ZyXEL ZyWALL ATP700 User Guide - Page 596

CHAPTER 29 IDP 29.1 Overview This chapter introduces packet inspection IDP (Intrusion, Detection and Prevention), custom signatures, and updating signatures. An IDP system can detect malicious or suspicious packets and respond instantaneously. IDP on the Zyxel Device protects against network-based intrusions. 29.1.1 What You Can Do in this Chapter • Use the Security Service > IDP screen (Section 29.2 on page 597) to view registration and signature information. • Use the Security Service > IDP > Custom Signature > Add screens (Section 29.3 on page 602) to create a new custom signature, edit an existing signature, delete existing signatures or save signatures to your computer. • Use the Security Service > IDP > White List screen (Section 29.4 on page 610) to list signatures that will be exempted from IDP inspection. 29.1.2 What You Need To Know Packet Inspection Signatures A signature is a pattern of malicious or suspicious packet activity. You can specify an action to be taken if the system matches a stream of data to a malicious signature. You can change the action in the profile screens. Packet inspection examine OSI (Open System Interconnection) layer-4 to layer-7 packet contents for malicious data. Generally, packet inspection signatures are created for known attacks while anomaly detection looks for abnormal behavior. Applying Your IDP Configuration Changes to the Zyxel Device's IDP settings affect new sessions, but not the sessions that already existed before you applied the new settings. 29.1.3 Before You Begin • Register for a trial IDP subscription in the Registration screen. This gives you access to free signature updates. This is important as new signatures are created as new attacks evolve. When the trial subscription expires, purchase and enter a license key using the same screens to continue the subscription. ZyWALL ATP Series User's Guide 596