User manual JUNIPER NETWORKS IDP OS 5.1R1 RELEASE NOTES REV 1

[. . . ] IDP Series Release Notes IDP OS 5. 1r1 February 8, 2011 Revision 01 Contents Overview . 6 Compatibility with Network and Security Manager . 6 Compatibility with Juniper Networks Infranet Controller . 22 Copyright © 2011, Juniper Networks, Inc. 1 Juniper Networks Intrusion Detection and Prevention Release Notes Overview Juniper Networks Intrusion Detection and Prevention Series devices enable you to enforce a security policy that leverages continuous security research by the Juniper Security Center to protect your network from attacks. [. . . ] Resolved an issue where VLAN Q in Q traffic had not been distributed among the IDP engines (IDP8200). Resolved an issue with the Radius PAM module that had resulted in Radius authentication for SSH to fail. Resolved an issue with idpLogReader debug logs where the IP address bits had been displayed in reverse order. NSM displayed the logs correctly. 430000 438306 439660 510099 543532 Configuration Issues 517629 Resolved an issue where ACM had rejected Radius username formats containing a period (for example, john. doe). 12 Copyright © 2011, Juniper Networks, Inc. Resolved Issues Table 4: Resolved Issues (continued) PR Description Detection Accuracy 414795 Resolved an issue where APE rules could behave unexpectedly. If you configured a rule to drop Telnet traffic, for example, all traffic running over the standard Telnet port (port 23) would be dropped. Improved accuracy detecting attacks in highly fragmented HTTP traffic. 436273 Logging / Packet Capture 274827 All formats: Corrected log messages when an IDP rulebase rule matches ICMP or UDP attacks and the rule action is set to close client and server. The action actually taken is a drop connection. In previous releases, the log had been the action specified in the rule--"close client and server". In this release, we now report the action actually taken by the IDP Series device--"drop connection". Packet capture: You cannot use tcpdump to capture packets in both directions. In IDP OS Release 5. 1, we support a new utility, called jnetTcpdump, that you can use to capture packets in both directions. Changed threshold: When traffic through the IDP Series device exceeds session capacity, the device generates an event log and drops the traffic (if the constant for logging implicit drops is enabled). To avoid generating many logs around a similar event, the IDP Series device does not log additional instances until a threshold is reached. In this release, we have changed the delay threshold from 1024 to 100 instances. Syslog: NIC state events reported in syslog messages had not indicated that the virtual router has returned to "Normal mode". Syslog: Changes in link status (link down or link up) had not been reported in syslog messages. NSM Profiler: Updates to Network Profile tab logs had lagged behind Protocol Profile tab logs. These two views are now updated simultaneously. NSM Log Viewer: Resolved an issue where variable data had not been displayed in the NSM Log Viewer collection. SNMP: The SNMP trap jnxIdpSensorFreeDiskSpace had been generated when the disk space exceeds the threshold but a downtrap had not been generated when it fell below the threshold. SNMP: In IDP OS 5. 0r2 release notes, we reported that we had changed the polling interval for SNMP traps and SNMP polling to five minutes to decrease latency and CPU utilization for single core platforms (IDP600, IDP200, IDP75), where the IDP engine, JNET driver, and control plane processes share the same CPU. SNMP reporting has been improved in IDP OS Release 5. 1. [. . . ] Explains IDP Series features and provides examples of how to use the system. Provides examples and reference information for creating custom attack objects. Describes how to use IDP Reporter, an on-box reporting platform that includes predefined reports on attack detection and application usage. You can also use IDP Reporter to schedule regular publication of reports that are of interest to you or your stakeholders. IDP Series Feature Documentation IDP Series Administration Guide IDP Series Concepts and Examples Guide IDP Series Custom Attack Objects Reference and Examples Guide IDP Reporter User's Guide Table 6 on page 20 lists related NSM documentation. Table 7: Related NSM Documentation Document Network and Security Manager release notes Network and Security Manager Installation Guide Description Provides information about new features, changed features, fixed problems, and known issues with the NSM release. [. . . ]