Index

Symbols

10 gigabit ports, IOC modules
10 Gigabit Small Form-Factor Pluggable card, IOC modules
3DES (Triple Data Encryption Standard), IPsec Encryption Algorithms, Selecting the Appropriate VPN Configuration
3G cards, on SRX210, SRX200 Series
41 gigabit SFP IOC card, IOC modules

A

access control list (ACL), Configuring a stateless firewall filter to control traffic on fxp0
in troubleshooting, VPN troubleshooting process
access mode, in transparent mode, Interface Modes in Transparent Mode
access port, Switching Configuration
access-control system, role-based, Accounts for Administrative Users
action criteria, in security policy, Action Criteria, Configuring a policy to restrict inbound or outbound management requests
action profiles, in security policy, Security Policy Criteria and Precedence
Active Directory
mapping users based on group membership, Configuring realms, roles, and sign-in policies
miscellaneous tasks, Miscellaneous Active Directory tasks
SPNEGO and, UserFW
active reconnaissance, Stages of a System Compromise
active/active deployment
for high availability clusters, Active/active
for SRX3000 line products, Data Center Edge
active/backup state, for control plane, The Control Plane
active/passive mode, Sample Deployments, Summary
for high availability clusters, Active/passive
ActiveX, Shifting Threats
address books, for security zones, Address books
address objects
mapping IP address to, Address objects
in NAT ruleset, Best Practices
in security policy, Security Policy Criteria and Precedence
address persistence, in source NAT, Other SRX source NAT configuration options
Address Resolution Protocol (ARP), with traceroute, MAC Address Learning
address sets, Best Practices
for security zones, Address sets
address shifting, in source NAT, Other SRX source NAT configuration options
administrative user accounts, Accounts for Administrative Users, Remote authentication
ADSL cards, Interface modules for the SRX200 line
ae interface, Aggregate Interfaces
AES (Advanced Encryption Standard), IPsec Encryption Algorithms, Selecting the Appropriate VPN Configuration
aggregate interfaces, Aggregate Interfaces, LACP protocol
Aggressive mode for IKE negotiations, Aggressive mode, Configuring IKEv1 Phase 1 IKE policy with preshared key, Aggressive mode
vs. Main mode, Selecting the Appropriate VPN Configuration
aggressive session aging, Aggressive session aging
configuring flow option, Configuring the aggressive session ageout flow option
AH (Authentication Header), Phase 2 IKE negotiation modes, IPsec VPN Protocol
best practices, Best Practices
vs. ESP, Selecting the Appropriate VPN Configuration
alarm threshold, in SYN Cookie/SYN Proxy, SYN Spoofing Protection Modes
alarm-without-drop setting, in Screen profile, Configuring a Screen profile
alarms, Informational panels
ALGs (application layer gateways), Application Layer Gateways, Enabling an ALG example, Best Practices
enabling example, Enabling an ALG example
Anti-Replay detection for IPsec VPN, Anti-Replay Protection
configuring, Configuring common IPsec VPN components
anticipating needs, Welcome to the SRX
antispam feature, Antispam
deployment, Sample Deployments
on SRX Series, Branch-Specific Features
troubleshooting, Antispam
antivirus software, IPS and UTM, Antivirus, Which AV to Choose?
in branch SRX, Branch-Specific Features
Express AV engine, Express AV, Which AV to Choose?
default profile for configuring, Default Express AV profile
focus of, Antivirus + URL Filtering+ IPS?
Kaspersky Full AV, Kaspersky Full AV, Express AV
configuring scanning and fallback options, Configuring Kaspersky AV scanning and fallback options
default profile for configuring, Configuring Kaspersky with the default profile
selecting, Which AV to Choose?
Sophos engine, Sophos AV
default profile for configuring, Configuring Sophos with a default profile
feature profiles, Sophos AV feature profiles
SRX vs. desktop, I Have SRX Antivirus: Do I Need Desktop Antivirus?
testing, Testing antivirus
troubleshooting, Antivirus
any role in SRX, Configuring the SRX for UserFW
appliance-based firewall model, Evolving into the SRX
application caching, controlling, Controlling application caching
application contexts, Application contexts
Application Denial of Service (AppDoS) prevention, Data Center Services Tier
Application Firewall (AppFW), Flow Mode and Packet Mode, Application Firewall, What About Application Firewalling in NGFW?
best practices, AppFW
configuring and deploying, Configuring and Deploying Application Firewall, Configuring application redirect
ruleset types, Three types of Application Firewall rulesets
with encrypted applications, AppFW with encrypted applications
operating, AppTrack, Operating Application Firewall
application groups
creating custom, Creating custom application groups
enabling and disabling, Enabling and disabling applications and application groups
Application Identification (AI), AI Processing Architecture, Application system cache
best practices, Application Identification
cache hits and misses, Checking AppID counters
counters, Checking AppID counters
downloading and installing sigpacks, Downloading and Installing Application Identification Sigpacks, Enabling application identification heuristics
in IPS processing, Packet processing path
object output, Signature-based pattern matching
signature operations, AppID Signature Operations, Creating custom application groups
troubleshooting, Operating Application Identification, Operating Application Firewall
application layer gateways (ALGs), Application Layer Gateways, Best Practices
enabling example, Enabling an ALG example
application objects, Application objects, Configuring a policy to restrict inbound or outbound management requests
creating custom, Enabling an ALG example
IPS and, Application objects
in security policy, Security Policy Criteria and Precedence
Application Quality of Service (AppQoS), Application Quality of Service
best practices, AppQoS
configuring and deploying, Configuring and Deploying Application Quality of Service, Configuring an AppQoS example
example, Configuring an AppQoS example, Configuring an AppQoS example
operating, Operating Application QoS
application redirect, configuring, Configuring application redirect
application sets, Application sets, Best Practices
application statistics, Checking application statistics, Checking application statistics
application system cache, Application system cache
Application-DDoS rulebase, Rulebases
application.list file, Useful IPS files
applications, enabling and disabling, Enabling and disabling applications and application groups
apply-groups command, Node-Specific Information
AppSecure, Data Center Services Tier, AppSecure Basics
best practices, Best Practices, SSL FP
components, Acknowledgments, AppSecure Component Overview, Application system cache
(see also specific component names)
Application Firewall (AppFW), Application Firewall
Application Identification (AI), Application Identification, AI Processing Architecture, Application system cache
Application Quality of Service (AppQoS), Application Quality of Service
AppTrack, Application Tracking
SSL Forward Proxy, SSL Forward Proxy
User Role Firewalling, User Role Firewalling
licensing, AppSecure Licensing
sample deployment, Sample Deployments, Sample Deployments
troubleshooting, Troubleshooting and Operation
AppTrack, Application Tracking, Sample Deployments
best practices, AppTrack
configuring and deploying, Configuring and Deploying AppTrack, Configuring AppTrack options
enabling, Enabling AppTrack
Assured forwarding class, Forwarding class
asymmetric traffic, through firewall, TCP SYN checks
attack database, Attack database, Useful IPS files
attack groups, custom, Custom Attack Groups
attack objects
downloading Juniper predefined, Getting Started with IPS on the SRX
updates for, Attack object updates versus full updates, Best Practices
viewing, Viewing IPS attack objects and group membership
in Junos Space, Viewing IPS attack objects and group membership
attack table, IPS Attack Table
attack threshold, in SYN Cookie/SYN Proxy, SYN Spoofing Protection Modes
attack-group.list file, Useful IPS files
attack.list file, Useful IPS files
attacks
object types, Attack Object Types, Signature performance impacts
custom, Custom attack objects and groups
predefined, Predefined attack objects and groups
severity levels of, Severities
shifted strategies, Shifting Threats
stages of, Stages of a System Compromise
viewing statistics, Viewing the Screen Attack Statistics
Aurora Internet Explorer exploit, Security Packages
authentication
certificate, Certificate authentication
configuring, Configuring Phase 1 proposals, Configuring IKEv1 Phase 2 proposals
IKE, IKE Authentication
in IPsec VPN, IPsec Authentication Algorithms
for VPN, Selecting the Appropriate VPN Configuration
Authentication Header (AH), Phase 2 IKE negotiation modes, IPsec VPN Protocol
best practices, Best Practices
vs. ESP, Selecting the Appropriate VPN Configuration
authentication server, configuring, Configuring the authentication server
AX411 Wireless LAN Access Point, AX411, CX111
license for, Licensing

B

Bad IP Option Screen, Bad IP Option Screen
bandwidth limit, Rate limiter
BDPUs (Bridge Protocol Data Units), Spanning Tree
Best Effort forwarding class, Forwarding class, Configuring an AppQoS example
best practices
AppSecure, Best Practices
DHCP (Dynamic Host Configuration Protocol), Best Practices
intrusion prevention systems (IPS), Best Practices, Best Practices
IPsec VPN (IP Security virtual private network), Best Practices, Best Practices
Network Address Translation (NAT), Best Practices
for number of monitored hosts, IP Monitoring
Screens, Best Practices
security policies, Best Practices, Best Practices
for system services configuration, Best Practices
Unified Threat Management (UTM), Best Practices
bidirectional forwarding detection (BFD), Preserving the Control Plane
bidirectional NAT, Junos NAT Types
binary syslog, Configuring Stream mode logging on the data plane
blacklist approach to firewall rules, Configuring a blacklist application ruleset, Configuring a whitelist application ruleset
best practices, AppFW
for Juniper Local filtering, URL Custom URLs, blacklists, whitelists, and categories
when to use, When to use blacklist, whitelist, and hybrid rulesets
blind switching, Branch-Specific Features, SRX100 Series
Block Frag Screen, Block Frag Screen
Border Gateway Protocol (BGP) route reflector, licensing, Licensing
botnet attacks on data center, Data Center Edge
branch firewall, Built for Services
SRX Series products for, Deployment Solutions
branch SRX Series, Branch SRX Series, Branch Summary
and AX411 appliances, AX411
features specific to, Branch-Specific Features, Branch-Specific Features
hardware overview, Branch SRX Series Hardware Overview
licensing, Licensing
packet mode, Flow Mode and Packet Mode
SRX100 series, SRX100 Series, SRX100 Series
SRX200 Series, SRX200 Series, Interface modules for the SRX200 line
interface modules for, Interface modules for the SRX200 line
SRX500 Series, SRX500 Series
SRX550, SRX500 Series
capacities, SRX500 Series
SRX600 Series, SRX600 Series, Interface modules for the SRX600 line
interface modules for, Interface modules for the SRX600 line
SRX650
capacities, SRX600 Series
summary, Branch Summary
bridge domains, Routing Instance Types
listing active, The show bridge domain Command
in transparent mode, Interfaces, family bridge, and bridge domains in transparent mode, Bridge Domains
configuring, Sample Deployments
bridge loop, transparent mode firewall for, Transparent Mode and Bridge Loops, Spanning Tree Protocol
bridge MAC learning table, The show bridge mac-table Command
Bridge Protocol Data Units (BDPUs), Spanning Tree
bridge, for transparent mode interface, Transparent Interfaces
bridging, configuring options, Configuring Bridging Options
byte stream, measuring randomness of, Heuristic-based detection

