Juniper IDP OS 5.1R1 - S REV 1 Instruction Manual

IDP Series Release Notes
IDP OS 5.1r1
February 8, 2011
Revision 01
Contents Overview...........................................................2
SupportedHardware.................................................2
NewandChangedFeatures............................................2
UnsupportedFeatures................................................4
KnownLimitations...................................................4
SupportedUpgradePaths.............................................5
DowngradingorReverting.............................................6
Licensing...........................................................6
Compatibility with Network and Security Manager . . . . . . . . . . . . . . . . . . . . . . . . . 6
Compatibility with Juniper Networks Infranet Controller . . . . . . . . . . . . . . . . . . . . . 7
BrowserRequirements................................................7
UpgradingIDPSoftware...............................................7
UpgradingwithNSM..............................................8
UpgradingwiththeCLI...........................................10
ResolvedIssues.....................................................12
Known Issues ......................................................15
Documentation ....................................................20
GettingHelp.......................................................22
1Copyright © 2011, Juniper Networks, Inc.

Overview
Juniper Networks Intrusion Detection and Prevention Series devices enable you to enforce
a security policy that leverages continuous security research by the Juniper Security Center
to protect your network from attacks. The IDP Series also includes features that enable
you to gather information about applications and servers in your network.
These release notes contain information about what is included in this product release:
supported features, unsupported features, changed features, known problems, and
resolved problems. If the information in the release notes differs from the information
found in the documentation set, follow the release notes.
Supported Hardware
IDP 5.1r1 is supported on the following platforms:
•IDP8200, IDP800, IDP250, IDP75
•IDP1100, IDP600, IDP200
New and Changed Features
The following table summarizes new and changed features.
Table 1: New Features
DescriptionFeature
IDP OS Release 5.1 supports high availability in network designs where you have deployed
redundant network paths and use the failure detection features of a firewall, router, or switch
to manage the cutover from the primary path to the backup path in cases of failure. For details,
see IDP Series Deployment Scenarios.
High availability
Beginning in IDP OS Release 5.1, you can operate the IDP Series device in simulation mode. In
simulation mode, the original packets are forwarded immediately and the IDP Series device
processes a copy, logging actions that would have been taken if simulation mode were not
enabled.
You operate an IDP Series device in simulation mode in the following situations:
•When you first deploy the IDP Series device in your network and you want to evaluate the
security actions it takes without disrupting traffic.
•When you implement a new feature or change a security policy and you want to evaluate the
impact without disrupting traffic.
•As a workaround to avoid traffic outages when IDP processing is resulting in crashes and other
failures.
For details, see Simulation Mode Overview and its related topics.
Simulation mode
IDP OS Release 5.1 supports extensive system resource instrumentation, so you can use SNMP
utilities to monitor device health and load. For details, see SNMP Statistic Reporting and
Traps Task Summary and its related topics.
Enhanced system resource
instrumentation
Copyright © 2011, Juniper Networks, Inc.2
Juniper Networks Intrusion Detection and Prevention Release Notes

Table 1: New Features (continued)
DescriptionFeature
Beginning with IDP OS Release 5.1, the application identification feature can match extended
application signatures used in APE rulebase rules. Extended application signatures are also called
nested application signatures. The predefined extended application signatures developed for
IDP OS Release 5.1 include the most prevalent Web 2.0 applications running over HTTP. If your
security policy includes APE rules configured to match extended application signatures, the
application identification process identifies and generates the following HTTP contexts:
http-url-parsed, http-url-parsed-param-parsed, http-header-host, and http-header-content-type.
The application identification feature can then match application signature patterns in those
contexts.
J-Security Center updates application signatures and develops new ones as necessary. Beginning
with IDP OS Release 5.1, you can use NSM to browse predefined application objects, predefined
extended application objects, and application groups. You can also use NSM to create custom
application definitions, if needed. You cannot, however, create custom extended application
definitions.
For details, see Using Application Identification,Using Application Objects, and their related
topics.
Enhanced application
identification
Beginning with IDP OS Release 5.1:
•You can create rules that match extended application objects (also called nested application
objects).
•You can apply a new action to matching rules: DiffServ + Ratelimiting.
•If you use user-role based matching, you can set a global option to enable an aggregate limit
for matching user-roles (default) or a per-subscriber rate limit (by using a CLI command).
For details, see Understanding the APE Rulebase and its related topics.
Enhanced APE rulebase
features
IDP OS Release 5.1 supports the following configurable constraints to enable you to fine-tune
custom attack signatures:
•Within bytes—Configure a byte range where the attack pattern must be detected.
•Within packets—Configure a packet range where the attack pattern must be detected.
•Context checking—Configure a byte-length requirement for matching contexts.
This release also supports bit-level matching for binary protocols.
For details, see the IDP Series Custom Attack Object Reference and Examples Guide.
Enhanced attack signature
Beginning with IDP OS Release 5.1, you can specify the protocol and port to use for syslog
messages. See Configuring Syslog Collection (NSM Procedure).
Configurable syslog
communication
Beginning with IDP OS Release 5.1, you can use a new utility to capture packets at the Rx interface
(receiving interface) and also at the Tx interface (transmitting interface). See Using
jnetTcpdump to Capture Packets.
Bidirectional packet capture
3Copyright © 2011, Juniper Networks, Inc.
New and Changed Features

