Juniper IDP OS 5.1R1 - S REV 1 Instruction Manual

IDP Series Release Notes

IDP OS 5.1r1

February 8, 2011

Revision 01

Contents Overview...........................................................2

SupportedHardware.................................................2

NewandChangedFeatures............................................2

UnsupportedFeatures................................................4

KnownLimitations...................................................4

SupportedUpgradePaths.............................................5

DowngradingorReverting.............................................6

Licensing...........................................................6

Compatibility with Network and Security Manager . . . . . . . . . . . . . . . . . . . . . . . . . 6

Compatibility with Juniper Networks Infranet Controller . . . . . . . . . . . . . . . . . . . . . 7

BrowserRequirements................................................7

UpgradingIDPSoftware...............................................7

UpgradingwithNSM..............................................8

UpgradingwiththeCLI...........................................10

ResolvedIssues.....................................................12

Known Issues ......................................................15

Documentation ....................................................20

GettingHelp.......................................................22

Overview

Juniper Networks Intrusion Detection and Prevention Series devices enable you to enforce

a security policy that leverages continuous security research by the Juniper Security Center

to protect your network from attacks. The IDP Series also includes features that enable

you to gather information about applications and servers in your network.

These release notes contain information about what is included in this product release:

supported features, unsupported features, changed features, known problems, and

resolved problems. If the information in the release notes differs from the information

found in the documentation set, follow the release notes.

Supported Hardware

IDP 5.1r1 is supported on the following platforms:

•IDP8200, IDP800, IDP250, IDP75

•IDP1100, IDP600, IDP200

New and Changed Features

The following table summarizes new and changed features.

Table 1: New Features

DescriptionFeature

IDP OS Release 5.1 supports high availability in network designs where you have deployed

redundant network paths and use the failure detection features of a firewall, router, or switch

to manage the cutover from the primary path to the backup path in cases of failure. For details,

see IDP Series Deployment Scenarios.

High availability

Beginning in IDP OS Release 5.1, you can operate the IDP Series device in simulation mode. In

simulation mode, the original packets are forwarded immediately and the IDP Series device

processes a copy, logging actions that would have been taken if simulation mode were not

enabled.

You operate an IDP Series device in simulation mode in the following situations:

•When you first deploy the IDP Series device in your network and you want to evaluate the

security actions it takes without disrupting traffic.

•When you implement a new feature or change a security policy and you want to evaluate the

impact without disrupting traffic.

•As a workaround to avoid traffic outages when IDP processing is resulting in crashes and other

failures.

For details, see Simulation Mode Overview and its related topics.

Simulation mode

IDP OS Release 5.1 supports extensive system resource instrumentation, so you can use SNMP

utilities to monitor device health and load. For details, see SNMP Statistic Reporting and

Traps Task Summary and its related topics.

Enhanced system resource

instrumentation

Juniper Networks Intrusion Detection and Prevention Release Notes

Table 1: New Features (continued)

DescriptionFeature

Beginning with IDP OS Release 5.1, the application identification feature can match extended

application signatures used in APE rulebase rules. Extended application signatures are also called

nested application signatures. The predefined extended application signatures developed for

IDP OS Release 5.1 include the most prevalent Web 2.0 applications running over HTTP. If your

security policy includes APE rules configured to match extended application signatures, the

application identification process identifies and generates the following HTTP contexts:

http-url-parsed, http-url-parsed-param-parsed, http-header-host, and http-header-content-type.

The application identification feature can then match application signature patterns in those

contexts.

J-Security Center updates application signatures and develops new ones as necessary. Beginning

with IDP OS Release 5.1, you can use NSM to browse predefined application objects, predefined

extended application objects, and application groups. You can also use NSM to create custom

application definitions, if needed. You cannot, however, create custom extended application

definitions.

For details, see Using Application Identification,Using Application Objects, and their related

topics.

Enhanced application

identification

Beginning with IDP OS Release 5.1:

•You can create rules that match extended application objects (also called nested application

objects).