C

CA (certificate authority), Certificate authentication
SSL FP support for installing certificate, Configuring SSL Forward Proxy on the SRX
cable modem, Interface modules for the SRX200 line
cache
application system, Application system cache
clearing files, Clearing the download and cache files on the SRX
campus core firewalls, The Junos Enterprise Services Reference Network
categories, for custom URL pattern, Custom URL category
CBC (Cipher Block Chaining), Configuring Phase 1 proposals
cellular Internet access, RF interference and, Branch-Specific Features
central point (CP), SPU for, SPC
centralized management, Centralized Management, Using NSM
certificate revocation lists (CRLs), Certificate Validation
certificates
authentication, Certificate authentication
best practices, SSL FP
configuring, Configuration for Remote-Office1 proposal with certificates, Configuring IKEv1 Phase 1 policies
configuring IKEv1 Phase 1 IKE policy, Configuring IKEv1 Phase 1 IKE policy with certificates
importing external, Configuring SSL Forward Proxy on the SRX
preconfiguration tasks, Certificate Preconfiguration Tasks
validation for IPsec VPN, Certificate Validation
chassis cluster, Medium Branch, Chassis Cluster, Getting Started with High Availability, Six pack
deployment solutions, Deployment Concepts, Six pack
high availability, node-specific information, Node-Specific Information, Node-Specific Information
hold-down timer to prevent failover, Redundancy Groups
integrating into network, Integrating the Cluster into Your Network, Configuring Interfaces
managing members, Managing Cluster Members
private mode, Differences from Standalone
sample deployment, Sample Deployments, Summary
status of, Activating Juniper Services Redundancy Protocol
for transparent mode deployment, Sample Deployments
Chassis Information view (J-Web), Chassis view
Chassis Status panel, Informational panels
chassisD daemon, System services that operate on the control plane, Hardware Monitoring
child processes, Branch SRX Series Hardware Overview
Cipher Block Chaining (CBC), Configuring Phase 1 proposals
ciphers, defining for SRX/Servers, Configuring SSL Forward Proxy on the SRX
Cisco Systems, GETVPN solution, Group VPN
clear interface statistics command, Monitoring Interface Counters
clear services application-identification application-system-cache command, Checking the AppID engine settings and cache
clearing, cache files, Clearing the download and cache files on the SRX
CLI (see command-line interface (CLI))
Client-Outbound firewall rule, Sample Deployments
client-side threats, Layer 7 protection against, Unified Threat Management
client-to-server attacks, Direction-specific detection
Close-Client IPS action, IPS actions
Close-Client-and-Server IPS action, IPS actions
Close-Server IPS action, IPS actions
closing session, Application objects
cloud networks, deployment, Cloud Networks, The Junos Enterprise Services Reference Network
cluster ID, Cluster ID
cluster-master mode, Managing Cluster Members
clustering mode, requirements for running device, Chassis Cluster
coldsync, The Dreaded Priority Zero
command-line interface (CLI), How to Use This Book, Device management, SRX GUI Management
for management services, Command-Line Interfaces, Configuring SSH access
commands, running from configuration mode, Aggregate Interfaces
compact flash port, SRX600 Series
complex attack objects, Dynamic attack groups
concurrent sessions, at data center core, Data Center Services Tier
configuration
committing, Committing the configuration
J-Web tool for managing, Configuration management
configuration mode in Junos CLI
running commands from, Aggregate Interfaces
congestion, and loss priority for dropped traffic, Loss priority
connection-oriented communications, How to Use This Book
connectionless paradigm, How to Use This Book
connectivity
maximum, example SRX5800 configuration for, SRX5000 Series
security for, Preface
console, Command-Line Interfaces
configuring options, Configuring console options
content filtering, Content Filtering, Content Filtering, Configuring syslog to send UTM to a remote server
troubleshooting, Content Filtering
contexts, in IPS processing, Packet processing path, Application contexts
control link
failure, Control link and data link failure
monitoring, Control link
control plane
access, vs. data plane, Accessing System Services: Control Plane Versus Data Plane, Configuring a security policy to control data plane management traffic
high availability and, The Control Plane
logs
configuring, Configuring control plane logging on the SRX, Configuring control plane logging on the SRX
configuring Event mode, Configuring Event mode logging to the control plane
vs. data plane logs, Control Plane Versus Data Plane Logs, JFlow on the SRX
preserving, Preserving the Control Plane
in redundancy group, Redundancy Groups
states, Activating Juniper Services Redundancy Protocol
system services and, System Services and the Control Plane, System services that operate on the control plane
control ports, configuring, Configuring the Control Ports, Configuring the Control Ports
core dump, Checking for Core Dumps
troubleshooting, Core Dumps
Count action, in security policy, Action Criteria
counters
for IPS troubleshooting, IPS Counters
viewing on interface, Viewing the Services/Counters on the Interface, Viewing the Services/Counters on the Interface
CPE (Customer Premise Equipment), SRX installed in, Configuring the SRX as a DHCP client
CPS rate, Data Center SRX Series Hardware Overview
craft port, in SRX5600, SRX5000 Series
Critical severity level of attacks, Severities
CRLs (certificate revocation lists), Certificate Validation, Best Practices
custom spam profile, Configuring a custom spam profile and policy
CX111 Cellular Broadband Data Bridge, CX111
cyberthreats, IPS and UTM

D

daemons
restarting platform, Restarting Platform Daemons
for system services, System Services and the Control Plane
troubleshooting, Troubleshooting Individual Daemons
dashboard
for J-Web tool, Dashboard, Informational panels
chassis view, Chassis view, Chassis view, Informational panels, Informational panels
customizing, Informational panels
for NSM, Using NSM
Dashboard Preferences dialog box, Informational panels
data center firewall, Built for Services
deployment solutions, Data Center
services tier, Data Center Services Tier
edge of, Data Center Edge, Data Center Edge
SRX Series products for, Deployment Solutions
data center SRX Series, SRX Series Product Lines, Data Center SRX Series, IOC modules
antivirus feature for, Branch-Specific Features
features specific to, Data Center SRX-Specific Features
hardware overview, Data Center SRX Series Hardware Overview
session setup, Data Center SRX Series Session Setup, Data Center SRX Series Session Setup
SRX1000 Series, Data Center SRX Series, SRX1000 Series
SRX1400 Series
capacities, SRX1000 Series
SRX3000 Series, Data Center SRX Series, SRX3000 Series, IOC modules
SRX3400, SRX3000 Series
capacities, SRX3000 Series
SRX3600, SRX3000 Series
capacities, SRX3000 Series
interface modules for, IOC modules
SRX5000 Series, Data Center SRX Series, SRX5000 Series, IOC modules
capacities, SRX5000 Series
IOC modules, IOC modules
upgrade for NG-SPC support, NG-SPC
SRX5600, SRX5000 Series
FPC numbers, SRX5000 Series
SRX5800, SRX5000 Series, SRX5000 Series
example line configurations, SRX5000 Series
FPC numbers, SRX5000 Series
Data Encryption Standard (DES), IPsec Encryption Algorithms, Selecting the Appropriate VPN Configuration
Data Leak Protection (DLP), Content Filtering
data links, The Data Plane
configuring for transparent mode deployment, Sample Deployments
failure, Control link and data link failure
monitoring, Data link
data path, The Data Plane
data plane, System Services and the Control Plane
access, vs. control plane, Accessing System Services: Control Plane Versus Data Plane, Configuring a security policy to control data plane management traffic
default route in, Management Interfaces
high availability and, The Data Plane
logs, vs. control plane logs, Control Plane Versus Data Plane Logs
security policy enforcement on, Packet Flow
system services and, System Services and the Data Plane
troubleshooting, Verifying the Data Plane, Verifying the Data Plane
data, creation, Preface
date and time, manually configuring, Manually configuring SRX time
Day One Automation Series, Device management
Dead Peer Detection (DPD), Power supplies, Dead Peer Detection
debug output, for troubleshooting transparent mode, Transparent Mode Troubleshooting Steps
debugging VPN, VPN Tracing and Debugging, Configuring and analyzing VPN tracing
dedicated mode, for data center SRX Series, Data Center SRX-Specific Features
deep packet inspection, Welcome to the SRX, ScreenOS to Junos
default action, in security policy, Security Policy Precedence
default profile for configuring antispam, Configuring antispam with the default profile
default-policy action, Top to Bottom Policy Evaluation
denial-of-service (DoS) attacks, A Brief Review of Denial-of-Service Attacks, DoS Versus DDoS
on data center, Data Center Edge
exploit-based, Exploit-Based DoS
flood-based, Flood-Based DoS
screen feature for, Service Provider
vs. DDoS, DoS Versus DDoS
with ICMP, DoS Attacks with ICMP, Configuring the ICMP Ping of Death Screen
with IP protocols, DoS Attacks with IP Protocols, Configuring the Unknown IP Protocol Screen
with TCP, DoS Attacks with TCP, Configuring the WinNuke Screen
with UDP, DoS Attacks with UDP
deny action, in security policy, Action Criteria
DES (Data Encryption Standard), IPsec Encryption Algorithms, Selecting the Appropriate VPN Configuration
desktop antivirus, need for, I Have SRX Antivirus: Do I Need Desktop Antivirus?
destination address, in IPS policy, Match criteria
destination MAC addresses, known vs. unknown, Slow-path SPU packet processing
destination NAT, Junos NAT Types
combining with source NAT, Combination Source and Destination NAT, Combination Source and Destination NAT
examples, Destination NAT, Configuration destination NAT
flow debugging, Source NAT
no-NAT rules with, No-NAT with Source or Destination NAT, No-NAT with Source or Destination NAT
pools, Destination NAT pools
precedence for, NAT type precedence
rulesets, Destination NAT rulesets
destination objects, negated, for security zones, Negated source and destination objects
destination zone, Security zones
Destination-IP Session Limit screen, Session Limit Screens, Destination IP Session Limit Screen
detail command, show security ike security-associations
detail flag, for show route table command, Static Routing
detector engines, in IPS process, Detector engines
Deterministic Finite Automaton (DFA) technology, Signature-based pattern matching
Device Management Interface (DMI), Space: The Final Frontier of Management
DHCP (Dynamic Host Configuration Protocol), Dynamic Host Configuration Protocol, Configuring the SRX as a DHCP relay server
best practices, Best Practices
client configuration on SRX, Configuring the SRX as a DHCP client
operational mode commands for troubleshooting, DHCP Operational Mode Commands
relay server configuration on SRX, Configuring the SRX as a DHCP relay server
server configuration on SRX, Configuring the SRX as a DHCP server
differentiated Services Code Point (DSCP), Differentiated Services Code Point
Diffie-Hellman groups, Aggressive mode, Configuring Phase 1 proposals
troubleshooting, VPN troubleshooting process
Diffie-Hellman key exchange process, Main mode, Aggressive mode
group number, Selecting the Appropriate VPN Configuration
direction-specific detection, in IPS processing, Direction-specific detection
Disable Session Resumption option, in SSL Proxy profile, Configuring SSL Forward Proxy on the SRX
disabled control plane state, Activating Juniper Services Redundancy Protocol
discard option, for static routing, Static Routing
disk storage, on firewall, monitoring, Informational panels
distinguished name (DN), as IKE identity, IKE Identities
distributed denial-of-service (DDoS) attack
on data center, Data Center Edge
vs. DoS, DoS Versus DDoS
DLP (Data Leak Protection), Content Filtering
DMI (Device Management Interface), Space: The Final Frontier of Management
DMZ
IPS deployment, Sample Deployments
SRX Series devices firewall deployment, The Junos Enterprise Services Reference Network
DNS (Domain Name System), Domain Name System
address objects, DNS address objects
DOCSIS 3.0 card, Interface modules for the SRX200 line
DoS attack (see denial-of-service (DoS) attacks)
dotted decimal format, How to Use This Book
downgrade process, for Junos, Software management
downloading
for Application Identification (AI) sigpacks, Downloading and Installing Application Identification Sigpacks, Enabling application identification heuristics
Drop-Connection IPS action, IPS actions
Drop-Packet IPS action, IPS actions
DSCP (differentiated Services Code Point), Differentiated Services Code Point
field rewrite, DSCP rewrite
dual control links, Configuring the Control Ports
dual mastership, Configuring the Control Ports
dyamic routing network protocols, Dynamic Routing Protocols
dynamic attack groups, Custom attack objects and groups, Dynamic attack groups
best practices, Best Practices
configuring, Configuring static and dynamic attack groups
dynamic gateways, configuring, Configuring dynamic gateways and remote access clients
dynamic group objects, Sample Deployments
Dynamic Host Configuration Protocol (DHCP) (see DHCP (Dynamic Host Configuration Protocol))
dynamic IP address
configuring IKE gateway with, Configuring an IKE gateway with a dynamic IP address
configuring remote gateways with, Configuring IKEv1 Phase 1 gateways
dynamic VPN, Dynamic VPN, Dynamic VPN, Best Practices
interface for, Best Practices
dynamic VPN client, Branch-Specific Features
licensing, Licensing

E

egress interface, Security zones, NAT Precedence in the Junos Event Chain
egress traffic, NPUs for, Data Center SRX Series Session Setup, Data Center SRX Series Session Setup
egress zone, Inherited ScreenOS features
embryonic session, Data Center SRX Series Session Setup
Encapsulating Security Payload (ESP), SRX100 Series, Phase 2 IKE negotiation modes, IPsec VPN Protocol
best practices, Best Practices
vs. AH, Selecting the Appropriate VPN Configuration
encrypted applications, AppFW with, AppFW with encrypted applications
encryption (see Internet Key Exchange (IKE)) (see IPsec VPN (IP Security virtual private network))
encryption algorithms
configuring, Configuring Phase 1 proposals, Configuring IKEv1 Phase 2 proposals
in IPsec VPN, IPsec Encryption Algorithms, Selecting the Appropriate VPN Configuration
End to End Data-path Debug, Performing a Packet Capture on the High-End SRX
ending sessions, Data Center SRX Series Session Setup
Engine-not-ready option, for Sophos engine, Sophos AV feature profiles
Enhanced Websense Filtering, Antivirus + URL Filtering+ IPS?
enterprise management, Management Interfaces
error statistics, Monitoring Interface Counters
ESP (Encapsulating Security Payload), Phase 2 IKE negotiation modes, IPsec VPN Protocol
best practices, Best Practices
vs. AH, Selecting the Appropriate VPN Configuration
Ethernet, How to Use This Book
Ethernet ports
on SRX100, SRX100 Series
on SRX210, SRX200 Series
etheroptions hierarchy
adding interfaces to aggregate device, Aggregate Interfaces
for physical interfaces, Physical Interfaces
event mode, vs. stream mode, for data plane logs, Data plane logs: Event versus Stream mode
Exempt rulebase, Rulebases
Expedited forwarding class, Forwarding class, Configuring an AppQoS example
explicit drop rules, Best Practices
exploit-based denial-of-service (DoS) attacks, Exploit-Based DoS
exporting flow records, JFlow on the SRX
ExpressCard slot, on SRX210, SRX200 Series
Extensible Markup Language (XML) interface
Junos CLI as, Device management
external certificate, importing, Configuring SSL Forward Proxy on the SRX
external interface, configuring for IPsec VPN, Configuring IKEv1 Phase 1 gateways
extreme mode, in SRX3400, SRX3000 Series

