Chapter 51 Troubleshooting

matched still goes through. Since the ZyWALL erases the infected portion of the file before sending it, you may not be able to open the file.

The ZyWALL is not scanning some zipped files.

The ZyWALL cannot unzip password protected ZIP files or a ZIP file within another ZIP file. There are also limits to the number of ZIP files that the ZyWALL can concurrently unzip.

The ZyWALL is deleting some zipped files.

The anti-virus policy may be set to delete zipped files that the ZyWALL cannot unzip. The ZyWALL cannot unzip password protected ZIP files or a ZIP file within another ZIP file. There are also limits to the number of ZIP files that the ZyWALL can concurrently unzip.

The ZyWALL’s performance seems slower after configuring IDP.

Depending on your network topology and traffic load, binding every packet direction to an IDP profile may affect the ZyWALL’s performance. You may want to focus IDP scanning on certain traffic directions such as incoming traffic.

IDP is dropping traffic that matches a rule that says no action should be taken.

The ZyWALL checks all signatures and continues searching even after a match is found. If two or more rules have conflicting actions for the same packet, then the ZyWALL applies the more restrictive action (reject-both,reject-receiver or reject-sender, drop, none in this order). If a packet matches a rule for reject- receiver and it also matches a rule for reject-sender, then the ZyWALL will reject-both.

I uploaded a custom signature file and now all of my earlier custom signatures are gone.

The name of the complete custom signature file on the ZyWALL is ‘custom.rules’. If you import a file named ‘custom.rules’, then all custom signatures on the

764

 

ZyWALL USG 50 User’s Guide