Table 1: New Features (continued)
DescriptionFeature
You can use the following CLI command enhancements to display system information:
•scio app cache—A new option, listall, allows you to list the entire application identification
cache. Previously, only the most recent 32 were listed.
•scio logview—A new command that enables you to troubleshoot log collection by NSM. The
command allows you to view raw log data on the IDP Series device so you can compare it to
the logs seen at NSM.
•scio subs—A new option displays aggregate statistics for all IDP engines on IDP8200. IDP8200
has multiple IDP engines. To view an aggregation, use scio subs aggregatestatus s0. To view
statistics per engine, use scio subs status s0.
•scio var—The TCP and UDP flow tables now include a column for application.
Enhanced debugging and
troubleshooting tools
Unsupported Features
The following features are not supported in IDP OS Release 5.1:
•SSL decryption using IDEA-based algorithms or ciphers. Also not supported in IDP OS
Release 5.0.x.
•On IDP8200, 10 gigabyte fiber interfaces do not support interface signaling or peer
port modulation. Also not supported in IDP OS Release 5.0.x.
•Authentication to the ACM via RADIUS with RSA SecurID (authentication via RADIUS
server is supported). Same as IDP OS Release 5.0.x.
Note that IDP75 does not have an HA interface. We do not support an HA deployment
with IDP75 devices. Also, IDP75 has only one pair of traffic interfaces. We do not support
a mixed mode deployment with IDP75 devices.
Known Limitations
For single core platforms (IDP75, IDP200, IDP600), we recommend you disable
application volume tracking (AVT). The AVT feature is fully functional, but the AVT
process is CPU intensive. During stress testing, high CPU usage by the AVT feature resulted
in link flapping.
Note that if you disable AVT, IDP Reporter application volume reports are empty.
To disable AVT:
1. From NSM Device Manager, double-click a device and then click Profiler Settings.
2. Click the General tab.
3. Deselect Enable AVT.
4. Click Apply.
5. From NSM Device Manager, right-click the device and select Update Device to push
your configuration change to the device.
Copyright © 2011, Juniper Networks, Inc.4
Juniper Networks Intrusion Detection and Prevention Release Notes

Supported Upgrade Paths
You can upgrade directly from any of the following versions:
•5.0r2
•5.0r1
•4.1r4
Beginning with IDP OS Release 5.0, IDP Series does not support bridge, proxy-arp, or
router mode. Before upgrading to IDP OS 5.1, you must redeploy the IDP Series device in
transparent or sniffer mode.
NOTE: The upgrade paths assume your current IDP Series device has been
in use and the device had been added to NSM. You might encounter
unexpected behavior during the upgrade if you are upgrading from a newly
reimaged, undeployed IDP OS 4.2 or 4.1 device (such as a 2009 factory image
of the IDP OS). In these cases, we recommend you add the IDP device to NSM
and import the device configuration into NSM prior to performing the upgrade.
Doing so will avoid the file permissions issue described in KB 15071.
Table 2 on page 5 describes the changes to files and directories you will notice when
you upgrade.
Table 2: Changes to Files and Directories
Files and DirectoriesUpgrade Path
No changes to attend to before upgrade.From 5.0r2
Before you upgrade, take note of the following changes and recommended actions:
•IDP 5.1r1 stores packet logs in numbered subdirectories of /usr/idp/device/var/pktlogs/. To implement
this change, your existing /usr/idp/device/var/pktlogs/ directory will be overwritten. If you have
been using the option to maintain packet data locally and send to NSM on demand, copy any packet
logs you want saved from /usr/idp/device/var/pktlogs/ to a remote location before you upgrade.
Previously collected packet capture logs will not be available to NSM. This action is not required if
you have been using the option to always include packet data when NSM sends the event log.
•Your custom settings in the /usr/idp/device/bin/user_funcs file are preserved when you upgrade.
No action is required.
From 5.0r1
5Copyright © 2011, Juniper Networks, Inc.
Supported Upgrade Paths

