Juniper NETWORK AND SECURITY MANAGER 2010.3 - ADMINISTRATION GUIDE... Instruction Manual

Juniper Networks
Network and Security
Manager
Administration Guide
Release
2010.3
Published: 2010-08-17
Revision 1
Copyright © 2010, Juniper Networks, Inc.

Juniper Networks, Inc.
1194 North Mathilda Avenue
Sunnyvale, California 94089
USA
408-745-2000
www.juniper.net
This product includes the Envoy SNMP Engine, developed by Epilogue Technology, an Integrated Systems Company. Copyright © 1986-1997,
Epilogue Technology Corporation. All rights reserved. This program and its documentation were developed at private expense, and no part
of them is in the public domain.
This product includes memory allocation software developed by Mark Moraes, copyright © 1988, 1989, 1993, University of Toronto.
This product includes FreeBSD software developed by the University of California, Berkeley, and its contributors. All of the documentation
and software included in the 4.4BSD and 4.4BSD-Lite Releases is copyrighted by the Regents of the University of California. Copyright ©
1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994. The Regents of the University of California. All rights reserved.
GateD software copyright © 1995, the Regents of the University. All rights reserved. Gate Daemon was originated and developed through
release 3.0 by Cornell University and its collaborators. Gated is based on Kirton’s EGP, UC Berkeley’s routing daemon (routed), and DCN’s
HELLO routing protocol. Development of Gated has been supported in part by the National Science Foundation. Portions of the GateD
software copyright © 1988, Regents of the University of California. All rights reserved. Portions of the GateD software copyright © 1991, D.
L. S. Associates.
This product includes software developed by Maker Communications, Inc., copyright © 1996, 1997, Maker Communications, Inc.
Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United
States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other
trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.
Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify,
transfer, or otherwise revise this publication without notice.
Products made or sold by Juniper Networks or components thereof might be covered by one or more of the following patents that are
owned by or licensed to Juniper Networks: U.S. Patent Nos. 5,473,599, 5,905,725, 5,909,440, 6,192,051, 6,333,650, 6,359,479, 6,406,312,
6,429,706, 6,459,579, 6,493,347, 6,538,518, 6,538,899, 6,552,918, 6,567,902, 6,578,186, and 6,590,785.
Network and Security Manager Administration Guide
Copyright © 2010, Juniper Networks, Inc.
All rights reserved. Printed in USA.
Writing: Rama Vasudevan, James Thomas
Editing: Sonia Saruba
Cover Design: Edmonds Design
Revision History
August 18, 2010— Revision 1
The information in this document is current as of the date listed in the revision history.
Copyright © 2010, Juniper Networks, Inc.ii

END USER LICENSE AGREEMENT
READ THIS END USER LICENSE AGREEMENT (“AGREEMENT”) BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE.
BY DOWNLOADING, INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS
CONTAINED HEREIN, YOU (AS CUSTOMER OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO
BIND THE CUSTOMER) CONSENT TO BE BOUND BY THIS AGREEMENT. IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED
HEREIN, THEN (A) DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE, AND (B) YOU MAY CONTACT JUNIPER NETWORKS
REGARDING LICENSE TERMS.
1. The Parties. The parties to this Agreement are (i) Juniper Networks, Inc. (if the Customer’s principal office is located in the Americas) or
Juniper Networks (Cayman) Limited (if the Customer’s principal office is located outside the Americas) (such applicable entity being referred
to herein as “Juniper”), and (ii) the person or organization that originally purchased from Juniper or an authorized Juniper reseller the applicable
license(s) for use of the Software (“Customer”) (collectively, the “Parties”).
2. The Software. In this Agreement, “Software” means the program modules and features of the Juniper or Juniper-supplied software, for
which Customer has paid the applicable license or support fees to Juniper or an authorized Juniper reseller, or which was embedded by
Juniper in equipment which Customer purchased from Juniper or an authorized Juniper reseller. “Software” also includes updates, upgrades
and new releases of such software. “Embedded Software” means Software which Juniper has embedded in or loaded onto the Juniper
equipment and any updates, upgrades, additions or replacements which are subsequently embedded in or loaded onto the equipment.
3. License Grant. Subject to payment of the applicable fees and the limitations and restrictions set forth herein, Juniper grants to Customer
a non-exclusive and non-transferable license, without right to sublicense, to use the Software, in executable form only, subject to the
following use restrictions:
a. Customer shall use Embedded Software solely as embedded in, and for execution on, Juniper equipment originally purchased by
Customer from Juniper or an authorized Juniper reseller.
b. Customer shall use the Software on a single hardware chassis having a single processing unit, or as many chassis or processing units
for which Customer has paid the applicable license fees; provided, however, with respect to the Steel-Belted Radius or Odyssey Access
Client software only, Customer shall use such Software on a single computer containing a single physical random access memory space
and containing any number of processors. Use of the Steel-Belted Radius or IMS AAA software on multiple computers or virtual machines
(e.g., Solaris zones) requires multiple licenses, regardless of whether such computers or virtualizations are physically contained on a single
chassis.
c. Product purchase documents, paper or electronic user documentation, and/or the particular licenses purchased by Customer may
specify limits to Customer’s use of the Software. Such limits may restrict use to a maximum number of seats, registered endpoints, concurrent
users, sessions, calls, connections, subscribers, clusters, nodes, realms, devices, links, ports or transactions, or require the purchase of
separate licenses to use particular features, functionalities, services, applications, operations, or capabilities, or provide throughput,
performance, configuration, bandwidth, interface, processing, temporal, or geographical limits. In addition, such limits may restrict the use
of the Software to managing certain kinds of networks or require the Software to be used only in conjunction with other specific Software.
Customer’s use of the Software shall be subject to all such limitations and purchase of all applicable licenses.
d. For any trial copy of the Software, Customer’s right to use the Software expires 30 days after download, installation or use of the
Software. Customer may operate the Software after the 30-day trial period only if Customer pays for a license to do so. Customer may not
extend or create an additional trial period by re-installing the Software after the 30-day trial period.
e. The Global Enterprise Edition of the Steel-Belted Radius software may be used by Customer only to manage access to Customer’s
enterprise network. Specifically, service provider customers are expressly prohibited from using the Global Enterprise Edition of the
Steel-Belted Radius software to support any commercial network access services.
The foregoing license is not transferable or assignable by Customer. No license is granted herein to any user who did not originally purchase
the applicable license(s) for the Software from Juniper or an authorized Juniper reseller.
4. Use Prohibitions. Notwithstanding the foregoing, the license provided herein does not permit the Customer to, and Customer agrees
not to and shall not: (a) modify, unbundle, reverse engineer, or create derivative works based on the Software; (b) make unauthorized
copies of the Software (except as necessary for backup purposes); (c) rent, sell, transfer, or grant any rights in and to any copy of the
Software, in any form, to any third party; (d) remove any proprietary notices, labels, or marks on or in any copy of the Software or any product
in which the Software is embedded; (e) distribute any copy of the Software to any third party, including as may be embedded in Juniper
equipment sold in the secondhand market; (f) use any ‘locked’ or key-restricted feature, function, service, application, operation, or capability
without first purchasing the applicable license(s) and obtaining a valid key from Juniper, even if such feature, function, service, application,
operation, or capability is enabled without a key; (g) distribute any key for the Software provided by Juniper to any third party; (h) use the
iiiCopyright © 2010, Juniper Networks, Inc.

