O'Reilly logo

Junos Security by James Quinn, Timothy Eberhard, Patricio Giecco, Brad Woodberg, Rob Cameron

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Troubleshooting IPS

The SRX has a wealth of facilities that you can use to gain lots of information about IPS functionality and the security state of the inspection events for traffic that is passing through the SRX. So, in addition to the security events of the SRX there are also troubleshooting facilities to look at in the IPS policy commit process. In this section, we have broken down troubleshooting into several sections with examples of the commands, their output, and things to look for.

Checking IPS Status

First off, it is important to make sure the SRX is up and running with an active IPS policy and that it is seeing traffic. If you don’t see the information, the SRX is not inspecting traffic.

This first example shows the SRX without the IPS configured; the second example uses an active configuration. Note that on top of these steps, you can also add flow debugging to the list of things to examine. Although flow debugging won’t get into the gory details of IPS debugging, it will give you a good idea of what is happening prior to IPS processing.

## Inactive IPS example, note Policy Name, No Detector Engine ##
root@SRX5800-1> show security idp status node0: -------------------------------------------------------------------------- State of IDP: 2-default, Up since: 1987-07-02 12:00:52 UTC (1179w6d 06:24 ago) Packets/second: 0 Peak: 0 @ 1987-07-02 12:00:52 UTC KBits/second : 0 Peak: 0 @ 1987-07-02 12:00:52 UTC Latency (microseconds): [min: 0] [max: 0] [avg: 0] Packet Statistics: ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required