Filter
Top Products
ZyWALL IDP 10 Quick Start Guide
5
Network-based intrusions have the goal of bringing down a network or networks by attacking
computer(s), switch(es), router(s) or modem(s) (see 1, 2, 3 and 4 in Figure 1). If the LAN and/or DMZ
switch is compromised (see 2 in Figure 1), then those networks are compromised. If the firewall/router
is attacked (see 3 in Figure 1) and/or the Internet access broadband modem (see 4 in Figure 1), then this
is the equivalent of a Denial of Service (DoS) attack on your network(s).
Host-based intrusions may be used to cause network-based intrusions when the goal of the host virus is
to propagate attacks on the network, or attack computer/server operating system vulnerabilities with the
goal of bringing down the computer/server.
To protect against network-based intrusions, you need the ZyWALL Intrusion Detection Prevention
(IDP) Appliance. Typical network-based intrusions are SQL slammer, Blaster, Nimda, MyDoom etc.
2 Introducing the ZyWALL IDP 10
The ZyWALL IDP 10 functions as a plug and play bridge designed to protect networks from intrusions
while allowing safe Internet access.
The default ZyWALL IDP 10 IP address is 192.168.1.3.
An IDP can detect malicious or suspicious packets and respond instantaneously. It can detect intrusions
based on pre-defined attack patterns, violations of protocol standards (RFCs – Requests for Comments)
or abnormal flows such as port scans. The rules that define detections are called “signatures”.
The ZyWALL IDP comes with a built-in signature set that can be regularly updated. Regular updates
are vital as new attack types are constantly evolving.
For people with knowledge of packet header types and OSI (Open System Interconnection), the IDP
allows you to create your own rules.
You can configure the ZyWALL IDP using the friendly, embedded web configurator or the command-
line interface you access via the console port.
3 Application Examples
You can install a ZyWALL IDP either between the firewall (or switch) and Internet to protect your
local networks and firewall (or switch) from intrusions from the Internet, behind the firewall (or switch)
to protect the DMZ servers from intrusions from the local network (due to an infected LAN computer,
for example), or ideally, install one in front of the firewall and two others behind the firewall.
In the installation example (see Figure 2) ZyWALL IDPs (A1 and A2) protect the LAN and DMZ from
intrusions from the Internet and from each other. They also receive firewall protection.
ZyWALL IDP (A3) protects the firewall (B), DMZ servers (and LAN). However, it does not receive
firewall protection.