Software in any manner that extends or is broader than the uses purchased by Customer from Juniper or an authorized Juniper reseller; (i)
use Embedded Software on non-Juniper equipment; (j) use Embedded Software (or make it available for use) on Juniper equipment that
the Customer did not originally purchase from Juniper or an authorized Juniper reseller; (k) disclose the results of testing or benchmarking
of the Software to any third party without the prior written consent of Juniper; or (l) use the Software in any manner other than as expressly
provided herein.
5. Audit. Customer shall maintain accurate records as necessary to verify compliance with this Agreement. Upon request by Juniper,
Customer shall furnish such records to Juniper and certify its compliance with this Agreement.
6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper.
As such, Customer shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence,
which at a minimum includes restricting access to the Software to Customer employees and contractors having a need to use the Software
for Customer’s internal business purposes.
7. Ownership. Juniper and Juniper’s licensors, respectively, retain ownership of all right, title, and interest (including copyright) in and to
the Software, associated documentation, and all copies of the Software. Nothing in this Agreement constitutes a transfer or conveyance
of any right, title, or interest in the Software or associated documentation, or a sale of the Software, associated documentation, or copies
of the Software.
8. Warranty, Limitation of Liability, Disclaimer of Warranty. The warranty applicable to the Software shall be as set forth in the warranty
statement that accompanies the Software (the “Warranty Statement”). Nothing in this Agreement shall give rise to any obligation to support
the Software. Support services may be purchased separately. Any such support shall be governed by a separate, written support services
agreement. TO THE MAXIMUM EXTENT PERMITTED BY LAW, JUNIPER SHALL NOT BE LIABLE FOR ANY LOST PROFITS, LOSS OF DATA,
OR COSTS OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR CONSEQUENTIAL DAMAGES
ARISING OUT OF THIS AGREEMENT, THE SOFTWARE, OR ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE. IN NO EVENT SHALL JUNIPER
BE LIABLE FOR DAMAGES ARISING FROM UNAUTHORIZED OR IMPROPER USE OF ANY JUNIPER OR JUNIPER-SUPPLIED SOFTWARE.
EXCEPT AS EXPRESSLY PROVIDED IN THE WARRANTY STATEMENT TO THE EXTENT PERMITTED BY LAW, JUNIPER DISCLAIMS ANY
AND ALL WARRANTIES IN AND TO THE SOFTWARE (WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE), INCLUDING ANY
IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT DOES
JUNIPER WARRANT THAT THE SOFTWARE, OR ANY EQUIPMENT OR NETWORK RUNNING THE SOFTWARE, WILL OPERATE WITHOUT
ERROR OR INTERRUPTION, OR WILL BE FREE OF VULNERABILITY TO INTRUSION OR ATTACK. In no event shall Juniper’s or its suppliers’
or licensors’ liability to Customer, whether in contract, tort (including negligence), breach of warranty, or otherwise, exceed the price paid
by Customer for the Software that gave rise to the claim, or if the Software is embedded in another Juniper product, the price paid by
Customer for such other product. Customer acknowledges and agrees that Juniper has set its prices and entered into this Agreement in
reliance upon the disclaimers of warranty and the limitations of liability set forth herein, that the same reflect an allocation of risk between
the Parties (including the risk that a contract remedy may fail of its essential purpose and cause consequential loss), and that the same
form an essential basis of the bargain between the Parties.
9. Termination. Any breach of this Agreement or failure by Customer to pay any applicable fees due shall result in automatic termination
of the license granted herein. Upon such termination, Customer shall destroy or return to Juniper all copies of the Software and related
documentation in Customer’s possession or control.
10. Taxes. All license fees payable under this agreement are exclusive of tax. Customer shall be responsible for paying Taxes arising from
the purchase of the license, or importation or use of the Software. If applicable, valid exemption documentation for each taxing jurisdiction
shall be provided to Juniper prior to invoicing, and Customer shall promptly notify Juniper if their exemption is revoked or modified. All
payments made by Customer shall be net of any applicable withholding tax. Customer will provide reasonable assistance to Juniper in
connection with such withholding taxes by promptly: providing Juniper with valid tax receipts and other required documentation showing
Customer’s payment of any withholding taxes; completing appropriate applications that would reduce the amount of withholding tax to
be paid; and notifying and assisting Juniper in any audit or tax proceeding related to transactions hereunder. Customer shall comply with
all applicable tax laws and regulations, and Customer will promptly pay or reimburse Juniper for all costs and damages related to any
liability incurred by Juniper as a result of Customer’s non-compliance or delay with its responsibilities herein. Customer’s obligations under
this Section shall survive termination or expiration of this Agreement.
11. Export. Customer agrees to comply with all applicable export laws and restrictions and regulations of any United States and any
applicable foreign agency or authority, and not to export or re-export the Software or any direct product thereof in violation of any such
restrictions, laws or regulations, or without all necessary approvals. Customer shall be liable for any such violations. The version of the
Software supplied to Customer may contain encryption or other capabilities restricting Customer’s ability to export the Software without
an export license.
Copyright © 2010, Juniper Networks, Inc.iv