•You can apply a new action to matching rules: DiffServ + Ratelimiting.

•If you use user-role based matching, you can set a global option to enable an aggregate limit

for matching user-roles (default) or a per-subscriber rate limit (by using a CLI command).

For details, see Understanding the APE Rulebase and its related topics.

Enhanced APE rulebase

features

IDP OS Release 5.1 supports the following configurable constraints to enable you to fine-tune

custom attack signatures:

•Within bytes—Configure a byte range where the attack pattern must be detected.

•Within packets—Configure a packet range where the attack pattern must be detected.

•Context checking—Configure a byte-length requirement for matching contexts.

This release also supports bit-level matching for binary protocols.

For details, see the IDP Series Custom Attack Object Reference and Examples Guide.

Enhanced attack signature

Beginning with IDP OS Release 5.1, you can specify the protocol and port to use for syslog

messages. See Configuring Syslog Collection (NSM Procedure).

Configurable syslog

communication

Beginning with IDP OS Release 5.1, you can use a new utility to capture packets at the Rx interface

(receiving interface) and also at the Tx interface (transmitting interface). See Using

jnetTcpdump to Capture Packets.

Bidirectional packet capture

New and Changed Features

Table 1: New Features (continued)

DescriptionFeature

You can use the following CLI command enhancements to display system information:

•scio app cache—A new option, listall, allows you to list the entire application identification

cache. Previously, only the most recent 32 were listed.

•scio logview—A new command that enables you to troubleshoot log collection by NSM. The

command allows you to view raw log data on the IDP Series device so you can compare it to

the logs seen at NSM.

•scio subs—A new option displays aggregate statistics for all IDP engines on IDP8200. IDP8200

has multiple IDP engines. To view an aggregation, use scio subs aggregatestatus s0. To view

statistics per engine, use scio subs status s0.

•scio var—The TCP and UDP flow tables now include a column for application.

Enhanced debugging and

troubleshooting tools

Unsupported Features

The following features are not supported in IDP OS Release 5.1:

•SSL decryption using IDEA-based algorithms or ciphers. Also not supported in IDP OS

Release 5.0.x.

•On IDP8200, 10 gigabyte fiber interfaces do not support interface signaling or peer

port modulation. Also not supported in IDP OS Release 5.0.x.

•Authentication to the ACM via RADIUS with RSA SecurID (authentication via RADIUS

server is supported). Same as IDP OS Release 5.0.x.

Note that IDP75 does not have an HA interface. We do not support an HA deployment

with IDP75 devices. Also, IDP75 has only one pair of traffic interfaces. We do not support

a mixed mode deployment with IDP75 devices.

Known Limitations

For single core platforms (IDP75, IDP200, IDP600), we recommend you disable

application volume tracking (AVT). The AVT feature is fully functional, but the AVT

process is CPU intensive. During stress testing, high CPU usage by the AVT feature resulted

in link flapping.

Note that if you disable AVT, IDP Reporter application volume reports are empty.

To disable AVT:

1. From NSM Device Manager, double-click a device and then click Profiler Settings.

2. Click the General tab.

3. Deselect Enable AVT.

4. Click Apply.

5. From NSM Device Manager, right-click the device and select Update Device to push

your configuration change to the device.

Juniper Networks Intrusion Detection and Prevention Release Notes

Supported Upgrade Paths

You can upgrade directly from any of the following versions:

•5.0r2

•5.0r1

•4.1r4

Beginning with IDP OS Release 5.0, IDP Series does not support bridge, proxy-arp, or

router mode. Before upgrading to IDP OS 5.1, you must redeploy the IDP Series device in

transparent or sniffer mode.

NOTE: The upgrade paths assume your current IDP Series device has been

in use and the device had been added to NSM. You might encounter

unexpected behavior during the upgrade if you are upgrading from a newly

reimaged, undeployed IDP OS 4.2 or 4.1 device (such as a 2009 factory image

of the IDP OS). In these cases, we recommend you add the IDP device to NSM

and import the device configuration into NSM prior to performing the upgrade.

