ZyXEL Communications ZyWall ATP series User Manual page 806

The Zyxel Device's performance slowed down after I configured many new application patrol
entries.
The Zyxel Device checks the ports and conditions configured in application patrol entries in the order
they appear in the list. While this sequence does not affect the functionality, you might improve the
performance of the Zyxel Device by putting more commonly used ports at the top of the list.
The Zyxel Device's anti-malware scanner cleaned an infected file but now I cannot use the file.
The scanning engine checks the contents of the packets for virus. If a virus pattern is matched, the Zyxel
Device removes the infected portion of the file along with the rest of the file. The uninfected portion of
the file before a virus pattern was matched still goes through. Since the Zyxel Device erases the infected
portion of the file before sending it, you may not be able to open the file.
The Zyxel Device is not scanning some zipped files.
The Zyxel Device cannot unzip password protected ZIP files or a ZIP file within another ZIP file. There are also limits to
the number of ZIP files that the Zyxel Device can concurrently unzip.
The Zyxel Device is deleting some zipped files.
The anti-malware policy may be set to delete zipped files that the Zyxel Device cannot unzip. The Zyxel
Device cannot unzip password protected ZIP files or a ZIP file within another ZIP file. There are also limits
to the number of ZIP files that the Zyxel Device can concurrently unzip.
The Zyxel Device's performance seems slower after configuring IDP.
Depending on your network topology and traffic load, binding every packet direction to an IDP profile
may affect the Zyxel Device's performance. You may want to focus IDP scanning on certain traffic
directions such as incoming traffic.
IDP is dropping traffic that matches a rule that says no action should be taken.
The Zyxel Device checks all signatures and continues searching even after a match is found. If two or
more rules have conflicting actions for the same packet, then the Zyxel Device applies the more
restrictive action (reject-both, reject-receiver or reject-sender, drop, none in this order). If a packet
Chapter 43 Troubleshooting
ZyWALL ATP Series User's Guide
806