IDP for Logical Systems

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security idp custom-attack http-bf severity critical 
set security idp custom-attack http-bf time-binding count 3 
set security idp custom-attack http-bf time-binding scope peer 
set security idp custom-attack http-bf attack-type signature context http-url-parsed 
set security idp custom-attack http-bf attack-type signature pattern .*juniper.* 
set security idp custom-attack http-bf attack-type signature direction client-to-server

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure a custom attack object:

1. Log in to the primary logical system as the primary administrator and enter configuration mode.

   content_copy zoom_out_map

   [edit]
   admin@host> configure
   admin@host# 
   

2. Create the custom attack object and set the severity level.

   content_copy zoom_out_map

   [edit security idp]
   admin@host# set custom-attack http-bf severity critical
   

3. Configure attack detection parameters.

   content_copy zoom_out_map

   [edit security idp]
   admin@host# set custom-attack http-bf time-binding count 3 
   admin@host# set custom-attack http-bf time-binding scope peer
   

4. Configure stateful signature parameters.

   content_copy zoom_out_map

   [edit security idp]
   admin@host# set custom-attack http-bf attack-type signature context http-url-parsed
   admin@host# set custom-attack http-bf attack-type signature pattern .*juniper.*
   admin@host# set custom-attack http-bf attack-type signature direction client-to-server
   

Results

From configuration mode, confirm your configuration by entering the show security idp custom-attack http-bf command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
admin@host# show security idp custom-attack http-bf
severity critical;
    time-binding {
        count 3;
        scope peer;
    }
        attack-type {
            signature {
                context http-url-parsed;
                pattern .*juniper.*;
                direction client-to-server;
            }
        }

If you are done configuring the device, enter commit from configuration mode.

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security idp idp-policy root-idp-policy rulebase-ips rule 1 match application default 
set security idp idp-policy root-idp-policy rulebase-ips rule 1 match attacks custom-attacks http-bf 
set security idp idp-policy root-idp-policy rulebase-ips rule 1 then action drop-connection 
set security idp idp-policy root-idp-policy rulebase-ips rule 1 then notification log-attacks
set system security-profile master-profile idp-policy root-idp-policy

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

To configure an IDP policy:

1. Create the IDP policy and configure match conditions.

   content_copy zoom_out_map

   [edit security idp]
   admin@host# set idp-policy root-idp-policy rulebase-ips rule 1 match application default
   admin@host# set idp-policy root-idp-policy rulebase-ips rule 1 match attacks custom-attacks http-bf
   

2. Configure actions for the IDP policy.

   content_copy zoom_out_map

   [edit security idp]
   admin@host# set idp-policy root-idp-policy rulebase-ips rule 1 then action drop-connection
   admin@host# set idp-policy root-idp-policy rulebase-ips rule 1 then notification log-attacks
   

3. Add the IDP policy to the security profile.

   content_copy zoom_out_map

   [edit system security-profile master-profile]
   admin@host# set idp-policy lsys1-idp-policy
   

Results

From configuration mode, confirm your configuration by entering the show security idp idp-policy root-idp-policy and show system security-profile master-profile commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
admin@host# show security idp idp-policy root-idp-policy
    rulebase-ips {
        rule 1 {
            match {
                application default;
                attacks {
                    custom-attacks http-bf;
                }
            }
            then {
                action {
                    drop-connection;
                }
                notification {
                    log-attacks;
                }
            }
        }
    }
admin@host# show system security-profile master-profile
...
idp-policy lsys1-idp-policy;

If you are done configuring the device, enter commit from configuration mode.

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security policies from-zone lsys-root-untrust to-zone lsys-root-trust policy enable-idp match source-address any 
set security policies from-zone lsys-root-untrust to-zone lsys-root-trust policy enable-idp match destination-address any 
set security policies from-zone lsys-root-untrust to-zone lsys-root-trust policy enable-idp match application any 
set security policies from-zone lsys-root-untrust to-zone lsys-root-trust policy enable-idp then permit application-services idp

Step-by-Step Procedure

To enable IDP in a security policy:

1. Create the security policy and configure match conditions.

   content_copy zoom_out_map

   [edit security policies from-zone lsys-root-untrust to-zone lsys-root-trust]
   admin@host# set policy enable-idp match source-address any
   admin@host# set policy enable-idp match destination-address any
   admin@host# set policy enable-idp match application any
   

2. Enable IDP.

   content_copy zoom_out_map

   [edit security policies from-zone lsys-root-untrust to-zone lsys-root-trust]
   admin@host# set policy enable-idp then permit application-services idp
   

Results

From configuration mode, confirm your configuration by entering the show security policies command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

For brevity, this show command output includes only the configuration that is relevant to this example. Any other configuration on the system has been replaced with ellipses (...).