Doing so will avoid the file permissions issue described in KB 15071.

Table 2 on page 5 describes the changes to files and directories you will notice when

you upgrade.

Table 2: Changes to Files and Directories

Files and DirectoriesUpgrade Path

No changes to attend to before upgrade.From 5.0r2

Before you upgrade, take note of the following changes and recommended actions:

•IDP 5.1r1 stores packet logs in numbered subdirectories of /usr/idp/device/var/pktlogs/. To implement

this change, your existing /usr/idp/device/var/pktlogs/ directory will be overwritten. If you have

been using the option to maintain packet data locally and send to NSM on demand, copy any packet

logs you want saved from /usr/idp/device/var/pktlogs/ to a remote location before you upgrade.

Previously collected packet capture logs will not be available to NSM. This action is not required if

you have been using the option to always include packet data when NSM sends the event log.

•Your custom settings in the /usr/idp/device/bin/user_funcs file are preserved when you upgrade.

No action is required.

From 5.0r1

Supported Upgrade Paths

Table 2: Changes to Files and Directories (continued)

Files and DirectoriesUpgrade Path

When you upgrade from IDP OS 4.1r4 to IDP OS 5.1r1, you are reimaging the disk with a new operating

system. All partitions except /var/idp are rewritten.

In addition, IDP 5.1r1 stores packet logs in numbered subdirectories of /usr/idp/device/var/pktlogs/.

This is the same directory structure introduced in IDP 4.1r4. Note, however, that the upgrade process

preserves only packet log files in /usr/idp/device/var/pktlogs/0/. Packet log files in other directories

will be lost upon upgrade. If you have been using the option to maintain packet data locally and send

to NSM on demand, copy logs from /usr/idp/device/var/pktlogs/1/ and higher numbered log directories

to a remote location before you upgrade. This action is not required if you have been using the option

to always include packet data when NSM sends the event log.

From 4.1r4

The upgrade process restores your license and most of your previous settings. The following settings

are not preserved:

•The upgrade does not retain settings no longer supported in IDP 5.1.

•The upgrade process saves a backup of your previous /usr/idp/device/bin/user_funcs file, but

installs a new user_funcs file in order to provide appropriate content for IDP 5.1.

Downgrading or Reverting

You cannot downgrade or revert to a previous version. You can reimage the operating

system, if necessary. For details on reimaging, see the installation guide for your IDP

Series device.

Licensing

The upgrade procedure preserves your earlier license configuration. The reimaging

procedure does not. If you reimage the appliance, see the installation guide for information

on licensing.

Compatibility with Network and Security Manager

At the time of the IDP OS Release 5.1r1, we verified compatibility with the following release

of Network and Security Manager (NSM):

•NSM 2010.4 build LGB14z2q21

NSM 2010.4 build LGB14z2q21 is required to support new IDP OS Release 5.1 features.

Table 3: Download Locations for NSM 2010.4 (Requires Log In)

URLNSM Software

https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_ui_win_x86.zip

(Windows)

NSM Client

https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_ui_linux_x86.zip (Linux)

Juniper Networks Intrusion Detection and Prevention Release Notes

Table 3: Download Locations for NSM 2010.4 (Requires Log In) (continued)

URLNSM Software

https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_servers_sol_sparc.zip

(Solaris)

NSM Server

https://download.juniper.net/software/nsm/2010.4q21/nsm2010.4q21_servers_linux_x86.zip

(Linux)

https://download.juniper.net/software/nsm/2010.4q16/md5sum.txt

MD5 checksum

NOTE: NSMXpress users should consult KB 13946 for information on how

to upgrade NSMXpress to a patch version of NSM.

Compatibility with Juniper Networks Infranet Controller

The user-role-based policy feature depends on deployment with IC Series Unified Access

Control (UAC) 4.1r1 or later. Contact your Juniper Networks sales representative for

information on UAC release dates.

