Idp Profile Configuration - ZyXEL Communications ZyWALL USG Series User Manual

Chapter 3 Protecting Your Network

3.6 IDP Profile Configuration

IDP (Intrusion, Detection and Prevention) detects malicious or suspicious packets and protects
against network-based intrusions.
Note: You need to first activate your IDP service license or trial. See
Registration on page
You may want to create a new profile if not all signatures in a base profile are applicable to your
network. In this case you should disable non-applicable signatures so as to improve ZyWALL IDP
processing efficiency.
You may also find that certain signatures are triggering too many false positives or false negatives.
A false positive is when valid traffic is flagged as an attack. A false negative is when invalid traffic is
wrongly allowed to pass through the ZyWALL. As each network is different, false positives and false
negatives are common on initial IDP deployment.
You could create a new 'monitor profile' that creates logs but all actions are disabled. Observe the
logs over time and try to eliminate the causes of the false alarms. When you're satisfied that they
have been reduced to an acceptable level, you could then create an 'inline profile' whereby you
configure appropriate actions to be taken when a packet matches a signature.
3.6.1 Procedure To Create a New Profile
To create a new profile:
Click Configuration > Anti-X > IDP > Profile and in the Profile Management section of this
1
screen, click the Add icon. A pop-up screen will appear allowing you to choose a base profile. Select
a base profile to go to the profile details screen.
Note: If Internet Explorer opens a warning screen about a script making Internet Explorer
run slowly and the computer maybe becoming unresponsive, just click No to
continue.
Type a new profile Name. Enable or disable individual signatures by selecting a row and clicking
2
Activate or Inactivate. Click OK.
58
55.
Device and Service
ZyWALL USG 20-2000 User's Guide