Chapter 25 Security Policy
ZyWALL ATP Series User’s Guide
490
The following table describes the labels in this screen.
Table 195 Configuration > Security Policy > ADP > Profile > Add-Protocol-Anomaly
LABEL
DESCRIPTION
Name
A name is automatically generated that you can edit. The name must be the same
in the Traffic Anomaly and Protocol Anomaly screens for the same ADP profile. You
may use 1-31 alphanumeric characters, underscores(
_
), or dashes (-), but the first
character cannot be a number. This value is case-sensitive. These are valid, unique
profile names:
• MyProfile
• mYProfile
• Mymy12_3-4
• These are invalid profile names:
• 1mYProfile
• My Profile
• MyProfile?
• Whatalongprofilename123456789012
Description
In addition to the name, type additional information to help you identify this ADP
profile.
TCP Decoder/UDP
Decoder/ICMP Decoder/IP
Decoder
Perform the following actions for each type of encoder.
Activate
To turn on an entry, select it and click
Activate
.
Inactivate
To turn off an entry, select it and click
Inactivate
.
Log
To edit an item’s log option, select it and use the
Log
icon. Select whether to have
the Zyxel Device generate a log (
log
), log and alert (
log alert
) or neither (
no
) when
traffic matches this anomaly policy.
Action
To edit what action the Zyxel Device takes when a packet matches a policy, select
the policy and use the
Action
icon.
original setting
: Select this action to return each rule in a service group to its
previously saved configuration.
none
: Select this action to have the Zyxel Device take no action when a packet
matches a policy.
drop
: Select this action to have the Zyxel Device silently drop a packet that matches
a policy. Neither sender nor receiver are notified.
reject-sender
: Select this action to have the Zyxel Device send a reset to the sender
when a packet matches the policy. If it is a TCP attack packet, the Zyxel Device will
send a packet with a ‘RST’ flag. If it is an ICMP or UDP attack packet, the Zyxel
Device will send an ICMP unreachable packet.
reject-receiver
: Select this action to have the Zyxel Device send a reset to the
receiver when a packet matches the policy. If it is a TCP attack packet, the Zyxel
Device will send a packet with an a ‘RST’ flag. If it is an ICMP or UDP attack packet,
the Zyxel Device will do nothing.
reject-both
: Select this action to have the Zyxel Device send a reset to both the
sender and receiver when a packet matches the policy. If it is a TCP attack packet,
the Zyxel Device will send a packet with a ‘RST’ flag to the receiver and sender. If it is
an ICMP or UDP attack packet, the Zyxel Device will send an ICMP unreachable
packet.
#
This is the entry’s index number in the list.
Status
The activate (light bulb) icon is lit when the entry is active and dimmed when the
entry is inactive.
Name
This is the name of the anomaly policy. Click the
Name
column heading to sort in
ascending or descending order according to the protocol anomaly policy name.
