Description

This article provides information on how to configure an IDP rule and policy to scan or detect attacks for the traffic that passes through an LSYS (Logical System).

Symptoms

How to configure an IDP rule and policy to scan or detect attacks for the traffic that passes through an LSYS (Logical System).

Solution


For example:

Topology :

192.168.1.0/24 ----------- (ge-0/0/1) [SRX] (ge-0/0/0) ------- 172.27.1.0/16.
Both of the interfaces are part of the LSYS logical system.

The relevant configuration is as follows:

Address-Book configuration on the Root-Logical-System : 
set security address-book address-book-1 address src-dup 172.27.0.0/16
set security address-book address-book-1 address dest1-dup 192.168.1.0/24

Note : An address-book has been created in the global security hierarchy, so as to refer it in the IDP rule. The subnets are the same as those under the logical system's security zone address-book


IDP Configuration : 
set security idp idp-policy test-policy rulebase-ips rule r1 match source-address src-dup
set security idp idp-policy test-policy rulebase-ips rule r1 match destination-address dest1-dup
set security idp idp-policy test-policy rulebase-ips rule r1 match application default
set security idp idp-policy test-policy rulebase-ips rule r1 match attacks custom-attacks myattack
set security idp idp-policy test-policy rulebase-ips rule r1 then action drop-connection
set security idp idp-policy test-policy rulebase-ips rule r1 then notification log-attacks
set security idp active-policy test-policy
set security idp custom-attack myattack severity major
set security idp custom-attack myattack attack-type signature context ftp-get-filename
set security idp custom-attack myattack attack-type signature pattern ".*\.\[exe\]"
set security idp custom-attack myattack attack-type signature direction client-to-server
For more information, refer to KB16561 - SRX Getting Started - Configure and Troubleshoot IDP on SRX [juniper.net] .

Logical System :

Security Policy : 
set logical-systems LSYS security policies from-zone trust to-zone untrust policy LSYS-idp-test-policy match source-address src
set logical-systems LSYS security policies from-zone trust to-zone untrust policy LSYS-idp-test-policy match destination-address dest
set logical-systems LSYS security policies from-zone trust to-zone untrust policy LSYS-idp-test-policy match application any
set logical-systems LSYS security policies from-zone trust to-zone untrust policy LSYS-idp-test-policy then permit application-services idp
Security Profile : 
set system security-profile lsys-security-profile idp-policy test-policy <  This statement is required to enable IDP-policy in the logical system .

Address Books (LSYS) : 
set logical-systems LSYS security zones security-zone trust address-book address src 172.27.0.0/16
set logical-systems LSYS security zones security-zone untrust address-book address dest 192.168.1.0/24
For the complete configuration of the logical system, refer to the Junos® OS Logical Systems Configuration Guide for Security Devices, Release 11.2 .



Verification :

To verify, you can run the following command: 
root@3600-1> show security idp attack table
IDP attack statistics:

Attack name #Hits
myattack 2 
root@3600-1> request pfe execute command "show usp idp lsys map" target tnp tnp-name fpc8.pic0< Here, FPC8 is a SPC.
SENT: Ukern command: show usp idp lsys map
GOT:
GOT: lsys_id    lsys_name                        policy_id  policy_name
GOT: --------------------------------------------------------------------
GOT: 0          root-logical-system              41925      test-policy
GOT: 2          LSYS                             41925      test-policy
GOT:
GOT:
Local: End Of file