Juniper NETWORK AND SECURITY MANAGER 2010.2 - ADMINISTRATION GUIDE... Instruction Manual

Juniper Networks
Network and Security
Manager
Administration Guide
Release
2010.2
Published: 2010-05-18
Revision 1
Copyright © 2010, Juniper Networks, Inc.

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
This product includes the Envoy SNMP Engine, developed by Epilogue Technology, an Integrated Systems Company. Copyright © 1986-1997,
Epilogue Technology Corporation. All rights reserved. This program and its documentation were developed at private expense, and no part
of them is in the public domain.
This product includes memory allocation software developed by Mark Moraes, copyright © 1988, 1989, 1993, University of Toronto.
This product includes FreeBSD software developed by the University of California, Berkeley, and its contributors. All of the documentation
and software included in the 4.4BSD and 4.4BSD-Lite Releases is copyrighted by the Regents of the University of California. Copyright ©
1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994. The Regents of the University of California. All rights reserved.
GateD software copyright © 1995, the Regents of the University. All rights reserved. Gate Daemon was originated and developed through
release 3.0 by Cornell University and its collaborators. Gated is based on Kirton’s EGP, UC Berkeley’s routing daemon (routed), and DCN’s
HELLO routing protocol. Development of Gated has been supported in part by the National Science Foundation. Portions of the GateD
software copyright © 1988, Regents of the University of California. All rights reserved. Portions of the GateD software copyright © 1991, D.
L. S. Associates.
This product includes software developed by Maker Communications, Inc., copyright © 1996, 1997, Maker Communications, Inc.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United
States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other
trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify,
transfer, or otherwise revise this publication without notice.
Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are
owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312,
6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785.
Network and Security Manager Administration Guide
Copyright © 2010, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Writing: Cheryl Bartholomeusz, James Thomas
Editing: Sonia Saruba
Cover Design: Edmonds Design
Revision History
May 18, 2010— Revision 1
The information in this document is current as of the date listed in the revision history.
Copyright © 2010, Juniper Networks, Inc.ii

END USER LICENSE AGREEMENT
READ THIS END USER LICENSE AGREEMENT (“AGREEMENT”) BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE.
BY DOWNLOADING, INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS
CONTAINED HEREIN, YOU (AS CUSTOMER OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO
BIND THE CUSTOMER) CONSENT TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED
HEREIN, THEN (A) DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE, AND (B) YOU MAY CONTACT JUNIPER NETWORKS
REGARDING LICENSE TERMS.
1. The Parties. The parties to this Agreement are (i) Juniper Networks, Inc. (if the Customer’s principal office is located in the Americas) or
Juniper Networks (Cayman) Limited (if the Customer’s principal office is located outside the Americas) (such applicable entity being referred
to herein as “Juniper”), and (ii) the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable
license(s) for use of the Software (“Customer”) (collectively, the “Parties”).
2. The Software. In this Agreement, “Software” means the program modules and features of the Juniper or Juniper-supplied software, for
which Customer has paid the applicable license or support fees to Juniper or an authorized Juniper reseller, or which was embedded by
Juniper in equipment which Customer purchased from Juniper or an authorized Juniper reseller. “Software” also includes updates, upgrades
and new releases of such software. “Embedded Software” means Software which Juniper has embedded in or loaded onto the Juniper
equipment and any updates, upgrades, additions or replacements which are subsequently embedded in or loaded onto the equipment.
3. License Grant. Subject to payment of the applicable fees and the limitations and restrictions set forth herein, Juniper grants to Customer
a non-exclusive and non-transferable license, without right to sublicense, to use the Software, in executable form only, subject to the
following use restrictions:
a. Customer shall use Embedded Software solely as embedded in, and for execution on, Juniper equipment originally purchased by
Customer from Juniper or an authorized Juniper reseller.
b. Customer shall use the Software on a single hardware chassis having a single processing unit, or as many chassis or processing units
for which Customer has paid the applicable license fees; provided, however, with respect to the Steel-Belted Radius or Odyssey Access
Client software only, Customer shall use such Software on a single computer containing a single physical random access memory space
and containing any number of processors. Use of the Steel-Belted Radius or IMS AAA software on multiple computers or virtual machines
(e.g., Solaris zones) requires multiple licenses, regardless of whether such computers or virtualizations are physically contained on a single
chassis.
c. Product purchase documents, paper or electronic user documentation, and/or the particular licenses purchased by Customer may
specify limits to Customer’s use of the Software. Such limits may restrict use to a maximum number of seats, registered endpoints, concurrent
users, sessions, calls, connections, subscribers, clusters, nodes, realms, devices, links, ports or transactions, or require the purchase of
separate licenses to use particular features, functionalities, services, applications, operations, or capabilities, or provide throughput,
performance, configuration, bandwidth, interface, processing, temporal, or geographical limits. In addition, such limits may restrict the use
of the Software to managing certain kinds of networks or require the Software to be used only in conjunction with other specific Software.
Customer’s use of the Software shall be subject to all such limitations and purchase of all applicable licenses.
d. For any trial copy of the Software, Customer’s right to use the Software expires 30 days after download, installation or use of the
Software. Customer may operate the Software after the 30-day trial period only if Customer pays for a license to do so. Customer may not
extend or create an additional trial period by re-installing the Software after the 30-day trial period.
e. The Global Enterprise Edition of the Steel-Belted Radius software may be used by Customer only to manage access to Customer’s
enterprise network. Specifically, service provider customers are expressly prohibited from using the Global Enterprise Edition of the
Steel-Belted Radius software to support any commercial network access services.
The foregoing license is not transferable or assignable by Customer. No license is granted herein to any user who did not originally purchase
the applicable license(s) for the Software from Juniper or an authorized Juniper reseller.
4. Use Prohibitions. Notwithstanding the foregoing, the license provided herein does not permit the Customer to, and Customer agrees
not to and shall not: (a) modify, unbundle, reverse engineer, or create derivative works based on the Software; (b) make unauthorized
copies of the Software (except as necessary for backup purposes); (c) rent, sell, transfer, or grant any rights in and to any copy of the
Software, in any form, to any third party; (d) remove any proprietary notices, labels, or marks on or in any copy of the Software or any product
in which the Software is embedded; (e) distribute any copy of the Software to any third party, including as may be embedded in Juniper
equipment sold in the secondhand market; (f) use any ‘locked’ or key-restricted feature, function, service, application, operation, or capability
without first purchasing the applicable license(s) and obtaining a valid key from Juniper, even if such feature, function, service, application,
operation, or capability is enabled without a key; (g) distribute any key for the Software provided by Juniper to any third party; (h) use the
iiiCopyright © 2010, Juniper Networks, Inc.

