close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
- Intrusion Detection and Prevention Overview
play_arrow Downloading and Updating the IDP Signature Database
play_arrow Configuring IDP Policies
play_arrow Understanding Custom Attacks Objects Service Contexts
play_arrow Configuring IDP Features
play_arrow Monitoring IDP
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

IDP Basic Configuration

date_range 27-Mar-25

arrow_backward

arrow_forward

This topic provides details about enabling IDP on SRX Series Firewalls. It covers key steps such as obtaining licenses, downloading signature updates, and applying predefined policies. The topic also highlights how to integrate IDP with security policies for effective traffic inspection and threat prevention.

Juniper Networks periodically provides a file containing attack database updates on its Web site. You can download this file to protect your network from new threats. The security package, which you can download from Juniper Networks, also includes IDP policy templates to help you implement IDP policy on your Junos security platform.

The procedures in this topic show you how to download and configure initial IDP functionality on your SRX Series Firewall.

You can use this procedure for your SRX Series Firewall running Junos OS Release 18.3R1. This configuration example is tested with Junos OS release 19.3R1.

You must complete the following steps before you configure IDP functionality on an SRX Series Firewall:

Download and Install the licenses
Verify the network access to your SRX Series Firewall.
Download and install IDP signature package (also referred as security package or attack objects)
Download policy templates (optional).
Configure recommended policy as the IDP policy (optional)
Enable IDP inspection in a security policy

Download and Install IDP Licenses

Juniper Networks maintains a database of attack signatures for use with the IDP feature. You need a valid license to retrieve updates for downloading and installing daily signature database updates provided by Juniper Networks. The IDP signature license key does not provide grace period support.

For license details, see Junos OS Feature License Keys.

Checking Your Connection to the Update Server

You must connect the Junos security platform to the Internet to update a device directly.

Use the following operational mode command to check the server connection from your Junos security platform.

content_copy zoom_out_map
user@host> request security idp security-package download check-server

content_copy zoom_out_map
Successfully retrieved from(https://signatures.juniper.net/cgi-bin/index.cgi).
Version info:3222(Detector=12.6.180190722, Templates=3222)

This command not only verifies network connectivity, but also provides the remote database version, which is useful for comparing version differences with the previous command output.

Download IDP Signature Package

You can download the Juniper Networks security package manually or automatically at specified time intervals. The following steps illustrate the operational mode commands to download the security package and check the status of the download.

Download the security package.
```
user@host> request security idp security-package download
```
```
Will be processed in async mode. Check the status using the status checking CLI
```
Downloading the database might take some time depending on the database size and the speed of your Internet connection.

Check the security package download status.

content_copy zoom_out_map
user@host> request security idp security-package download status 

content_copy zoom_out_map
Done;Successfully downloaded from(https://signatures.juniper.net/cgi-bin/index.cgi).
Version info:3222(Tue Nov  5 14:09:35 2019 UTC, Detector=12.6.180190722)

Install IDP Signature Package

Once you complete the download of IDP signature package, you must install the IDP signature package before the signatures are actually used in a policy. If you already have a policy configured, you do not need to recommit the policy—installing the updates adds them to the existing policy.

Install the security package.
```
user@host-1> request security idp security-package install
```
```
Will be processed in async mode. Check the status using the status checking CLI
```
Installing the attack database might take some time depending on the security package size.

Check the attack database install status.

The command output displays information about the downloaded and installed versions of the attack database.

content_copy zoom_out_map
user@host-1> request security idp security-package install status

content_copy zoom_out_map
Done;Attack DB update : successful - [UpdateNumber=3222,ExportDate=Tue Nov  5 14:09:35 2019 UTC,Detector=12.6.180190722]
    Updating control-plane with new detector : successful
    Updating data-plane with new attack or detector : successful

The system displays the following message if there are no active IDP policies configured on the devices.

content_copy zoom_out_map
Done;Attack DB update : successful - [UpdateNumber=3222,ExportDate=Tue Nov  5 14:09:35 2019 UTC,Detector=12.6.180190722]
     Updating control-plane with new detector : successful
     Updating data-plane with new attack or detector : not performed
      due to no active policy configured.

Download and Install IDP Policy Templates

The IDP signature package download includes various policy templates. Once you install the templates, you can use the template policies as they are, or you can customize them for your network environment.

Use the following steps to download and install the latest policy templates provided by Juniper Networks.

Download the predefined IDP policy templates.

content_copy zoom_out_map
user@host-1> request security idp security-package download policy-templates

content_copy zoom_out_map
Will be processed in async mode. Check the status using the status checking CLI

Check the security package download status.

content_copy zoom_out_map
user@host-1> request security idp security-package download status 

content_copy zoom_out_map
Done;Successfully downloaded from(https://signatures.juniper.net/cgi-bin/index.cgi).
Version info:3222

Install the IDP policy templates.

content_copy zoom_out_map
user@host-1> request security idp security-package install policy-templates

content_copy zoom_out_map
Will be processed in async mode. Check the status using the status checking CLI

Verify the installation status update.

content_copy zoom_out_map
user@host-1> request security idp security-package install status

content_copy zoom_out_map
Done;policy-templates has been successfully updated into internal repository
     (=>/var/run/scripts/commit/templates.xsl)!

