License申请： admin@SRX3600> request system license update trial

更新特征库要求配置中已有DNS配置，正确的时间配置，下载的URL security { idp { security-package { url https://services.netscreen.com/cgi-bin/index.cgi; } }

需要先更新特征库，再完成全局配置 1、 下载特征库 admin@SRX3600> request security idp security-package download 2、更新 admin@SRX3600> request security idp security-package install

IPS配置方法：

IDP对应的规则：（全局 ） set security idp idp-policy IDP_Default rulebase-ips rule 1 match from-zone any set security idp idp-policy IDP_Default rulebase-ips rule 1 match source-address any set security idp idp-policy IDP_Default rulebase-ips rule 1 match to-zone any set security idp idp-policy IDP_Default rulebase-ips rule 1 match destination-address any set security idp idp-policy IDP_Default rulebase-ips rule 1 match application default set security idp idp-policy IDP_Default rulebase-ips rule 1 match attacks predefined-attack-groups "Critical - IP" set security idp idp-policy IDP_Default rulebase-ips rule 1 match attacks predefined-attack-groups "Critical - TCP" set security idp idp-policy IDP_Default rulebase-ips rule 1 match attacks predefined-attack-groups "Major - TCP" set security idp idp-policy IDP_Default rulebase-ips rule 1 match attacks predefined-attack-groups "Major - IP" set security idp idp-policy IDP_Default rulebase-ips rule 1 then action no-action set security idp idp-policy IDP_Default rulebase-ips rule 1 then notification log-attacks alert set security idp active-policy IDP_Default

在具体的策略中调用，例如： set security policies from-zone trust to-zone untrust policy t-u-1 match source-address any set security policies from-zone trust to-zone untrust policy t-u-1 match destination-address any set security policies from-zone trust to-zone untrust policy t-u-1 then permit application-services idp

日志查看： 如果直接在设备中查看IDP log，需要做两步操作： 1、 security { log { mode event; event-rate 1500; } } 日志从data-plane转发到control-plane

2、增加IDP_log文件记录IDP信息 set system syslog file IDP_log any any set system syslog file IDP_log match RT_IDP set system syslog file IDP_log archive size 10m set system syslog file IDP_log archive files 10