Software in any manner that extends or is broader than the uses purchased by Customer from Juniper or an authorized Juniper reseller; (i)
use Embedded Software on non-Juniper equipment; (j) use Embedded Software (or make it available for use) on Juniper equipment that
the Customer did not originally purchase from Juniper or an authorized Juniper reseller; (k) disclose the results of testing or benchmarking
of the Software to any third party without the prior written consent of Juniper; or (l) use the Software in any manner other than as expressly
provided herein.
5. Audit. Customer shall maintain accurate records as necessary to verify compliance with this Agreement. Upon request by Juniper,
Customer shall furnish such records to Juniper and certify its compliance with this Agreement.
6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper.
As such, Customer shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence,
which at a minimum includes restricting access to the Software to Customer employees and contractors having a need to use the Software
for Customer’s internal business purposes.
7. Ownership. Juniper and Juniper’s licensors, respectively, retain ownership of all right, title, and interest (including copyright) in and to
the Software, associated documentation, and all copies of the Software. Nothing in this Agreement constitutes a transfer or conveyance
of any right, title, or interest in the Software or associated documentation, or a sale of the Software, associated documentation, or copies
of the Software.
8. Warranty, Limitation of Liability, Disclaimer of Warranty. The warranty applicable to the Software shall be as set forth in the warranty
statement that accompanies the Software (the “Warranty Statement”). Nothing in this Agreement shall give rise to any obligation to support
the Software. Support services may be purchased separately. Any such support shall be governed by a separate, written support services
agreement. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JUNIPER SHALL NOT BE LIABLE FOR ANY LOST PROFITS, LOSS OF DATA,
OR COSTS OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES
ARISING OUT OF THIS AGREEMENT, THE SOFTWARE, OR ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. IN NO EVENT SHALL JUNIPER
BE LIABLE FOR DAMAGES ARISING FROM UNAUTHORIZED OR IMPROPER USE OF ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE.
EXCEPT AS EXPRESSLY PROVIDED IN THE WARRANTY STATEMENT TO THE EXTENT PERMITTED BY LAW, JUNIPER DISCLAIMS ANY
AND ALL WARRANTIES IN AND TO THE SOFTWARE (WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE), INCLUDING ANY
IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT DOES
JUNIPER WARRANT THAT THE SOFTWARE, OR ANY EQUIPMENT OR NETWORK RUNNING THE SOFTWARE, WILL OPERATE WITHOUT
ERROR OR INTERRUPTION, OR WILL BE FREE OF VULNERABILITY TO INTRUSION OR ATTACK. In no event shall Juniper’s or its suppliers’
or licensors’ liability to Customer, whether in contract, tort (including negligence), breach of warranty, or otherwise, exceed the price paid
by Customer for the Software that gave rise to the claim, or if the Software is embedded in another Juniper product, the price paid by
Customer for such other product. Customer acknowledges and agrees that Juniper has set its prices and entered into this Agreement in
reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same reflect an allocation of risk between
the Parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss), and that the same
form an essential basis of the bargain between the Parties.
9. Termination. Any breach of this Agreement or failure by Customer to pay any applicable fees due shall result in automatic termination
of the license granted herein. Upon such termination, Customer shall destroy or return to Juniper all copies of the Software and related
documentation in Customer’s possession or control.
10. Taxes. All license fees payable under this agreement are exclusive of tax. Customer shall be responsible for paying Taxes arising from
the purchase of the license, or importation or use of the Software. If applicable, valid exemption documentation for each taxing jurisdiction
shall be provided to Juniper prior to invoicing, and Customer shall promptly notify Juniper if their exemption is revoked or modified. All
payments made by Customer shall be net of any applicable withholding tax. Customer will provide reasonable assistance to Juniper in
connection with such withholding taxes by promptly: providing Juniper with valid tax receipts and other required documentation showing
Customer’s payment of any withholding taxes; completing appropriate applications that would reduce the amount of withholding tax to
be paid; and notifying and assisting Juniper in any audit or tax proceeding related to transactions hereunder. Customer shall comply with
all applicable tax laws and regulations, and Customer will promptly pay or reimburse Juniper for all costs and damages related to any
liability incurred by Juniper as a result of Customer’s non-compliance or delay with its responsibilities herein. Customer’s obligations under
this Section shall survive termination or expiration of this Agreement.
11. Export. Customer agrees to comply with all applicable export laws and restrictions and regulations of any United States and any
applicable foreign agency or authority, and not to export or re-export the Software or any direct product thereof in violation of any such
restrictions, laws or regulations, or without all necessary approvals. Customer shall be liable for any such violations. The version of the
Software supplied to Customer may contain encryption or other capabilities restricting Customer’s ability to export the Software without
an export license.
Copyright © 2010, Juniper Networks, Inc.iv

