SRX IDP Full IDP Stateful Inspection 8 Detection mechanisms including Stateful Signatures and Protocol Anomalies Reassemble, normalize, eliminate ambi

Size: px

Start display at page:

Download "SRX IDP Full IDP Stateful Inspection 8 Detection mechanisms including Stateful Signatures and Protocol Anomalies Reassemble, normalize, eliminate ambi"

さわやすこ
5 years ago
Views:

1 IDP (INTRUSION DETECTION AND PREVENTION)

2 SRX IDP Full IDP Stateful Inspection 8 Detection mechanisms including Stateful Signatures and Protocol Anomalies Reassemble, normalize, eliminate ambiguity Track sessions Packets Application Traffic XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO XOXOXOXOXOXOXOXOXOOXOXOXOXOX OXOXOXOXOXOXOXOXOXOXOXOXOXOX XOXOXOXOXOXOXOXOXOXOXOXOXOXO Application Traffic Deny Some Attacks Deny Traffic SRX IDP SRX 2 Copyright 2009 Juniper Networks, Inc.

脆弱性や新たな脅威を研究する専任チームプロトコルデコードのノウハウ複数の研究機関やベンダーとのパートナーシップリバースエンジニアリングの専門家グローバルなハニーポットネットワーク業界トップクラスのレスポンスタイム

4 IDP

6 IDP ) lab@srx1> request system license add? Possible completions: <filename> Filename (URL, local, remote, or floppy) terminal Use login terminal lab@srx1> show system license License usage: Licenses Licenses Licenses Expiry Feature name used installed needed idp-sig :00:00 JST 6 Copyright 2009 Juniper Networks, Inc.

7 IDP ( DNS ) lab@srx1> request security idp security-package download check-server Successfully retrieved from( Version info:1687(detector= , Templates=2) lab@srx1> request security idp security-package download 7 Copyright 2009 Juniper Networks, Inc.

8 Status request security idp security-package download status In progress: Downloading... request security idp security-package download status In progress:signatureupdate_tmp.xml.gz 100 % Bytes/ Bytes lab@srx1> request security idp security-package download status Done;Successfully downloaded from( Version info:1687(fri May 21 12:48: , Detector= ) 8 Copyright 2009 Juniper Networks, Inc.

9 request security idp security-package install Status request security idp security-package install status In progress:performing DB update for an xml (SignatureUpdate.xml) request security idp security-package install status Done;Attack DB update : successful - [UpdateNumber=1687,ExportDate=Fri May 21 12:48: ,Detector= ] Updating control-plane with new detector : successful Updating data-plane with new attack or detector : not performed due to no existing running policy found. 9 Copyright 2009 Juniper Networks, Inc.

11 IDP request security idp security-package download policy-templates request security idp security-package download status Done;Successfully downloaded from( Version info:2 11 Copyright 2009 Juniper Networks, Inc.

12 request security idp security-package install policy-templates request security idp security-package install status Done;policy-templates has been successfully updated into internal repository (=>/var/db/scripts/commit/templates.xsl)! set system scripts commit file templates.xsl 12 Copyright 2009 Juniper Networks, Inc.

14 IDP IDP rule 1. rulebase-ips match from-zone to-zone source-address destination-address application set security idp idp-policy idp-policy-1 rulebase-ips rule 1 match fromzone any to-zone any source-address any destination-address any application default attacks predefined-attack-groups [Critical Major] 14 Copyright 2009 Juniper Networks, Inc.

15 IDP 2. no-action - ( ) ignore - drop-packet - drop-connection - close-client - RST close-server RST close-client-and-server RST mark-diffserv DSCP recommended Juniper lab@srx1# set security idp idp-policy Intranet rulebase-ips rule 1 then action drop-connection 15 Copyright 2009 Juniper Networks, Inc.

19 IDP set security policies from-zone trust to-zone untrust policy trust-tountrust match source-address any destination-address any application any set security policies from-zone trust to-zone untrust policy trust-tountrust then permit application-services idp 19 Copyright 2009 Juniper Networks, Inc.

20 IDP CONFIGURATION show security idp idp-policy idp-policy-1 { rulebase-ips { rule 1 { match { from-zone any; source-address any; to-zone any; destination-address any; application default; attacks { predefined-attack-groups [ Critical Major ]; } } then { action { drop-connection; } ip-action { ip-close; } notification { log-attacks; } } } } } 20 Copyright 2009 Juniper Networks, Inc.

21 show security idp show security idp? Possible completions: application-identification Show IDP application identification data application-statistics Show IDP application statistics attack Show IDP attack data counters Show IDP counters memory Show IDP data plane memory statistics policies Show the list of currently installed policies policy-templates-list Show available policy templates security-package-version Show the version of currently installed security-package status Show IDP status 21 Copyright 2009 Juniper Networks, Inc.

22 show security idp memory IDP data plane memory statistics: Total IDP data plane memory : 212 MB Used : 20 MB ( KB ) ( 9.43%) Available : 192 MB ( KB ) ( 90.57%) 22 Copyright 2009 Juniper Networks, Inc.

23 run show security idp status State of IDP: Disabled, Up since: :23:19 UTC (00:40:42 ago) Packets/second: 0 Peak: :23:19 UTC KBits/second : 0 Peak: :23:19 UTC Latency (microseconds): [min: 0] [max: 0] [avg: 0] Packet Statistics: [ICMP: 0] [TCP: 0] [UDP: 0] [Other: 0] Flow Statistics: ICMP: [Current: 0] [Max: :23:19 UTC] TCP: [Current: 0] [Max: :23:19 UTC] UDP: [Current: 0] [Max: :23:19 UTC] Other: [Current: 0] [Max: :23:19 UTC] Session Statistics: [ICMP: 0] [TCP: 0] [UDP: 0] [Other: 0] Policy Name : idp-policy-1 23 Copyright 2009 Juniper Networks, Inc.

Juniper Networks Corporate PowerPoint Template

Juniper Networks Corporate PowerPoint Template Juniper SRX 日本語マニュアル 41. SSL Forward Proxy の CLI 設定はじめに SRX340 における SSL Forward Proxy の CLI 設定ついて説明します手順内容は SRX340 JUNOS 15.1X49-D140 にて確認を実施しております SSL Proxy 機能については SRX340 以上の機種にてサポートされています 2018 年 8