Browser Requirements

The ACM, QuickStart utility, and IDP Reporter have been tested on the following browsers:

•Internet Explorer 7.x, 6.x

•Firefox 3.x, 2.x

Upgrading IDP Software

During upgrade, the IDP Series appliance is gracefully shut down. If you have configured

bypass for traffic interfaces, you do not need to be concerned about traffic disruption. If

you have not configured bypass, you should plan to complete your upgrade at an

appropriate time.

You can use NSM or the CLI to upgrade the IDP OS. You must use NSM to complete the

IDP detector engine and attack object updates.

TIP: If possible, use a laptop to connect to the console port of the IDP Series

device when you upgrade. This will enable you to view any console messages

that can assist in identifying any issues during upgrade. We understand this

is not possible or desirable in all deployments, so connecting via console is

not required to upgrade.

Compatibility with Juniper Networks Infranet Controller

This section provides the following upgrade workflows to upgrade a standalone IDP

Series device:

•Upgrading with NSM on page 8

•Upgrading with the CLI on page 10

NOTE: Upgrading an HA deployment involves special considerations. For

information on upgrading an HA deployment, see “Workflow: Upgrading an

IDP OS 4.1r4 Cluster to IDP OS 5.1”inIDP Series Deployment Scenarios.

Upgrading with NSM

This section describes a workflow for upgrading IDP software using only NSM.

To update IDP software:

1. Add the IDP software to the NSM GUI server.

2. Push the IDP software from the NSM GUI server to one or more IDP Series devices.

To add an IDP software image to the NSM GUI server:

1. Download the software image:

a. Go to https://www.juniper.net/customers/csc/software/ and log in with your

customer username and password.

b. Enter the IDP Series device serial number to display a view of applicable software

releases available for download.

c. Click the applicable link to display the software download page.

d. Download the software to a location you can access from your NSM client.

2. From the NSM main menu, select Tools > Software Manager to display the Software

Manager dialog box.

3. Click the + button to display the Open dialog box.

4. Select the IDP software image you just downloaded and click Open to add the software

image to the NSM GUI server.

5. Click OK.

To push the software image from the NSM GUI server to IDP Series devices:

1. From the NSM main menu, select Devices > Software > Install Device Software to

display the Install Device Software dialog box.

2. From the Select OS Name list, select ScreenOS/IDP.

3. From the Select Software Image list, select the image file you just added to the NSM

GUI server.

Juniper Networks Intrusion Detection and Prevention Release Notes

4. In the Select Devices list, select the IDP Series devices on which to install the software

update.

5. Click Next and complete the wizard steps.

6. Select Automate ADM Transformation to automatically update the Abstract Data

Model (ADM) for the device after NSM installs the update.

NOTE: If you clear this setting, the update is installed onto the device, but

you cannot manage the device from NSM until the device ADM is updated.

7. Click Finish to display upgrade status in the Job Information dialog box.

8. When the upgrade finishes, click Close to exit the Job Information dialog box.

The software upgrade is complete.

NOTE: You might encounter unexpected behavior if you have changed the

factory BIOS settings for the IDP Series device. We advise that you do not

change the factory BIOS settings.

The console will hang at GRUB after reboot if you have changed the BIOS

setting Console redirection > Continue Console redirection after POST to ON.

To resolve this issue, press the Delete key to enter BIOS and set this option

to OFF.

Next Steps: If you are upgrading from IDP OS Release 5.0r1 or 5.0r2, skip this step. You completed

it when you upgraded to IDP 5.0r1. If you are upgrading from IDP OS 4.1r4:

a. Run through the ACM wizard to reconfigure your virtual routers. In IDP OS Release

5.0 and later, you use ACM to configure deployment mode per virtual router.

b. If necessary, copy any custom settings from the backup copy of user_funcs to the

new user_funcs file.

2. Check to see if J-Security Center has released an update for the detector engine or

attack database:

From the NSM main menu, select Tools > View/Update NSM attack database and

complete the wizard steps.