12. Commercial Computer Software. The Software is “commercial computer software” and is provided with restricted rights. Use,
duplication, or disclosure by the United States government is subject to restrictions set forth in this Agreement and as provided in DFARS
227.7201 through 227.7202-4, FAR 12.212, FAR 27.405(b)(2), FAR 52.227-19, or FAR 52.227-14(ALT III) as applicable.
13. Interface Information. To the extent required by applicable law, and at Customer's written request, Juniper shall provide Customer
with the interface information needed to achieve interoperability between the Software and another independently created program, on
payment of applicable fee, if any. Customer shall observe strict obligations of confidentiality with respect to such information and shall use
such information in compliance with any applicable terms and conditions upon which Juniper makes such information available.
14. Third Party Software. Any licensor of Juniper whose software is embedded in the Software and any supplier of Juniper whose products
or technology are embedded in (or services are accessed by) the Software shall be a third party beneficiary with respect to this Agreement,
and such licensor or vendor shall have the right to enforce this Agreement in its own name as if it were Juniper. In addition, certain third party
software may be provided with the Software and is subject to the accompanying license(s), if any, of its respective owner(s). To the extent
portions of the Software are distributed under and subject to open source licenses obligating Juniper to make the source code for such
portions publicly available (such as the GNU General Public License (“GPL”) or the GNU Library General Public License (“LGPL”)), Juniper
will make such source code portions (including Juniper modifications, as appropriate) available upon request for a period of up to three
years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194 N. Mathilda Ave., Sunnyvale, CA
94089, ATTN: General Counsel. You may obtain a copy of the GPL at http://www.gnu.org/licenses/gpl.html, and a copy of the LGPL
at http://www.gnu.org/licenses/lgpl.html .
15. Miscellaneous. This Agreement shall be governed by the laws of the State of California without reference to its conflicts of laws
principles. The provisions of the U.N. Convention for the International Sale of Goods shall not apply to this Agreement. For any disputes
arising under this Agreement, the Parties hereby consent to the personal and exclusive jurisdiction of, and venue in, the state and federal
courts within Santa Clara County, California. This Agreement constitutes the entire and sole agreement between Juniper and the Customer
with respect to the Software, and supersedes all prior and contemporaneous agreements relating to the Software, whether oral or written
(including any inconsistent terms contained in a purchase order), except that the terms of a separate written agreement executed by an
authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict with terms contained
herein. No modification to this Agreement nor any waiver of any rights hereunder shall be effective unless expressly assented to in writing
by the party to be charged. If any portion of this Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity
of the remainder of this Agreement. This Agreement and associated documentation has been written in the English language, and the
Parties agree that the English version will govern. (For Canada: Les parties aux présentés confirment leur volonté que cette convention de
même que tous les documents y compris tout avis qui s'y rattaché, soient redigés en langue anglaise. (Translation: The parties confirm that
this Agreement and all related documentation is and will be in the English language)).
vCopyright © 2010, Juniper Networks, Inc.

Copyright © 2010, Juniper Networks, Inc.vi

Table of Contents
AboutThisGuide.................................................xlv
Objectives ........................................................xlv
Audience .........................................................xlv
Conventions ......................................................xlvi
Documentation ...................................................xlvii
RequestingTechnicalSupport........................................xlix
Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xlix
OpeningaCasewithJTAC..........................................l
Part 1 Getting Started with NSM
Chapter 1 Introduction to Network and Security Manager . . . . . . . . . . . . . . . . . . . . . . . . . 3
AboutNSM.........................................................3
SecurityIntegration...............................................4
DeviceConfiguration..........................................4
NetworkOrganization.........................................4
Role-BasedAdministration.....................................4
CentralizedDeviceConfiguration................................5
DeviceManagement..............................................6
ImportingDevices............................................6
DeviceModeling..............................................6
RapidDeployment............................................6
Policy-BasedManagement.....................................6
Error Prevention, Recovery, and Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
DeviceConfigurationValidation.................................7
PolicyValidation..............................................7
Atomic Configuration and Updating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
DeviceImageUpdates.........................................8
Auditing ....................................................8
CompleteSystemManagement....................................8
VPNAbstraction.............................................8
IntegratedLoggingandReporting................................9
Monitoring Status ............................................9
JobManagement.............................................9
TechnicalOverview..................................................10
Architecture....................................................10
User Interface ...............................................11
ManagementSystem.........................................11
ManagedDevices................................................13
Firewall and IDP (ScreenOS/IDP) Devices . . . . . . . . . . . . . . . . . . . . . . . . 13
DevicesRunningJUNOSSoftware..............................16
viiCopyright © 2010, Juniper Networks, Inc.

SSLVPNSecureAccessProducts..............................20
Juniper Networks IC Series Unified Access Control Appliances . . . . . . . . 21
ExtranetDevices.............................................21
DistributedDataCollection........................................21
DeviceSchemas................................................22
Security .......................................................22
ScalingandPerformance.........................................22
WorkingintheUserInterface..........................................23
Characters Not Supported in Login Passwords . . . . . . . . . . . . . . . . . . . . . . . . 23
ManagingBlockedLoginAttempts.................................23
ConfiguringUIPreferences........................................23
UIOverview....................................................23
NavigationTree.............................................24
CommonTasksPane.........................................24
MainDisplayArea...........................................25
MenuBar ..................................................25
Toolbar....................................................25
Status Bar .................................................25
NSMModules..................................................25
InvestigateModules..........................................25
ConfigureModules...........................................27
AdministerModules..........................................31
Validation Icons in the User Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Validation and Data Origination Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Working with Other NSM Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
SearchingintheUserInterface.....................................33
ContainsString[C]SearchMode...............................34
StartsWith[S]SearchMode..................................34
Regular Expression [R] Search Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
IP[I]SearchMode...........................................36
SearchforanExactMatch(E)..................................37
GlobalSearch..................................................38
NewFeaturesin2010.2..............................................39
Chapter2 PlanningYourVirtualNetwork......................................41
ConfiguringDevicesOverview.........................................41
ImportingExistingDevices........................................42
ModelingNewDevices...........................................43
EditingaDeviceConfiguration.....................................44
Configuring IDP-Capable Devices Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
CommonCriteriaEAL2Compliance................................45
GuidanceforIntendedUsage..................................45
GuidanceforPersonnel.......................................45
Guidance for Physical Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
SupportedIDP-CapableDevices...............................45
Enabling Jumbo Frames (ISG1000 Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Copyright © 2010, Juniper Networks, Inc.viii
Network and Security Manager Administration Guide