[edit]
    admin@host# show security policies
    from-zone lsys-root-untrust to-zone lsys-root-trust {
        policy enable-idp {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit {
                    application-services {
                        idp;
                    }
                }
            }
        }
    }
...

If you are done configuring the device, enter commit from configuration mode.

Purpose

Verify that attacks are being matched in network traffic.

Action

From operational mode, enter the show security idp attack table command.

admin@host> show security idp attack table
IDP attack statistics:
  Attack name                                 #Hits
  http-bf                                              1

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set system security-profile ls-design-profile idp-policy Recommended

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To add a predefined IDP policy to a security profile for a user logical system:

1. Log in to the primary logical system as the primary administrator and enter configuration mode.

   content_copy zoom_out_map

   [edit]
   admin@host> configure
   admin@host# 
   

2. Add the IDP policy to the security profile.

   content_copy zoom_out_map

   [edit system security-profile]
   admin@host# set ls-design-profile idp-policy Recommended
   

Results

From configuration mode, confirm your configuration by entering the show security idp and show system security-profile ls-design-profile commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
admin@host# show security idp
    idp-policy Recommended {
        ...
    }
[edit]
admin@host# show system security-profile ls-design-profile
    policy {
        ...
    }
    idp-policy Recommended;
logical-system ls-product-design;

If you are done configuring the device, enter commit from configuration mode.

Purpose

Verify the IDP policy assigned to the logical system.

Action

From operational mode, enter the show security idp logical-system policy-association command. Ensure that the IDP policy in the security profile that is bound to the logical system is correct.

admin@host> show security idp logical-system policy-association
Logical system         IDP policy 
ls-product-design      Recommended

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security policies from-zone ls-product-design-untrust to-zone ls-product-design-trust policy enable-idp match source-address any
set security policies from-zone ls-product-design-untrust to-zone ls-product-design-trust policy enable-idp match destination-address any
set security policies from-zone ls-product-design-untrust to-zone ls-product-design-trust policy enable-idp match application any
set security policies from-zone ls-product-design-untrust to-zone ls-product-design-trust policy enable-idp then permit application-services idp

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure a security policy to enable IDP in a user logical system:

1. Log in to the logical system as the user logical system administrator and enter configuration mode.

   content_copy zoom_out_map

   [edit]
   lsdesignadmin1@host:ls-product-design>configure
   lsdesignadmin1@host:ls-product-design#
   

2. Configure a security policy that matches traffic from the ls-product-design-untrust zone to the ls-product-design-trust zone.

   content_copy zoom_out_map

   [edit security policies from-zone ls-product-design-untrust to-zone ls-product-design-trust]
   lsdesignadmin1@host:ls-product-design# set policy enable-idp match source-address any
   lsdesignadmin1@host:ls-product-design# set policy enable-idp match destination-address any
   lsdesignadmin1@host:ls-product-design# set policy enable-idp match application any
   

3. Configure the security policy to enable IDP for matching traffic.

   content_copy zoom_out_map

   [edit security policies from-zone ls-product-design-untrust to-zone ls-product-design-trust]
   lsdesignadmin1@host:ls-product-design# set policy enable-idp then permit application-services idp
   

Results

From configuration mode, confirm your configuration by entering the show security policies command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

For brevity, this show command output includes only the configuration that is relevant to this example. Any other configuration on the system has been replaced with ellipses (...).

[edit]
lsdesignadmin1@host:ls-product-design# show security policies 
    from-zone ls-product-design-untrust to-zone ls-product-design-trust {
        policy enable-idp {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit {
                    application-services {
                        idp;
                    }
                }
            }
        }
        ...
    }

If you are done configuring the device, enter commit from configuration mode.

Purpose

Verify that attacks are being matched in network traffic.

Action

From operational mode, enter the show security idp attack table command.

admin@host> show security idp attack table
IDP attack statistics:
  Attack name                                 #Hits
  FTP:USER:ROOT                               1

CLI Quick Configuration

Step-by-Step Procedure

To configure a user logical system:

1. Configure a user logical system.

   content_copy zoom_out_map

   [edit]
   user@host# set logical-system LSYS1
   

2. Exit from the configuration mode and enter to the operational mode.

   content_copy zoom_out_map

   user@host# exit
   

3. Login as LSYS1 user to the user logical sytem and enter to configuration mode.

   content_copy zoom_out_map

   user@host> set cli logical-system LSYS1
   user@host:LSYS1> edit
   user@host:LSYS1# 
   

Results

From configuration mode, confirm your configuration by entering the show logical-systems command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
user@host# show logical-systems
    LSYS1 {
    }

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security idp custom-attack my-http severity info
set security idp custom-attack my-http attack-type signature protocol-binding application HTTP
set security idp custom-attack my-http attack-type signature context http-get-url
set security idp custom-attack my-http attack-type signature pattern .*test.*
set security idp custom-attack my-http attack-type signature direction any

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide.

