ZyXEL ZYWALL USG 100 User Guide - Page 50
IDP Profile Configuration, 3.6.1 Procedure To Create a New Profile
View all ZyXEL ZYWALL USG 100 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 50 highlights
Chapter 3 Protecting Your Network 3.6 IDP Profile Configuration IDP (Intrusion, Detection and Prevention) detects malicious or suspicious packets and protects against network-based intrusions. Note: You need to first activate your IDP service license or trial. See Device and Service Registration on page 47. You may want to create a new profile if not all signatures in a base profile are applicable to your network. In this case you should disable non-applicable signatures so as to improve ZyWALL IDP processing efficiency. You may also find that certain signatures are triggering too many false positives or false negatives. A false positive is when valid traffic is flagged as an attack. A false negative is when invalid traffic is wrongly allowed to pass through the ZyWALL. As each network is different, false positives and false negatives are common on initial IDP deployment. You could create a new 'monitor profile' that creates logs but all actions are disabled. Observe the logs over time and try to eliminate the causes of the false alarms. When you're satisfied that they have been reduced to an acceptable level, you could then create an 'inline profile' whereby you configure appropriate actions to be taken when a packet matches a signature. 3.6.1 Procedure To Create a New Profile To create a new profile: 1 Click Configuration > Anti-X > IDP > Profile and in the Profile Management section of this screen, click the Add icon. A pop-up screen will appear allowing you to choose a base profile. Select a base profile to go to the profile details screen. Note: If Internet Explorer opens a warning screen about a script making Internet Explorer run slowly and the computer maybe becoming unresponsive, just click No to continue. 2 Type a new profile Name. Enable or disable individual signatures by selecting a row and clicking Activate or Inactivate. Click OK. 50 ZyWALL USG100-PLUS User's Guide