Juniper Networks IDP250 manual

IDP Series Intrusion Detection and Prevention Appliances IDP250 Installation Guide Release 5.0 Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, California 94089 USA 408-745-2000 www.juniper.net Part Number: 530-029729-01, Revision 01[...]

This product includes the Envoy SNMP Engine, developed by Epilogue Technology, an Integrated Systems Company. Copyright © 1986-1997, Epilogue Technology Corporation. All rights reserved. This program and its documentation were developed at private expense, and no part of them is in the public domain. This product includes memory allocation softwar[...]

END USER LICENSE AGREEMENT READ THIS END USER LICENSE AGREEMENT ( “ AGREEMENT ” ) BEFORE DOWNLOADING, INSTALLING, OR USING THE SOFTWARE. BY DOWNLOADING, INSTALLING, OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS CONTAINED HEREIN, YOU (AS CUSTOMER OR IF YOU ARE NOT THE CUSTOMER, AS A REPRESENTATIVE/AGENT AUTHORIZED TO [...]

6. Confidentiality. The Parties agree that aspects of the Software and associated documentation are the confidential property of Juniper. As such, Customer shall exercise all reasonable commercial efforts to maintain the Software and associated documentation in confidence, which at a minimum includes restricting access to the Software to Customer e[...]

agreements relating to the Software, whether oral or written (including any inconsistent terms contained in a purchase order), except that the terms of a separate written agreement executed by an authorized Juniper representative and Customer shall govern to the extent such terms are inconsistent or conflict with terms contained herein. No modifica[...]

vi ■[...]

Table of Contents Preface xi Objectives ......................................................................................................xi Audience ........................................................................................................xi Documentation Conventions ...............................................................[...]

Part 2 Performing the Installation Chapter 3 Installation Overview 21 Before You Begin ...........................................................................................21 Basic Steps ....................................................................................................22 Chapter 4 Installing the Appliance to Your Equipment R[...]

Part 4 Upgrading Software and Installing Field Replaceable Units Chapter 8 Upgrading Software 49 Updating Software (NSM Procedure) .............................................................49 Upgrading Software (CLI Procedure) ..............................................................51 Chapter 9 Installing Field Replaceable Units 53 Replaci[...]

x ■ Table of Contents IDP250 Installation Guide[...]

Preface This preface includes the following topics: ■ Objectives on page xi ■ Audience on page xi ■ Documentation Conventions on page xi ■ Related Documentation on page xiii ■ Requesting Technical Support on page xiv Objectives This guide explains how to install, configure, update, and service an IDP Series Intrusion Detection and Prevent[...]

Table 2 on page xii defines text conventions used in this guide. Table 2: Text Conventions Examples Description Convention ■ Issue the clock source command. ■ Specify the keyword exp-msg . ■ Click User Objects ■ Represents commands and keywords in text. ■ Represents keywords ■ Represents UI elements Bold typeface like this user input Re[...]

Related Documentation Table 4 on page xiii lists related IDP documentation. Table 4: Related IDP Documentation Description Document Contains information about what is included in a specific product release: supported features, unsupported features, changed features, known problems, and resolved problems. If the information in the release notes diff[...]

Table 5: Related NSM Documentation (continued) Description Document Describes how to configure and manage IDP devices using NSM. This guide also helps in understanding of how to configure basic and advanced NSM functionality, including adding new devices, deploying new device configurations, updating device firmware, viewing log information, and mo[...]

■ Find solutions and answer questions using our Knowledge Base: http://kb.juniper.net/ ■ Download the latest versions of software and review release notes: http://www.juniper.net/customers/csc/software/ ■ Search technical bulletins for relevant hardware and software notifications: https://www.juniper.net/alerts/ ■ Join and participate in th[...]

xvi ■ Requesting Technical Support IDP250 Installation Guide[...]

Part 1 Hardware and Software Overview ■ Hardware Overview on page 3 ■ Software Overview on page 15 Hardware and Software Overview ■ 1[...]

2 ■ Hardware and Software Overview IDP250 Installation Guide[...]

Chapter 1 Hardware Overview This chapter includes the following topics: ■ IDP250 Overview on page 3 ■ Power Supply on page 4 ■ Hard Drive on page 4 ■ Fans on page 4 ■ System Status LEDs on page 4 ■ USB Port on page 5 ■ Serial Console Port on page 5 ■ Management Interface Port on page 5 ■ High Availability Interface Port on page 6 [...]

