avoid the risk of overwriting modifications to the pre-defined policies (created using the templates) when you commit the configuration.

Use the following steps to delete or to deactivate the commit script file:

Enabling IDP in a Security Policy

The final step to activating the recommended IDP policy is to apply the IDP action to a security policy.

Enable the security policy for IDP inspection.

Commit the changes once you are done with configuration.

Verify the IDP configuration in security policy using the show security policies policy-name idp-policy-1 detail command.

The sample output confirms that you have enabled IDP for the security policy.

Now, you can proceed with configuring other IDP policies. See Example: Configuring Multiple IDP Policies and a Default IDP Policy for Unified Security Policies.

ON THIS PAGE