F

fab interface, Configuring the Fabric Links
fabric chip, IOC modules
fabric links, The Data Plane
configuring, Configuring the Fabric Links, Configuring the Fabric Links
redundant, Configuring the Fabric Links
verifying, First Steps
Facebook, rule blocking, Three types of Application Firewall rulesets
failover, Fault Monitoring
hold-down timer to prevent in chassis cluster, Redundancy Groups
information to handle traffic, The Data Plane
manual, Manual Failover, Manual Failover
multiple interfaces in zone for, One interface per zone versus multiple interfaces per zone
for service provider, Mobile Carriers
fallback options
for Kaspersky Full AV, Kaspersky Full AV
for Sophos engine, Sophos AV feature profiles
false positives and false positives, in IPS, False Positives and False Negatives in IPS
family (protocol), Logical Interfaces
family bridge, in transparent mode, Interfaces, family bridge, and bridge domains in transparent mode
fast-path SPU processing, Fast-path SPU packet processing
fault monitoring, Fault Monitoring, Preserving the Control Plane
hardware monitoring, Hardware Monitoring, Power supplies
interface monitoring, Interface Monitoring, Interface Monitoring
IP monitoring, IP Monitoring
File Transfer Protocol (FTP), Application Layer Gateways
antivirus feature for, Branch-Specific Features
File Usage panel, Informational panels
file-based protection, IPS and UTM
filesystem interfaces, on control plane, System services that operate on the control plane
FIN-No-ACK Screen, FIN-No-ACK Screen
financial network, data center SRX Series for, SRX5000 Series
Firefox, J-Web: Your On-Box Assistant
firewall filter, Flow Mode and Packet Mode
firewall policies, Firewall policies
Junos OS management, Firewall policy management
lookup, Packet Flow
rules defining objects to be excluded, Negated source and destination objects
firewalls, Foreword
importance of, Welcome to the SRX
Flash, Shifting Threats
Flex IOC card, IOC modules
flexible PIC concentrator (FPC), Physical Interfaces, Chassis Cluster
slots for, SRX3000 Series
flood-based denial-of-service (DoS) attacks, Flood-Based DoS
flood-based Screens, Best Practices
flooding frame, MAC Address Learning
flow
and IP VPNs, Flow Processing and IPsec VPNs
debugging, Flow Debugging with NAT, Static NAT
in transparent mode, Transparent Mode Flow Process
viewing exceptions, Viewing Flow Exceptions
flow mode, Branch-Specific Features, Flow Mode and Packet Mode, Flow Mode and Packet Mode
in branch SRX Series, Branch Summary
flow options, SRX Flow Options, Configuring the TCP initial session timeout and TCP time wait timeout
aggressive session aging, Aggressive session aging
TCP sequence checks, TCP sequence checks, Configuring TCP sequence checks
flow records, exporting, JFlow on the SRX
flow trace, troubleshooting, Performing a Flow Trace, Performing a Flow Trace
flowd daemon, The Data Plane
IPS-bound traffic processed by, Packet processing path
RE monitored by, Software Monitoring
forwarding classes, Forwarding class
FPC (flexible PIC concentrator), Physical Interfaces
FQDN (fully qualified domain name)
as IKE identity, IKE Identities
in SSL certificate, AppFW with encrypted applications
fragmentation
configuring, Configuring common IPsec VPN components
in IPS processing, Packet processing path
in IPsec VPN, Fragmentation
FreeBSD, ScreenOS to Junos
from zone, Security zones, NAT Precedence in the Junos Event Chain
in IPS policy, Match criteria
FTP (File Transfer Protocol), Application Layer Gateways
antivirus feature for, Branch-Specific Features
fully qualified domain name (FQDN), as IKE identity, IKE Identities
Fun WebProducts spyware, Exempt rulebase
functional zones, Functional Zones, Functional Zones
fxp0 interface, Routing Instances, Accessing System Services: Control Plane Versus Data Plane, Managing Cluster Members
management port, Management Interfaces

G

G-PIM slots, SRX600 Series, Interface modules for the SRX600 line
G.SHDSL standard, Interface modules for the SRX200 line
GARPs, Configuring Interfaces
gateway configuration
for IKEv1 Phase 1, Configuring IKEv1 Phase 1 gateways, Configuring IKEv1 Phase 1 gateways
for IPsec VPN, Configuring common IPsec VPN components
Generic Route Encapsulation (GRE), SRX100 Series
global security policies, Security Policy Precedence
Google Chrome, J-Web: Your On-Box Assistant
granularity, of SRX IPS implementation, Packet processing path
Gratuitous ARPs (GARPs), High Availability with Transparent Mode
Group VPN, Group VPN
groups in Junos, Node-Specific Information
groups.xml file, Useful IPS files
GUI management, Acknowledgments, SRX GUI Management
(see also J-Web tool)

H

hardware
monitoring, Hardware Monitoring, Power supplies
Screens in, Screens in Hardware and Software
hashing, IPsec Authentication Algorithms
heartbeat timers, configuring, Configuring Heartbeat Timers
help command, for logs, Tips for Viewing Syslog Messages
heuristic-based detection of applications, Heuristic-based detection, Enabling application identification heuristics
High Availability (HA), Medium Branch
basics, High Availability
chassis clusters, Chassis Cluster, Getting Started with High Availability, Six pack
deployment concepts, Deployment Concepts, Six pack
node-specific information, Node-Specific Information, Node-Specific Information
reth interface for, Aggregate Interfaces
SNMP in, SNMP in High Availability Chassis Clusters
control plane and, The Control Plane
data plane and, The Data Plane
fault monitoring, Fault Monitoring, Preserving the Control Plane
hardware monitoring, Hardware Monitoring, Power supplies
interface monitoring, Interface Monitoring, Interface Monitoring
IP monitoring, IP Monitoring, IP Monitoring
IPsec termination in, IPsec termination in HA
preparing devices for deployment, Preparing Devices for Deployment, Redundancy Groups
and source NAT with Port overloading, Other SRX source NAT configuration options
troubleshooting, Troubleshooting and Operation, Manual Failover
with transparent mode, High Availability with Transparent Mode
hijacking attacks, preventing, TCP sequence checks
Hit Count output, Security policy tools
hold-down timer
failover prevention in chassis cluster, Redundancy Groups
manual failover and, Manual Failover
honored sessions, Operating Application QoS
host inbound traffic configuration, Functional Zones
host security policies, Host security policies
hostname
defining, Task wizards
as IKE identity, IKE Identities
troubleshooting, VPN troubleshooting process
Hostname attribute, Selecting the Appropriate VPN Configuration
hub and spoke IPsec VPN, Hub and Spoke IPsec VPNs
best practices, Best Practices
hybrid approach to firewall rules, Three types of Application Firewall rulesets, Configuring a hybrid application ruleset
best practices, AppFW
when to use, When to use blacklist, whitelist, and hybrid rulesets
HyperText Transfer Protocol (HTTP), antivirus feature for, Branch-Specific Features
hypervisor, JunosV Firefly (Virtual Junos)