EnablingIDPFunctionality........................................47
Adding an ISG2000/ISG1000 Security Device with a Security
Module ................................................47
Installing Advanced License Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
UpdatingAttackObjects......................................47
AddingObjects(Optional)....................................48
Configuring a Security Policy for IDP . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
ReviewingIDPLogs..........................................53
MaintainingIDP.................................................54
CreatingIDP-OnlyAdministrators..................................54
Simplifying Management ............................................54
UsingDeviceGroups.............................................55
UsingDeviceTemplates..........................................55
UsingConfigurationGroups.......................................55
MergingPolicies................................................56
UsingaNamingConvention.......................................56
Example: Using a Naming Convention for Devices . . . . . . . . . . . . . . . . . 56
Example: Using a Naming Convention for Address Objects . . . . . . . . . . 56
CreatinganInformationBanner........................................57
AddinganInformationBanner.....................................57
ModifyinganInformationBanner..................................60
DeletinganInformationBanner....................................60
Chapter 3 Configuring Role-Based Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Role-Based Administration ...........................................61
Domains.......................................................61
AboutRoles....................................................62
Using Role-Based Administration Effectively . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Enterprise Organizations .........................................63
Geographical Divisions .......................................63
NOCandSOC..............................................64
Administrator Types .........................................64
ServiceProviders................................................65
InternalNetwork............................................65
Managed Security Service Provider (MSSP) . . . . . . . . . . . . . . . . . . . . . . 65
Configuring Role-Based Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
CreatingAdministrators..........................................67
ConfiguringGeneralSettings...................................67
ConfiguringAuthorization.....................................67
RADIUS Authentication and Authorization . . . . . . . . . . . . . . . . . . . . . . . 68
ConfiguringRoles............................................74
CreatingCustomRoles...........................................74
RolesandPermissions...........................................86
Permissions Changes in Release 2008.1 . . . . . . . . . . . . . . . . . . . . . . . . . 86
Permissions Changes in Release 2006.1 . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Permissions Changes in Release 2005.3 . . . . . . . . . . . . . . . . . . . . . . . . . 87
Assigning and Viewing Custom Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Configuring a User Activity in a Custom Role . . . . . . . . . . . . . . . . . . . . . . . . . 88
ViewingLoggedAdministrators....................................89
ixCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Forcing an Administrator to Log Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
CreatingSubdomains............................................90
ViewingCurrentDomainDetail....................................90
Example: Configuring Role-Based Administration . . . . . . . . . . . . . . . . . . . . . . 91
Step1:CreatetheSubdomains.................................91
Step 2: Create the Subdomain Administrator . . . . . . . . . . . . . . . . . . . . . . 91
Step 3: Create the Viewing and Reporting Administrator . . . . . . . . . . . . . 92
Step 4: Verify Administrator Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Part 2 Integrating
Chapter4 Adding Devices ...................................................97
AboutDeviceCreation...............................................98
DetermineDeviceStatus.........................................99
VerifyingDeviceConfiguration....................................100
ManagingtheDevice............................................100
BeforeYouBeginAddingDevices.....................................100
ImportingVersusModeling.......................................101
Importing Device Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
ModelingDeviceConfigurations................................101
DeviceAddProcess.........................................102
SelectingtheDomain...........................................102
AddingSingleorMultipleDevices..................................103
SpecifyingtheOSandVersion....................................104
Determining Port Mode (ScreenOS Devices Only) . . . . . . . . . . . . . . . . . . . . 104
Trust-UntrustPortMode.....................................105
Home-WorkPortMode......................................105
Dual-UntrustPortMode.....................................106
CombinedPortMode........................................106
Trust-Untrust-DMZPortMode................................107
Trust/Untrust/DMZ (Extended) Mode . . . . . . . . . . . . . . . . . . . . . . . . . . 108
DMZ-Dual-UntrustPortMode.................................109
PortModeSummary.........................................110
ChangingthePortMode......................................111
Supported Add Device Workflows by Device Family . . . . . . . . . . . . . . . . . . . . . . . . 111
Importing Devices ..................................................112
Requirements ..................................................113
Adding and Importing Devices with Static IP Addresses . . . . . . . . . . . . . . . . 113
ScreenOSDevices...........................................113
IDPSensors................................................115
JUNOSDevices.............................................116
SAandICDevices...........................................117
Adding Devices with Dynamic IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . 118
ScreenOSDevices...........................................118
IDP Sensors ...............................................120
Adding and Importing an Infranet Controller or Secure Access
Device .................................................121
Adding and Importing a JUNOS Device with a Dynamic IP Address . . . 124
Copyright © 2010, Juniper Networks, Inc.x
Network and Security Manager Administration Guide