■ Traffic Interface Ports on page 7 ■ IDP250 Technical Specifications on page 59 Power Supply The appliance has one power supply. It is a field replaceable unit (FRU). Related Topics ■ Replacing a Power Supply on page 53 Hard Drive The appliance has one 80 GB hard drive. It is not a field replaceable unit (FRU). Fans When the system is cool, [...]

USB Port The appliance has a USB port you can use to reimage the appliance, if necessary. Serial Console Port The console serial port provides access, using an RJ-45 connector, to the command-line interface (CLI). NOTE: Although both the console serial port and the management port use RJ-45 connectors, do not plug the network cable into the console[...]

Table 7: Management Port LEDs (continued) Description State LED Connection is 1000 Mbps. Orange TX/RX Connection is 100 Mbps. Green If LINK indicates activity, TX/RX off indicates connection is 10 Mbps. If LINK indicates no activity, TX/RX off indicates no activity as well. Off High Availability Interface Port The high availability interface port i[...]

Table 8: High Availability Port LEDs (continued) Description State LED Connection is 1000 Mbps. Orange TX/RX Connection is 100 Mbps. Green If LINK indicates activity, TX/RX off indicates connection is 10 Mbps. If LINK indicates no activity, TX/RX off indicates no activity as well. Off Traffic Interface Ports You use the traffic interface ports to c[...]

Table 9: Copper Port LEDs Description State LED Link is present. Glows green LINK ACT Activity. Blinks green No link present. Off Connection is 100 Mbps. Green LINK SPD Connection is 1 Gbps. Yellow If LINK ACT is on, the connection is 10 Mbps. If LINK ACT is off, LINK SPD off indicates no link is present as well. Off Interface is not in bypass mode[...]

Table 10: Fiber Port LEDs Description State LED Link is present. Glows green LINK ACT Activity. Flashes green No link present. Off Connection is 100 Mbps. Green LINK SPD Connection is 1 Gbps. Yellow Connection is 10 Gbps. Orange If LINK ACT is on, the connection is 10 Mbps. If LINK ACT is off, LINK SPD off indicates no link is present as well. Off [...]

Deployment Mode For each virtual router, you select the deployment mode: ■ Sniffer – In an out-of-path, sniffer mode deployment, the IDP appliance can detect attacks but can take only limited action. You connect the IDP traffic interfaces to a mirrored port of a network hub or switch. ■ Transparent – In an in-path, transparent mode deployme[...]

Figure 6: Internal Bypass When the IDP operating system resumes healthy operations, it sends a reset signal to the traffic interfaces, and the interfaces resume normal operation. NOTE: All copper port traffic interfaces support internal bypass. Some, but not all, fiber port traffic interfaces support internal bypass. Check with your sales contact f[...]

External Bypass The External Bypass setting supports third-party external bypass units. When the IDP appliance is turned on and available, it sends NetScreen Redundancy Protocol (NSRP) heartbeats to the external bypass unit. When the NSRP packets flow, the external bypass unit allows connections to proceed through the IDP appliance. If IDP encounte[...]

When PPM is enabled, a PPM daemon monitors the health of IDP traffic interfaces belonging to the same virtual router. If a traffic interface loses link, the PPM process turns off any associated network interfaces in the same virtual router so that other network devices detect that the virtual router is down and route around it. For example, assume [...]

■ If you enable Layer 2 bypass, the interfaces pass through IPv6, internetwork packet exchange (IPX), Cisco Discovery Protocol (CDP), and interior gateway routing protocol (IGRP). ■ If you enable internal bypass, the interfaces do not pass through NetScreen Redundancy Protocol (NSRP) packets even if Layer 2 bypass is enabled. ■ If you enable [...]

Chapter 2 Software Overview This chapter includes the following topics: ■ On-Box Software Overview on page 15 ■ Centralized Management with NSM Overview on page 16 ■ J-Security Center Updates Overview on page 17 On-Box Software Overview You use on-box software to get the appliance up and running in the desired deployment mode, to configure ap[...]

Table 11: IDP On-Box Utilities (continued) Usage Software You can use the idp.sh utility to start, stop, or get status information on appliance processes. For details, see the IDP Administration Guide . idp.sh utility You can use the sctop utility to monitor connection tables and view status. For details, see the IDP Administration Guide . sctop ut[...]

For IDP deployments, centralized management provides the following benefits: ■ Centralized management for IDP appliances and other network devices ■ Consolidated logs from different devices in a single repository ■ Centralized management of enterprise security policies ■ Simplified management for attack signature updates ■ Role-based admi[...]

