ZyXEL ZyWALL ATP700 User Guide - Page 526
Creating New ADP Profiles
View all ZyXEL ZyWALL ATP700 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 526 highlights
Chapter 24 Security Policy Table 200 Configuration > Security Policy > ADP > General LABEL DESCRIPTION Priority Status From This is the rank in the list of anomaly profile policies. The list is applied in order of priority. The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the direction of travel of packets to which an anomaly profile is bound. Traffic direction is defined by the zone the traffic is coming from. Use the From field to specify the zone from which the traffic is coming. Select ZyWALL to specify traffic coming from the Zyxel Device itself. From LAN means packets traveling from a computer on one LAN subnet to a computer on another subnet via the Zyxel Device's LAN1 zone interfaces. The Zyxel Device does not check packets traveling from a LAN computer to another LAN computer on the same subnet. From WAN means packets that come in from the WAN zone and the Zyxel Device routes back out through the WAN zone. Anomaly Profile Note: Depending on your network topology and traffic load, applying every packet direction to an anomaly profile may affect the Zyxel Device's performance. An anomaly profile is a set of anomaly policies with configured activation, log and action settings. This field shows which anomaly profile is bound to which traffic direction. Select an ADP profile to apply to the entry's traffic direction. Configure the ADP profiles in the ADP profile screens. 24.5.2 Creating New ADP Profiles Create new ADP profiles in the Configuration > Security Policy > ADP > Profile screens. When creating ADP profiles. you may find that certain policies are triggering too many false positives or false negatives. A false positive is when valid traffic is flagged as an attack. A false negative is when invalid traffic is wrongly allowed to pass through the Zyxel Device. As each network is different, false positives and false negatives are common on initial ADP deployment. To counter this, you could create a 'monitor profile' that creates logs, but all actions are disabled. Observe the logs over time and try to eliminate the causes of the false alarms. When you're satisfied that they have been reduced to an acceptable level, you could then create an 'in-line profile' whereby you configure appropriate actions to be taken when a packet matches a policy. ADP profiles consist of traffic anomaly profiles and protocol anomaly profiles. To create a new profile, select a base profile and then click OK to go to the profile details screen. Type a new profile name, enable or disable individual policies and then edit the default log options and actions. Click Configuration > Security Policy > ADP > Profile to view the following screen. ZyWALL ATP Series User's Guide 526