Verifying Imported Device Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
UsingDeviceMonitor........................................128
UsingDeviceManager.......................................128
UsingJobManager..........................................128
UsingConfigurationSummaries...............................129
ModelingDevices..................................................130
Requirements .................................................130
ModelingaDevice..............................................130
CreatingaDeviceConfiguration....................................131
ActivatingaDevice..............................................132
Devices with Static IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Devices with Dynamic IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Using Rapid Deployment (ScreenOS Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
CreatingtheConfiglet...........................................140
InstallingtheConfiglet..........................................143
PreparingtheDevice........................................143
InstallingtheConfiglet.......................................143
Updating the Device Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
SummarizeDeltaConfiguration...............................145
Example: User Successfully Selects and Updates Two Devices with
DeltaOption ...........................................145
Example: User Selects Two Devices with Delta Option and One Device
Fails ..................................................146
Example: User Selects Two Devices to Update Without the Delta
Option ................................................146
Example: User Selects Two Devices to Update with the Delta Option,
ButHasnoAdminPrivileges...............................146
AddingVsysDevices................................................146
Placing the Root Device in a Global Domain or a Subdomain . . . . . . . . . . . . 147
ImportingVsysDevices..........................................147
ModelingVsysDevices..........................................148
AddingL2VRootSystems........................................150
AddinganExtranetDevice...........................................150
AddingClusters....................................................151
AddingaClusterDeviceObject....................................151
AddingMemberstotheCluster....................................152
AddingScreenOSorIDPClusters..................................152
Adding Secure Access or Infranet Controller Clusters . . . . . . . . . . . . . . . . . . 152
Adding and Importing a Secure Access or Infranet Controller Cluster
through Unreachable Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Adding and Importing a Secure Access or Infranet Controller Cluster
throughReachableWorkflow..............................154
Adding Clusters of Routers Running JUNOS Software . . . . . . . . . . . . . . . . . . 155
Adding and Importing a JUNOS Cluster . . . . . . . . . . . . . . . . . . . . . . . . . 156
Adding a JUNOS Cluster with Modeled Cluster Members . . . . . . . . . . . . 157
Activating and Updating a Modeled JUNOS Cluster . . . . . . . . . . . . . . . . 157
Example: Adding and Importing a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
AddingtheCluster..........................................158
AddingtheClusterMembers..................................159
xiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Importing the Cluster configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Example: Creating, Activating, and Updating a Cluster with Modeled Cluster
Members .................................................160
AddingtheCluster..........................................160
ModelingtheClusterMembers................................161
ActivatingtheClusterMembers................................162
UpdatingtheCluster........................................164
Adding a Vsys Cluster and Vsys Cluster Members . . . . . . . . . . . . . . . . . . . . . 164
Example:AddingaVsysCluster...............................164
Adding Multiple Devices Using Automatic Discovery (JUNOS, SA, and IC Devices
) ............................................................166
AddingaDeviceDiscoveryRule....................................167
RunningaDeviceDiscoveryRule..................................168
AddingManyDevicesUsingCSVFiles..................................168
CreatingtheCSVFile............................................169
Devices with Static IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Device with Dynamic IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
UndeployedDevices.........................................173
ValidatingtheCSVFile...........................................175
ImportingManyDevices.........................................175
Adding and Importing Many Devices with Static IP Addresses . . . . . . . 176
Adding and Importing Many Devices with Dynamic IP Addresses . . . . . 176
ModelingManyDevices..........................................177
UsingRapidDeployment.........................................177
Modeling and Activating Many Devices with Configlets . . . . . . . . . . . . . 178
Activating Many Devices with Configlets . . . . . . . . . . . . . . . . . . . . . . . . . 179
AddingDeviceGroups...............................................179
Example:CreatingaDeviceGroup.................................180
Setting Up NSM to Work With Infranet Controller and Infranet Enforcer . . . . . . . 181
Avoiding Naming Conflicts of the Authorization Server Object . . . . . . . . . . . 181
Avoiding NACN Password Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Chapter5 Configuring Devices ..............................................185
AboutDeviceConfiguration..........................................186
About Configuring Device Families . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
About Configuring Clusters, VPNs, Vsys Devices, Policies, and Shared
Objects ...................................................186
Configuration Features ..........................................187
AbouttheDeviceEditor......................................187
AboutDeviceTemplates.....................................187
AboutConfigurationGroups..................................188
Editing Devices Using the Device Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Validation and Data Origination Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
ConfiguringDeviceFeatures......................................191
Configuring ScreenOS/IDP Device Features . . . . . . . . . . . . . . . . . . . . . . 192
Configuring Secure Access or Infranet Controller Device Features . . . . 194
Configuring JUNOS Device Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Updating the Configuration on the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Copyright © 2010, Juniper Networks, Inc.xii
Network and Security Manager Administration Guide

UsingDeviceTemplates.............................................196
ModifyingValuesinTemplates....................................197
Example: Creating and Applying a Device Template for DNS Settings . . . . . 198
CreatingtheTemplate.......................................198
ApplyingtheTemplate.......................................199
TemplatesandImportingDevices.................................200
Promoting a Device Configuration to a Template . . . . . . . . . . . . . . . . . . . . . 200
Changing Values Inherited from Templates . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Reverting a Configuration to Default Values of a Template . . . . . . . . . . . . . 202
TemplatesandValidation........................................202
ApplyingMultipleTemplates.....................................202
Example: Using Multiple Device Templates . . . . . . . . . . . . . . . . . . . . . . 203
TemplateLimitations...........................................207
Maximumof63Templates...................................207
DeviceGroups.............................................208
DefaultValues.............................................208
PredefinedDeviceData......................................208
ListKeyFields.............................................208
Specifying the Order of List Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Combining Template Data with Device Object Data . . . . . . . . . . . . . . . 210
Operations That Change the Sequence of Ordered Lists . . . . . . . . . . . . 210
RulesforReorderingLists.....................................211
ExamplesofReorderedLists...................................211
Identifying Ordered List Entries That Do Not Match the Template or
ConfigurationGroupOrder................................214
Using the Template Operations Directive . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
SelectOSNameSection.....................................216
SelectDevicesSection.......................................216
SelectTemplateSection.....................................216
TemplateOperationSection..................................217
Options Section ............................................217
Template Operations Box Recommended Workflow . . . . . . . . . . . . . . . 218
Removing Templates with the Template Operations Directive . . . . . . . 219
Exporting and Importing Device Templates . . . . . . . . . . . . . . . . . . . . . . . . . . 220
ExportingaDeviceTemplate.................................220
ImportingaDeviceTemplate.................................220
UsingConfigurationGroups..........................................221
Creating and Editing Configuration Groups . . . . . . . . . . . . . . . . . . . . . . . . . . 222
CreatingaConfigurationGroup................................222
EditingaConfigurationGroup.................................223
Validating a Configuration Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Ordered Lists and Wildcard Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
ApplyingaConfigurationGroup...................................224
ExcludingaConfigurationGroup..................................225
Editing a Device Object That Uses Configuration Groups . . . . . . . . . . . . . . . 226
DeletingaConfigurationGroup....................................227
Adding Ordered List Entries Using Configuration Groups . . . . . . . . . . . . . . . 227
ReorderingLists................................................227
xiiiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Using Configuration Groups with Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Sharing Configuration Group Definitions Across Multiple Devices . . . . . . . . 228
ConfiguringClusters................................................232
Configuring Cluster Objects Directly by Editing the Configuration . . . . . . . . 232
Configuring Cluster Objects Using Templates . . . . . . . . . . . . . . . . . . . . . . . . 232
Configuring Global Cluster Data with Configuration Groups (JUNOS Clusters
Only).....................................................233
Configuring Member-Level Data in a JUNOS Cluster . . . . . . . . . . . . . . . . . . . 233
Configuring JUNOS Devices with Redundant Routing Engines . . . . . . . . . . . . . . 234
ConfiguringaRoutingEngine.....................................234
Viewing a Routing Engine Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
OverviewofVRRPSupportinNSM....................................236
Platforms on Which NSM Supports VRRP . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Activating VRRP on a Device Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
DefiningaVSIasaVRRPinterface.................................237
ManagingConfigurationFiles........................................238
Viewing and Comparing Configuration File Versions . . . . . . . . . . . . . . . . . . . 238
Updating the Device with a Configuration File Version . . . . . . . . . . . . . . . . . 238
Importing or Viewing the Current Version of the Configuration File . . . . . . . 238
Automatic Import of Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Chapter6 UpdatingDevices.................................................241
About Updating ...................................................241
HowtheUpdateProcessWorks...................................242
About Atomic Configuration—ScreenOS Devices . . . . . . . . . . . . . . . . . . . . . 243
About Atomic Updating—ScreenOS Devices . . . . . . . . . . . . . . . . . . . . . . . . 244
About Atomic Configuration and Atomic Update—DMI-Compatible
Devices...................................................245
About Implicit Updates (Secure Access and Infranet Controller Devices
Only) ....................................................246
KnowingWhentoUpdate...........................................246
Verifying Device Status in Device Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
ConnectionStatus..........................................247
ConfigurationStatus........................................247
Verifying Device Status in Device Manager . . . . . . . . . . . . . . . . . . . . . . . . . . 249
ReviewingLogs................................................249
Identifying Administrative Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
ReviewingReports.............................................250
UsingPreviewTools................................................250
RunningaConfigurationSummary.................................251
Using a Delta Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
PerforminganUpdate..............................................254
RetryingaFailedUpdate........................................255
ConfiguringUpdateOptions......................................255
UpdateOptionsforScreenOS................................255
Update Options for DMI-Compatible Devices . . . . . . . . . . . . . . . . . . . . 256
TrackingDeviceUpdates............................................256
ReviewingJobInformation.......................................258
DeviceStatesDuringUpdate.....................................259
Copyright © 2010, Juniper Networks, Inc.xiv
Network and Security Manager Administration Guide