18 ■ J-Security Center Updates Overview IDP250 Installation Guide[...]

Part 2 Performing the Installation ■ Installation Overview on page 21 ■ Installing the Appliance to Your Equipment Rack and Connecting Power on page 23 ■ Performing the Initial Network Configuration and Licensing Tasks on page 27 ■ Connecting the IDP Traffic Interfaces to Your Network and Verifying Traffic Flow on page 35 Performing the Ins[...]

20 ■ Performing the Installation IDP250 Installation Guide[...]

Chapter 3 Installation Overview This chapter includes the following topics: ■ Before You Begin on page 21 ■ Basic Steps on page 22 Before You Begin The location of the device, the layout of the mounting equipment, and the security of your wiring room are crucial for proper system operation. CAUTION: To prevent abuse and intrusion by unauthorize[...]

Related Topics ■ Common Criteria EAL2 Compliance on page 63 Basic Steps Take the following basic steps to install the appliance and connect it to your network: 1. Read the release notes for your release. Release notes make you aware of supported and unsupported features, known issues, and fixed issues. Go to http://www.juniper.net/techpubs/softwa[...]

Chapter 4 Installing the Appliance to Your Equipment Rack and Connecting Power This chapter includes the following topics: ■ Rack Mounting Kits and Required Tools on page 23 ■ Mounting to Midmount Brackets on page 24 ■ Mounting to Rack Rails on page 25 ■ Connecting Power on page 25 Rack Mounting Kits and Required Tools Table 12 on page 23 d[...]

Mounting to Midmount Brackets To mount the appliance using the midmount brackets: 1. Attach one rack-mounting bracket to each side of the chassis with the bracket screws. Figure 10: 1-RU Midmount Bracket 2. With another person, place the chassis into position between rack posts in the equipment rack and align the rack-mounting bracket holes with th[...]

Related Topics ■ Rack Mounting Kits and Required Tools on page 23 Mounting to Rack Rails To mount the device to equipment rack rails: 1. Attach the rails to each side of the chassis with the bracket screws. Make sure the hinged brackets are at the back of the device. Make sure the rails are positioned so they reach the back of the rack when the d[...]

2. Connect the other end of the power cable to the electrical outlet. 26 ■ Connecting Power IDP250 Installation Guide[...]

Chapter 5 Performing the Initial Network Configuration and Licensing Tasks This chapter includes the following topics: ■ Performing the Initial Configuration on page 27 ■ Getting Started with the EasyConfig Wizard (Serial Console Port) on page 29 ■ Getting Started with the QuickStart Wizard (Management Port) on page 30 ■ Getting Started wit[...]

Table 13: Getting Started Configuration Tools Defaults Applied: You Specify: Getting Started Tool ■ Root password: abc123 ■ Fully qualified domain name: Blank ■ RADIUS support: Disabled ■ Network interfaces: Auto-negotiate speed/duplex ■ Virtual routers: ■ Sniffer mode: One virtual router (vr0) ■ Transparent mode: One virtual router f[...]

Getting Started with the EasyConfig Wizard (Serial Console Port) We recommend you get started by running the EasyConfig wizard to assign an IP address to the management interface. Then, you can access the ACM Wizard from a remote location to complete the appliance configuration. To perform the initial configuration with the EasyConfig wizard: 1. Co[...]

Mask: 255.255.255.0 What IP address do you want to configure for the management interface? [192.168.1.1] 7. Type an IP address and press Enter. The following text appears: What netmask do you want to configure for the management interface? [255.255.255.0] 8. Type your netmask and press Enter . The system configures your interfaces. The following te[...]

To get started with the QuickStart wizard: 1. Connect one end of an Ethernet cable to the management interface port and the other end to the Ethernet port of your laptop. 2. On your laptop, open a Web browser. 3. In the browser Address or Location box, enter https://192.168.1.1 . NOTE: ACM access uses SSL, so you must type https:// and not http:// [...]

6. Type the default user name (root) and password (abc123). 7. Click ACM to start the ACM wizard. Complete the wizard steps as described in the online Help. Related Topics ■ Performing the Initial Configuration on page 27 Installing the Product License Key IDP 4.1 and later releases require you to install a permanent license key. To install the p[...]