To configure a custom attack object:

1. Log in to the user logical system as LSYS1 and enter configuration mode.

   content_copy zoom_out_map

   [edit]
   user@host:LSYS1# 
   

2. Create the custom attack object and set the severity level.

   content_copy zoom_out_map

   [edit security idp]
   user@host:LSYS1# set custom-attack my-http severity info
   

3. Configure stateful signature parameters.

   content_copy zoom_out_map

   [edit security idp]
   user@host:LSYS1# set custom-attack my-http attack-type signature protocol-binding application HTTP
   user@host:LSYS1# set custom-attack my-http attack-type signature context http-get-url
   user@host:LSYS1# set custom-attack my-http attack-type signature pattern .*test.*
   user@host:LSYS1# set custom-attack my-http attack-type signature direction any
   

Results

From configuration mode, confirm your configuration by entering the show security idp custom-attack my-http command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
user@host:LSYS1# show security idp custom-attack my-http
severity info;
    attack-type {
    signature {
        protocol-binding {
            application HTTP;
        }
        context http-get-url;
        pattern .*test.*;
        direction any;
    }
}

If you are done configuring the device, enter commit from configuration mode.

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security idp idp-policy idpengine rulebase-ips rule 1 match from-zone any
set security idp idp-policy idpengine rulebase-ips rule 1 match source-address any
set security idp idp-policy idpengine rulebase-ips rule 1 match to-zone any
set security idp idp-policy idpengine rulebase-ips rule 1 match destination-address any
set security idp idp-policy idpengine rulebase-ips rule 1 match application default
set security idp idp-policy idpengine rulebase-ips rule 1 match attacks custom-attacks my-http
set security idp idp-policy idpengine rulebase-ips rule 1 then action no-action
set security idp idp-policy idpengine rulebase-ips rule 1 then notification log-attacks

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

To configure an IDP policy:

1. Create the IDP policy and configure match conditions.

   content_copy zoom_out_map

   [edit security idp]
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 match from-zone any
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 match source-address any
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 match to-zone any
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 match destination-address any
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 match application default
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 match attacks custom-attacks my-http
   

2. Configure actions for the IDP policy.

   content_copy zoom_out_map

   [edit security idp]
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 then action no-action
   user@host:LSYS1# set idp-policy idpengine rulebase-ips rule 1 then notification log-attacks
   

Results

From configuration mode, confirm your configuration by entering the show security idp idp-policy idpengine and show system security-profile master-profile commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
user@host:LSYS1# show security idp idp-policy idpengine
rulebase-ips {
    rule 1 {
        match {
            from-zone any;
            source-address any;
            to-zone any;
            destination-address any;
            application default;
            attacks {
                custom-attacks my-http;
            }
        }
        then {
            action {
                no-action;
            }
            notification {
                log-attacks;
            }
        }
    }
}

If you are done configuring the device, enter commit from configuration mode.

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

set security policies from-zone z1 to-zone z2 policy p1 match source-address any 
set security policies from-zone z1 to-zone z2 policy p1 match destination-address any 
set security policies from-zone z1 to-zone z2 policy p1 match application any 
set security policies from-zone z1 to-zone z2 policy p1 then permit application-services idp-policy idpengine

Step-by-Step Procedure

To enable IDP in a security policy:

1. Create the security policy and configure match conditions.

   content_copy zoom_out_map

   [edit security policies from-zone z1 to-zone z2]
   user@host:LSYS1# set policy p1 match source-address any
   user@host:LSYS1# set policy p1 match destination-address any
   user@host:LSYS1# set policy p1 match application any
   

2. Enable IDP.

   content_copy zoom_out_map

   [edit security policies from-zone z1 to-zone z2]
   user@host:LSYS1# set policy p1 then permit application-services idp-policy idpengine
   

Results

From configuration mode, confirm your configuration by entering the show security policies command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]
user@host:LSYS1# show security policies
from-zone z1 to-zone z2 {
    policy p1{
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit {
                application-services {
                    idp-policy idpengine;
                }
            }
        }
    }
}

If you are done configuring the device, enter commit from configuration mode.

Purpose

Verify that attack detection is happening for the custom attack.

Action

From operational mode, enter the show security idp attack table command.

user@host:LSYS1> show security idp policies
 PIC : FPC 0 PIC 0:
ID    Name                   Sessions    Memory      Detector
 1     idpengine              0           188584      12.6.130180509

user@host:LSYS1> show security idp attack table
IDP attack statistics:

  Attack name                                  #Hits
  my-http							                         1
  

Meaning

The output displays the attacks detected for the custom attack that is configured in the IDP policy in the user logical system LSYS1.