UnderstandingUpdatingErrors...................................260
Chapter7 ManagingDevices................................................263
ManagingDeviceSoftwareVersions...................................264
Upgrading the Device Software Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Upgrading a Device Software Version from NSM . . . . . . . . . . . . . . . . . 266
Upgrading a Device Software Version outside NSM . . . . . . . . . . . . . . . 266
AdjustingtheDeviceOSVersion..................................267
Downgrading the Device OS Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Rolling back the Device OS Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
DeletingtheDeviceOSVersion...................................268
UpgradingDeviceSupport.......................................268
Managing License Keys (ScreenOS Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
Installing License Keys on a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Importing License Key Information into NSM . . . . . . . . . . . . . . . . . . . . . . . . 269
InstallingTrialLicenseKeys......................................269
Viewing and Reconciling Device Inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
ViewingtheDeviceInventory.....................................270
Comparing and Reconciling Device Inventory . . . . . . . . . . . . . . . . . . . . . . . . . 271
Managing Large Binary Data Files (Secure Access and Infranet Controller Devices
Only) ........................................................273
Uploading and Linking Large Binary Data Files . . . . . . . . . . . . . . . . . . . . . . . 274
ImportingCustomSign-InPages..................................276
CreatingaCustomSign-InPage...............................277
Linking to a Custom Sign-In Page Shared Object . . . . . . . . . . . . . . . . . . 277
Importing Antivirus Live Update Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
UploadingLiveUpdateSettings...............................277
.........................................................277
Linking to a Live Update File Shared Object . . . . . . . . . . . . . . . . . . . . . . 278
Importing Endpoint Security Assessment Plug-in (ESAP) Packages . . . . . . 278
UploadingESAPPackages...................................278
Linking to an ESAP Package Shared Object . . . . . . . . . . . . . . . . . . . . . . 279
Importing Third-Party Host Checker Policies . . . . . . . . . . . . . . . . . . . . . . . . . 279
Uploading a Third-Party Host Checker Policy . . . . . . . . . . . . . . . . . . . . . 279
Linking to a Third-Party Host Checker Policy Shared Object . . . . . . . . 280
Importing a Secure Virtual Workspace Wallpaper Image (Secure Access
Devices Only) .............................................280
Uploading a Secure Virtual Workspace Wallpaper Image . . . . . . . . . . . 280
Linking to a Secure Virtual Workspace Wallpaper Image Shared
Object................................................280
Importing Hosted Java Applets (Secure Access Devices Only) . . . . . . . . . . . 281
UploadingaJavaApplet.....................................281
Linking to a Hosted Java Applet Shared Object . . . . . . . . . . . . . . . . . . . 281
Importing a Custom Citrix Client .cab File (Secure Access Devices Only) . . 282
Uploading a Custom Citrix Client .cab File . . . . . . . . . . . . . . . . . . . . . . . 282
Linking to a Custom Citrix .cab File Shared Object . . . . . . . . . . . . . . . . . 282
Backing up and Restoring SA and IC Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
BackingupanSAorICDevice....................................283
RestoringSAorICDevices.......................................283
xvCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Backing up multiple SA or IC Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Configuring Preferences for Backing up and Restoring SA or IC Devices . . . 283
Viewing Backed up Versions for an SA or IC Device . . . . . . . . . . . . . . . . . . . 284
Setting the RMA State on an SA/IC Device . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Activating an SA/IC Device Set to the RMA State . . . . . . . . . . . . . . . . . . . . . 285
Performing a Full Restore of an SA or IC Device . . . . . . . . . . . . . . . . . . . . . . 286
Managing User Sessions for SA and IC Devices . . . . . . . . . . . . . . . . . . . . . . . . . . 286
ActivatingSubscriptionServices......................................287
Managing the Attack Object Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Updating the Attack Object Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
Updating Attack Objects for IDP-Enabled devices . . . . . . . . . . . . . . . . 288
Updating DI Attacks on ScreenOS 5.0 Devices . . . . . . . . . . . . . . . . . . . 290
UsingUpdatedAttackObjects................................291
Verifying the Attack Object Database Version . . . . . . . . . . . . . . . . . . . . . . . . 291
AutomaticVerification.......................................291
ManualVerification.........................................292
Managing Different Attack Database Versions . . . . . . . . . . . . . . . . . . . . 292
Example: Updating Devices with Different Attack Object Database
Versions ..............................................293
UpdatingtheIDPDetectorEngine.................................293
Example: Confirm IDP Engine Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
SchedulingSecurityUpdates.....................................294
Example: Update Attack Objects and Push to Connected Devices . . . 296
SchedulingtheUpdate......................................296
Example: Using Crontab to Schedule Attack Updates . . . . . . . . . . . . . . 297
Viewing Scheduled Security Updates in the Job Manager . . . . . . . . . . . 298
Viewing Scheduled Security Updates in the Audit Log Viewer . . . . . . . 298
UpdatingAVPatternFiles...........................................298
UpdatingtheWebCategoryList......................................298
MiscellaneousDeviceOperations.....................................299
LaunchingaWebUIforaDevice..................................300
LaunchingaTelnetCLIWindow..................................300
RebootingDevices.............................................300
RefreshingDNSEntries..........................................301
Updating the Device Clock with an NTP Server . . . . . . . . . . . . . . . . . . . . . . . 301
Setting the Root Administrator on a Device . . . . . . . . . . . . . . . . . . . . . . . . . 302
Failing Over or Reverting Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
SettingtheRMAStateonaDevice................................303
Upgrading the OS Version During an RMA-Activate Device Workflow . . . . . 304
Troubleshooting a BGP Peer Session on a Device . . . . . . . . . . . . . . . . . . . . 304
Reactivating Wireless Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
FindingUsages................................................305
Managing ScreenOS Device Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
AbstractDataModel...........................................306
DataModel...................................................306
DataModelSchema........................................306
DataModelUpdating.......................................307
DataModelImporting.......................................309
Copyright © 2010, Juniper Networks, Inc.xvi
Network and Security Manager Administration Guide

