- play_arrow Downloading and Updating the IDP Signature Database
- play_arrow Configuring IDP Policies
- play_arrow Understanding Custom Attacks Objects Service Contexts
- play_arrow Configuring IDP Features
- play_arrow Monitoring IDP
- play_arrow Configuration Statements and Operational Commands
ON THIS PAGE
Intrusion Detection and Prevention Overview
The Juniper Networks IDP system detects and prevents network threats by monitoring traffic for malicious activity. It uses a signature database to identify attacks and applies security policies for real-time mitigation. It enhances network security and provides proactive threat detection and response.
Intrusion detection is the process of monitoring the events occurring in your network and analyzing the events for signs of possible incidents, violations, or imminent threats to your security policies. Intrusion prevention is the process of performing intrusion detection and then stopping the detected incidents. These security measures are available as intrusion detection systems (IDS) and intrusion prevention systems (IPS), which become part of your network to detect and stop potential incidents.
Benefits of IDP
By leveraging IDP, you can significantly enhance your network's security posture, protecting against a wide range of known and emerging threats. The following are some of the benefits:
Proactive Threat Prevention—Stops attacks before they can cause damage.
Network Visibility—Provides insights into potential security issues.
Customizable Protection—Allows tailoring of security policies to specific network needs.
Compliance Support—Helps meet regulatory requirements for network security.
Automated Response and Remediation—The IDP system can automatically respond to detected threats by blocking malicious traffic, quarantining affected firewalls, and alerting administrators. This helps in minimizing the impact of security incidents.
IDP Workflow
The IDP system inspects traffic to detect and mitigate threats. The traffic inspection engine analyzes packets using signature-based detection, protocol anomaly detection, and behavioral analysis. If a threat is found, a decision is taken at the policy enforcement and actions stage whether to block, alert, or log the activity. The events are logged and reported back to the administrators for further analysis. Threat intelligence and updates continuously improves detection by adding new threat data and ensures real-time protection against evolving cyberthreats.
Table 1: IDP Workflow lists the details of the IDP workflow.
| Component | Description |
|---|---|
| Traffic Inspection Engine (Or IDP Inspection Process) | Examines packets for potential security risks (matches known attack patterns). |
| Detection Mechanisms | Signature-based detection, Protocol anomaly detection (identifies deviations from expected network behavior), and Behavioral analysis (detects unusual patterns based on historical data) |
| Policy Enforcement and Actions | Once a threat is identified, the system enforces policies and decides whether to block, alert, or log the activity. |
| Logging and Reporting | Detected events are logged or reported. Administrators analyze and respond |
| Threat Intelligence and Updates | Continuously feed new threat data into the system. |
Get Started with IDP
To implement IDP on your SRX Series Firewalls:
IDP functionality is enabled by default on all SRX Series Firewalls. If you plan to use only custom attack signatures, no additional license is required. You need a separate license if you want to access and install updates to the regularly updated signature database.
See IDP license information about the Software Licenses for SRX Series Firewalls page.
Download and install the IDP signature database. The signature databases are available as a security package on the Juniper Networks website. This database includes attack object and attack object groups that you can use in IDP policies to match traffic against known attacks. This feature is available if you purchased a license.
See Updating the IDP Signature Database.- Enable IDP in your security policy. See Enable IDP in a security policy.
- Configure IDP policies.
You can configure recommended policy as the IDP policy. We provide predefined policy templates to use as a starting point for creating your own policies. Each template is a set of rules of a specific rulebase type that you can copy and then update according to your requirements.
To get started, we recommend you use the predefined policy named “Recommended”.
See IDP Policies Overview. Enable a security policy for IDP inspection. For transit traffic to pass through IDP inspection, you configure a security policy and enable IDP application services on all traffic that you want to inspect. See Enabling IDP in a Security Policy
.