Table 2: Changes to Files and Directories (continued)
Files and DirectoriesUpgrade Path
When you upgrade from IDP OS 4.1r4 to IDP OS 5.1r1, you are reimaging the disk with a new operating
system. All partitions except /var/idp are rewritten.
In addition, IDP 5.1r1 stores packet logs in numbered subdirectories of /usr/idp/device/var/pktlogs/.
This is the same directory structure introduced in IDP 4.1r4. Note, however, that the upgrade process
preserves only packet log files in /usr/idp/device/var/pktlogs/0/. Packet log files in other directories
will be lost upon upgrade. If you have been using the option to maintain packet data locally and send
to NSM on demand, copy logs from /usr/idp/device/var/pktlogs/1/ and higher numbered log directories
to a remote location before you upgrade. This action is not required if you have been using the option
to always include packet data when NSM sends the event log.
From 4.1r4
The upgrade process restores your license and most of your previous settings. The following settings
are not preserved:
•The upgrade does not retain settings no longer supported in IDP 5.1.
•The upgrade process saves a backup of your previous /usr/idp/device/bin/user_funcs file, but
installs a new user_funcs file in order to provide appropriate content for IDP 5.1.
Downgrading or Reverting
You cannot downgrade or revert to a previous version. You can reimage the operating
system, if necessary. For details on reimaging, see the installation guide for your IDP
Series device.
Licensing
The upgrade procedure preserves your earlier license configuration. The reimaging
procedure does not. If you reimage the appliance, see the installation guide for information
on licensing.
Compatibility with Network and Security Manager
At the time of the IDP OS Release 5.1r1, we verified compatibility with the following release
of Network and Security Manager (NSM):
•NSM 2010.4 build LGB14z2q21
NSM 2010.4 build LGB14z2q21 is required to support new IDP OS Release 5.1 features.
Table 3: Download Locations for NSM 2010.4 (Requires Log In)
URLNSM Software
https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_ui_win_x86.zip
(Windows)
NSM Client
https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_ui_linux_x86.zip (Linux)
Copyright © 2011, Juniper Networks, Inc.6
Juniper Networks Intrusion Detection and Prevention Release Notes

Table 3: Download Locations for NSM 2010.4 (Requires Log In) (continued)
URLNSM Software
https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_servers_sol_sparc.zip
(Solaris)
NSM Server
https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_servers_linux_x86.zip
(Linux)
https://download.juniper.net/software/nsm/2010.4q16/md5sum.txt
MD5 checksum
NOTE: NSMXpress users should consult KB 13946 for information on how
to upgrade NSMXpress to a patch version of NSM.
Compatibility with Juniper Networks Infranet Controller
The user-role-based policy feature depends on deployment with IC Series Unified Access
Control (UAC) 4.1r1 or later. Contact your Juniper Networks sales representative for
information on UAC release dates.
Browser Requirements
The ACM, QuickStart utility, and IDP Reporter have been tested on the following browsers:
•Internet Explorer 7.x, 6.x
•Firefox 3.x, 2.x
Upgrading IDP Software
During upgrade, the IDP Series appliance is gracefully shut down. If you have configured
bypass for traffic interfaces, you do not need to be concerned about traffic disruption. If
you have not configured bypass, you should plan to complete your upgrade at an
appropriate time.
You can use NSM or the CLI to upgrade the IDP OS. You must use NSM to complete the
IDP detector engine and attack object updates.
TIP: If possible, use a laptop to connect to the console port of the IDP Series
device when you upgrade. This will enable you to view any console messages
that can assist in identifying any issues during upgrade. We understand this
is not possible or desirable in all deployments, so connecting via console is
not required to upgrade.
7Copyright © 2011, Juniper Networks, Inc.
Compatibility with Juniper Networks Infranet Controller

