ZyXEL ZyWALL ATP700 User Guide - Page 610

Chapter 29 IDP Search for, then activate the signature, configure what action to take when a packet matches it and if it should generate a log or alert in a profile. Then bind the profile to a zone. 29.3.4 Verifying Custom Signatures Configure the signature to create a log when traffic matches the signature. (You may also want to configure an alert if it is for a serious attack and needs immediate attention.) After you apply the signature to a zone, you can see if it works by checking the logs (Monitor > Log). The Priority column shows warn for signatures that are configured to generate a log only. It shows critical for signatures that are configured to generate a log and alert. All IDP signatures come under the IDP category. The Note column displays ACCESS FORWARD when no action is configured for the signature. It displays ACCESS DENIED if you configure the signature action to drop the packet. The destination port is the service port (53 for DNS in this case) that the attack tries to exploit. Figure 404 Custom Signature Log 29.4 The White List Screen Use this screen to list signatures that will be exempted from IDP inspection. The Zyxel Device will exclude incoming packets with the listed signature(s) from being intercepted and inspected. Click Configuration > Security Service > IDP > White List to display the following screen. Use Add to put a new item in the list or Edit to change an existing one or Remove to delete an existing entry. ZyWALL ATP Series User's Guide 610