I

IC enforcer, configuring SRX as, Configuring the SRX as an IC enforcer
ICMP (Internet Control Message Protocol), How to Use This Book
DoS attacks with, DoS Attacks with ICMP, Configuring the ICMP Ping of Death Screen
fragment screen, ICMP Fragment Screen
IP sweep screen, ICMP IP Sweep Screen
large packet screen, ICMP Large Packet Screen
ping of death screen, ICMP Ping of Death Screen
for VPN monitoring, VPN Monitoring
ICMP flood screen, ICMP Flood Screen
ICMP reset, Action Criteria
idle timeout, for application object, Application objects
IDPD process, System Services and the Data Plane
IFD, Physical Interfaces
IFL, Physical Interfaces
Ignore-Connection IPS action, IPS actions
Ignore-Server-Auth-Failure option, in SSL Proxy profile, Configuring SSL Forward Proxy on the SRX
IKE (Internet Key Exchange)
AutoKey vs. manual keys, Selecting the Appropriate VPN Configuration
best practices, Best Practices
configuring connection sharing, Configuring dynamic gateways and remote access clients
identities, IKE Identities
negotiations, IKE Negotiations
authentication, IKE Negotiations
Phase 1 authentication, VPN troubleshooting process
version 1, IKE Version 1 Overview, Proxy ID negotiation
configuring gateway with static IP, Configuring an IKEv1 gateway with static IP address and DPD
configuring gateways, Configuring IKEv1 Phase 1 gateways, Configuring IKEv1 Phase 1 gateways
configuring with certificates, Configuring IKEv1 Phase 1 IKE policy with certificates
configuring with preshared key, Aggressive mode, Configuring IKEv1 Phase 1 IKE policy with preshared key, Aggressive mode
configuring with preshared key, Main mode, Configuring IKEv1 Phase 1 IKE policy with preshared key, Main mode
key lifetimes, IKEv1 Key Lifetimes
phase 1 configuration, Phase 1 IKE Configuration, Phase 2 IKE Configuration
phase 1 negotiation modes, Phase 1 IKE negotiation modes
phase 2 configuration, Phase 2 IKE Configuration, IKEv1 Versus IKEv2 Configuration
phase 2 negotiations, Phase 2 IKE negotiation modes
vs. version 2 configuration, IKEv1 Versus IKEv2 Configuration, IPsec and SRX HA
version 2, IKE Version 2
vs. version 1, IKEv1 versus IKEv2
IKE identity, Selecting the Appropriate VPN Configuration
IKE-ID, IKE Identities
IMIX number, Data Center SRX Series Hardware Overview
importing external certificate, Configuring SSL Forward Proxy on the SRX
in-band management, Management Interfaces
inactivity timeout, for application object, Application objects
inbound management requests, policy to restrict, Configuring a policy to restrict inbound or outbound management requests
ineligible control plane state, Activating Juniper Services Redundancy Protocol
Inet, for transform definition, Static NAT transforms
infection attempts, Stages of a System Compromise
information availability, High Availability
Information severity level of attacks, Severities
information, expansion, Preface
Infranet controller (IC)
best practices, UserFW
configuring, Configuring the IC, Configuring realms, roles, and sign-in policies
firewall rules for clients to communicate with, Configuring the SRX for UserFW
service account for, Operating UserFW
troubleshooting facilities on, Operating UserFW
ingress interface, Screen processing in, Screen Processing only happens on the ingress interface
ingress point for data center, Data Center
ingress traffic
NPUs for, Data Center SRX Series Session Setup
policing, Configuring and Deploying Application Quality of Service
ingress zone, Inherited ScreenOS features
inline tap mode, for data center SRX Series, Data Center SRX-Specific Features
input/output cards (IOCs), Interface card
installing
for Application Identification (AI) sigpacks, Downloading and Installing Application Identification Sigpacks, Enabling application identification heuristics
security packages, troubleshooting,, Troubleshooting and Monitoring Security Package Installation, Checking Policy Compilation Status
interface binding, configuring, Configuring route-based VPNs
interface cards
monitoring, Interface card
for SRX1400, SRX1000 Series
interface counters, monitoring, Monitoring Interface Counters, Performing a Flow Trace
interface modes, in transparent mode, Interface Modes in Transparent Mode
interface modules
for SRX200 Series, Interface modules for the SRX200 line
for SRX3600, IOC modules
for SRX600 Series, Interface modules for the SRX600 line
interface range command, Switching Configuration
interfaces, Interfaces, Transparent Interfaces
adding to routing interfaces, Configuring Routing Instances
addressing in transparent mode, Interfaces, family bridge, and bridge domains in transparent mode
aggregate, Aggregate Interfaces, LACP protocol
configuring, Configuring Interfaces, Configuring Interfaces
to allow IKE traffic, Configuring IKEv1 Phase 1 gateways
displaying, Physical Interfaces
IRB, IRB Interfaces
J-Web for managing, Interfaces
logical, Logical Interfaces, Logical Interfaces
management, Management Interfaces, Management Interfaces
as members of reth, Configuring Interfaces
monitoring, Interface monitoring, Interface Monitoring, Interface Monitoring
number per zone, One interface per zone versus multiple interfaces per zone
numbering format, Chassis Cluster
output of statistics, Viewing Flow Exceptions
physical, Physical Interfaces, Physical Interfaces
in redundancy group, Redundancy Groups
in source NAT, Interfaces, Interfaces
source NAT examples with, Source NAT with interfaces, Source NAT with interfaces
statistics on, Checking interface statistics
transparent, Transparent Interfaces
troubleshooting, Checking Interfaces
virtual, Virtual Interfaces
for VPN, terminating, VPN troubleshooting process
internal clients, IPS deployment, Sample Deployments
internal servers, IPS deployment, Sample Deployments
Internet Explorer, J-Web: Your On-Box Assistant
Internet Key Exchange (IKE) (see IKE (Internet Key Exchange))
Internet Message Access Protocol (IMAP), antivirus feature for, Branch-Specific Features
interzone security policies, Security Policy Precedence
intrazone security policies, Security Policy Precedence, Top to Bottom Policy Evaluation
intrusion detection and prevention (IDP), Is It IDP or IPS?
intrusion prevention systems (IPS), Preface
actual deployment, Actual Deployment
attack object types, Attack Object Types, Signature performance impacts
best practices, Best Practices, Best Practices
configuring, Configuring IPS Features on the SRX, Deploying and Tuning IPS
automatic updates, Configuring automatic updates
creating, activating and referencing, Creating, activating, and referencing IPS, Creating, activating, and referencing IPS
example, Getting started example
Exempt rulebase, Exempt rulebase
GZIP/Deflate Decompression, Enabling GZIP/Deflate Decompression
static and dynamic attack groups, Configuring static and dynamic attack groups
data center SRX Series features for, Data Center SRX-Specific Features
for data center servers, Branch-Specific Features
day-to-day management, Day-to-Day IPS Management
deploying and tuning, Deploying and Tuning IPS, Day-to-Day IPS Management
deployments, Sample Deployments, Summary
false positives and false negatives, False Positives and False Negatives in IPS
firewall inspection of attack vs., How Does IPS Work?
how it works, How Does IPS Work?, Dynamic attack groups
Junos Space and IPS signature downloads, Configuring automatic updates
licensing, Licensing
management functionality on SRX, Management IPS Functionality on the SRX
need for, The Need for IPS, Antivirus + URL Filtering+ IPS?
packet processing, IPS Packet Processing on the SRX, SRX deployment options
policy components, IPS Policy Components
actions, Then actions, Targets and timeouts
match criteria, Match criteria
rulebases, Rulebases
sensor attributes, Sensor Attributes
SRX deployment options, SRX deployment options
testing policy, Testing Your Policy, Leveraging sniffer mode for the deployment
troubleshooting, Troubleshooting and Operation, IP Action Table
attack table, IPS Attack Table
checking policy compilation status, Checking Policy Compilation Status
checking security package version, Checking Security Package Version
checking status of, Checking IPS Status
counters for, IPS Counters
security package installation, Troubleshooting and Monitoring Security Package Installation, Checking Policy Compilation Status
useful files, Useful IPS files
and UTM, IPS and UTM
viewing attack objects and group membership, Viewing IPS attack objects and group membership
vs. deep inspection/IPS Lite, What Is the Difference Between Full IPS and Deep Inspection/IPS Lite?
vs. UTM, Unified Threat Management
IP action table, troubleshooting, IP Action Table
IP actions, IP actions
IP addresses, How to Use This Book
on aggregate interface, Aggregate Interfaces
configuration, Logical Interfaces
displaying, Interfaces
as IKE identity, IKE Identities
mapping object to, Address objects
reporting by geographic location, Reporting with STRM
IP fragments, Block Frag Screen
IP monitoring, IP Monitoring
IP options field, Bad IP Option Screen
IP prefix address objects, IP prefix address objects
IP prefix, for transform definition, Static NAT transforms
IP protocols, DoS attacks with, DoS Attacks with IP Protocols, Configuring the Unknown IP Protocol Screen
IP range objects, IP range objects
IP Security Option Screen, IP Security Option Screen
IP Security virtual private network (IPsec VPN), IPsec VPN
IP Session Limit Screens, Aggressive session aging
IP Spoofing Screen, IP Spoofing Screen
IP Stream Option Screen, IP Stream Option Screen
IP Tear Drop Screen, IP Tear Drop Screen
IP Timestamp Option Screen, IP Timestamp Option Screen
IP-Block action, IP actions
IP-Close action, IP actions
IP-Notify action, IP actions
IPS, Acknowledgments, Data Center Services Tier
(see also intrusion prevention systems (IPS))
IPS rulebase, creating, Creating, activating, and referencing IPS
IPsec
access to SRX Series firewalls, The Junos Enterprise Services Reference Network
caveats on SRX, IPsec Caveats on SRX
configuring Phase 2 policy, Configuring Phase 2 IPsec policy
statistics on, show security ipsec statistics
termination in HA, IPsec termination in HA
IPsec VPN (IP Security virtual private network), IPsec VPN
anti-replay protection for, Anti-Replay Protection
architecture overview, VPN Architecture Overview, Remote Access VPNs
authentication algorithms, IPsec Authentication Algorithms
best practices, Best Practices, Best Practices
certificate validation, Certificate Validation
configuring, IPsec VPN Configuration
certificate preconfiguration tasks, Certificate Preconfiguration Tasks
NTP, Configuring NTP
differentiated Services Code Point (DSCP), Differentiated Services Code Point
encryption algorithms, IPsec Encryption Algorithms
flow process and, Flow Processing and IPsec VPNs
fragmentation, Fragmentation
IKE version 1, IKE Version 1 Overview, Proxy ID negotiation
manual keys, IPsec Manual Keys
mode, IPsec VPN Mode
Network Time Protocol (NTP) for, Network Time Protocol
preshared key authentication, Preshared key authentication
vs. certificate, Selecting the Appropriate VPN Configuration
vs. SSL VPNs, Remote Access VPNs
IPv4, Logical Interfaces
IPv6
enabling flow-based or packet-based processing, Flow Mode and Packet Mode
encapsulation, Flow Mode and Packet Mode
NAT automatic translation, Option 3: NAT 64 automatic translation
NAT translation of IPv4 to, Option 2: NAT46 Static mapping
packet fragments on, Block Frag Screen
protocol versions for, Dynamic Routing Protocols
route configuration, Static Routing
Screens and, Screen Theory and Examples
support for IPsec, IPv6 and IPsec on the SRX
IRB (integrated routing and bridging) interfaces, IRB Interfaces
configuring, Configuring Integrated Routing and Bridging, Configuring Integrated Routing and Bridging, Sample Deployments
IS-IS routing protocol, Dynamic Routing Protocols
ISSU (unified in-service software upgrade), Configuring the Control Ports
for VPN, ISSU for VPN

J

J-Net community, When All Else Fails
J-Web tool, Device management, SRX GUI Management, J-Web: Your On-Box Assistant, Network connectivity
configuration management, Configuration management
dashboard, Dashboard, Informational panels
chassis view, Chassis view, Chassis view
customizing, Informational panels
informational panels, Informational panels, Informational panels
device configuration, Device Configuration, Point and click CLI
task wizards, Task wizards, Task wizards
interface management, Interfaces
monitoring with, Monitoring Your SRX
operational tasks, Operational Tasks, Disk management
Ping option, Network connectivity
point and click CLI, Point and click CLI
rebooting, Rebooting
troubleshooting with, Troubleshooting from J-Web
viewing security logs, Viewing Security Logs Locally
Java, Shifting Threats
JavaScript, Shifting Threats
JFlow format, JFlow on the SRX
best practices, Best Practices
JFlow record export, SRX Logging and Flow Records
jsrpd daemon, System services that operate on the control plane, The Control Plane, The Data Plane, Activating Juniper Services Redundancy Protocol
heartbeat messages, Data link
logging, The Dreaded Priority Zero
JTAC, When All Else Fails
jumbo frame, Data Center SRX Series Hardware Overview, Configuring the Fabric Links
Juniper Day One Library, How to Use This Book
Juniper Group VPN solution, Group VPN
Juniper Knowledge Base, Transparent Mode Troubleshooting Steps
Juniper Local URL filtering, pros and cons, Which URL filtering solution to choose?
Juniper Networks, Preface
AX411 Wireless LAN Access Point, Branch-Specific Features, AX411, CX111
CX111 Cellular Broadband Data Bridge, Branch-Specific Features, CX111
EX Series Ethernet Switches, Large Branch
J Series Services Routers, Branch-Specific Features
management paradigm, Cloud Networks
MX960 3D Universal Edge Router, Service Provider
resources for learning SRX, When All Else Fails
SA Series SSL VPN Appliances, Branch-Specific Features
Juniper Networks SRX Series products, Foreword, Acknowledgments, Acknowledgments, Welcome to the SRX
(see also branch SRX series)
(see also data center SRX Series)
deployment solutions, Deployment Solutions, The Junos Enterprise Services Reference Network
cloud networks, Cloud Networks, Cloud Networks
data center, Data Center
large branch, Large Branch, Large Branch
medium branch, Medium Branch
mobile carriers, Mobile Carriers, Mobile Carriers
service provider, Service Provider, Service Provider
small branch, Small Branch
development, Preface
hardware platform, The SRX Series Platform, Built for Services
inherited ScreenOS features, Inherited ScreenOS features
predecessors, Evolving into the SRX
SRX100, Small Branch, The Junos Enterprise Services Reference Network, SRX100 Series, SRX100 Series
capacities, SRX100 Series
SRX110, SRX100 Series
SRX1400, Data Center Edge
SRX200 Series, SRX200 Series, Interface modules for the SRX200 line
interface modules for, Interface modules for the SRX200 line
SRX210, Small Branch
capacities, SRX200 Series
enhanced version, SRX200 Series
SRX220, SRX200 Series
capacities, SRX200 Series
SRX240, Medium Branch, The Junos Enterprise Services Reference Network, SRX200 Series
capacities, SRX200 Series
SRX3000, Data Center Edge, Interface card
SRX Clustering Module, Configuring the Control Ports
SRX5000 Series, Preface, Interface card
control ports, Configuring the Control Ports
switch control board (SCB), Switch control board
SRX550, Medium Branch, Large Branch
SRX5800, Data Center Services Tier, The Junos Enterprise Services Reference Network
for mobile carrier networks, Mobile Carriers
PIC status, Verifying the Data Plane
SRX5800 Services Gateway
in cloud network, Cloud Networks
SRX650, Large Branch, The Junos Enterprise Services Reference Network
upgrade process, Software management
VPN components, Other SRX VPN Components, Dynamic VPN
VPN types, SRX VPN Types, Which should you use: Policy- or route-based VPN?
policy-based, Policy-Based VPNs
route-based, Route-Based VPNs
Juniper Services Redundancy protocol, activating, Activating Juniper Services Redundancy Protocol
Juniper Support
Knowledge Base, Application contexts
Technical Bulletins, Attack database
juniper-nsp mailing list, When All Else Fails
Junos Enterprise Services Reference Network, The Junos Enterprise Services Reference Network, The Junos Enterprise Services Reference Network
Junos OS, Preface, Preface, ScreenOS to Junos
common shared codebase, Built for Services
control plane, System Services and the Control Plane
device management, Device management, Device management
downgrade process for, Software management
modular architecture, ScreenOS to Junos
SNMP MIB, Junos SNMP MIB
Junos Script, Device management
Junos Space, Device management, Centralized Management, Space: The Final Frontier of Management, Firewall policy management
application dashboard, The Junos Space ecosphere
firewall policy management, Firewall policy management
and IPS signature downloads, Configuring automatic updates
Security Director, Security Director
viewing IPS attack objects in, Viewing IPS attack objects and group membership
junos-host zone type, Host security policies
Junos-Local Feature profile, Juniper Local feature profile options
junos:web, vs. junos:HTTP, Configuring a whitelist application ruleset
JunosV Firefly (virtual Junos), JunosV Firefly (Virtual Junos)

L

LACP (Link Aggregate Control Protocol), LACP protocol
LAND Attack Screen, LAND Attack Screen
large branch deployment, Large Branch
reference network, The Junos Enterprise Services Reference Network
latency issues, VPN design and, Full Mesh VPNs
Layer 2 active/active mode, High Availability with Transparent Mode
Layer 2 domain, transparent mode for segmenting, Segmenting a Layer 2 domain
Layer 2 loop, Spanning Tree
Layer 2 security zone, Transparent Mode Zones
Layer 2 switch, destination MAC addresses and, MAC Address Learning
Layer 2, switching from Layer 3, Configuring Transparent Mode Basics
Layer 3 mode, Transparent Interfaces
Layer 3/Layer 4 applications, creating, Creating Layer 3/Layer 4 applications
layered security, IPS and UTM
least privilege concept
for Screens, Best Practices
for security policy, Best Practices
licensing
AppSecure, AppSecure Licensing
for branch SRX series, Licensing
intrusion prevention systems (IPS), Licensing, Getting Started with IPS on the SRX
key, and SRX100 memory, SRX100 Series
Unified Threat Management (UTM), UTM Licensing
configuring, Configuring Licensing
User Role Firewall, UserFW packaging and licensing
UTM features, UTM Engine
line rate switching, Branch-Specific Features
Link Aggregate Control Protocol (LACP), LACP protocol
load sharing, active/active deployment for, Active/active
local interfaces, Interfaces, Mixed mode, Configuring Interfaces, Configuring Interfaces
six pack deployment, Six pack
Local URL filtering, URL filtering flavors, URL Filtering
default profile, Default local URL filtering profile
profile options, Juniper Local feature profile options
local users, configuration, Configuring local users
Log/Log-Create action, IP actions
logging, SRX Logging and Flow Records, JFlow on the SRX
AppQoS, Logging
by AppTrack, Configuring and Deploying AppTrack
best practices, Best Practices
to control plane, configuring Event mode, Configuring Event mode logging to the control plane
data plane vs. control plane, Control Plane Versus Data Plane Logs
on firewall policies, Best Practices
formats, Configuring Stream mode logging on the data plane, Syslog format types
for IPS monitoring, Day-to-Day IPS Management
packets in IPS, Packet logging
sample firewall, Sample firewall logs
sampling rates for, JFlow on the SRX
in security policy, Action Criteria
in SSL Proxy profile, Configuring SSL Forward Proxy on the SRX
STRM for managing, Log Management with STRM
UTM messages, Logging UTM Messages
viewing with NAT, View Firewall Logs with NAT
logical interfaces, Physical Interfaces, Logical Interfaces, Logical Interfaces, One interface per zone versus multiple interfaces per zone
login
to J-Web tool, J-Web: Your On-Box Assistant
for local users, Configuring local users
login class, creating, Creating a login class
Login Sessions panel, Informational panels
loop, in routed network, Spanning Tree
Loose Source Route Option, Route Option Screens
loss priority, Loss priority

