Chapter 27 Security Policy
ZyWALL USG Series User’s Guide
583
27.5.2 Creating New ADP Profiles
Create new ADP profiles in the
Configuration > Security Policy > ADP > Profile
screens.
When creating ADP profiles. you may find that certain policies are triggering too many false positives or
false negatives. A false positive is when valid traffic is flagged as an attack. A false negative is when
invalid traffic is wrongly allowed to pass through the Zyxel Device. As each network is different, false
positives and false negatives are common on initial ADP deployment.
To counter this, you could create a ‘monitor profile’ that creates logs, but all actions are disabled.
Observe the logs over time and try to eliminate the causes of the false alarms. When you’re satisfied that
they have been reduced to an acceptable level, you could then create an ‘in-line profile’ whereby you
configure appropriate actions to be taken when a packet matches a policy.
ADP profiles consist of traffic anomaly profiles and protocol anomaly profiles. To create a new profile,
select a base profile and then click
OK
to go to the profile details screen. Type a new profile name,
enable or disable individual policies and then edit the default log options and actions.
Click
Configuration > Security Policy > ADP > Profile
to view the following screen.
Edit
Select an entry and click this to be able to modify it.
Remove
Select an entry and click this to delete it.
Activate
To turn on an entry, select it and click
Activate
.
Inactivate
To turn off an entry, select it and click
Inactivate
.
Move
To change an entry’s position in the numbered list, select it and click
Move
to display
a field to type a number for where you want to put that entry and press [ENTER] to
move the entry to the number that you typed.
#
This is the entry’s index number in the list.
Priority
This is the rank in the list of anomaly profile policies. The list is applied in order of
priority.
Status
The activate (light bulb) icon is lit when the entry is active and dimmed when the
entry is inactive.
From
This is the direction of travel of packets to which an anomaly profile is bound. Traffic
direction is defined by the zone the traffic is coming from.
Use the
From
field to specify the zone from which the traffic is coming. Select
ZyWALL
to specify traffic coming from the Zyxel Device itself.
From
LAN
means packets traveling from a computer on one LAN subnet to a
computer on another subnet via the Zyxel Device’s LAN1 zone interfaces. The Zyxel
Device does not check packets traveling from a LAN computer to another LAN
computer on the same subnet.
From
WAN
means packets that come in from the WAN zone and the Zyxel Device
routes back out through the WAN zone.
Note: Depending on your network topology and traffic load, applying
every packet direction to an anomaly profile may affect the Zyxel
Device’s performance.
Anomaly Profile
An anomaly profile is a set of anomaly policies with configured activation, log and
action settings. This field shows which anomaly profile is bound to which traffic
direction. Select an ADP profile to apply to the entry’s traffic direction. Configure the
ADP profiles in the ADP profile screens.
Table 208 Configuration > Security Policy > ADP > General
LABEL
DESCRIPTION
Summary of Contents for USG110
Page 27: ...27 PART I User s Guide ...
Page 195: ...195 PART II Technical Reference ...
Page 309: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 309 ...
Page 313: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 313 ...
Page 358: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 358 ...
Page 373: ...Chapter 10 Interfaces ZyWALL USG Series User s Guide 373 ...