12. Commercial Computer Software. The Software is “commercial computer software” and is provided with restricted rights. Use,
duplication, or disclosure by the United States government is subject to restrictions set forth in this Agreement and as provided in DFARS
227.7201 through 227.7202-4, FAR 12.212, FAR 27.405(b)(2), FAR 52.227-19, or FAR 52.227-14(ALT III) as applicable.
13. Interface Information. To the extent required by applicable law, and at Customer's written request, Juniper shall provide Customer
with the interface information needed to achieve interoperability between the Software and another independently created program, on
payment of applicable fee, if any. Customer shall observe strict obligations of confidentiality with respect to such information and shall use
such information in compliance with any applicable terms and conditions upon which Juniper makes such information available.
14. Third Party Software. Any licensor of Juniper whose software is embedded in the Software and any supplier of Juniper whose products
or technology are embedded in (or services are accessed by) the Software shall be a third party beneficiary with respect to this Agreement,
and such licensor or vendor shall have the right to enforce this Agreement in its own name as if it were Juniper. In addition, certain third party
software may be provided with the Software and is subject to the accompanying license(s), if any, of its respective owner(s). To the extent
portions of the Software are distributed under and subject to open source licenses obligating Juniper to make the source code for such
portions publicly available (such as the GNU General Public License (“GPL”) or the GNU Library General Public License (“LGPL”)), Juniper
will make such source code portions (including Juniper modifications, as appropriate) available upon request for a period of up to three
years from the date of distribution. Such request can be made in writing to Juniper Networks, Inc., 1194 N. Mathilda Ave., Sunnyvale, CA
94089, ATTN: General Counsel. You may obtain a copy of the GPL at http://www.gnu.org/licenses/gpl.html, and a copy of the LGPL
at http://www.gnu.org/licenses/lgpl.html .
15. Miscellaneous. This Agreement shall be governed by the laws of the State of California without reference to its conflicts of laws
principles. The provisions of the U.N. Convention for the International Sale of Goods shall not apply to this Agreement. For any disputes
arising under this Agreement, the Parties hereby consent to the personal and exclusive jurisdiction of, and venue in, the state and federal
courts within Santa Clara County, California. This Agreement constitutes the entire and sole agreement between Juniper and the Customer
with respect to the Software, and supersedes all prior and contemporaneous agreements relating to the Software, whether oral or written
(including any inconsistent terms contained in a purchase order), except that the terms of a separate written agreement executed by an
authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict with terms contained
herein. No modification to this Agreement nor any waiver of any rights hereunder shall be effective unless expressly assented to in writing
by the party to be charged. If any portion of this Agreement is held invalid, the Parties agree that such invalidity shall not affect the validity
of the remainder of this Agreement. This Agreement and associated documentation has been written in the English language, and the
Parties agree that the English version will govern. (For Canada: Les parties aux présentés confirment leur volonté que cette convention de
même que tous les documents y compris tout avis qui s'y rattaché, soient redigés en langue anglaise. (Translation: The parties confirm that
this Agreement and all related documentation is and will be in the English language)).
vCopyright © 2010, Juniper Networks, Inc.

Copyright © 2010, Juniper Networks, Inc.vi

Table of Contents
AboutThisGuide.................................................xlv
Objectives ........................................................xlv
Audience .........................................................xlv
Conventions ......................................................xlvi
Documentation ...................................................xlvii
RequestingTechnicalSupport........................................xlix
Self-Help Online Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xlix
OpeningaCasewithJTAC..........................................l
Part 1 Getting Started with NSM
Chapter 1 Introduction to Network and Security Manager . . . . . . . . . . . . . . . . . . . . . . . . . 3
AboutNSM.........................................................3
SecurityIntegration...............................................4
DeviceConfiguration..........................................4
NetworkOrganization.........................................4
Role-BasedAdministration.....................................4
CentralizedDeviceConfiguration................................5
DeviceManagement..............................................6
ImportingDevices............................................6
DeviceModeling..............................................6
RapidDeployment............................................6
Policy-BasedManagement.....................................6
Error Prevention, Recovery, and Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
DeviceConfigurationValidation.................................7
PolicyValidation..............................................7
Atomic Configuration and Updating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
DeviceImageUpdates.........................................8
Auditing ....................................................8
CompleteSystemManagement....................................8
VPNAbstraction.............................................8
IntegratedLoggingandReporting................................9
Monitoring Status ............................................9
JobManagement.............................................9
TechnicalOverview..................................................10
Architecture....................................................10
User Interface ...............................................11
ManagementSystem.........................................11
ManagedDevices................................................13
Firewall and IDP (ScreenOS/IDP) Devices . . . . . . . . . . . . . . . . . . . . . . . . 13
DevicesRunningJunosOS.....................................16
viiCopyright © 2010, Juniper Networks, Inc.

SSLVPNSecureAccessProducts..............................20
Juniper Networks IC Series Unified Access Control Appliances . . . . . . . . 21
ExtranetDevices.............................................21
DistributedDataCollection........................................21
DeviceSchemas................................................22
Security .......................................................22
ScalingandPerformance.........................................22
WorkingintheUserInterface..........................................23
Characters Not Supported in Login Passwords . . . . . . . . . . . . . . . . . . . . . . . . 23
ManagingBlockedLoginAttempts.................................23
ConfiguringUIPreferences........................................23
UIOverview....................................................23
NavigationTree.............................................24
CommonTasksPane.........................................24
MainDisplayArea...........................................25
MenuBar ..................................................25
Toolbar....................................................25
Status Bar .................................................25
NSMModules..................................................25
InvestigateModules..........................................25
ConfigureModules...........................................27
AdministerModules..........................................31
Validation Icons in the User Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Validation and Data Origination Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Working with Other NSM Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
SearchingintheUserInterface.....................................33
ContainsString[C]SearchMode...............................34
StartsWith[S]SearchMode..................................34
Regular Expression [R] Search Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
IP[I]SearchMode...........................................36
SearchforanExactMatch(E)..................................37
GlobalSearch..................................................38
NewFeaturein2010.3...............................................39
Chapter2 PlanningYourVirtualNetwork......................................41
ConfiguringDevicesOverview.........................................41
ImportingExistingDevices........................................42
ModelingNewDevices...........................................43
EditingaDeviceConfiguration.....................................44
Configuring IDP-Capable Devices Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
CommonCriteriaEAL2Compliance................................45
GuidanceforIntendedUsage..................................45
GuidanceforPersonnel.......................................45
Guidance for Physical Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
SupportedIDP-CapableDevices...............................45
Enabling Jumbo Frames (ISG1000 Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Copyright © 2010, Juniper Networks, Inc.viii
Network and Security Manager Administration Guide