M

MAC (see media access control (MAC) addresses)
MAG Pulse appliance, The Junos Enterprise Services Reference Network
Main mode for IKE negotiation, Main mode, Configuring IKEv1 Phase 1 IKE policy with preshared key, Main mode
vs. Aggressive mode, Selecting the Appropriate VPN Configuration
Major severity level of attacks, Severities
malware, IPS and UTM, Shifting Threats
managed service provider (MSP) environment, Service Provider
Management Daemon (MGD), System services that operate on the control plane
management interface, Management Interfaces, Management Interfaces
management paradigm, for Juniper Networks, Cloud Networks
management services, Management Services, Junos SNMP MIB
best practices, Best Practices
command-line interface (CLI), Command-Line Interfaces, Configuring SSH access
management zone, Functional Zones
manual failover, Manual Failover, Manual Failover
manual key exchange, IKE Version 1 Overview
many-to-many mapping, static NAT, Static NAT many-to-many mapping, Option 3: NAT 64 automatic translation
Mark-Diffserv IPS action, IPS actions
master-only IP, Node-Specific Information
match criteria, in security policy, Match Criteria, Configuring schedulers
match policy, Security policy tools
matched sessions, Operating SSL Forward Proxy
maximum connectivity, example SRX5800 configuration for, SRX5000 Series
maximum segment size (MSS), Fragmentation
maximum transmission unit (MTU), Fragmentation
MD5 (Message-Digest algorithm 5), IPsec Authentication Algorithms
media access control (MAC) addresses, How to Use This Book
learning, MAC Address Learning
for reth, Interfaces
troubleshooting, Transparent Mode Troubleshooting Steps
unknown destination, Transparent Mode Specific Options
medium branch location, deployment to, Medium Branch
memory
on SRX100, SRX100 Series
Resource Utilization panel to display, Informational panels
Message-Digest algorithm 5 (MD5), IPsec Authentication Algorithms
metric options, for static routing, Static Routing
MGD (Management Daemon), System services that operate on the control plane
MIB (Management Information Base), monitoring, Junos SNMP MIB
mini-PIMs, Interface modules for the SRX200 line
Minor severity level of attacks, Severities
mixed mode, for high availability clusters, Mixed mode
mobile carriers
data center SRX Series for, SRX5000 Series
deployment of, Mobile Carriers, Mobile Carriers
mobility, of computing devices, User Role Firewalling
monitor flow, Performing a Flow Trace
MPLS, Branch-Specific Features, Branch Summary
MSP (managed service provider) environment, Service Provider
MSS (maximum segment size), Fragmentation
MTU (maximum transmission unit), Fragmentation
Multiple Spanning Tree Protocol (MSTP), Spanning Tree, Spanning Tree Protocol in transparent mode Layer 2 deployments
interfaces to enable, Spanning Tree
Muus, Mike, Network connectivity

N

names
for rib, Static Routing
for routing instances, Configuring Routing Instances
for zones, Sample Deployment
NAT (see Network Address Translation (NAT))
NAT scenarios, in session table, Viewing the Firewall Session Table
National Institute of Standards and Technology (NIST), IPsec Encryption Algorithms
negated objects, source and destination, for security zones, Negated source and destination objects
nested application signatures, Nested application signatures
NETCONF protocol, Device management
NetConf protocol, Space: The Final Frontier of Management
enabling over SSH, Enabling NetConf over SSH
NetScreen Screen OS platforms, Preface
NetScreen Security Manager (NSM), Legacy Security Management, Using NSM
NetScreen Technologies, Evolving into the SRX
Network Address Translation (NAT), Acknowledgments, Acknowledgments, Network Address Translation
(see also source NAT)
(see also static NAT)
best practices, Best Practices
Junos components, Junos NAT Components, When you don’t need Proxy-ARP/NDP
Junos fundamentals, Junos NAT Fundamentals, NAT type precedence
types, Junos NAT Types
keepalives configuration, Configuring IKEv1 Phase 1 gateways
need for, The Need for NAT
in practice, Junos NAT in Practice
precedence in Junos event chain, NAT Precedence in the Junos Event Chain, NAT type precedence
rules, NAT Rules
ScreenOS for, The SRX Series Platform
security policies and, NAT and Security Policies
troubleshooting, NAT Rule and Usage Counters
flow debugging, Flow Debugging with NAT, Static NAT
rule and usage counters, NAT Rule and Usage Counters, Viewing the Session Table
session table, Viewing the Session Table, View NAT Errors
viewing firewall logs, View Firewall Logs with NAT
viewing errors, View NAT Errors, View Firewall Logs with NAT
Network Address Translation Traversal (NAT-T)
configuring, Configuring IKEv1 Phase 1 gateways
VPN and, NAT Traversal
Network and Security Manager (NSM), Device management, Centralized Management, Management IPS Functionality on the SRX
Network Control forwarding class, Forwarding class
network design, security policy enforcement and, Best Practices
network processing card (NPC), monitoring, Network Processing Card
Network Processing Units (NPUs), NPU, NPU
for scaling, Data Center SRX Series Hardware Overview
network protocols, Preface, SRX Networking Basics, Functional Zones, Basic Protocols, Spanning Tree
decoding in IPS processing, Packet processing path
dynamic routing, Dynamic Routing Protocols
Network Time Protocol (NTP), Network Time Protocol, Configuring the SRX as an NTP server, Best Practices
best practices, Best Practices
for IPsec VPN, Network Time Protocol
configuring, Configuring NTP
SRX configuration as server, Configuring the SRX as an NTP server
network-based threats, IPS and UTM
networking
attacker use of ICMP to map, ICMP IP Sweep Screen
sample deployment, Sample Deployment, Sample Deployment
troubleshooting
connectivity, Network connectivity
equipment, Transparent Mode Troubleshooting Steps
networking services, Networking Services, Configuring the SRX as a DHCP relay server
on control plane, System services that operate on the control plane
DHCP (Dynamic Host Configuration Protocol), Dynamic Host Configuration Protocol
DNS (Domain Name System), Domain Name System
Next Generation Services Processing card, monitoring, Services Processing Card/Next Generation Services Processing Card
next-hop keyword, Static Routing
Next-Hop Tunnel Binding (NHTB), Special point-to-multipoint attributes
NG-PSU (next-generation power supply units), SRX5000 Series
NG-SPC (Next Generation SPC), NG-SPC
NHTB (Next-Hop Tunnel Binding), Special point-to-multipoint attributes
nine-tuple, Packet Flow
NIST (National Institute of Standards and Technology), IPsec Encryption Algorithms
No-Action IPS action, IPS actions
best practices, Best Practices
no-NAT rules, with source or destination NAT, No-NAT with Source or Destination NAT, No-NAT with Source or Destination NAT
no-old-master-upgrade command, Configuring the Control Ports
node ID, Node ID
nonalphameric characters, in preshared keys, Preshared key authentication
notification actions in IPS, Notification actions
Notification options, in Sophos feature profile, Sophos AV feature profiles
NPU (network processor), IOC modules
bundling, NPU
NSM (see Network and Security Manager (NSM))
NSPC card, for SRX1400, SRX1000 Series
NTP (see Network Time Protocol (NTP))

O

objects, defining in global zone, Address books
OCSP (Online Certificate Status Protocol), Certificate Validation, Certificate Validation
Office documents, attacks using, Shifting Threats
office environment, reference network, The Junos Enterprise Services Reference Network
one-to-one mapping, static NAT, Static NAT one-to-one mapping, Static NAT one-to-one mapping
OneSecure, Is It IDP or IPS?
Online Certificate Status Protocol (OCSP), Certificate Validation, Certificate Validation
OpenSSH, Configuring SSH access
Optimized option, for SRX VPN monitoring, VPN Monitoring
OSI (Open Systems Interconnection) model, How to Use This Book
Out of resources option, for Sophos engine, Sophos AV feature profiles
out-of-band attacks, listening for, SRX deployment options
out-of-band network, for management, Management Interfaces
outbound management requests, policy to restrict, Configuring a policy to restrict inbound or outbound management requests
overflow pools in NAT, Pools
best practices, Best Practices

P

Packet Captures (PCAPs), Performing a Packet Capture on SRX Branch, Performing a Packet Capture on SRX Branch
best practices, Best Practices
on high-end SRX, Performing a Packet Capture on the High-End SRX, Performing a Packet Capture on the High-End SRX
for troubleshooting, Packet capture
packet filters, Preface
packet flooding, Transparent Mode Specific Options
packet flow, Packet Flow, Packet Flow
NAT and, NAT Precedence in the Junos Event Chain
Screens and, How Screens Fit into the Packet Flow
Packet Forwarding Engine (PFE), Built for Services
packet mode, Branch-Specific Features, Flow Mode and Packet Mode
in branch SRX Series, Branch Summary
packet rate, Data Center SRX Series Hardware Overview
packet size, Data Center SRX Series Hardware Overview
packet-based Screens, Packet versus threshold Screens
packets
fragmentation, Block Frag Screen
in ICMP, ICMP Large Packet Screen
processing for IPS, IPS Packet Processing on the SRX, SRX deployment options
processing in IPS
logging, Packet logging
TCP fragmentation of, SYN-Frag Screen
parallel processing, Branch SRX Series Hardware Overview, Branch SRX Series Hardware Overview
partial mesh VPNs, Partial Mesh VPNs
pathfinder tool, How to Use This Book
PCAPs (see Packet Captures (PCAPs))
PDF documents, attacks using, Shifting Threats
Perfect Forward Secrecy (PFS), Perfect Forward Secrecy, Selecting the Appropriate VPN Configuration
performance, Data Center SRX Series Hardware Overview, Data Center SRX Series Hardware Overview
permissions, login classes to control, Creating a login class
Permit action, in security policy, Action Criteria
persistent NAT, Other SRX source NAT configuration options
PFS (Perfect Forward Secrecy), Perfect Forward Secrecy, Selecting the Appropriate VPN Configuration
phone-home traffic, Stages of a System Compromise
PHY (physical chip), in SRX5000, IOC modules
physical interface card (PIC), SRX3000 Series
physical interfaces, Physical Interfaces, Physical Interfaces
disabling, Physical Interfaces
physical locations, multiple, for data center, Data Center
PIM card, diagram for SRX650, Interface modules for the SRX600 line
ping, Network connectivity, VPN troubleshooting process
enabling, Sample Deployment
for IP monitoring, IP Monitoring
ping of death screen, ICMP Ping of Death Screen
ping probe, IP Monitoring
point-to-multipoint NHTB, Point-to-multipoint NHTB
policy-based VPNs, Policy-Based VPNs
configuring, Configuring policy-based VPNs
troubleshooting, VPN troubleshooting process
vs. route-based, Selecting the Appropriate VPN Configuration
policy-driven management system, for large networks, Device management
pools for source NAT, Pools
examples with, Source NAT with pools and interfaces, Source NAT with pools and interfaces
port scans, detection, TCP Port Scan Screen
ports, AppSecure Basics
randomization in source NAT, Other SRX source NAT configuration options
spanning-tree operational commands to identify status, Spanning Tree
for Telnet/SSH, Configuring SSH access
Post Office Protocol 3 (POP3), antivirus feature for, Branch-Specific Features
Power over Ethernet (PoE)
ports, SRX200 Series
SRX550 support for, SRX500 Series
power supplies, monitoring, Power supplies
precedence
NAT in Junos event chain, NAT Precedence in the Junos Event Chain
NAT rulesets, NAT ruleset precedence
predefined proposal set, vs. custom proposal sets, Selecting the Appropriate VPN Configuration
predictive session identification, Predictive session identification
preference options, for static routing, Static Routing
Preferred Ciphers, for SRX/Servers, Configuring SSL Forward Proxy on the SRX
prefix name, for transform definition, Static NAT transforms
preshared key authentication
configuring, Configuration for Remote-Office1 proposal with preshared keys, Configuring IKEv1 Phase 1 policies
configuring IKEv1 Phase 1 IKE policy, Configuring IKEv1 Phase 1 IKE policy with preshared key, Main mode
for VPN, Preshared key authentication
vs. certificate, Selecting the Appropriate VPN Configuration
primary actions, in security policy, Action Criteria
priority zero, troubleshooting, The Dreaded Priority Zero
private IP addresses, from NAT, The Need for NAT
private mode, for chassis cluster, Differences from Standalone
privilege escalation phase of attack, Stages of a System Compromise
protocol anomaly attack objects, Attack Object Types
protocols (see network protocols)
proxy IDs
configuring, Configuring route-based VPNs
negotiation for VPN, Proxy ID negotiation
for policy-based VPNs, Policy-Based VPNs
for route-based VPNs, Route-Based VPNs
troubleshooting, VPN troubleshooting process
proxy server, SRX configuration as, Configuring the SRX as a proxy server
proxy-ARP, Proxy-ARP and Proxy-NDP, When you don’t need Proxy-ARP/NDP
configuring, Configuring Proxy-ARP/NDP
proxy-based firewall, Preface
proxy-NDP (Neighbor Discovery Protocol), Proxy-ARP and Proxy-NDP, When you don’t need Proxy-ARP/NDP
configuring, Configuring Proxy-ARP/NDP
when no need of, When you don’t need Proxy-ARP/NDP
public IP addresses, The Need for NAT
public network, access to, Mobile Carriers
Putty, Configuring SSH access

