ZyWALL IDP 10 Quick Start Guide

Network-based intrusions have the goal of bringing down a network or networks by attacking computer(s), switch(es), router(s) or modem(s) (see 1, 2, 3 and 4 in Figure 1). If the LAN and/or DMZ switch is compromised (see 2 in Figure 1), then those networks are compromised. If the firewall/router is attacked (see 3 in Figure 1) and/or the Internet access broadband modem (see 4 in Figure 1), then this is the equivalent of a Denial of Service (DoS) attack on your network(s).

Host-based intrusions may be used to cause network-based intrusions when the goal of the host virus is to propagate attacks on the network, or attack computer/server operating system vulnerabilities with the goal of bringing down the computer/server.

To protect against network-based intrusions, you need the ZyWALL Intrusion Detection Prevention (IDP) Appliance. Typical network-based intrusions are SQL slammer, Blaster, Nimda, MyDoom etc.

2 Introducing the ZyWALL IDP 10

The ZyWALL IDP 10 functions as a plug and play bridge designed to protect networks from intrusions while allowing safe Internet access.

The default ZyWALL IDP 10 IP address is 192.168.1.3.

An IDP can detect malicious or suspicious packets and respond instantaneously. It can detect intrusions based on pre-defined attack patterns, violations of protocol standards (RFCs – Requests for Comments) or abnormal flows such as port scans. The rules that define detections are called “signatures”.

The ZyWALL IDP comes with a built-in signature set that can be regularly updated. Regular updates are vital as new attack types are constantly evolving.

For people with knowledge of packet header types and OSI (Open System Interconnection), the IDP allows you to create your own rules.

You can configure the ZyWALL IDP using the friendly, embedded web configurator or the command- line interface you access via the console port.

3 Application Examples

You can install a ZyWALL IDP either between the firewall (or switch) and Internet to protect your local networks and firewall (or switch) from intrusions from the Internet, behind the firewall (or switch) to protect the DMZ servers from intrusions from the local network (due to an infected LAN computer, for example), or ideally, install one in front of the firewall and two others behind the firewall.

In the installation example (see Figure 2) ZyWALL IDPs (A1 and A2) protect the LAN and DMZ from intrusions from the Internet and from each other. They also receive firewall protection.

ZyWALL IDP (A3) protects the firewall (B), DMZ servers (and LAN). However, it does not receive firewall protection.

5