Chapter 30 ADP

These are the default base profiles at the time of writing.

Table 166 Base Profiles

BASE PROFILE

DESCRIPTION

all

All traffic anomaly and protocol anomaly rules are enabled. Rules with a high or

 

severe severity level (greater than three) generate log alerts and cause packets

 

that trigger them to be dropped. Rules with a very low, low or medium severity

 

level (less than or equal to three) generate logs (not log alerts) and no action is

 

taken on packets that trigger them.

 

 

none

All traffic anomaly and protocol anomaly rules are disabled. No logs are generated

 

nor actions are taken.

 

 

OK

Click OK to save your changes.

 

 

Cancel

Click Cancel to exit this screen without saving your changes.

 

 

30.3.2 Configuring The ADP Profile Summary Screen

Select Anti-X > ADP > Profile.

Figure 399 Anti-X > ADP > Profile

The following table describes the fields in this screen.

Table 167 Anti-X > ADP > Profile

LABEL

DESCRIPTION

Name

This is the name of the profile you created.

 

 

Base Profile

This is the base profile from which the profile was created.

 

 

(Icons)

Click the Add icon in the column header to create a new profile. A pop-up screen

 

displays requiring you to choose a base profile from which to create the new profile.

 

Click an Edit icon to edit an existing profile.

 

Click a Remove icon to delete an existing profile.

 

 

30.3.3 Creating New ADP Profiles

You may want to create a new profile if not all rules in a base profile are applicable to your network. In this case you should disable non-applicable rules so as to improve ZyWALL ADP processing efficiency.

You may also find that certain rules are triggering too many false positives or false negatives. A false positive is when valid traffic is flagged as an attack. A false negative is when invalid traffic is wrongly allowed to pass through the ZyWALL. As each network is different, false positives and false negatives are common on initial ADP deployment.

You could create a new ‘monitor profile’ that creates logs but all actions are disabled. Observe the logs over time and try to eliminate the causes of the false alarms. When you’re satisfied that they have been reduced to an acceptable level, you could then create an ‘inline profile’ whereby you configure appropriate actions to be taken when a packet matches a rule.

 

517

ZyWALL USG 100/200 Series User’s Guide