Q

quad-slot X-PIM card, Interface modules for the SRX600 line
Quality of Service (QoS) in transparent mode, QoS in Transparent Mode
configuring, Configuring Transparent Mode QoS, Configuring VLAN Rewriting
Quick mode in phase 2 IKE, Phase 2 IKE negotiation modes, Quick mode

R

radio frequency (RF) interference, Branch-Specific Features
RADIUS, Remote authentication
Rapid Spanning Tree Protocol (RSTP), Spanning Tree
rate limiter, in AppQoS, Rate limiter, Configuring an AppQoS example
real-time object (RTO), The Data Plane
realms, configuring on IC, Configuring realms, roles, and sign-in policies
reboot
after software upgrade, Software management
with J-Web tool, Rebooting
Recommended IPS action, IPS actions
Reconnaissance phase of attack, Stages of a System Compromise
Record Route Option, Route Option Screens
redirect rules, for unauthenticated users, Operating UserFW
redundancy groups, Redundancy Groups, Redundancy Groups, Redundancy Groups
global options for monitoring, IP Monitoring
redundant fabric link, Configuring the Fabric Links
redundant power supplies, Power supplies
reference network, The Junos Enterprise Services Reference Network
reject action
for all traffic, rule for, Configuring a hybrid application ruleset
in security policy, Action Criteria
reject option, for static routing, Static Routing
remote access clients
configuring, Configuring dynamic gateways and remote access clients
configuring IKEv1, Configuring an IKEv1 remote access client
remote access VPN, Remote Access VPNs
sample deployment, Remote Access VPN
remote authentication, Remote authentication
remote offices, IKEv1 Phase 2 proposal for, Configuring an IKEv1 Phase 2 proposal for remote offices and client connections
Remote-Office-Cert proposal, configuring with certificates, Configuration for Remote-Office1 proposal with certificates
Remote-Office-PSK proposal, configuring, Configuration for Remote-Office1 proposal with preshared keys
Renegotiation option, SSL support for, Configuring SSL Forward Proxy on the SRX
Request for Comments (RFC), 4741, on NetConf protocol, Space: The Final Frontier of Management
request security idp security-package download status command, Troubleshooting and Monitoring Security Package Installation
request security idp security-package install status command, Troubleshooting and Monitoring Security Package Installation
request services application-identification command, Checking the AppID package
request services application-identification install command, Checking the AppID package
request services application-identification uninstall command, Checking the AppID package
request support information command, When All Else Fails
request system license add command, AppSecure Licensing, Getting Started with IPS on the SRX, Configuring Licensing
Resource Utilization panel, Informational panels
resource-manager qualifier, for sessions using ALGs, Application Layer Gateways
REST (Representational State Transfer) protocol, Space: The Final Frontier of Management
restart <service> command, Restarting Platform Daemons
reth (redundant Ethernet interface), Aggregate Interfaces, Interfaces, Integrating the Cluster into Your Network
checking status of, Checking Interfaces
Reverse Proxy (SSL Inspection), SSL Inspection (Reverse Proxy)
revoked certificates, list of, Certificate Validation
rib (routing information base), Static Routing
roles, configuring on IC, Configuring realms, roles, and sign-in policies
root password on authentication, Task wizards
route engine (RE)
flowd daemon for monitoring, Software Monitoring
monitoring, Route engine
in SRX cluster, Chassis Cluster
in SRX1000, SRX1000 Series
in SRX3000, SRX3000 Series
in SRX5000, SRX5000 Series
route keyword, Static Routing
route lookup, Static Routing
Route Option Screens, Route Option Screens
route-based VPNs, Route-Based VPNs
best practices, Best Practices
configuring, Configuring route-based VPNs
troubleshooting, VPN troubleshooting process
vs. policy-based, Selecting the Appropriate VPN Configuration
routers, How to Use This Book
virtual, Inherited ScreenOS features
routing
configuring, Configuring route-based VPNs
protocol preferences, Static Routing
static, Static Routing, Static Routing
transparent mode for complex environments, Complex routing environments
troubleshooting, Static Routing
routing information base (rib), Static Routing
routing instances, Routing Instances
configuring, Configuring Routing Instances, Configuring Routing Instances
types, Routing Instance Types
routing mode, Transparent Interfaces
Routing Protocol Daemon (RPD), System services that operate on the control plane
routing table, statistics on, Static Routing
routing-options hierarchy, static routes added to, Static Routing
RST packets, TCP sequence check configuration for, Configuring TCP sequence checks for RST packets
RSTP (Rapid Spanning Tree Protocol), Spanning Tree
RT (real time), Sample firewall logs
RTO (real-time object), The Data Plane
rulebases, in IPS policy, Rulebases
rulesets, in NAT, Rulesets, When you don’t need Proxy-ARP/NDP
run command, Aggregate Interfaces