Applying the Recommended IDP Policy

The Junos OS downloads the policy templates in the form of a commit script. Once you download and install the policy templates, you must activate the template commit script with the configuration mode commands with the following steps:

Enable the templates.xsl scripts file.
```
[edit]
user@host-1# set system scripts commit file templates.xsl
```
The downloaded templates are saved to the Junos OS configuration database. The templates are available in the CLI at the [edit security idp idp-policy] hierarchy level.
You must commit the configuration to activate a commit script.
```
[edit]
user@host-1# commit
```

Display the list of downloaded templates.

content_copy zoom_out_map
[edit]
user@host-1# set security idp default-policy ?

content_copy zoom_out_map
Possible completions:
 <default-policy>     Set active policy
  Client-And-Server-Protection
  Client-And-Server-Protection-1G
  Client-Protection
  Client-Protection-1G
  DMZ_Services
  DNS_Service
  File_Server
  Getting_Started
  IDP_Default
  Recommended
  Server-Protection
  Server-Protection-1G
  Web_Server

Activate the predefined policy as the active policy. In this example, you use Recommended policy as active policy.
```
[edit]
user@host-1# set security idp default-policy Recommended
```
IDP signature database provides templates a multitude of network scenarios. For more information, see Predefined IDP Policy Templates.
Confirm the active policy enabled on your device.
```
[edit]
user@host-1# show security idp default-policy
```
```
default-policy Recommended;
```

Deactivate the Commit Script File

We recommend you to delete or deactivate the commit script file. By deleting or deactivating the commit script file, you can avoid the risk of overwriting modifications to the predefined policies (created using the templates) when you commit the configuration.

Use the following steps to delete or to deactivate the commit script file:

content_copy zoom_out_map
user@host# delete system scripts commit file templates.xsl 
user@host# deactivate system scripts commit file templates.xsl

Enabling IDP in a Security Policy

The final step to activating the recommended IDP policy is to apply the IDP action to a security policy.

Enable the security policy for IDP inspection.

content_copy zoom_out_map
[edit]
user@host-1# set security policies from-zone untrust to-zone trust policy policy-1 match source-address any
user@host-1# set security policies from-zone untrust to-zone trust policy policy-1 match destination-address any
user@host-1# set security policies from-zone untrust to-zone trust policy policy-1 match application any
user@host-1# set security policies from-zone untrust to-zone trust policy policy-1 match dynamic-application junos:YAHOO-MAIL
user@host-1# set security policies from-zone untrust to-zone trust policy policy-1 match dynamic-application junos:FACEBOOK-ACCESS
user@host-1# set security policies from-zone untrust to-zone trust policy policy-1then permit application-services idp-policy Recommended

Commit the changes once you are done with configuration.

Verify the IDP configuration in security policy using the show security policies policy-name idp-policy-1 detail command.

content_copy zoom_out_map
user@host>  show security policies policy-name policy-1 detail
Policy: p1, action-type: permit, State: enabled, Index: 4, Scope Policy: 0
  Policy Type: Configured
  Sequence number: 1
  From zone: untrust, To zone: trust
  Source vrf group:
    any
  Destination vrf group:
    any
  Source addresses:
    any-ipv4(global): 0.0.0.0/0
    any-ipv6(global): ::/0
  Destination addresses:
    any-ipv4(global): 0.0.0.0/0
    any-ipv6(global): ::/0
  Application: any
    IP protocol: 0, ALG: 0, Inactivity timeout: 0
      Source port range: [0-0]
      Destination ports: [0-0]
  Dynamic Application:
    junos:FACEBOOK-ACCESS: 244
    junos:YAHOO-MAIL: 236
    Per policy TCP Options: SYN check: No, SEQ check: No, Window scale: No
  Intrusion Detection and Prevention: enabled
  Unified Access Control: disabled

The sample output confirms that you have enabled IDP for the security policy.

Now, you can proceed with configuring other IDP policies. See Example: Configuring Multiple IDP Policies and a Default IDP Policy for Unified Security Policies.

arrow_backward PREVIOUS IDP Signature Database Overview

NEXT arrow_forward IDP Signature Language Enhancements

Intrusion Detection and Prevention User Guide

ON THIS PAGE

IDP Basic Configuration

Download and Install IDP Licenses

Checking Your Connection to the Update Server

Download IDP Signature Package

Install IDP Signature Package

Download and Install IDP Policy Templates

Applying the Recommended IDP Policy

Deactivate the Commit Script File

Enabling IDP in a Security Policy

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Intrusion Detection and Prevention User Guide

ON THIS PAGE

IDP Basic Configuration

Download and Install IDP Licenses

Checking Your Connection to the Update Server

Download IDP Signature Package

Install IDP Signature Package

Download and Install IDP Policy Templates

Applying the Recommended IDP Policy

Deactivate the Commit Script File

Enabling IDP in a Security Policy

Related Documentation

Stay in touch