Juniper SRX Series

Chapter 13. Intrusion Prevention

Although stateful firewall technology is a powerful mechanism for controlling cyberthreats and preventing denials of service, controlling targeted exploitation requires deeper inspection and control of the application layer traffic itself. The SRX platform integrates the power of stateful firewalling, routing, NAT, and VPNs, along with the power of Juniper IDP technology, into a single unit. Make no mistake: this is true IPS, not a subset of inspection capabilities, and it’s all done within integrated network purposed hardware so that additional types of components are not needed.

This chapter details the Juniper IPS functionality built into the SRX. It starts with an overview of IPS—what it does, why it’s necessary, and how it compares to other technologies, including Juniper’s legacy platforms. Then we look at how to configure, operate, tune, and troubleshoot the IPS on the SRX, and explore some of the features that have been introduced since the Junos Security series book was released. As with all the chapters in this book, questions at the end of the chapter should help those taking Juniper’s security certification to prepare for their exam.

The Need for IPS

Despite what some flashy vendor advertisements and blogs might say, stateful firewalling is not dead, nor will it be anytime soon. Stateful firewalling provides a core layer of security to ensure that network traffic is restricted to only that which a policy dictates from the networking layer ...