EnablingIDPFunctionality........................................47
Adding an ISG2000/ISG1000 Security Device with a Security
Module ................................................47
Installing Advanced License Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
UpdatingAttackObjects......................................47
AddingObjects(Optional)....................................48
Configuring a Security Policy for IDP . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
ReviewingIDPLogs..........................................53
MaintainingIDP.................................................54
CreatingIDP-OnlyAdministrators..................................54
Simplifying Management ............................................54
UsingDeviceGroups.............................................55
UsingDeviceTemplates..........................................55
UsingConfigurationGroups.......................................55
MergingPolicies................................................56
UsingaNamingConvention.......................................56
Example: Using a Naming Convention for Devices . . . . . . . . . . . . . . . . . 56
Example: Using a Naming Convention for Address Objects . . . . . . . . . . 56
CreatinganInformationBanner........................................57
AddinganInformationBanner.....................................57
ModifyinganInformationBanner..................................60
DeletinganInformationBanner....................................60
Chapter 3 Configuring Role-Based Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Role-Based Administration ...........................................61
Domains.......................................................61
AboutRoles....................................................62
Using Role-Based Administration Effectively . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Enterprise Organizations .........................................63
Geographical Divisions .......................................63
NOCandSOC..............................................64
Administrator Types .........................................64
ServiceProviders................................................65
InternalNetwork............................................65
Managed Security Service Provider (MSSP) . . . . . . . . . . . . . . . . . . . . . . 65
Configuring Role-Based Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
CreatingAdministrators..........................................67
ConfiguringGeneralSettings...................................67
ConfiguringAuthorization.....................................67
RADIUS Authentication and Authorization . . . . . . . . . . . . . . . . . . . . . . . 68
ConfiguringRoles............................................74
CreatingCustomRoles...........................................74
RolesandPermissions...........................................86
Permissions Changes in Release 2008.1 . . . . . . . . . . . . . . . . . . . . . . . . . 86
Permissions Changes in Release 2006.1 . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Permissions Changes in Release 2005.3 . . . . . . . . . . . . . . . . . . . . . . . . . 87
Assigning and Viewing Custom Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Configuring a User Activity in a Custom Role . . . . . . . . . . . . . . . . . . . . . . . . . 88
ViewingLoggedAdministrators....................................89
ixCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Forcing an Administrator to Log Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
CreatingSubdomains............................................90
ViewingCurrentDomainDetail....................................90
Example: Configuring Role-Based Administration . . . . . . . . . . . . . . . . . . . . . . 91
Step1:CreatetheSubdomains.................................91
Step 2: Create the Subdomain Administrator . . . . . . . . . . . . . . . . . . . . . . 91
Step 3: Create the Viewing and Reporting Administrator . . . . . . . . . . . . . 92
Step 4: Verify Administrator Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Part 2 Integrating
Chapter4 Adding Devices ...................................................97
AboutDeviceCreation...............................................98
DetermineDeviceStatus.........................................99
VerifyingDeviceConfiguration....................................100
ManagingtheDevice............................................100
BeforeYouBeginAddingDevices.....................................100
ImportingVersusModeling.......................................101
Importing Device Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
ModelingDeviceConfigurations................................101
DeviceAddProcess.........................................102
SelectingtheDomain...........................................102
AddingSingleorMultipleDevices..................................103
SpecifyingtheOSandVersion....................................104
Determining Port Mode (ScreenOS Devices Only) . . . . . . . . . . . . . . . . . . . . 104
Trust-UntrustPortMode.....................................105
Home-WorkPortMode......................................105
Dual-UntrustPortMode.....................................106
CombinedPortMode........................................106
Trust-Untrust-DMZPortMode................................107
Trust/Untrust/DMZ (Extended) Mode . . . . . . . . . . . . . . . . . . . . . . . . . . 108
DMZ-Dual-UntrustPortMode.................................109
PortModeSummary.........................................110
ChangingthePortMode......................................111
Supported Add Device Workflows by Device Family . . . . . . . . . . . . . . . . . . . . . . . . 111
Importing Devices ..................................................112
Requirements ..................................................113
Adding and Importing Devices with Static IP Addresses . . . . . . . . . . . . . . . . 113
ScreenOSDevices...........................................113
IDPSensors................................................115
Junos Devices ..............................................116
SAandICDevices...........................................117
Adding Devices with Dynamic IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . 118
ScreenOSDevices...........................................118
IDP Sensors ...............................................120
Adding and Importing an Infranet Controller or Secure Access
Device .................................................121
Adding and Importing a Junos Device with a Dynamic IP Address . . . . . 124
Copyright © 2010, Juniper Networks, Inc.x
Network and Security Manager Administration Guide

Verifying Imported Device Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
UsingDeviceMonitor........................................128
UsingDeviceManager.......................................128
UsingJobManager..........................................128
UsingConfigurationSummaries...............................129
ModelingDevices..................................................130
Requirements .................................................130
ModelingaDevice..............................................130
CreatingaDeviceConfiguration....................................131
ActivatingaDevice..............................................132
Devices with Static IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Devices with Dynamic IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Using Rapid Deployment (ScreenOS Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
CreatingtheConfiglet...........................................140
InstallingtheConfiglet..........................................143
PreparingtheDevice........................................143
InstallingtheConfiglet.......................................143
Updating the Device Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
SummarizeDeltaConfiguration...............................145
Example: User Successfully Selects and Updates Two Devices with
DeltaOption ...........................................145
Example: User Selects Two Devices with Delta Option and One Device
Fails ..................................................146
Example: User Selects Two Devices to Update Without the Delta
Option ................................................146
Example: User Selects Two Devices to Update with the Delta Option,
ButHasnoAdminPrivileges...............................146
AddingVsysDevices................................................146
Placing the Root Device in a Global Domain or a Subdomain . . . . . . . . . . . . 147
ImportingVsysDevices..........................................147
ModelingVsysDevices..........................................148
AddingL2VRootSystems........................................150
AddinganExtranetDevice...........................................150
AddingClusters....................................................151
AddingaClusterDeviceObject....................................151
AddingMemberstotheCluster....................................152
AddingScreenOSorIDPClusters..................................152
Adding Secure Access or Infranet Controller Clusters . . . . . . . . . . . . . . . . . . 152
Adding and Importing a Secure Access or Infranet Controller Cluster
through Unreachable Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Adding and Importing a Secure Access or Infranet Controller Cluster
throughReachableWorkflow..............................154
Adding Clusters of Routers Running Junos OS . . . . . . . . . . . . . . . . . . . . . . . . 155
Adding and Importing a Junos Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Adding a Junos Cluster with Modeled Cluster Members . . . . . . . . . . . . . 157
Activating and Updating a Modeled Junos Cluster . . . . . . . . . . . . . . . . . 157
Example: Adding and Importing a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
AddingtheCluster..........................................158
AddingtheClusterMembers..................................159
xiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Importing the Cluster configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Example: Creating, Activating, and Updating a Cluster with Modeled Cluster
Members .................................................160
AddingtheCluster..........................................160
ModelingtheClusterMembers................................161
ActivatingtheClusterMembers................................162
UpdatingtheCluster........................................164
Adding a Vsys Cluster and Vsys Cluster Members . . . . . . . . . . . . . . . . . . . . . 164
Example:AddingaVsysCluster...............................164
Adding Multiple Devices Using Automatic Discovery (Junos, SA, and IC Devices
) ............................................................166
AddingaDeviceDiscoveryRule....................................167
RunningaDeviceDiscoveryRule..................................168
AddingManyDevicesUsingCSVFiles..................................168
CreatingtheCSVFile............................................169
Devices with Static IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Device with Dynamic IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
UndeployedDevices.........................................173
ValidatingtheCSVFile...........................................175
ImportingManyDevices.........................................175
Adding and Importing Many Devices with Static IP Addresses . . . . . . . 176
Adding and Importing Many Devices with Dynamic IP Addresses . . . . . 176
ModelingManyDevices..........................................177
UsingRapidDeployment.........................................177
Modeling and Activating Many Devices with Configlets . . . . . . . . . . . . . 178
Activating Many Devices with Configlets . . . . . . . . . . . . . . . . . . . . . . . . . 179
AddingDeviceGroups...............................................179
Example:CreatingaDeviceGroup.................................180
Setting Up NSM to Work With Infranet Controller and Infranet Enforcer . . . . . . . 181
Avoiding Naming Conflicts of the Authorization Server Object . . . . . . . . . . . 181
Avoiding NACN Password Conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Chapter5 Configuring Devices ..............................................185
AboutDeviceConfiguration..........................................186
About Configuring Device Families . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
About Configuring Clusters, VPNs, Vsys Devices, Policies, and Shared
Objects ...................................................186
Configuration Features ..........................................187
AbouttheDeviceEditor......................................187
AboutDeviceTemplates.....................................187
AboutConfigurationGroups..................................188
Editing Devices Using the Device Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Validation and Data Origination Icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
ConfiguringDeviceFeatures......................................191
Configuring ScreenOS/IDP Device Features . . . . . . . . . . . . . . . . . . . . . . 192
Configuring Secure Access or Infranet Controller Device Features . . . . 194
Configuring Junos Device Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
Updating the Configuration on the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Copyright © 2010, Juniper Networks, Inc.xii
Network and Security Manager Administration Guide

UsingDeviceTemplates.............................................196
ModifyingValuesinTemplates....................................197
Example: Creating and Applying a Device Template for DNS Settings . . . . . 198
CreatingtheTemplate.......................................198
ApplyingtheTemplate.......................................199
TemplatesandImportingDevices.................................200
Promoting a Device Configuration to a Template . . . . . . . . . . . . . . . . . . . . . 200
Changing Values Inherited from Templates . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Reverting a Configuration to Default Values of a Template . . . . . . . . . . . . . 202
TemplatesandValidation........................................202
ApplyingMultipleTemplates.....................................202
Example: Using Multiple Device Templates . . . . . . . . . . . . . . . . . . . . . . 203
TemplateLimitations...........................................207
Maximumof63Templates...................................207
DeviceGroups.............................................208
DefaultValues.............................................208
PredefinedDeviceData......................................208
ListKeyFields.............................................208
Specifying the Order of List Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Combining Template Data with Device Object Data . . . . . . . . . . . . . . . 210
Operations That Change the Sequence of Ordered Lists . . . . . . . . . . . . 210
RulesforReorderingLists.....................................211
ExamplesofReorderedLists...................................211
Identifying Ordered List Entries That Do Not Match the Template or
ConfigurationGroupOrder................................214
Using the Template Operations Directive . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
SelectOSNameSection.....................................216
SelectDevicesSection.......................................216
SelectTemplateSection.....................................216
TemplateOperationSection..................................217
Options Section ............................................217
Template Operations Box Recommended Workflow . . . . . . . . . . . . . . . 218
Removing Templates with the Template Operations Directive . . . . . . . 219
Exporting and Importing Device Templates . . . . . . . . . . . . . . . . . . . . . . . . . . 220
ExportingaDeviceTemplate.................................220
ImportingaDeviceTemplate.................................220
UsingConfigurationGroups..........................................221
Creating and Editing Configuration Groups . . . . . . . . . . . . . . . . . . . . . . . . . . 222
CreatingaConfigurationGroup................................222
EditingaConfigurationGroup.................................223
Validating a Configuration Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Ordered Lists and Wildcard Matching . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
ApplyingaConfigurationGroup...................................224
ExcludingaConfigurationGroup..................................225
Editing a Device Object That Uses Configuration Groups . . . . . . . . . . . . . . . 226
DeletingaConfigurationGroup....................................227
Adding Ordered List Entries Using Configuration Groups . . . . . . . . . . . . . . . 227
ReorderingLists................................................227
xiiiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Using Configuration Groups with Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Sharing Configuration Group Definitions Across Multiple Devices . . . . . . . . 228
ConfiguringClusters................................................232
Configuring Cluster Objects Directly by Editing the Configuration . . . . . . . . 232
Configuring Cluster Objects Using Templates . . . . . . . . . . . . . . . . . . . . . . . . 232
Configuring Global Cluster Data with Configuration Groups (Junos Clusters
Only).....................................................233
Configuring Member-Level Data in a Junos Cluster . . . . . . . . . . . . . . . . . . . . 233
Configuring Junos Devices with Redundant Routing Engines . . . . . . . . . . . . . . . 234
ConfiguringaRoutingEngine.....................................234
Viewing a Routing Engine Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
OverviewofVRRPSupportinNSM....................................236
Platforms on Which NSM Supports VRRP . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Activating VRRP on a Device Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
DefiningaVSIasaVRRPinterface.................................237
ManagingConfigurationFiles.........................................237
Viewing and Comparing Configuration File Versions . . . . . . . . . . . . . . . . . . . 238
Updating the Device with a Configuration File Version . . . . . . . . . . . . . . . . . 238
Importing or Viewing the Current Version of the Configuration File . . . . . . . 238
Automatic Import of Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
Chapter6 UpdatingDevices................................................239
AboutUpdating...................................................239
HowtheUpdateProcessWorks..................................240
About Atomic Configuration—ScreenOS Devices . . . . . . . . . . . . . . . . . . . . . 241
About Atomic Updating—ScreenOS Devices . . . . . . . . . . . . . . . . . . . . . . . . 242
About Atomic Configuration and Atomic Update—DMI-Compatible
Devices...................................................243
About Implicit Updates (Secure Access and Infranet Controller Devices
Only) ....................................................244
KnowingWhentoUpdate...........................................244
Verifying Device Status in Device Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
ConnectionStatus..........................................245
ConfigurationStatus........................................245
Verifying Device Status in Device Manager . . . . . . . . . . . . . . . . . . . . . . . . . . 247
ReviewingLogs................................................247
Identifying Administrative Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
ReviewingReports.............................................248
UsingPreviewTools................................................248
RunningaConfigurationSummary................................249
Using a Delta Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
PerforminganUpdate..............................................252
RetryingaFailedUpdate.........................................253
ConfiguringUpdateOptions......................................253
UpdateOptionsforScreenOS.................................253
Update Options for DMI-Compatible Devices . . . . . . . . . . . . . . . . . . . . 254
TrackingDeviceUpdates............................................254
ReviewingJobInformation.......................................256
DeviceStatesDuringUpdate.....................................257
Copyright © 2010, Juniper Networks, Inc.xiv
Network and Security Manager Administration Guide