ArchivingandRestoring..............................................311
Archiving Logs and Configuration Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Restoring Logs and Configuration Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Managing Device Schemas Through the Juniper Update Mechanism . . . . . . . . . 312
DownloadingSchemas..........................................313
Downloading Schemas Using the NSM UI . . . . . . . . . . . . . . . . . . . . . . . 314
Downloading Schemas Using the GUI Server CLI . . . . . . . . . . . . . . . . . . 314
ApplyingaSchema.............................................315
Part 3 Managing
Chapter8 Configuring Objects ..............................................319
AboutObjects ....................................................320
UsingObjectsAcrossDomains....................................322
ReplacingObjects..............................................322
Working with Unused Shared Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323
Searching for Unused Shared Objects . . . . . . . . . . . . . . . . . . . . . . . . . . 323
Deleting an Unused Shared Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323
WorkingwithObjectVersions.....................................323
Searching For and Deleting Duplicate Objects . . . . . . . . . . . . . . . . . . . . . . . 324
ConfiguringAddressObjects.........................................324
ViewingAddressObjects........................................325
CreatingAddressObjects........................................325
AddingaHostAddressObject................................326
Adding a Network Address Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Editing and Deleting Address Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
ReplacingAddressObjects...................................327
AddinganAddressObjectGroup..............................327
Adding a Multicast Group Address Object . . . . . . . . . . . . . . . . . . . . . . . 328
Adding Static DNS Host Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
BlockedHosts.................................................330
ConfiguringApplicationObjects......................................330
Viewing Predefined Application Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
Creating Custom Application Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Editing and Deleting Application Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
ConfiguringScheduleObjects........................................332
CreatingScheduleObjects.......................................332
ConfiguringAccessProfileObjects....................................332
Configuring Quality of Service Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
Creating a Quality of Service Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
Deleting a Quality of Service Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
Editing a Quality of Service Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
WorkingwithDIAttackObjects.......................................335
Viewing Predefined DI Attack Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335
Viewing Attack Version Information for Attack Objects . . . . . . . . . . . . . . . . 335
Viewing Predefined DI Attack Object Groups . . . . . . . . . . . . . . . . . . . . . . . . 336
Updating Predefined DI Attack Objects and Groups . . . . . . . . . . . . . . . . . . . 336
CreatingDIProfiles.............................................336
xviiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

WorkingwithIDPAttackObjects.....................................338
ViewingPredefinedIDPAttacks...................................339
Viewing Predefined IDP Attack Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
Viewing Attack Version Information for Attack Objects and Groups . . . . . . 340
Updating Predefined IDP Attack Objects and Groups . . . . . . . . . . . . . . . . . 340
Configuring Custom DI and IDP Attack Objects . . . . . . . . . . . . . . . . . . . . . . . . . . 340
UsingtheAttackObjectWizard...................................341
Copying and Editing Predefined Attack Objects to Create Custom Attack
Objects ...................................................341
Configuring Attack Name and Description . . . . . . . . . . . . . . . . . . . . . . . . . . 342
Configuring Extended Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
ConfiguringExternalReferences..................................343
ConfiguringTargetPlatforms.....................................344
Creating a Signature Attack Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345
Configuring General Attack Properties . . . . . . . . . . . . . . . . . . . . . . . . . . 345
Configuring Attack Detection Properties . . . . . . . . . . . . . . . . . . . . . . . . 349
Configuring Header Match Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
Configuring a Protocol Anomaly Attack Object . . . . . . . . . . . . . . . . . . . . . . . 355
Configuring a Compound Attack Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356
Configuring General Attack Properties . . . . . . . . . . . . . . . . . . . . . . . . . . 356
Configuring Compound Attack Members . . . . . . . . . . . . . . . . . . . . . . . . 357
ConfiguringtheDirectionFilter....................................359
CreatingCustomDIAttackGroups....................................359
CreatingCustomIDPAttackGroups...................................359
CreatingStaticAttackGroups....................................360
Creating Dynamic Attack Groups (IDP Only) . . . . . . . . . . . . . . . . . . . . . . . . 360
UpdatingDynamicGroups.......................................363
EditingaCustomAttackGroup...................................364
DeletingaCustomAttackGroup..................................364
UnifiedThreatManagement.........................................364
CreatingUTMProfiles...........................................364
CreatinganAntivirusProfile......................................365
CreatinganAntispamProfile.....................................366
Creating a Content Filtering Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366
CreatingaURLFilteringProfile....................................367
MiscellaneousUTMFeatures.....................................368
Multipurpose Internet Mail Extension (MIME) Lists . . . . . . . . . . . . . . . . 368
ExtensionLists.............................................369
CommandLists............................................369
URLPatterns..............................................369
URL Categories ............................................370
ScreenOS Threat Management Features . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
ConfiguringAntivirusObjects.................................370
Configuring External AV Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371
Configuring Internal AV Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372
Configuring ICAP AV Servers and Profiles . . . . . . . . . . . . . . . . . . . . . . . . 373
ConfiguringICAPAVProfiles..................................374
Configuring Web Filtering Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
Copyright © 2010, Juniper Networks, Inc.xviii
Network and Security Manager Administration Guide