[root@localhost ~] scio lic add lic.txt 9. Run the following scio command to verify you have successfully added the license key: [root@localhost ~] scio lic list [root@localhost ~]# scio lic list ID Machine ID Issue Date Expiration OK Feature -- ---------------- ------------------------ ------------------------ ------- ------------------- 1 Upgrade[...]

34 ■ Installing the Product License Key IDP250 Installation Guide[...]

Chapter 6 Connecting the IDP Traffic Interfaces to Your Network and Verifying Traffic Flow This chapter includes the following topics: ■ Guidelines for Connecting IDP Interfaces to Your Network Devices on page 35 ■ Choosing Cables for Traffic Interfaces (Copper Ports) on page 36 ■ Connecting and Disconnecting Fiber Cables on page 37 ■ Verif[...]

Table 14: Interface Connection Guidelines (continued) Cable Connection Guidelines Port Sniffer Mode – Copper Ports 1. Connect one end of a CAT-5 straight-through cable to a traffic interface port located at the front of the chassis. 2. Connect the other end to the Switched Port Analyzer (SPAN) port of a switch or a hub. Traffic interface ports Tr[...]

NOTE: IDP75, IDP250, IDP800, and IDP8200 support auto-MDIX. Connecting Devices That Do Not Support Auto-MDIX For connections to a firewall or server, use a crossover cable. For connections to a switch or hub, use a straight-through cable. NOTE: Conventionally, crossover cables have an orange outer jacket. If you are not sure if your Cat 5 cable is [...]

3. Slide the clip into the transceiver port until it clicks into place. Because the fit is close, you may have to apply some pressure to seat the clip. Apply pressure evenly and gently to avoid clip breakage. To remove a Gigabit Ethernet cable from a transceiver: 1. Hold the cable clip firmly but gently between your thumb and forefinger with your t[...]

Part 3 Adding the IDP Appliance to NSM ■ Adding the IDP Appliance to NSM on page 41 Adding the IDP Appliance to NSM ■ 39[...]

40 ■ Adding the IDP Appliance to NSM IDP250 Installation Guide[...]

Chapter 7 Adding the IDP Appliance to NSM This chapter includes the following topics: ■ Reviewing Compatibility with NSM on page 41 ■ Adding a Reachable IDP Device to NSM on page 41 Reviewing Compatibility with NSM Review the release notes for information regarding compatibility between your IDP Series release and NSM release. In some cases, yo[...]

To import an IDP device with a known IP address: 1. In the NSM navigation tree, select Device Manager > Devices . Figure 12: NSM Add Device Wizard: Add Device 2. Click the + icon and select Device to display the Add Device wizard. 3. Select Device Is Reachable (default) and click Next to display the page where you configure connection settings. [...]

■ Enter the password for the device admin user. You set the password for admin when you ran the ACM Wizard. ■ Enter the password for the device root user. You set the password for root when you ran the ACM Wizard. NOTE: In NSM, passwords are case-sensitive. ■ Select SSH Version 2 and port 22. Click Next . The Wizard displays a page where you [...]

5. Log into the IDP command-line interface and verify the SSH key fingerprint. Comparing the SSH key fingerprint information enables you to detect man-in-the-middle attacks: a. Connect to the IDP command-line interface: ■ Use SSH to connect to the IP address or hostname for the management interface. Log in as admin and enter su – to switch to r[...]

Figure 16: NSM Add Device Wizard: Add Device Confirmation 8. Click Next to import the configuration from the IDP device. Upon success, NSM displays the following message: Figure 17: NSM Add Device Wizard: Configuration Import Confirmation 9. Click Finish . For IDP 4.1 and later devices, NSM next runs a job to update the IDP device with the Recommen[...]

Figure 18: NSM Device Manager: Viewing Device Status Related Topics ■ Reviewing Compatibility with NSM on page 41 ■ Basic Steps on page 22 46 ■ Adding a Reachable IDP Device to NSM IDP250 Installation Guide[...]

Part 4 Upgrading Software and Installing Field Replaceable Units ■ Upgrading Software on page 49 ■ Installing Field Replaceable Units on page 53 ■ Reimaging the Appliance on page 55 Upgrading Software and Installing Field Replaceable Units ■ 47[...]

48 ■ Upgrading Software and Installing Field Replaceable Units IDP250 Installation Guide[...]

Chapter 8 Upgrading Software This chapter includes the following topics: ■ Updating Software (NSM Procedure) on page 49 ■ Upgrading Software (CLI Procedure) on page 51 Updating Software (NSM Procedure) To update IDP software: 1. Add the IDP software to the NSM GUI server. 2. Push the IDP software from the NSM GUI server to one or more IDP devic[...]