UnderstandingUpdatingErrors...................................258
Chapter7 ManagingDevices................................................261
ManagingDeviceSoftwareVersions...................................262
Upgrading the Device Software Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Upgrading a Device Software Version from NSM . . . . . . . . . . . . . . . . . . 264
Upgrading a Device Software Version outside NSM . . . . . . . . . . . . . . . 264
AdjustingtheDeviceOSVersion..................................265
Downgrading the Device OS Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Rolling back the Device OS Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
DeletingtheDeviceOSVersion...................................266
UpgradingDeviceSupport.......................................266
Managing License Keys (ScreenOS Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Installing License Keys on a Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Importing License Key Information into NSM . . . . . . . . . . . . . . . . . . . . . . . . 267
InstallingTrialLicenseKeys......................................267
Viewing and Reconciling Device Inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
ViewingtheDeviceInventory.....................................268
Comparing and Reconciling Device Inventory . . . . . . . . . . . . . . . . . . . . . . . . 269
Managing Large Binary Data Files (Secure Access and Infranet Controller Devices
Only).........................................................271
Uploading and Linking Large Binary Data Files . . . . . . . . . . . . . . . . . . . . . . . 272
ImportingCustomSign-InPages..................................274
CreatingaCustomSign-InPage...............................275
Linking to a Custom Sign-In Page Shared Object . . . . . . . . . . . . . . . . . . 275
Importing Antivirus Live Update Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
UploadingLiveUpdateSettings...............................275
.........................................................275
Linking to a Live Update File Shared Object . . . . . . . . . . . . . . . . . . . . . . 276
Importing Endpoint Security Assessment Plug-in (ESAP) Packages . . . . . . 276
UploadingESAPPackages...................................276
Linking to an ESAP Package Shared Object . . . . . . . . . . . . . . . . . . . . . . 277
Importing Third-Party Host Checker Policies . . . . . . . . . . . . . . . . . . . . . . . . . 277
Uploading a Third-Party Host Checker Policy . . . . . . . . . . . . . . . . . . . . . 277
Linking to a Third-Party Host Checker Policy Shared Object . . . . . . . . . 278
Importing a Secure Virtual Workspace Wallpaper Image (Secure Access
DevicesOnly)..............................................278
Uploading a Secure Virtual Workspace Wallpaper Image . . . . . . . . . . . 278
Linking to a Secure Virtual Workspace Wallpaper Image Shared
Object ................................................278
Importing Hosted Java Applets (Secure Access Devices Only) . . . . . . . . . . 279
UploadingaJavaApplet.....................................279
Linking to a Hosted Java Applet Shared Object . . . . . . . . . . . . . . . . . . . 279
Importing a Custom Citrix Client .cab File (Secure Access Devices Only) . . 280
Uploading a Custom Citrix Client .cab File . . . . . . . . . . . . . . . . . . . . . . . 280
Linking to a Custom Citrix .cab File Shared Object . . . . . . . . . . . . . . . . 280
Backing up and Restoring SA and IC Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
BackingupanSAorICDevice.....................................281
RestoringSAorICDevices........................................281
xvCopyright © 2010, Juniper Networks, Inc.
Table of Contents

Backing up multiple SA or IC Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
Configuring Preferences for Backing up and Restoring SA or IC Devices . . . . 281
Viewing Backed up Versions for an SA or IC Device . . . . . . . . . . . . . . . . . . . . 282
Setting the RMA State on an SA/IC Device . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Activating an SA/IC Device Set to the RMA State . . . . . . . . . . . . . . . . . . . . . 283
Performing a Full Restore of an SA or IC Device . . . . . . . . . . . . . . . . . . . . . . 284
Managing User Sessions for SA and IC Devices . . . . . . . . . . . . . . . . . . . . . . . . . . 284
ActivatingSubscriptionServices......................................285
Managing the Attack Object Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Updating the Attack Object Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Updating Attack Objects for IDP-Enabled devices . . . . . . . . . . . . . . . . 286
Updating DI Attacks on ScreenOS 5.0 Devices . . . . . . . . . . . . . . . . . . . 288
UsingUpdatedAttackObjects................................289
Verifying the Attack Object Database Version . . . . . . . . . . . . . . . . . . . . . . . 289
Automatic Verification ......................................289
ManualVerification.........................................290
Managing Different Attack Database Versions . . . . . . . . . . . . . . . . . . . 290
Example: Updating Devices with Different Attack Object Database
Versions ...............................................291
UpdatingtheIDPDetectorEngine.................................291
Example: Confirm IDP Engine Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
SchedulingSecurityUpdates.....................................292
Example: Update Attack Objects and Push to Connected Devices . . . 294
SchedulingtheUpdate......................................294
Example: Using Crontab to Schedule Attack Updates . . . . . . . . . . . . . 295
Viewing Scheduled Security Updates in the Job Manager . . . . . . . . . . . 296
Viewing Scheduled Security Updates in the Audit Log Viewer . . . . . . . 296
UpdatingAVPatternFiles...........................................296
UpdatingtheWebCategoryList......................................296
MiscellaneousDeviceOperations.....................................297
LaunchingaWebUIforaDevice..................................298
LaunchingaTelnetCLIWindow...................................298
RebootingDevices.............................................298
RefreshingDNSEntries.........................................299
Updating the Device Clock with an NTP Server . . . . . . . . . . . . . . . . . . . . . . 299
Setting the Root Administrator on a Device . . . . . . . . . . . . . . . . . . . . . . . . . 300
Failing Over or Reverting Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
SettingtheRMAStateonaDevice.................................301
Upgrading the OS Version During an RMA-Activate Device Workflow . . . . . 302
Troubleshooting a BGP Peer Session on a Device . . . . . . . . . . . . . . . . . . . . . 302
Reactivating Wireless Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
FindingUsages................................................303
Managing ScreenOS Device Capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
AbstractDataModel...........................................304
DataModel...................................................304
DataModelSchema........................................304
DataModelUpdating.......................................305
DataModelImporting.......................................307
Copyright © 2010, Juniper Networks, Inc.xvi
Network and Security Manager Administration Guide

ArchivingandRestoring.............................................309
Archiving Logs and Configuration Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Restoring Logs and Configuration Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
Managing Device Schemas Through the Juniper Update Mechanism . . . . . . . . . 310
Downloading Schemas ..........................................311
Downloading Schemas Using the NSM UI . . . . . . . . . . . . . . . . . . . . . . . . 312
Downloading Schemas Using the GUI Server CLI . . . . . . . . . . . . . . . . . . 312
ApplyingaSchema.............................................313
Part 3 Managing
Chapter8 ConfiguringObjects...............................................317
AboutObjects.....................................................318
UsingObjectsAcrossDomains...................................320
ReplacingObjects..............................................320
Working with Unused Shared Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Searching for Unused Shared Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Deleting an Unused Shared Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
WorkingwithObjectVersions.....................................321
Searching For and Deleting Duplicate Objects . . . . . . . . . . . . . . . . . . . . . . . 322
ConfiguringAddressObjects.........................................322
ViewingAddressObjects........................................323
CreatingAddressObjects........................................323
AddingaHostAddressObject................................324
Adding a Network Address Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324
Editing and Deleting Address Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
ReplacingAddressObjects...................................325
AddinganAddressObjectGroup..............................325
Adding a Multicast Group Address Object . . . . . . . . . . . . . . . . . . . . . . . 326
Adding Static DNS Host Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
BlockedHosts.................................................328
ConfiguringApplicationObjects......................................328
Viewing Predefined Application Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
Creating Custom Application Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
Editing and Deleting Application Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
ConfiguringScheduleObjects........................................330
CreatingScheduleObjects.......................................330
ConfiguringAccessProfileObjects....................................330
Configuring Quality of Service Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Creating a Quality of Service Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Deleting a Quality of Service Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
Editing a Quality of Service Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
WorkingwithDIAttackObjects.......................................333
Viewing Predefined DI Attack Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
Viewing Attack Version Information for Attack Objects . . . . . . . . . . . . . . . . 333
Viewing Predefined DI Attack Object Groups . . . . . . . . . . . . . . . . . . . . . . . . 334
Updating Predefined DI Attack Objects and Groups . . . . . . . . . . . . . . . . . . . 334
CreatingDIProfiles.............................................334
xviiCopyright © 2010, Juniper Networks, Inc.
Table of Contents

WorkingwithIDPAttackObjects.....................................336
ViewingPredefinedIDPAttacks...................................337
Viewing Predefined IDP Attack Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Viewing Attack Version Information for Attack Objects and Groups . . . . . . 338
Updating Predefined IDP Attack Objects and Groups . . . . . . . . . . . . . . . . . 338
Configuring Custom DI and IDP Attack Objects . . . . . . . . . . . . . . . . . . . . . . . . . . 338
UsingtheAttackObjectWizard...................................339
Copying and Editing Predefined Attack Objects to Create Custom Attack
Objects...................................................339
Configuring Attack Name and Description . . . . . . . . . . . . . . . . . . . . . . . . . . 340
Configuring Extended Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
ConfiguringExternalReferences...................................341
ConfiguringTargetPlatforms.....................................342
Creating a Signature Attack Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
Configuring General Attack Properties . . . . . . . . . . . . . . . . . . . . . . . . . . 343
Configuring Attack Detection Properties . . . . . . . . . . . . . . . . . . . . . . . . 347
Configuring Header Match Properties . . . . . . . . . . . . . . . . . . . . . . . . . . 350
Configuring a Protocol Anomaly Attack Object . . . . . . . . . . . . . . . . . . . . . . . 353
Configuring a Compound Attack Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
Configuring General Attack Properties . . . . . . . . . . . . . . . . . . . . . . . . . . 354
Configuring Compound Attack Members . . . . . . . . . . . . . . . . . . . . . . . . 355
ConfiguringtheDirectionFilter....................................357
CreatingCustomDIAttackGroups....................................357
CreatingCustomIDPAttackGroups...................................357
CreatingStaticAttackGroups....................................358
Creating Dynamic Attack Groups (IDP Only) . . . . . . . . . . . . . . . . . . . . . . . . . 358
UpdatingDynamicGroups.......................................361
EditingaCustomAttackGroup...................................362
DeletingaCustomAttackGroup..................................362
UnifiedThreatManagement.........................................362
CreatingUTMProfiles...........................................362
CreatinganAntivirusProfile......................................363
CreatinganAntispamProfile.....................................364
Creating a Content Filtering Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
CreatingaURLFilteringProfile....................................365
MiscellaneousUTMFeatures.....................................366
Multipurpose Internet Mail Extension (MIME) Lists . . . . . . . . . . . . . . . . 366
ExtensionLists.............................................367
CommandLists............................................367
URLPatterns..............................................367
URLCategories............................................368
ScreenOS Threat Management Features . . . . . . . . . . . . . . . . . . . . . . . . . . . 368
ConfiguringAntivirusObjects.................................368
Configuring External AV Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
Configuring Internal AV Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Configuring ICAP AV Servers and Profiles . . . . . . . . . . . . . . . . . . . . . . . . 371
ConfiguringICAPAVProfiles..................................372
Configuring Web Filtering Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
Copyright © 2010, Juniper Networks, Inc.xviii
Network and Security Manager Administration Guide

ConfiguringCustomPolicyFields.....................................374
DefiningMetadata..............................................375
InstantiatingNewObjects....................................375
Adding Custom Detail Object to Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
OpenLogViewer...........................................376
ConfiguringGTPObjects............................................376
ConfiguringInfo................................................376
LimitingGTPMessageLength.................................376
LimitingGTPMessageRate...................................377
LimitingGTPTunnels........................................377
RemovingInactiveGTPTunnels...............................377
ValidatingSequenceNumbers................................377
FilteringGTP-in-GTPPackets.................................378
Removing GTP R6 Informational Elements . . . . . . . . . . . . . . . . . . . . . . 378
InspectingTunnelEndpointIDs................................378
Configuring Traffic Logging and Counting . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
TrafficCounting............................................378
TrafficLogging.............................................378
Configuring IMSI Prefix and APN Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
CreatinganAPNFilter.......................................379
CreatinganIMSIPrefixFilter..................................380
Configuring GTP Message Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
Configuring Subscriber Tracing (Lawful Interception) . . . . . . . . . . . . . . . . . . 381
Example:CreatingaGTPObject...............................381
ConfiguringServiceObjects..........................................382
ViewingPredefinedServices.....................................382
CreatingCustomServices.......................................384
ServiceObjectGroups..........................................385
Example: Creating a Custom Service and Group . . . . . . . . . . . . . . . . . . 386
Example: Creating a Custom Sun-RPC Service . . . . . . . . . . . . . . . . . . . 387
Example: Creating a Custom MS-RPC Service . . . . . . . . . . . . . . . . . . . 388
Editing and Deleting Service Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
ReplacingServiceObjects.......................................389
ConfiguringSCTPObjects...........................................390
ConfiguringanSCTPObject.....................................390
Configuring Authentication Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
Configuring General Authentication Server Settings . . . . . . . . . . . . . . . . . . . 391
Configuring Authentication Server Redundancy . . . . . . . . . . . . . . . . . . . . . . 391
Configuring Authentication for User Types . . . . . . . . . . . . . . . . . . . . . . . . . . 392
DomainNameChecking.....................................392
DomainNameStripping.....................................392
Configuring Authentication Server Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
Configuring a RADIUS Authentication Server . . . . . . . . . . . . . . . . . . . . . 393
Configuring a SecurID Authentication Server . . . . . . . . . . . . . . . . . . . . . 396
Configuring an LDAP Authentication Server . . . . . . . . . . . . . . . . . . . . . 398
Configuring a TACACS Authentication Server . . . . . . . . . . . . . . . . . . . . 398
ConfiguringUserObjects............................................399
ConfiguringLocalUsers.........................................399
ConfiguringLocalUserGroups...................................400
xixCopyright © 2010, Juniper Networks, Inc.
Table of Contents

ConfiguringExternalUsers......................................400
ConfiguringExternalUserGroups.................................400
ConfiguringVLANObjects...........................................403
ConfiguringIPPools...............................................403
UsingMultipleIPRanges........................................404
ConfiguringGroupExpressions.......................................404
ConfiguringRemoteSettings........................................407
Configuring Routing Instance Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
ViewingRoutingInstanceObjects.................................408
Creating Routing Instance Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
ConfiguringNATObjects............................................409
ConfiguringLegacyNATObjects..................................409
ConfiguringDIPObjects......................................410
ConfiguringMIPObjects.....................................410
ConfiguringVIPObjects......................................410
ConfiguringJunosOSNATObjects.................................411
ConfiguringSourceNATObjects...............................411
Configuring Destination NAT Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
ConfiguringCertificateAuthorities.....................................416
UsingCertificateAuthorities......................................417
Configuring Certificate Authorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417
ConfiguringCRLObjects............................................418
UsingCRLs....................................................418
ConfiguringCRLs...............................................419
ConfiguringExtranetPolicies.........................................419
ConfiguringBinaryDataObjects......................................420
AddingBinaryDataObjects......................................420
Viewing, Editing, and Deleting Binary Data Objects . . . . . . . . . . . . . . . . . . . . 421
ConfiguringProtectedResources......................................421
CreatingProtectedResources....................................422
EditingProtectedResources......................................422
ConfiguringIKEProposals...........................................422
Creating Custom IKE Phase1 Proposals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
Creating Custom IKE Phase 2 Proposals . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424
ConfiguringDial-inObjects..........................................425
CreatingaDial-InProfile.........................................425
Linking the Dial-In Profile with the Device . . . . . . . . . . . . . . . . . . . . . . . . . . . 426
Setting the Time-out Period for the Modem Dial-In Authentication . . . . . . 426
Configuring Border Signaling Gateway Objects . . . . . . . . . . . . . . . . . . . . . . . . . . 426
Chapter 9 Configuring Security Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429
AboutSecurityPolicies.............................................430
Viewing Rulebase Columns for a Security Policy . . . . . . . . . . . . . . . . . . . . . 430
Viewing and Editing Custom Policy Fields . . . . . . . . . . . . . . . . . . . . . . . . 431
AboutRulebases...............................................432
RuleExecutionSequence....................................433
About Rules ..................................................434
Copyright © 2010, Juniper Networks, Inc.xx
Network and Security Manager Administration Guide