This section provides the following upgrade workflows to upgrade a standalone IDP
Series device:
•Upgrading with NSM on page 8
•Upgrading with the CLI on page 10
NOTE: Upgrading an HA deployment involves special considerations. For
information on upgrading an HA deployment, see “Workflow: Upgrading an
IDP OS 4.1r4 Cluster to IDP OS 5.1”inIDP Series Deployment Scenarios.
Upgrading with NSM
This section describes a workflow for upgrading IDP software using only NSM.
To update IDP software:
1. Add the IDP software to the NSM GUI server.
2. Push the IDP software from the NSM GUI server to one or more IDP Series devices.
To add an IDP software image to the NSM GUI server:
1. Download the software image:
a. Go to https://www.juniper.net/customers/csc/software/ and log in with your
customer username and password.
b. Enter the IDP Series device serial number to display a view of applicable software
releases available for download.
c. Click the applicable link to display the software download page.
d. Download the software to a location you can access from your NSM client.
2. From the NSM main menu, select Tools > Software Manager to display the Software
Manager dialog box.
3. Click the + button to display the Open dialog box.
4. Select the IDP software image you just downloaded and click Open to add the software
image to the NSM GUI server.
5. Click OK.
To push the software image from the NSM GUI server to IDP Series devices:
1. From the NSM main menu, select Devices > Software > Install Device Software to
display the Install Device Software dialog box.
2. From the Select OS Name list, select ScreenOS/IDP.
3. From the Select Software Image list, select the image file you just added to the NSM
GUI server.
Copyright © 2011, Juniper Networks, Inc.8
Juniper Networks Intrusion Detection and Prevention Release Notes

4. In the Select Devices list, select the IDP Series devices on which to install the software
update.
5. Click Next and complete the wizard steps.
6. Select Automate ADM Transformation to automatically update the Abstract Data
Model (ADM) for the device after NSM installs the update.
NOTE: If you clear this setting, the update is installed onto the device, but
you cannot manage the device from NSM until the device ADM is updated.
7. Click Finish to display upgrade status in the Job Information dialog box.
8. When the upgrade finishes, click Close to exit the Job Information dialog box.
The software upgrade is complete.
NOTE: You might encounter unexpected behavior if you have changed the
factory BIOS settings for the IDP Series device. We advise that you do not
change the factory BIOS settings.
The console will hang at GRUB after reboot if you have changed the BIOS
setting Console redirection > Continue Console redirection after POST to ON.
To resolve this issue, press the Delete key to enter BIOS and set this option
to OFF.
Next Steps: If you are upgrading from IDP OS Release 5.0r1 or 5.0r2, skip this step. You completed
it when you upgraded to IDP 5.0r1. If you are upgrading from IDP OS 4.1r4:
1.
a. Run through the ACM wizard to reconfigure your virtual routers. In IDP OS Release
5.0 and later, you use ACM to configure deployment mode per virtual router.
b. If necessary, copy any custom settings from the backup copy of user_funcs to the
new user_funcs file.
2. Check to see if J-Security Center has released an update for the detector engine or
attack database:
From the NSM main menu, select Tools > View/Update NSM attack database and
complete the wizard steps.
3. Push the updated IDP detector engine to IDP Series devices:
From the NSM main menu, select Devices > IDP Detector Engine > Load IDP Detector
Engine for ScreenOS and complete the wizard steps.
9Copyright © 2011, Juniper Networks, Inc.
Upgrading IDP Software

NOTE: Updating the IDP detector engine on a device does not require a
reboot of the device.
4. Push a security policy update job to update attack objects in use in your security policy:
a. In NSM, select Devices > Configuration > Update Device Config.
b. Select devices to which to push the updates and set update job options.
c. Click OK.
Upgrading with the CLI
This section describes a workflow where you use the CLI to upgrade the software image
on the IDP Series device. You still use NSM to update the detector engine and attack
objects.
To upgrade IDP OS from the CLI:
1. Download the software image to a host that runs an FTP server. Follow these steps:
a. Go to https://www.juniper.net/customers/csc/software/ and log in with your
customer username and password.
b. Enter the IDP Series device serial number to display a view of applicable software
releases available for download.
c. Click the applicable link to display the software download page.
d. Save the sensor_version.sh file (where version is the number that identifies the
software release version).
2. Connect to the IDP command-line interface in one of the following ways:
•Use SSH to connect to the IP address or hostname for the management interface.
Log in as admin and enter su - to switch to root.
•If you prefer, make a connection through the serial port and log in as root.
NOTE: To make an SSH connection, you must have enabled SSH for the
management port (eth0). For details, see the ACM online Help.
3. Use SCP or FTP to copy the software image file to the IDP appliance. The IDP appliance
does not run an FTP server, so you have to initiate the FTP session from the IDP
appliance.
4. Run the upgrade script by entering sh sensor_version.sh, where version is the number
that identifies the OS release version. When the script has finished, enter reboot.
Copyright © 2011, Juniper Networks, Inc.10
Juniper Networks Intrusion Detection and Prevention Release Notes