3. From the Select Software Image list, select the image file you just added to the NSM GUI server. 4. In the Select Devices list, select the IDP devices on which to install the software update. 5. Click Next and complete the wizard steps. 6. Select Automate ADM Transformation to automatically update the Abstract Data Model (ADM) for the device aft[...]

3. Push a security policy update job to update attack objects in use in your security policy: a. In NSM, select Devices > Configuration > Update Device Config . b. Select devices to which to push the updates and set update job options. c. Click OK . Related Topics ■ Upgrading Software (CLI Procedure) on page 51 Upgrading Software (CLI Proce[...]

Next Steps: Download the IDP detector engine and NSM attack database updates to the NSM GUI server: 1. From the NSM main menu, select Tools > View/Update NSM attack database and complete the wizard steps. 2. Push the updated IDP detector engine to IDP devices: From the NSM main menu, select Devices > IDP Detector Engine > Load IDP Detector[...]

Chapter 9 Installing Field Replaceable Units This chapter includes the following topics: ■ Replacing a Power Supply on page 53 Replacing a Power Supply The following procedure applies to models for which the power supply is a field replaceable unit (FRU). For information on obtaining spares, contact your Juniper Networks sales representative. To [...]

The power supply LED turns amber to indicate that the power supply is receiving power. The LED turns green to indicate that it is receiving power and is giving power to the appliance (only occurs if appliance is on). The high-pitched whine stops and the PS FAIL light on the front of the appliance turns off. 54 ■ Replacing a Power Supply IDP250 In[...]

Chapter 10 Reimaging the Appliance This chapter includes the following topic: ■ Reimaging and Relicensing an Appliance on page 55 Reimaging and Relicensing an Appliance The appliance comes with software preinstalled. If needed, you can reinstall the factory image. This process is known as reimaging the appliance. The reimaging process rewrites th[...]

56 ■ Reimaging and Relicensing an Appliance IDP250 Installation Guide[...]

Part 5 Technical Specifications and Compliance Statements ■ Technical Specifications on page 59 ■ Compliance Statements on page 61 ■ Common Criteria EAL2 Compliance on page 63 Technical Specifications and Compliance Statements ■ 57[...]

58 ■ Technical Specifications and Compliance Statements IDP250 Installation Guide[...]

Chapter 11 Technical Specifications This chapter includes the following topics: ■ IDP250 Technical Specifications on page 59 IDP250 Technical Specifications Table 15 on page 59 lists physical specifications. Table 15: Physical Specifications Value Specification 1 RU Form Factor 1.69 in. (4.3 cm) Height 17 in. (43.2 cm) Width 15 in. (38.1 cm) Dept[...]

Table 17: Power Cord Specifications Specifications Country ■ UL-approved and CSA-certified ■ Flexible cord minimum spec: No. 18 (1.5 mm2SVT or SJT, 3-conductor ■ Current capacity of 10A minimum ■ Earth-grounding attachment plug with NEMA 5-15P (10A, 125V) configuration United States and Canada Table 18 on page 60 list environmental specific[...]

Chapter 12 Compliance Statements This chapter includes the following topic: ■ Standards Compliance on page 61 Standards Compliance Table 20: Standards Compliance Category ■ UL 60950, Third Edition — Safety of Information Technology Equipment ■ CSA C2.22 No. 60950, Third Edition — Safety of Information Technology Equipment ■ EN 60950, 20[...]

62 ■ Standards Compliance IDP250 Installation Guide[...]

Chapter 13 Common Criteria EAL2 Compliance This chapter includes the following topics: ■ Common Criteria EAL2 Compliance on page 63 Common Criteria EAL2 Compliance Table 21 on page 63Table 21 on page 63 provides guidelines you must observe to deploy and use the IDP appliance in compliance with the Common Criteria EAL2. In addition, you must obser[...]

64 ■ Common Criteria EAL2 Compliance IDP250 Installation Guide[...]

Part 6 Index ■ Index on page 67 Index ■ 65[...]

66 ■ Index IDP250 Installation Guide[...]

Index Symbols 1998 Class A compliance .............................................61 A ACM ...................................................................... 15, 31 ACM Online Help .........................................................xiii adding a device to NSM ................................................41 audience for documentation .[...]

LEDs fault ........................................................................ 4 HA port ...................................................................6 hard drive ...............................................................4 IDP250 ................................................................... 3 power ............................[...]