Creating New Adp Profiles - ZyXEL Communications ZyWALL 110 User Manual

Table 154 Configuration > Security Policy > ADP > General
LABEL
Edit
Remove
Activate
Inactivate
Move
#
Priority
Status
From
Anomaly Profile

21.5.2 Creating New ADP Profiles

Create new ADP profiles in the Configuration > Security Policy > ADP > Profile screens.
When creating ADP profiles. you may find that certain policies are triggering too many false
positives or false negatives. A false positive is when valid traffic is flagged as an attack. A false
negative is when invalid traffic is wrongly allowed to pass through the ZyWALL/USG. As each
network is different, false positives and false negatives are common on initial ADP deployment.
To counter this, you could create a 'monitor profile' that creates logs, but all actions are disabled.
Observe the logs over time and try to eliminate the causes of the false alarms. When you're
satisfied that they have been reduced to an acceptable level, you could then create an 'in-line
profile' whereby you configure appropriate actions to be taken when a packet matches a policy.
ADP profiles consist of traffic anomaly profiles and protocol anomaly profiles. To create a new
profile, select a base profile and then click OK to go to the profile details screen. Type a new profile
name, enable or disable individual policies and then edit the default log options and actions.
Click Configuration > Security Policy > ADP > Profile to view the following screen.
Chapter 21 Security Policy
DESCRIPTION
Select an entry and click this to be able to modify it.
Select an entry and click this to delete it.
To turn on an entry, select it and click Activate.
To turn off an entry, select it and click Inactivate.
To change an entry's position in the numbered list, select it and click Move to
display a field to type a number for where you want to put that entry and press
[ENTER] to move the entry to the number that you typed.
This is the entry's index number in the list.
This is the rank in the list of anomaly profile policies. The list is applied in order
of priority.
The activate (light bulb) icon is lit when the entry is active and dimmed when the
entry is inactive.
This is the direction of travel of packets to which an anomaly profile is bound.
Traffic direction is defined by the zone the traffic is coming from.
Use the From field to specify the zone from which the traffic is coming. Select
ZyWALL to specify traffic coming from the ZyWALL/USG itself.
From LAN means packets traveling from a computer on one LAN subnet to a
computer on another subnet via the ZyWALL/USG's LAN1 zone interfaces. The
ZyWALL/USG does not check packets traveling from a LAN computer to another
LAN computer on the same subnet.
From WAN means packets that come in from the WAN zone and the ZyWALL/
USG routes back out through the WAN zone.
Note: Depending on your network topology and traffic load, applying every packet
direction to an anomaly profile may affect the ZyWALL/USG's
performance.
An anomaly profile is a set of anomaly policies with configured activation, log
and action settings. This field shows which anomaly profile is bound to which
traffic direction. Select an ADP profile to apply to the entry's traffic direction.
Configure the ADP profiles in the ADP profile screens.
ZyWALL/USG Series User's Guide
374