S

sampling rates, for logs, JFlow on the SRX
scalable services, Built for Services
scaling
by cloud network, Cloud Networks
under load, Built for Services
scan options
for Kaspersky Full AV, Kaspersky Full AV
in Sophos feature profile, Sophos AV feature profiles
SCEP (Simple Certificate Enrollment Protocol), Simple Certificate Enrollment Protocol, Best Practices
scheduler objects, in security policy, Security Policy Criteria and Precedence, Schedulers, Configuring schedulers
screen feature, for DoS attack, Service Provider
Screen profiles
applying to zones, Applying Screen profiles to single and multiple zones
configuring, Configuring a Screen profile
ScreenOS operating system
limitations, ScreenOS to Junos
services provided, The SRX Series Platform
ScreenOS platform, Evolving into the SRX
inherited features from, Inherited ScreenOS features
IP/MAC mapping in, Configuring Proxy-ARP/NDP
NAT and, Junos NAT Fundamentals
service objects in, Application objects
Screens
best practices, Best Practices
defined, Screens and Flow Options
in hardware and software, Screens in Hardware and Software
packet flow and, How Screens Fit into the Packet Flow
profiles, Screen Profiles
deployment, Sample Deployment, Summary
session limit, Session Limit Screens, Configuring the Destination IP Session Limit Screen
theory and examples, Screen Theory and Examples, Configuring the TCP initial session timeout and TCP time wait timeout
troubleshooting, Troubleshooting and Operation, Sample Deployment
viewing attack statistics, Viewing the Screen Attack Statistics
viewing profile settings, Viewing Screen Profile Settings
secondary actions, in security policy, Action Criteria
Secure Hash Algorithm 1 (SHA-1), IPsec Authentication Algorithms
Secure Hash Algorithm 2 (SHA-2), IPsec Authentication Algorithms
Secure Sockets Layer (SSL), SSL Forward Proxy
SSL Forward Proxy, SSL Forward Proxy
secure tunnel interface (st0 interface) (see st0 interfaces)
SecureCRT, Configuring SSH access
security, Preface
legacy management, Legacy Security Management, Using NSM
NAT and, NAT as a Security Component?
zones for, Security Zones
Security Design (SD) application, Device management, Viewing IPS attack objects and group membership
security packages, Security Packages
installation troubleshooting, Troubleshooting and Monitoring Security Package Installation, Checking Policy Compilation Status
security policies, Security Policies
best practices, Best Practices, Best Practices
components, Security Policy Components in Depth, Enabling an ALG example
action criteria, Action Criteria, Configuring a policy to restrict inbound or outbound management requests
match criteria, Match Criteria, Configuring schedulers
configuring, Configuring security policies, Host security policies
configuring to control data plane management traffic, Configuring a security policy to control data plane management traffic
criteria, Security Policy Criteria and Precedence
deployment, Sample Deployment, Summary
host, Host security policies
NAT and, NAT and Security Policies
permit options, Permit options
precedence, Security Policy Precedence, Top to Bottom Policy Evaluation
rule placement, Configuring security policies
tools, Security policy tools
in transparent mode, Transparent Mode Security Policy
configuring, Configuring Transparent Mode Security Policies, Configuring Bridging Options, Sample Deployments
troubleshooting, Troubleshooting and Operation, Performing a Packet Capture on the High-End SRX
viewing, Viewing Security Policies, Security policy tools
security policy context, Security Policy Precedence
Security Resources panel, Informational panels
security services, Foreword
security zones, Security Zones, Security Policy Criteria and Precedence, Security zones
configuring, Sample Deployment, Configuring security zones
in transparent mode, configuring, Configuring Transparent Mode Security Zones, Configuring Transparent Mode Security Policies, Sample Deployments
security-related events, logs, Configuring control plane logging on the SRX
self-signed CA certificate, creating, Configuring SSL Forward Proxy on the SRX
separation of duties, transparent mode for, Separation of duties
serial port connection, SRX200 line support, Interface modules for the SRX200 line
serialization processing, in IPS processing, Packet processing path
server load balancing, Data Center Services Tier
server-to-client attacks, Direction-specific detection
service objects, in ScreenOS, Application objects
Service Processing Card (SPC), SPC
service provider, deployment to, Service Provider, Service Provider
services
defined, The SRX Series Platform
restarting, Restarting Platform Daemons
viewing on interface, Viewing the Services/Counters on the Interface, Viewing the Services/Counters on the Interface
Services and Routing Engine (SRE), SRX600 Series
services gateway, Welcome to the SRX
Services Processing card (SPC), monitoring, Services Processing Card/Next Generation Services Processing Card
Services Processing Units (SPUs), SPC
capacities, SPC
for scaling, Data Center SRX Series Hardware Overview
session ageout, Session teardown
Session Close logs, Action Criteria
session init logs, Action Criteria
session keepalives, Configuring IKEv1 Phase 1 gateways
session limit screens, Session Limit Screens, Configuring the Destination IP Session Limit Screen, Best Practices
session resumption, Configuring SSL Forward Proxy on the SRX
session table, SPC
NAT scenarios in, Viewing the Firewall Session Table
output of, Packet Flow
troubleshooting, Viewing the Session Table, View NAT Errors
viewing, Viewing the Firewall Session Table, Sample firewall logs
session timeout, Session teardown
sessions, SRX100 Series
closing, Application objects
defining number from individual source, Source IP Session Limit Screen
synchronization, Configuring the Fabric Links
terminating, Session teardown
troubleshooting, Transparent Mode Troubleshooting Steps
set apply-groups “${node}” command, Node-Specific Information
set chassis cluster command, Activating Juniper Services Redundancy Protocol
set commands
for physical interfaces, Physical Interfaces
set gratuitous-arp-count command, Configuring Interfaces
set interfaces command, Configuring VLAN Rewriting
set redundancy-group command, configuration options, IP Monitoring
set security forwarding-options inet6 command, Static NAT one-to-one mapping
set system name-server command, Antispam
Setup wizard, in J-Web, Task wizards, Task wizards
seven-tuple, Packet Flow
severity levels, of attacks, Severities
SHA-1 (Secure Hash Algorithm 1), IPsec Authentication Algorithms
SHA-2 (Secure Hash Algorithm 2), IPsec Authentication Algorithms
shared configuration, vs. standalone, Differences from Standalone
shellcode, Stages of a System Compromise
show bridge domain command, The show bridge domain Command, Transparent Mode Troubleshooting Steps
show bridge mac-table command, The show bridge mac-table Command, Transparent Mode Troubleshooting Steps
show chassis cluster control-plane statistics command, Configuring the Control Ports, First Steps, First Steps
show chassis cluster interfaces command, Checking Interfaces
show chassis cluster statistics command, Configuring the Control Ports
show chassis cluster status command, Activating Juniper Services Redundancy Protocol, Configuring the Control Ports, First Steps, The Dreaded Priority Zero
show chassis fpc pic-status command, Control link and data link failure, Verifying the Data Plane, Verifying the Data Plane
show chassis hardware command, Physical Interfaces, Verifying the Data Plane
show chassis routing-engine command, Best Practices
show class-of-service application-traffic-control command, Operating Application QoS
show class-of-service command, Operating Application QoS
show groups junos-defaults command, Default profile configuration
show interfaces extensive command, Monitoring Interface Counters
show interfaces terse command, Physical Interfaces, Sample Deployment, Checking Interfaces
show interfaces | display inheritance command, Sample Deployments
show l2-learning global-information command, The show l2-learning global-information Command
show l2-learning global-mac-count command, The show l2-learning global-mac-count Command
show l2-learning interface command, The show l2-learning interface Command
show log command, Configuring control plane logging on the SRX
show log jsrpd command, The Dreaded Priority Zero
show ntp associations command, Checking NTP Status
show ntp status command, Checking NTP Status
show route command, Static Routing
show security anti-virus statistics command, Antivirus
show security flow ip-action command, IP Action Table
show security flow session <modifiers> command, Transparent Mode Troubleshooting Steps
show security flow session ? command, Viewing the Firewall Session Table, Sample firewall logs
show security idp attack detail command, Viewing IPS attack objects and group membership
show security idp attack table command, IPS Attack Table
show security idp policy-commit-status command, Checking Policy Compilation Status
show security idp security-package-version command, Checking the AppID package, Checking Security Package Version
show security idp status command, Creating, activating, and referencing IPS, Checking IPS Status
show security ike security-associations command, show security ike security-associations
show security ipsec inactive-tunnels command, show security ipsec inactive-tunnels
show security ipsec security-associations command, show security ipsec security-associations
show security ipsec statistics command, show security ipsec statistics
show security match-policies command, Operating UserFW
show security monitoring fpc <x> command, Best Practices
show security nat destination pool command, NAT Rule and Usage Counters
show security nat destination rule command, NAT Rule and Usage Counters
show security nat destination summary command, NAT Rule and Usage Counters
show security nat interface-nat-ports command, NAT Rule and Usage Counters
show security nat source pool command, NAT Rule and Usage Counters
show security nat source rule command, NAT Rule and Usage Counters
show security nat source summary command, NAT Rule and Usage Counters
show security nat static rule command, NAT Rule and Usage Counters
show security policies command, Viewing Security Policies
show security screen ids-option <Screen> command, Viewing Screen Profile Settings
show security screen statistics interface|zone command, Viewing the Screen Attack Statistics
show security utm <feature> statistics | status, Best Practices
show security utm anti-spam statistics command, Antispam
show security utm anti-spam status command, Antispam
show security utm anti-virus command, Antivirus
show security utm web-filtering statistics command, URL Filtering
show security utm web-filtering status command, URL Filtering
show security zones command, Sample Deployment
show services application-identification application-system-cache command, Checking the AppID engine settings and cache
show services application-identification version command, Checking the AppID package
show services ssl proxy statistics command, Operating SSL Forward Proxy
show snmp mib walk command, Junos SNMP MIB, Checking SNMP Status
show spanning-tree interface command, Transparent Mode Troubleshooting Steps
show system connections command, Viewing the System Connection Table
show system core-dumps command, Core Dumps
show system license command, UTM Engine
show system processes extensive | match IDPD command, Restarting Platform Daemons
show system services dhcp command, DHCP Operational Mode Commands
show | compare command, Aggregate Interfaces
show | display inheritance command, Node-Specific Information
sign-in policies, configuring on IC, Configuring realms, roles, and sign-in policies
signature-based attack objects, Attack Object Types
signature-based pattern matching, Signature-based pattern matching, Keeping honest applications honest, Enabling application identification heuristics
signatures
nested application, Nested application signatures
performance impact in IPS, Signature performance impacts
SignatureUpdate.xml file, Useful IPS files
Simple Certificate Enrollment Protocol (SCEP), Simple Certificate Enrollment Protocol
Simple Mail Transfer Protocol (SMTP), antivirus feature for, Branch-Specific Features
Simple Network Management Protocol (SNMP)
best practices, Best Practices
configuring traps, Configuring SNMP Traps
in high availability clusters, SNMP in High Availability Chassis Clusters
management, SNMP Management, Junos SNMP MIB
site-to-site IPsec VPN, Site-to-Site IPsec VPNs
configuring component, Configuring a common site-to-site VPN component
sample deployment, Site-to-Site VPN, Remote Access VPN
six pack deployment, for high availability, Six pack
Skype, SSL and, AppFW with encrypted applications
slow-path packet processing, Slow-path SPU packet processing
Slowloris attack, Session Limit Screens
small branch location
deployment to, Small Branch
reference network with SRX100 device, The Junos Enterprise Services Reference Network
Small Form-Factor Pluggable Interface Modules (SFP) mini-PIM ports, on SRX200, Interface modules for the SRX200 line
smart phones, Preface
sniffer mode, for IPS, SRX deployment options, Leveraging sniffer mode for the deployment
SNMP (see Simple Network Management Protocol (SNMP))
software
J-Web for managing, Software management
monitoring, Software Monitoring
Screens in, Screens in Hardware and Software
Sophos engine, Antivirus, Sophos AV
default profile for configuring, Configuring Sophos with a default profile
feature profile example, Configuring Sophos feature profile example
feature profiles, Sophos AV feature profiles
inspection diagram, Sophos AV
pros and cons, Which AV to Choose?
source address, in IPS policy, Match criteria
source identity, Source-Identity
source NAT, Junos NAT Types
best practices, Best Practices
combining with destination NAT, Combination Source and Destination NAT, Combination Source and Destination NAT
examples, Source NAT, Destination NAT
with interfaces, Source NAT with interfaces, Source NAT with interfaces
with pools and interfaces, Source NAT with pools and interfaces, Source NAT with pools and interfaces
flow debugging, Flow Debugging with NAT
High Availability and, Other SRX source NAT configuration options
no-NAT rules with, No-NAT with Source or Destination NAT, No-NAT with Source or Destination NAT
precedence for, NAT type precedence
rulesets, Source NAT rulesets
transforms, Interfaces
source objects, negated, for security zones, Negated source and destination objects
Source Route Option, Route Option Screens
source zone, Security zones
Source-IP Session Limit screens, Session Limit Screens
Space platform, for firewall policies management, Firewall policies
spam, Branch-Specific Features
filtering, Antispam
Spanning Tree Protocol (STP), SRX100 Series, Spanning Tree, Spanning Tree, Transparent Mode and Bridge Loops, Spanning Tree Protocol
in transparent mode Layer 2 deployments, Spanning Tree Protocol in transparent mode Layer 2 deployments
troubleshooting, Transparent Mode Troubleshooting Steps
split brain, Configuring the Control Ports, Control link, Control link and data link failure, First Steps
SPNEGO, Operating UserFW
Active Directory and, UserFW
authentication session, UserFW functionality overview
SRX Series products (see Juniper Networks SRX Series products)
SSH, Command-Line Interfaces
configuring options, Configuring SSH access
enabling NetConf protocol over, Enabling NetConf over SSH
SSL decryption, in IPS processing, Packet processing path
SSL Forward Proxy
best practices, SSL FP
configuring, Configuring and Deploying SSL Forward Proxy, AppFW with encrypted applications
troubleshooting, Operating SSL Forward Proxy
SSL Inspection (Reverse Proxy), SSL Inspection (Reverse Proxy)
SSL Reverse Proxy, SSL Forward Proxy, Configuring and Deploying SSL Forward Proxy
SSL session, restarting, Configuring SSL Forward Proxy on the SRX
SSL VPNs, vs. IPsec VPN, Remote Access VPNs
st0 interfaces
multipoint interface specified, Point-to-point versus point-to-multipoint VPNs
numbered vs. unnumbered, Numbered versus unnumbered st0 interfaces
state synchronization, data plane and, The Data Plane
stateful firewall, Preface, Welcome to the SRX, Data Center Services Tier, Flow Mode and Packet Mode, The Need for IPS
failover by, Preserving the Control Plane
high availability and, High Availability
IP spoofing and, IP Spoofing Screen
policies, Firewall policies
ScreenOS for, The SRX Series Platform
stateful processing, Service Provider
stateful signature detection, in IPS processing, Packet processing path
stateless filters
configuring for inbound management traffic, Configuring a stateless firewall filter to control all inbound management traffic
for connections to control plane, Accessing System Services: Control Plane Versus Data Plane
stateless inspection of traffic, Flow Mode and Packet Mode
stateless packet processing, Service Provider, Service Provider
static attack groups, Custom attack objects and groups, Static attack groups
best practices, Best Practices
configuring, Configuring static and dynamic attack groups
static IP address, configuring remote gateways with, Configuring IKEv1 Phase 1 gateways
static NAT, Junos NAT Types, NAT type precedence
best practices, Best Practices
flow debugging, Destination NAT, Static NAT
many-to-many mapping, Static NAT many-to-many mapping, Option 3: NAT 64 automatic translation
one-to-one mapping, Static NAT one-to-one mapping, Static NAT one-to-one mapping
rulesets, Static NAT rulesets
transforms, Static NAT transforms
static routing, Static Routing, Static Routing
configuration options, Static Routing
Statistical Report Manager software (STRM), Centralized Management
packet logging in, Configuring packet logging in the STRM
statistics, on application usage, Application Tracking
Storage Usage panel, Informational panels
stream mode on data plane
configuring, Configuring Stream mode logging on the data plane
vs. event mode, Data plane logs: Event versus Stream mode
Strict Source Route Option, Route Option Screens
strict SYN checks, Strict SYN checks
STRM (Statistical Report Manager software), Centralized Management
for log management, Log Management with STRM
reporting infrastructure, Reporting with STRM
structured syslog, Sample firewall logs
format, Configuring Stream mode logging on the data plane
subnet mask, Wildcard address objects
subnetting, How to Use This Book
Surfcontrol URL filtering, URL filtering flavors
Surfcontrol/Websense Integrated URL filtering, Surfcontrol/Websense Integrated URL filtering
sustained CPS rate, Data Center SRX Series Hardware Overview
switch control board (SCB), monitoring, Switch control board
switch fabric board (SFB)
failure impact, Switch fabric board
in SRX3000, SRX3000 Series
switch-packet counters, Data Center SRX Series Hardware Overview
switches, How to Use This Book
configuration, Switching Configuration, Switching Configuration
switching fabric interface, configuring, Configuring the Switching Fabric Interface
SYN checks
strict, Strict SYN checks
TCP, TCP SYN checks
in tunnels, SYN checks in tunnels
SYN Cookies, SYN Spoofing Protection Modes
SYN flood/spoofing attacks, protection against, SYN flood/spoofing attacks
SYN-ACK-ACK proxy screen, SYN-ACK-ACK Proxy Screen
SYN-FIN screen, SYN-FIN Screen
SYN-Frag Screen, SYN-Frag Screen
syslog, Application Tracking, Logging UTM Messages
formats, SRX Logging and Flow Records, Configuring Stream mode logging on the data plane
tips for viewing messages, Tips for Viewing Syslog Messages
syslogD, System services that operate on the control plane
System Alarms panel, Informational panels
system connection table, viewing, Viewing the System Connection Table
system I/O (SYSIO), in SRX1000, SRX1000 Series
System Identification panel (J-Web), Informational panels
system services, System Services, Configuring system services and protocols per zone or interface
best practices for configuring, Best Practices
control plane access vs. data plane, Accessing System Services: Control Plane Versus Data Plane, Configuring a security policy to control data plane management traffic
control plane and, System Services and the Control Plane, System services that operate on the control plane
data plane and, System Services and the Data Plane
traffic, Functional Zones
troubleshooting, Troubleshooting and Operation, Troubleshooting Individual Daemons
checking SNMP stats, Checking SNMP Status
core dump, Checking for Core Dumps
DHCP operational mode commands, DHCP Operational Mode Commands
restarting platform daemons, Restarting Platform Daemons
viewing security logs locally, Viewing Security Logs Locally
viewing services/counters on interface, Viewing the Services/Counters on the Interface, Viewing the Services/Counters on the Interface
viewing system connection table, Viewing the System Connection Table
zone-based service control, Zone-Based Service Control, Configuring system services and protocols per zone or interface