ConfiguringCustomPolicyFields.....................................376
DefiningMetadata..............................................377
InstantiatingNewObjects....................................377
Adding Custom Detail Object to Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
OpenLogViewer...........................................378
ConfiguringGTPObjects............................................378
ConfiguringInfo................................................378
LimitingGTPMessageLength.................................378
LimitingGTPMessageRate..................................379
LimitingGTPTunnels........................................379
RemovingInactiveGTPTunnels...............................379
ValidatingSequenceNumbers................................379
FilteringGTP-in-GTPPackets.................................380
Removing GTP R6 Informational Elements . . . . . . . . . . . . . . . . . . . . . . 380
InspectingTunnelEndpointIDs...............................380
Configuring Traffic Logging and Counting . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
TrafficCounting............................................380
TrafficLogging.............................................380
Configuring IMSI Prefix and APN Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
CreatinganAPNFilter.......................................381
CreatinganIMSIPrefixFilter..................................382
Configuring GTP Message Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383
Configuring Subscriber Tracing (Lawful Interception) . . . . . . . . . . . . . . . . . 383
Example:CreatingaGTPObject...............................383
ConfiguringServiceObjects.........................................384
ViewingPredefinedServices.....................................384
CreatingCustomServices.......................................386
ServiceObjectGroups..........................................387
Example: Creating a Custom Service and Group . . . . . . . . . . . . . . . . . . 388
Example: Creating a Custom Sun-RPC Service . . . . . . . . . . . . . . . . . . . 389
Example: Creating a Custom MS-RPC Service . . . . . . . . . . . . . . . . . . . 390
Editing and Deleting Service Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
ReplacingServiceObjects........................................391
ConfiguringSCTPObjects...........................................392
ConfiguringanSCTPObject......................................392
ConfiguringAuthenticationServers....................................392
Configuring General Authentication Server Settings . . . . . . . . . . . . . . . . . . . 393
Configuring Authentication Server Redundancy . . . . . . . . . . . . . . . . . . . . . . 393
Configuring Authentication for User Types . . . . . . . . . . . . . . . . . . . . . . . . . . 394
DomainNameChecking.....................................394
DomainNameStripping.....................................394
Configuring Authentication Server Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 395
Configuring a RADIUS Authentication Server . . . . . . . . . . . . . . . . . . . . . 395
Configuring a SecurID Authentication Server . . . . . . . . . . . . . . . . . . . . . 398
Configuring an LDAP Authentication Server . . . . . . . . . . . . . . . . . . . . . 400
Configuring a TACACS Authentication Server . . . . . . . . . . . . . . . . . . . . 400
ConfiguringUserObjects............................................401
ConfiguringLocalUsers.........................................401
ConfiguringLocalUserGroups...................................402
xixCopyright © 2010, Juniper Networks, Inc.
Table of Contents

ConfiguringExternalUsers.......................................402
ConfiguringExternalUserGroups.................................402
ConfiguringVLANObjects...........................................405
ConfiguringIPPools...............................................405
UsingMultipleIPRanges........................................406
ConfiguringGroupExpressions.......................................406
ConfiguringRemoteSettings........................................409
Configuring Routing Instance Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
ViewingRoutingInstanceObjects.................................410
Creating Routing Instance Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
ConfiguringNATObjects.............................................411
ConfiguringDIPObjects..........................................411
ConfiguringMIPObjects.........................................412
ConfiguringVIPObjects..........................................412
ConfiguringCertificateAuthorities.....................................412
UsingCertificateAuthorities......................................413
Configuring Certificate Authorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
ConfiguringCRLObjects............................................415
UsingCRLs....................................................415
ConfiguringCRLs...............................................415
ConfiguringExtranetPolicies.........................................415
ConfiguringBinaryDataObjects......................................416
AddingBinaryDataObjects.......................................417
Viewing, Editing, and Deleting Binary Data Objects . . . . . . . . . . . . . . . . . . . . 417
ConfiguringProtectedResources......................................417
CreatingProtectedResources....................................418
EditingProtectedResources......................................418
ConfiguringIKEProposals...........................................419
Creating Custom IKE Phase1 Proposals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
Creating Custom IKE Phase 2 Proposals . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420
ConfiguringDial-inObjects...........................................421
CreatingaDial-InProfile.........................................422
Linking the Dial-In Profile with the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
Setting the Time-out Period for the Modem Dial-In Authentication . . . . . . 422
Configuring Border Signaling Gateway Objects . . . . . . . . . . . . . . . . . . . . . . . . . . 422
Chapter 9 Configuring Security Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
AboutSecurityPolicies.............................................426
Viewing Rulebase Columns for a Security Policy . . . . . . . . . . . . . . . . . . . . . 426
Viewing and Editing Custom Policy Fields . . . . . . . . . . . . . . . . . . . . . . . 427
About Rulebases ..............................................428
RuleExecutionSequence....................................429
About Rules ..................................................430
AboutFirewallRulebases.......................................430
Firewall Rules (Zone and Global) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
VPNLinksandRules.........................................431
AboutRuleGroups.........................................432
AbouttheMulticastRulebase....................................432
About IDP Rulebases on ISG Family Devices . . . . . . . . . . . . . . . . . . . . . . . . . 432
Copyright © 2010, Juniper Networks, Inc.xx
Network and Security Manager Administration Guide