Juniper Networks IDP250 manual Deployment Mode

IDP250 Installation Guide

Deployment Mode

For each virtual router, you select the deployment mode:

■Sniffer–In an out-of-path, sniffer mode deployment, the IDP appliance can detect attacks but can take only limited action. You connect the IDP traffic interfaces to a mirrored port of a network hub or switch.

■Transparent–In an in-path, transparent mode deployment, traffic arrives in one interface and is forwarded through the other. The IDP appliance detects attacks and takes action according to your security policy rules. You connect the IDP traffic interfaces to firewalls or switches in the network path.

You can deploy a mix of sniffer and transparent mode virtual routers on the same IDP appliance.

For more information on deployment mode, see the IDP Concepts and Examples

Guide.

Internal Bypass

The Internal Bypass setting supports network security policies that privilege availability over security. In the event of failure or graceful shutdown, with internal bypass configured, the interfaces to enter an internal bypass state. In internal bypass, physical interfaces join mechanically to form a circuit that bypasses IDP processing. For example, if you configure internal bypass for vr0, and the IDP appliance encounters failure or is shut down, eth2 and eth3 join to form a circuit that avoids the IDP engine and forwards the traffic to the next network hop.

Internal bypass operates through a timing mechanism. When enabled, the timer on traffic interfaces counts down to a bypass trigger point. When the IDP appliance is turned on and available, it sends a reset signal to the traffic interface timer so that it does not reach the bypass trigger point. If the IDP operating system encounters failure, then it fails to send the reset signal, the timer counts down to the trigger point, and the traffic interfaces enter a bypass state. If the IDP appliance is shut down gracefully, the traffic interfaces immediately enter bypass.

Figure 6 on page 11 shows the communications path when a virtual router is in internal bypass state.

10■ Traffic Interface Ports