T

Tacacs+, Remote authentication
targets, of IP actions, Targets and timeouts
task wizards, in J-Web, Task wizards, Task wizards
TCP (Transmission Control Protocol), How to Use This Book, SRX100 Series
denial-of-service (DoS) attacks with, DoS Attacks with TCP, Configuring the WinNuke Screen
performance definitions, Data Center SRX Series Hardware Overview
TCP initial session timeout, Configuring the TCP initial session timeout and TCP time wait timeout
TCP No Flags Screen, TCP No Flags Screen
TCP Port Scan Screen, TCP Port Scan Screen
TCP reset, Action Criteria
TCP sequence checks, TCP sequence checks, Configuring TCP sequence checks
configuring for RST packets, Configuring TCP sequence checks for RST packets
TCP SockStress, Session Limit Screens
TCP state timeouts, TCP state timeouts
TCP Sweep Screen, TCP Sweep Screen
TCP SYN checks, TCP SYN checks
TCP wait state timeout, TCP state timeouts
Telnet, Command-Line Interfaces
configuring options, Configuring Telnet access
ports for, Configuring SSH access
templates
downloading policy, Getting Started with IPS on the SRX
for IPS process, Policy templates
terminal match, for IP action, Terminal Match
test security utm web-filtering profile <profile> test-string command, Websense site lookup tool
testing
antivirus software, Testing antivirus
IPS policy, Testing Your Policy, Leveraging sniffer mode for the deployment
threads of execution, Branch SRX Series Hardware Overview
Threats Activity panel, Informational panels
three-way handshake, Data Center SRX Series Session Setup, Strict SYN checks
threshold, Best Practices
for TCP Sweep Screen, Configuring the TCP Sweep Screen
threshold-based Screens, Packet versus threshold Screens
throughput of firewall, Data Center SRX Series Hardware Overview
testing, Data Center SRX Series Hardware Overview
timekeeping
best practices, Best Practices
importance, Network Time Protocol
synchronization, Best Practices
timeout
for IP action, Targets and timeouts
in Sophos feature profile, Sophos AV feature profiles
in SYN Cookie/SYN Proxy, SYN Spoofing Protection Modes
to-zone, Security zones, Match criteria
top-to-bottom evaluation, of security policy, Top to Bottom Policy Evaluation
TOR, SSL and, AppFW with encrypted applications
traceoptions, The Dreaded Priority Zero
traceroute, VPN troubleshooting process
tracing, for VPN troubleshooting, VPN Tracing and Debugging, Configuring and analyzing VPN tracing
traffic reports, Traffic reports
transparent interfaces, Transparent Interfaces
transparent mode, Troubleshooting Individual Daemons, Transparent Mode
components, Transparent Mode Components
configuration, Configuring Transparent Mode
deployment, The Junos Enterprise Services Reference Network, Sample Deployments, Summary
flow process, Transparent Mode Flow Process, Session teardown
high availability with, High Availability with Transparent Mode
limitations, Transparent Mode Limitations
Quality of Service (QoS), QoS in Transparent Mode
configuration, Configuring Transparent Mode QoS, Configuring VLAN Rewriting
security policies, Transparent Mode Security Policy
configuring, Configuring Transparent Mode Security Policies, Configuring Bridging Options
security zones, configuring, Configuring Transparent Mode Security Zones, Configuring Transparent Mode Security Policies
specific options, Transparent Mode Specific Options
troubleshooting, Troubleshooting and Operation, Transparent Mode Troubleshooting Steps
steps, Transparent Mode Troubleshooting Steps, Transparent Mode Troubleshooting Steps
when to use, When to Use Transparent Mode
zones, Transparent Mode Zones
Transport mode for IPsec VPN, IPsec VPN Mode
best practices, Best Practices
Trapeze, Branch-Specific Features
Triple Data Encryption Standard (3DES), IPsec Encryption Algorithms, Selecting the Appropriate VPN Configuration
troubleshooting
Application Identification (AI), Operating Application Identification
AppSecure, Troubleshooting and Operation, Sample Deployments
AppTrack, AppTrack
core dump, Core Dumps
daemons, Troubleshooting Individual Daemons
data plane, Verifying the Data Plane, Verifying the Data Plane
flow trace, Performing a Flow Trace, Performing a Flow Trace
high availability, Troubleshooting and Operation, Manual Failover
interfaces, Checking Interfaces
intrusion prevention systems (IPS), Troubleshooting and Operation, IP Action Table
attack table, IPS Attack Table
checking policy compilation status, Checking Policy Compilation Status
checking security package version, Checking Security Package Version
checking status of, Checking IPS Status
counters for, IPS Counters
IP action table, IP Action Table
security package installation, Troubleshooting and Monitoring Security Package Installation, Checking Policy Compilation Status
with J-Web tool, Troubleshooting from J-Web
Network Address Translation (NAT), NAT Rule and Usage Counters
flow debugging, Flow Debugging with NAT, Static NAT
session table, Viewing the Session Table, View NAT Errors
viewing firewall logs, View Firewall Logs with NAT
priority zero, The Dreaded Priority Zero
routing, Static Routing
Screens, Troubleshooting and Operation
security policies, Troubleshooting and Operation
SSL Forward Proxy, Operating SSL Forward Proxy
system services, Troubleshooting and Operation, Troubleshooting Individual Daemons
checking SNMP stats, Checking NTP Status
core dump, Checking for Core Dumps
DHCP operational mode commands, DHCP Operational Mode Commands
restarting platform daemons, Restarting Platform Daemons
viewing security logs locally, Viewing Security Logs Locally
viewing services/counters on interface, Viewing the Services/Counters on the Interface, Viewing the Services/Counters on the Interface
viewing system connection table, Troubleshooting and Operation
transparent mode, Troubleshooting and Operation, Transparent Mode Troubleshooting Steps
steps, Transparent Mode Troubleshooting Steps, Transparent Mode Troubleshooting Steps
Unified Threat Management (UTM), Troubleshooting and Operation, Content Filtering
antispam, Antispam
antivirus software, Antivirus
content filtering, Content Filtering
URL filtering, URL Filtering
VPN (virtual private networking), Troubleshooting and Operation, Configuring and analyzing VPN tracing
commands for, Useful VPN Commands, Checking interface statistics
tracing and debugging, VPN Tracing and Debugging, Configuring and analyzing VPN tracing
trunk mode, in transparent mode, Interface Modes in Transparent Mode
trunk port, Switching Configuration
trust interface, Sample Deployment
trust zone, configuring, Configuring system services and protocols per zone or interface
Trusted-CA
configuring, Configuring IKEv1 Phase 1 policies
in SSL Proxy profile, Configuring SSL Forward Proxy on the SRX
Tunnel mode for IPsec VPN, IPsec VPN Mode
best practices, Best Practices
tunnels
SYN checks in, SYN checks in tunnels
viewing inactive, show security ipsec inactive-tunnels

U

UDP (User Datagram Protocol), How to Use This Book, SRX100 Series
denial-of-service (DoS) attacks with, DoS Attacks with UDP
for IKE negotiations, VPN troubleshooting process
UFQDN (user FQDN), as IKE identity, IKE Identities
Ultrasurf, SSL and, AppFW with encrypted applications
unauthenticated role in SRX, Configuring the SRX for UserFW
unauthenticated users, redirect rules for, Operating UserFW
Unicast Reverse Path Forwarding (uRPF) lookup, IP Spoofing Screen
unified in-service software upgrade (ISSU), Configuring the Control Ports
Unified Threat Management (UTM)
antispam feature, Antispam
antivirus software, Antivirus, Antivirus, Which AV to Choose?
Sophos engine, Sophos AV, Kaspersky Full AV
basics, Unified Threat Management
best practices, Best Practices
components, UTM Components, Configuring syslog to send UTM to a remote server
application proxy, Application Proxy
custom objects, Custom Objects
feature profiles, Feature Profiles
policies, UTM Policies
content filtering, Content Filtering, Configuring syslog to send UTM to a remote server
deployments, Sample Deployments, Summary
IPS and, IPS and UTM
licensing, UTM Licensing
configuring, Configuring Licensing
logging messages, Logging UTM Messages
shifting threats, Shifting Threats
troubleshooting, Troubleshooting and Operation, Content Filtering
antispam, Antispam
antivirus software, Antivirus
URL filtering, URL Filtering
URL filtering, URL Filtering, Which URL filtering solution to choose?
flavors, URL filtering flavors
Websense Enhanced filtering, Websense Enhanced filtering
unit, in interface configuration, Logical Interfaces
universal resource locator (URL) filtering, Branch-Specific Features
unknown control plane state, Activating Juniper Services Redundancy Protocol
Unknown IP Protocol Screen, Unknown IP Protocol Screen
unknown role in SRX, Configuring the SRX for UserFW
untrust interface, Sample Deployment
untrust zone, configuring, Configuring system services and protocols per zone or interface
URL filtering, IPS and UTM, Unified Threat Management, URL Filtering, URL Filtering, Which URL filtering solution to choose?
default local profile, Default local URL filtering profile
deployment, Sample Deployments
profiles, URL filtering profiles
Surfcontrol/Websense Integrated, Surfcontrol/Websense Integrated URL filtering
troubleshooting, URL Filtering
Websense Enhanced filtering, Websense Enhanced filtering
user authentication infrastructure, STRM and, Reporting with STRM
user base dynamic firewalling, Large Branch
User Datagram Protocol (UDP), How to Use This Book
denial-of-service (DoS) attacks with, DoS Attacks with UDP
for IKE negotiations, VPN troubleshooting process
user interfaces, on control plane, System services that operate on the control plane
user objects, in security policy, Security Policy Criteria and Precedence
User Role Firewall, User Role Firewalling
best practices, UserFW
configuring and deploying, Configuring and Deploying User Role Firewall, Miscellaneous Active Directory tasks
functionality review, UserFW functionality overview, UserFW functionality overview
operating, Operating UserFW
packaging and licensing, UserFW packaging and licensing
users, display of logged on, Informational panels
UTM (see Unified Threat Management (UTM))

V

validation, heartbeat messages for, Configuring Heartbeat Timers
virtual interfaces, Virtual Interfaces
virtual Junos, JunosV Firefly (Virtual Junos)
virtual private networking (VPN) (see VPN (virtual private networking))
virtual router (VR), Inherited ScreenOS features
instances, Routing Instance Types
virtual security device (VSD), Redundancy Groups
viruses, Acknowledgments
(see also antivirus software)
identifying, IPS and UTM
protection against, Unified Threat Management
VLAN retagging, VLAN Rewriting
VLAN trunking, transparent mode and, Spanning Tree Protocol in transparent mode Layer 2 deployments
vlan-id-list command, Configuring VLAN Rewriting
vlan-rewrite command, Configuring VLAN Rewriting
VLANs
in cloud environment, Cloud Networks
configuration, Switching Configuration
name for, Switching Configuration
restricting BPDUs to, Restricting BPDUs to VLANs
rewriting, VLAN Rewriting
configuring, Configuring VLAN Rewriting, Configuring VLAN Rewriting
terminating multiple, Interface Modes in Transparent Mode
VMware, JunosV Firefly (Virtual Junos)
VPLS, Branch Summary
VPN (virtual private networking), Acknowledgments
(see also IPsec VPN (IP Security virtual private network))
architecture overview, VPN Architecture Overview, Remote Access VPNs
full mesh, Full Mesh VPNs
hub and spoke, Hub and Spoke IPsec VPNs
site-to-site, Site-to-Site IPsec VPNs
dynamic, Dynamic VPN, Best Practices
encryption algorithms, Selecting the Appropriate VPN Configuration
monitoring, VPN Monitoring
configuring, Configuring common IPsec VPN components
partial mesh, Partial Mesh VPNs
point-to-point vs. point-to-multipoint, Point-to-point versus point-to-multipoint VPNs
policy-based, vs. route-based, Selecting the Appropriate VPN Configuration
remote access, Remote Access VPNs
sample deployment, Sample Deployments, IPsec Caveats on SRX
remote access VPN, Remote Access VPN
site-to-site, Site-to-Site VPN, Remote Access VPN
ScreenOS for, The SRX Series Platform
selecting configuration, Selecting the Appropriate VPN Configuration, Selecting the Appropriate VPN Configuration
troubleshooting, Troubleshooting and Operation, Configuring and analyzing VPN tracing
commands for, Useful VPN Commands, Checking interface statistics
tracing and debugging, VPN Tracing and Debugging, Configuring and analyzing VPN tracing
VSD (virtual security device), Redundancy Groups
vulnerability exploitation phase of attack, Stages of a System Compromise

W

Warning severity level of attacks, Severities
web management, Web Management on the SRX
Web Trends Log Format (WELF), Configuring Stream mode logging on the data plane
Websense Enhanced URL filtering, URL filtering flavors, Websense Enhanced filtering
custom profile, Configuring a custom Websense Enhanced profile
default profile, Configuring Websense Enhanced default profile
pros and cons, Which URL filtering solution to choose?, Which URL filtering solution to choose?
troubleshooting, URL Filtering
Websense Redirect URL filtering, URL filtering flavors, Websense Redirect
default profile for configuring, Default Websense Redirect profile
pros and cons, Which URL filtering solution to choose?
Websense site lookup tool, Websense site lookup tool
Websense Threatseeker cloud, Websense Enhanced filtering
Websense/Surfcontrol Integrated URL filtering, pros and cons, Which URL filtering solution to choose?
Websense/Surfcontrol URL filtering, troubleshooting, URL Filtering
weighted round-robin algorithm, Data Center SRX Series Session Setup
WELF (Web Trends Log Format), Configuring Stream mode logging on the data plane
well-known ports, AppSecure Basics
whitelist approach to firewall rules, Three types of Application Firewall rulesets, Configuring a whitelist application ruleset
best practices, AppFW
for Juniper Local filtering, URL Custom URLs, blacklists, whitelists, and categories
in SSL Proxy profile, Configuring SSL Forward Proxy on the SRX
when to use, When to use blacklist, whitelist, and hybrid rulesets
WiFi, RF interference and, Branch-Specific Features
wildcard address objects, for IP prefix-based matches, Wildcard address objects
wing table, NPU
Winnuke Screen, WinNuke Screen
wireless capabilities, of AX411, AX411

Y

YouTube, Preface