3. Push the updated IDP detector engine to IDP Series devices:

From the NSM main menu, select Devices > IDP Detector Engine > Load IDP Detector

Engine for ScreenOS and complete the wizard steps.

Upgrading IDP Software

NOTE: Updating the IDP detector engine on a device does not require a

reboot of the device.

4. Push a security policy update job to update attack objects in use in your security policy:

a. In NSM, select Devices > Configuration > Update Device Config.

b. Select devices to which to push the updates and set update job options.

c. Click OK.

Upgrading with the CLI

This section describes a workflow where you use the CLI to upgrade the software image

on the IDP Series device. You still use NSM to update the detector engine and attack

objects.

To upgrade IDP OS from the CLI:

1. Download the software image to a host that runs an FTP server. Follow these steps:

a. Go to https://www.juniper.net/customers/csc/software/ and log in with your

customer username and password.

b. Enter the IDP Series device serial number to display a view of applicable software

releases available for download.

c. Click the applicable link to display the software download page.

d. Save the sensor_version.sh file (where version is the number that identifies the

software release version).

2. Connect to the IDP command-line interface in one of the following ways:

•Use SSH to connect to the IP address or hostname for the management interface.

•If you prefer, make a connection through the serial port and log in as root.

NOTE: To make an SSH connection, you must have enabled SSH for the

management port (eth0). For details, see the ACM online Help.

3. Use SCP or FTP to copy the software image file to the IDP appliance. The IDP appliance

does not run an FTP server, so you have to initiate the FTP session from the IDP

appliance.

4. Run the upgrade script by entering sh sensor_version.sh, where version is the number

that identifies the OS release version. When the script has finished, enter reboot.

Juniper Networks Intrusion Detection and Prevention Release Notes

This manual suits for next models

Table of contents

Other Juniper Software manuals

Juniper

Juniper JUNIPER CARE SERVICES User manual

Juniper

Juniper NETWORKS STRM - TECHNICAL NOTE REV 6-2008 User manual

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... User manual

Juniper

Juniper MEDIA FLOW CONTROLLER 2.0.4 - User manual

Juniper

Juniper JUNOSE 11.1.0 - REV 4-29-2010 User manual

Juniper

Juniper MEDIA FLOW CONTROLLER 2.0.4 - ADMINISTRATOR S GUIDE AND... Service manual

Juniper

Juniper MEDIA FLOW MANAGER 2.0.2 - ADMINISTRATOR S GUIDE AND... Service manual

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Installation and operation manual

Juniper

Juniper STRM 2008-2 - TECHNICAL NOTE CHANGING NETWORK SETTING... Instruction Manual

Juniper

Juniper JUNOS PULSE 2.0 RELEASE NOTES Instruction Manual

Juniper

Juniper JUNOS PUS MOBILE SECURITY SUITE User manual

Juniper

Juniper STRM 2008.2 RELEASE NOTES Instruction Manual

Juniper

Juniper TEPM AGENT - RELEASE NOTES 17-12-10 Instruction Manual

Juniper

Juniper JUNOS OS 10.3 - XML MANAGEMENT PROTOCOL GUIDE... User manual

Juniper

Juniper JUNOS SPACE SDK Installation guide

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 R2 - LOG MANAGEMENT ADMINISTRATION GUIDE REV... Instruction Manual

Juniper

Juniper JUNOS - NETWORK OPERATION GUIDE REV1 User manual

Juniper

Juniper JUNOS SOFTWARE 10.2 - SOFTWARE INSTALLATION AND UPGRADE GUIDE... Installation and operation manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.0.X - BGP AND MPLS CONFIGURATION GUIDE... User manual

Juniper

Juniper JUNOSE 11.1.X - LINK LAYER CONFIGURATION... User manual

Juniper

Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - SERVICE AVAILABILITY CONFIGURATION GUIDE... User manual

Juniper

Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - EVENT CATEGORY CORRELATION REV... User manual

Juniper

Juniper SPACE SECURITY DESIGN User manual

Juniper

Juniper JUNOS OS 10.4 - XML API OPERATIONAL Manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual