Reputation Filter
Overview
Use the Reputation Filter screens to configure settings for IP Reputation, DNS Filter and URL Threat filtering.
What You Need to Know
IP Reputation
IP reputation checks the reputation of an IP address from a database. An IP address with bad reputation associates with suspicious activities, such as spam, virus, and/or phishing. The Zyxel Device will respond when there are packets coming from an IPv4 address with bad reputation.
DNS Filter
DNS filtering inspects DNS queries made by clients on your network and compares the queries against a database of blocked or allowed Fully Qualified Domain Names (FQDNs). The Zyxel Device DNS filter will either drop the DNS query or reply to the user with a fake DNS response.
URL Threat Filter
URL filtering compares access to specific URLs against a database of blocked or allowed sites. Sites on the database are sorted into categories such as:
• Anonymizers | • Browser Exploits | • Malicious Downloads |
• Malicious Sites | • Phishing | • Spam URLs |
• Spyware Adware Keyloggers | • | • |
IP Reputation Screen
When you register for and enable the IP reputation service, your Zyxel Device downloads signature files that identifies reputation of IPv4 addresses. You can have the Zyxel Device forward, block, and/or log packets from IPv4 addresses based on these signatures and categories.
Use this screen to enable IP reputation and specify the action the Zyxel Device takes when it detects a suspicious activity or a connection attempt to or from an IPv4 address with bad reputation.
The priority for IP Reputation checking is as follows:
1 White List
2 Black List
3 External Black List
4 Local Zyxel Device Signatures
The following table describes the labels in this screen.
label | description |
|---|---|
IP Blocking | |
Enable | Select this option to turn on IP blocking on the Zyxel Device. Otherwise, clear it. |
Action | Set what action the Zyxel Device takes when packets come from an IPv4 address with bad reputation. forward: Select this action to have the Zyxel Device allow the packet to go through. block: Select this action to have the Zyxel Device deny the packets and send a TCP RST to both the sender and receiver when a packet comes from an IPv4 address with bad reputation. |
Threat Level Threshold | Select the threshold threat level to which the Zyxel Device will take action (high, medium and above, Low and above). The threat level is determined by the IP reputation engine. It grades IPv4 addresses. • high: An IPv4 address that scores 0 to 20 points. • medium and above: An IPv4 address that scores 0-60 points. • Low and above: An IPv4 address that scores 0-80 pointgs. |
Log | These are the log options: no: Do not create a log when the packet comes from an IPv4 address with bad reputation. log: Create a log on the Zyxel Device when the packet comes from an IPv4 address with bad reputation. log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when the packet comes from an IPv4 address with bad reputation. |
Types of Cyber Threats Coming From The Internet | Select the categories of packets that come from the Internet and are known to pose a security threat to users or their computers. Otherwise, deselect it. |
Anonymous Proxies | These are sites and proxies that act as an intermediary for surfing to other websites in an anonymous fashion, whether to circumvent Web filtering or for other reasons. |
Denial of Service | These are sites that issue Denial of Service (DoS) attacks, such as DoS, DDoS, SYN flood, and anomalous traffic detection. DoS attacks can flood your Internet connection with invalid packets and connection requests, using so much bandwidth and so many resources that Internet access becomes unavailable. The goal of DoS attacks is not to steal information, but to disable a device or network on the Internet. A Distributed Denial of Service (DDoS) attack is one in which multiple compromised systems attack a single target, thereby causing denial of service for users of the targeted system. SYN flood is an attack that attackers flood SYN packets to a server in TCP handshakes, and not respond with ACK packets on purpose. This keeps the server waiting for attackers’ responses to establish TCP connections, and make the server unavailable. Anomalous traffic detection could be malicious activities, such as malware outbreaks or hacking attempts. |
Exploits | These are sites that distribute exploits or exploit kits to infect website visitors’ devices. Exploits include shellcode, root kits, worms, or viruses that download additional malware to infect devices. An exploit kit consists of different exploits. |
Negative Reputation | These are sites that have bad reputation and associate with suspicious activities, such as spam, virus, and/or phishing. |
Scanners | These are sites that run unauthorized system vulnerabilities scan to look for vulnerabilities in website visitors’ devices. |
Spam Sources | These are sites that have been promoted through spam techniques. |
TOR Proxies | These are sites that act as the exit nodes in a Tor (The Onion Router) network. Tor is a service that keep users anonymous in the Internet and make users’ Internet activities untraceable. Tor hides user’s real IP addresses by encrypting data and transmitting the encrypted data in a chain of selected nodes acting as intermediaries. Each node can only decrypt the data sent from the node before it. The first node that receives the encrypted data is called the entry node. The last node is the last intermediary that the encrypted data will go through before it arrives at the destination. |
Web Attacks | These are sites that launch web attacks, such as SQL injection, cross site scripting, iframe injection, and brute force attack. SQL injection (SQLI) is an attack that attackers insert malicious SQL (Structured Query Language) code into a web application database query. Attackers can then access, add, modify, or delete data in users’ databases. Cross site scripting (XSS) is an attack that attackers injects malicious scripts to websites or web applications in the form of HTML or JavaScript code. The scripts execute when users visit the infected web page or perform the infected web applications. XSS will cause failures to encrypt traffic, cookie stealing, identity impersonation, and phishing. Iframe injection is an attack that attackers injects malicious iframe (inline frame) tags to websites. The malicious iframe tag downloads malware to the devices of the infected websites’ visitors, and steal users’ sensitive information. An iframe tag is an HTML tag that is used to embed contents from another source in a website, but attackers misuse this feature. Brute force attack is an attack that attackers attempt to gain access to websites or device via a succession of different passwords. |
Phishing | These are sites that are used for deceptive or fraudulent purposes (e.g. phishing), such as stealing financial or other user account information. These sites are most often designed to appear as legitimate sites in order to mislead users into entering their credentials. |
Types of Cyber Threats Coming From The Internet And Local Networks | Select the categories of packets that come from the Internet and local network. The categories of packets are known to pose a security threat to users or their computers. Otherwise, clear it. |
Botnets | A botnet is a network consisting of computers that are infected with malware and remotely controlled. The infected computers will contact and wait for instructions from a command and control (C&C) server. An attacker can control the botnet by setting up a C&C server and then sending commands to the infected computers. Alternatively, a peer-to-peer network approach is used. The infected computer scans and communicates with the peer devices in the same botnet to share commands or malware sent by the C&C server. These are botnet sites including command-and-control (C&C) servers. |
Test IP Threat Category | |
IP to test | Enter an IPv4 address of a website, and click the Query button to check if the website associates with suspicious activities that could pose a security threat to users or their computers. |
Signature Information | The Zyxel Device comes with signatures for IP reputation. These signatures are continually updated as new malware evolves. New signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the IP reputation signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for IP reputation service in order to be able to download new signatures from myZyxel (see the Registration screens). The following fields display information on the current signature set that the Zyxel Device is using. |
Current Version | This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as new signatures are added. |
Signature Number | This field displays the number of signatures in this set. |
Released Date | This field displays the date and time the set was released. |
Update Signatures | Click this to go to the Configuration > Licensing > Signature Update screen to check for new signatures at myZyxel. You can schedule or immediately download signatures. |
Apply | Click Apply to save your changes. |
Reset | Click Reset to return the screen to its last-saved settings. |
IP Reputation White List Screen
Use this screen to create white list entries. The Zyxel Device will allow the incoming and outgoing packets from the listed IPv4 addresses.
You can add up to 256 entries in the IP reputation white list.
The following table describes the labels in this screen.
Label | Description |
|---|---|
White List | |
Check White List | Select this check box and the Zyxel Device will allow the incoming packets that come from the listed IPv4 addresses.  Enable IP blocking in the Configuration > Security Service > Reputation Filter > IP Reputation > General screen for the white list to take effect. |
Add | Click this to create a new entry. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
Activate | To turn on an entry, select it and click Activate. |
Inactivate | To turn off an entry, select it and click Inactivate. |
# | This is the entry’s index number in the list. |
Status | The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. |
IPv4 Address | This field displays the IPv4 address of this entry. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
IP Reputation Black List Screen
Use this screen to create black list entries. The Zyxel Device will block the incoming and outgoing packets from the listed IPv4 addresses.
You can add up to 256 entries in the IP reputation black list.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Black List | |
Check Black List | Select this check box and the Zyxel Device will block the incoming packets that come from the listed IPv4 addresses. Select Enable under IP Blocking in the Configuration > Security Service > Reputation Filter > IP Reputation > General screen for the black list to take effect. |
Add | Click this to create a new entry. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
Activate | To turn on an entry, select it and click Activate. |
Inactivate | To turn off an entry, select it and click Inactivate. |
# | This is the entry’s index number in the list. |
Status | The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. |
IPv4 Address | This field displays the IPv4 address of this entry. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
IP Reputation External Black List Screen
Use this screen to use black list entries stored in a file on a web server that supports HTTP or HTTPS and is reachable from the Zyxel Device. The Zyxel Device will block incoming and outgoing packets from the black list entries in this file.
• The external black list file must be in text format (*.txt) with each entry separated by a new line.
• External black list entries can consist of single IPv4 / IPv6 IP addresses, IP address ranges, CIDR (Classless Inter-Domain Routing entries such as 192.168.1.1/24, 2001:7300:3500::1/64. These are some examples for your reference only:
• 4.4.4.4
• 192.168.1.0/32
• If the external blacklist file contains any invalid entries, the Zyxel Device will not use the file.
• The external black list file can contain up to 50,000 entries. A warning message displays when the maximum is reached.
The following table describes the labels in this screen.
Label | Description |
|---|---|
URL Blocking For External DB | |
Enable URL Blocking For External DB | Select this check box to have the Zyxel Device block the incoming packets that come from the listed addresses in the black list file on the server. Select Enable under IP Blocking in the Configuration > Security Service > Reputation Filter > IP Reputation > General screen for the black list to take effect. |
Add | Click this to create a new entry. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
# | This is the entry’s index number in the list. |
Name | This displays the identifying name for the black list file. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. |
Source | This displays the file name, path and IP address of the server containing the black list file. For example, http://172.16.107.20/blacklist-files/myip-ebl.txt |
Description | This displays the a description of the black list file. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. |
New IP reputation signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the IP reputation signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for IP reputation service in order to be able to download new signatures from myZyxel (see the Registration screens). Schedule signature updates for a day and time when your network is least busy to minimize disruption to your network. | |
Update Now | Click this to have the Zyxel Device immediately check for new signatures at myZyxel. If new signatures are found, they are then downloaded to the Zyxel Device. |
Auto Update | Click this to have the Zyxel Device automatically check for new signatures regularly at the time and day specified. You should select a time when your network is not busy for minimal interruption. |
Daily | Select this to have the Zyxel Device check for new signatures every day at the specified time. The time format is the 24 hour clock, so ‘23’ means 11 PM for example. |
Weekly | Select this option to have the Zyxel Device check for new signatures once a week on the day and at the time specified. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
IP Reputation External Black List Screen Add/Edit
Use this screen to define a black list file on a web server that supports HTTP or HTTPS.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Name | Enter an identifying name for the black list file. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. |
Source | Enter the exact file name, path and IP address of the server containing the black list file. For example, http://172.16.107.20/blacklist-files/myip-ebl.txt The server must be reachable from the Zyxel Device. |
Description | Enter a description of the black list file. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. |
OK | Click OK to save your changes back to the Zyxel Device. |
Cancel | Click Cancel to exit this screen without saving. |
DNS Filter Screen
A Domain Name System (DNS) server records mappings of FQDN (Fully Qualified Domain Names) to IP addresses. A FQDN consists of a host and domain name. For example, www.zyxel.com is a fully qualified domain name, where “www” is the host, “zyxel” is the second-level domain, and “com” is the top level domain.
DNS filtering inspects DNS queries made by clients on your network and compares the queries against a database of blocked or allowed Fully Qualified Domain Names (FQDNs).
If a user attempts to connect to a suspect site, where the DNS query packet contains an FQDN with a bad reputation, then a DSN query is sent from the user’s computer and detected by the DNS Filter.
The Zyxel Device DNS filter will either drop the DNS query or reply to the user with a fake DNS response using the default dnsft.cloud.zyxel.com IP address (where the user will see a “Web Page Blocked!” page) or a custom IP address.
The following types of DNS queries are allowed by the Zyxel Device:
• Type “A” for IPv4 addresses
The Zyxel Device replies with a DNS server error for the following types of DNS queries:
• Type “AAAA” for IPv6 addresses
• Type “NS” (Name Server) to get information about the authoritative name server
• Type “MX” (Mail eXchange) to request information about the mail exchange server for a specific DNS domain name.
• Type “CNAME” (Canonical Names) that specifies a domain name that has to be queried in order to resolve the original DNS query
• Type “PTR” (Pointer) that specifies a reverse query (requesting the FQDN corresponding to the IP address you provided)
• Type “SOA” (Start Of zone Authority) used when transferring zones
The priority for DNS filter checking is as follows:
1 White List
2 Black List
3 Local Zyxel Device Signatures
4 Cloud Query Cache
5 Cloud Query
The following table describes the labels in this screen.
label | description |
|---|---|
DNS Filter | |
Enable | Select this option to turn on DNS filtering on the Zyxel Device. Otherwise, clear it. Action and Log settings apply to DNS query packets triggered by the security threat categories. |
Action | Set what action the Zyxel Device takes when there is a DNS query packet containing an FQDN with a bad reputation. redirect: Select this action to have the Zyxel Device reply with a DNS reply packet containing a default or custom-defined IP address. pass: Select this action to have the Zyxel Device allow the DNS query packet and not reply with a DNS reply packet containing a default or custom-defined IP address. |
Log | These are the log options: no: Do not create a log when there is a DNS query packet containing an FQDN with a bad reputation. log: Create a log on the Zyxel Device when there is a DNS query packet containing an FQDN with a bad reputation. log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this to have the Zyxel Device send an alert when there is a DNS query packet containing an FQDN with a bad reputation. |
Redirect IP | Select this action to have the Zyxel Device reply with a DNS reply packet containing a default or custom-defined IP address when a DNS query packet contains an FQDN with a bad reputation. The default IP is the dnsft.cloud.zyxel.com IP address. If you select custom-defined IP, then enter a valid IPv4 address in the text box. |
Action When detecting malform DNS packets | Set what action the Zyxel Device takes when there is an abnormal DNS query packet. A DNS packet is defined as malformed when: • The number of entries in the question count field in the DNS header is 0 • An error occurs when parsing the domain name in the question field • The length of the domain name exceeds 255 characters. pass: Select this action to have the Zyxel Device allow the DNS query packet through the Zyxel Device. drop: Select this action to have the Zyxel Device discard the abnormal DNS query packet |
Security Threat Categories | Select the categories of FQDNs that may pose a security threat to network devices behind the Zyxel Device. |
Anonymizers | Sites and proxies that act as an intermediary for surfing to other Web sites in an anonymous fashion, whether to circumvent Web filtering or for other reasons. |
Browser Exploits | Sites that contain browser exploits. A browser exploit is any content that forces a web browser to perform operations that you do not explicitly intend. |
Malicious Downloads | Sites that have been identified as containing malicious downloads or malware harmful to a user's computer. |
Malicious Sites | Sites that install unwanted software on a user's computer with the intent to enable third-party monitoring or make system changes without the user's consent. |
Phishing | Sites that are used for deceptive or fraudulent purposes, such as stealing financial or other user account information. These sites are most often designed to appear as legitimate sites in order to mislead users into entering their credentials. |
Spam URLs | Sites that have been promoted through spam techniques. |
Spyware Adware Keyloggers | Sites that contain spyware, adware or keyloggers. • Spyware is a program installed on your computer, usually without your explicit knowledge, that captures and transmits personal information or Internet browsing habits and details to companies. Companies use this information to analyze browsing habits, to gather marketing data, and to sell your information to others. • Key logger programs try to capture and steal your passwords and watch and record everything you do on your computer. • Adware programs typically display blinking advertisements or pop-up windows when you perform a certain action. Adware programs are often installed in exchange for another service, such as the right to use a program without paying for it. |
Test Domain Name Category | |
Domain name to test | Enter an FQDN and click the Query button to check if the domain name is associated with suspicious activities that could pose a security threat to users or their computers. |
Signature Information | The signatures for DNS Filter and URL Threat Filter are the same. These signatures are continually updated as new malware evolves. New signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the IP reputation signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for IP reputation service in order to be able to download new signatures from myZyxel (see the Registration screens). The following fields display information on the current signature set that the Zyxel Device is using. |
Current Version | This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as new signatures are added. |
Signature Number | This field displays the number of signatures in this set. |
Released Date | This field displays the date and time the set was released. |
Update Signatures | Click this to go to the Configuration > Licensing > Signature Update screen to check for new signatures at myZyxel. You can schedule or immediately download signatures. |
Apply | Click Apply to save your changes. |
Reset | Click Reset to return the screen to its last-saved settings. |
DNS Filter White List Screen
Use this screen to create white list entries. The Zyxel Device will not reply with a DNS reply packet containing a default or custom-defined IP address when a DNS query packet contains an FQDN in the white list.
You can add up to 1,024 entries in this white list.
The following table describes the labels in this screen.
Label | Description |
|---|---|
White List | |
Enable White List | Select this check box and the Zyxel Device will not reply with a DNS reply packet containing a default or custom-defined IP address when a DNS query packet contains an FQDN in the white list. Select Enable under DNS Filter in the Configuration > Security Service > Reputation Filter > DNS Filter > General screen for the white list to take effect. |
Add | Click this to create a new entry. To add an FQDN, type a Fully-Qualified Domain Name (FQDN) of a web site. An FQDN starts with a host name and continues all the way up to the top-level domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain. Underscores are not allowed. Use "*." as a prefix in the FQDN for a wildcard domain name (for example, *.example.com). |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
Activate | To turn on an entry, select it and click Activate. |
Inactivate | To turn off an entry, select it and click Inactivate. |
# | This is the entry’s index number in the list. |
Status | The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. |
FQDN | This field displays the FQDN of this entry. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
DNS Filter Black List Screen
Use this screen to create black list entries. The Zyxel Device will reply with a DNS reply packet containing a default or custom-defined IP address when a DNS query packet contains an FQDN in the black list. For matched items in the black list, the action is always Redirect IP and log is always log alert.
You can add up to 1,024 entries in this black list.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Black List | |
Enable Black List | Select this check box and the Zyxel Device will reply with a DNS reply packet containing a default or custom-defined IP address when a DNS query packet contains an FQDN in the black list. Select Enable under DNS Filter in the Configuration > Security Service > Reputation Filter > DNS Filter > General screen for the white list to take effect. |
Add | Click this to create a new entry. To add an FQDN, type a Fully-Qualified Domain Name (FQDN) of a web site. An FQDN starts with a host name and continues all the way up to the top-level domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain. Underscores are not allowed. Use "*." as a prefix in the FQDN for a wildcard domain name (for example, *.example.com). |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
Activate | To turn on an entry, select it and click Activate. |
Inactivate | To turn off an entry, select it and click Inactivate. |
# | This is the entry’s index number in the list. |
Status | The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. |
FQDN | This field displays the FQDN of this entry. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
DNS Filter Profile
To use multiple profiles for this feature, run the following commands in the Zyxel Device Command Line Interface (CLI).
Router# configure terminal Router(config)# secure-policy-style advance Router(config)# show secure-policy-style status secure-policy-style: advance |
After you run these command, go to the feature screen again in the web configurator. You will be prompted to log out and then log in again.
After you log in again, you will see the new profile screen for this feature.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Add | Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. |
Edit | Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. |
Remove | Select an entry and click Remove to delete the selected entry. |
# | This field is a sequential value showing the number of the profile. The profile order is not important. |
Name | This displays the name of the profile created. |
Description | This displays the description of the profile. |
Add or Edit a DNS Filter Profile
Click Add to create a new entry or select an existing entry and click Edit to open the following screen where you can create or modify the entry’s settings.
The following table describes the labels in this screen.
label | description |
|---|---|
Configuration | |
Profile Name | Type the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names: • MyProfile • mYProfile • Mymy12_3-4 These are invalid profile names: • 1mYProfile • My Profile • MyProfile? • Whatalongprofilename123456789012 |
Description | Type a description for the profile rule to help identify the purpose of rule. You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. This field is optional. |
Action | Set what action the Zyxel Device takes when there is a DNS query packet containing an FQDN with a bad reputation. redirect: Select this action to have the Zyxel Device reply with a DNS reply packet containing a default or custom-defined IP address when a DNS query packet contains an FQDN with a bad reputation. pass: Select this action to have the Zyxel Device not reply with a DNS reply packet containing a default or custom-defined IP address. |
Log | These are the log options: no: Do not create a log when there is a DNS query packet containing an FQDN with a bad reputation. log: Create a log on the Zyxel Device when there is a DNS query packet containing an FQDN with a bad reputation. log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this to have the Zyxel Device send an alert when there is a DNS query packet containing an FQDN with a bad reputation. |
Scan Options | |
Check White List | Select this check box to have the Zyxel Device not perform the DNS filter check on DNS query packets that match the white list entries. |
Check Black List | Select this check box to have the Zyxel Device perform the DNS filter check on DNS query packets that match the black list entries. |
Check Black List | Select this check box to log and delete files with names that match the black list patterns. |
Security Threat Categories | Select the categories of FQDNs that may pose a security threat to network devices behind the Zyxel Device. |
Anonymizers | Sites and proxies that act as an intermediary for surfing to other Web sites in an anonymous fashion, whether to circumvent Web filtering or for other reasons. |
Browser Exploits | Sites that contain browser exploits. A browser exploit is any content that forces a web browser to perform operations that you do not explicitly intend. |
Malicious Downloads | Sites that have been identified as containing malicious downloads or malware harmful to a user's computer. |
Malicious Sites | Sites that install unwanted software on a user's computer with the intent to enable third-party monitoring or make system changes without the user's consent. |
Phishing | Sites that are used for deceptive or fraudulent purposes, such as stealing financial or other user account information. These sites are most often designed to appear as legitimate sites in order to mislead users into entering their credentials. |
Spam URLs | Sites that have been promoted through spam techniques. |
Spyware Adware Keyloggers | Sites that contain spyware, adware or keyloggers. • Spyware is a program installed on your computer, usually without your explicit knowledge, that captures and transmits personal information or Internet browsing habits and details to companies. Companies use this information to analyze browsing habits, to gather marketing data, and to sell your information to others. • Key logger programs try to capture and steal your passwords and watch and record everything you do on your computer. • Adware programs typically display blinking advertisements or pop-up windows when you perform a certain action. Adware programs are often installed in exchange for another service, such as the right to use a program without paying for it. |
OK | Click OK to save your changes back to the Zyxel Device. |
Cancel | Click Cancel to exit this screen without saving. |
Link a Profile
To link a profile to a policy, go to the Configuration > Security Policy > Policy Control screen, select a policy, and then click Edit. In the Edit Policy screen under Profile, select which profile you want to use for each security service.
DNS Filter Advance Screen
The Configuration > Security Service > Reputation Filter > DNS Filter > General screen also changes when using profiles.
The following table describes the labels in this screen.
label | description |
|---|---|
DNS Filter | |
Enable | Select this option to turn on DNS filtering on the Zyxel Device. Otherwise, clear it. Action and Log settings apply to DNS query packets triggered by the security threat categories. |
Inspect all traffic, setting: | Select this to have all traffic inspected by the default_profile. You cannot rename or delete the default_profile profile, but you can edit it by clicking the link here. |
Inspect by policy | If you configured a specific profile in the Profile tab for this service, select this to have specific traffic inspected by that profile. You must bind the profile to a policy in Security Policy > Policy Control. |
Redirect IP | Select this action to have the Zyxel Device reply with a DNS reply packet containing a default or custom-defined IP address when a DNS query packet contains an FQDN with a bad reputation. The default IP is the dnsft.cloud.zyxel.com IP address. If you select custom-defined IP, then enter a valid IPv4 address in the text box. |
Action When detecting malform DNS packets | Set what action the Zyxel Device takes when there is an abnormal DNS query packet. A DNS packet is defined as malformed when: • The number of entries in the question count field in the DNS header is 0 • An error occurs when parsing the domain name in the question field • The length of the domain name exceeds 255 characters. pass: Select this action to have the Zyxel Device allow the DNS query packet through the Zyxel Device. drop: Select this action to have the Zyxel Device discard the abnormal DNS query packet |
Test Domain Name Category | |
Domain name to test | Enter an FQDN and click the Query button to check if the domain name is associated with suspicious activities that could pose a security threat to users or their computers. |
Signature Information | The signatures for DNS Filter and URL Threat Filter are the same. These signatures are continually updated as new malware evolves. New signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the IP reputation signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for IP reputation service in order to be able to download new signatures from myZyxel (see the Registration screens). The following fields display information on the current signature set that the Zyxel Device is using. |
Current Version | This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as new signatures are added. |
Signature Number | This field displays the number of signatures in this set. |
Released Date | This field displays the date and time the set was released. |
Update Signatures | Click this to go to the Configuration > Licensing > Signature Update screen to check for new signatures at myZyxel. You can schedule or immediately download signatures. |
Apply | Click Apply to save your changes. |
Reset | Click Reset to return the screen to its last-saved settings. |
Remove Profiles
To remove profiles and revert to the default general security policy style, you must first make sure to change Inspect by policy to Inspect all traffic in the following security services: Anti-Malware, DNS Filter, URL Threat Filter, IDP, Email Security.
Note: All profiles that you created will be removed from Security Policy > Policy Control.
Run the following commands in the Zyxel Device Command Line Interface (CLI).
Router# configure terminal Router(config)# secure-policy-style general Router(config)# show secure-policy-style status secure-policy-style: general |
Wait a minute and then go to the feature screen again in the web configurator. You will be prompted to log out and then log in again.
After you log in again, you will not see the profile screen for this feature.
URL Threat Filter Screen
When you enable the URL Threat filtering service, your Zyxel Device downloads signature files that contain known URL Threat domain names and IP addresses. The Zyxel Device will also access an external database, Cloud Query, that has millions of web sites categorized based on content. You can have the Zyxel Device allow, block, warn and/or log access to web sites or hosts based on these signatures and categories.
The priority for URL Threat checking is as follows:
1 White List
2 Black List
3 External Black List
4 Local Zyxel Device Signatures
5 Cloud Query Cache
6 Cloud Query
Use this screen to enable URL Threat filtering and specify the action the Zyxel Device takes when it detects a suspicious activity or a connection attempt to or from a site in a selected category.
Click the URL Threat Filter icon for more information on the Zyxel Device’s security features.
The following table describes the labels in this screen.
label | description |
|---|---|
URL Blocking | |
Enable | Select this option to turn on URL blocking on the Zyxel Device. |
Action | Set what action the Zyxel Device takes when it detects a connection attempt to or from the web pages of the specified categories. block: Select this action to have the Zyxel Device block access to the web pages that match the categories that you select above. warn: Select this action to have the Zyxel Device display a warning message to the access requesters for the web pages before allowing users to access web pages that match the categories that you select above. pass: Select this action to have the Zyxel Device allow access to the web pages that match the categories that you select above. |
Log | These are the log options: • no: Do not create a log when it detects a connection attempt to or from the web pages of the specified categories. • log: Create a log on the Zyxel Device when it detects a connection attempt to or from the web pages of the specified categories. • log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when a connection matches web pages of the specified categories. |
Message to display when a site is blocked | |
Denied Access Message | Enter a message to be displayed when the URL Threat filter blocks access to a web page. Use up to 127 characters (0-9a-zA-Z;/?:@&=+$\.-_!~*'()%,”). For example, “Access to this web page is not allowed. Please contact the network administrator”. It is also possible to leave this field blank if you have a URL specified in the Redirect URL field. In this case if the URL Threat filter blocks access to a web page, the Zyxel Device just opens the web page you specified without showing a denied access message. |
Redirect URL | Enter the URL of the web page to which you want to send users when their web access is blocked by the URL Threat filter. The web page you specify here opens in a new frame below the denied access message. Use “http://” or “https://” followed by up to 262 characters (0-9a-zA-Z;/?:@&=+$\.-_!~*'()%). For example, http://192.168.1.17/blocked access. |
Security Threat Categories | Select the categories of web pages that may pose a security threat to network devices behind the Zyxel Device. |
Anonymizers | Sites and proxies that act as an intermediary for surfing to other Web sites in an anonymous fashion, whether to circumvent Web filtering or for other reasons. |
Browser Exploits | Sites that contain browser exploits. A browser exploit is any content that forces a web browser to perform operations that you do not explicitly intend. |
Malicious Downloads | Sites that have been identified as containing malicious downloads or malware harmful to a user's computer. |
Malicious Sites | Sites that install unwanted software on a user's computer with the intent to enable third-party monitoring or make system changes without the user's consent. |
Phishing | Sites that are used for deceptive or fraudulent purposes, such as stealing financial or other user account information. These sites are most often designed to appear as legitimate sites in order to mislead users into entering their credentials. |
Spam URLs | Sites that have been promoted through spam techniques. |
Spyware Adware Keyloggers | Sites that contain spyware, adware or keyloggers. • Spyware is a program installed on your computer, usually without your explicit knowledge, that captures and transmits personal information or Internet browsing habits and details to companies. Companies use this information to analyze browsing habits, to gather marketing data, and to sell your information to others. • Key logger programs try to capture and steal your passwords and watch and record everything you do on your computer. • Adware programs typically display blinking advertisements or pop-up windows when you perform a certain action. Adware programs are often installed in exchange for another service, such as the right to use a program without paying for it. |
Test URL Threat Category | |
URL to test | Enter a URL using http://domain or https://domain and click the Query button to check if the domain belongs to a URL threat category. |
Signature Information | The signatures for DNS Filter and URL Threat Filter are the same. These signatures are continually updated as new malware evolves. New signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the URL Threat filter signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for URL Threat filter service in order to be able to download new signatures from myZyxel (see the Registration screens). The following fields display information on the current signature set that the Zyxel Device is using. |
Current Version | This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as new signatures are added. |
Signature Number | This field displays the number of signatures in this set. |
Released Date | This field displays the date and time the set was released. |
Update Signatures | Click this to go to the Configuration > Licensing > Signature Update screen to check for new signatures at myZyxel. You can schedule or immediately download signatures. |
Apply | Click Apply to save your changes. |
Reset | Click Reset to return the screen to its last-saved settings. |
URL Threat Filter White List Screen
Use this screen to create white list entries. The Zyxel Device will allow incoming packets from the listed IPv4 addresses and URLs.
The following table describes the labels in this screen.
Label | Description |
|---|---|
White List | |
Add | Click this to create a new entry. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
# | This is the entry’s index number in the list. |
White List | This field displays the URL of this entry. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
URL Threat Filter Black List Screen
Use this screen to create black list entries. The Zyxel Device will block incoming packets from the listed IPv4 addresses and URLs.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Black List | |
Add | Click this to create a new entry. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
# | This is the entry’s index number in the list. |
Black List | This field displays the URL of this entry. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
URL Threat Filter External Black List Screen
Use this screen to use black list entries stored in a file on a web server that supports HTTP or HTTPS. The Zyxel Device will block incoming and outgoing packets from the black list entries in this file.
• The external black list file must be in text format (*.txt) with each entry separated by a new line.
• External black list entries can consist of a complete URL or a hostname and may contain wildcards. There are some examples for your reference only:
• https://www.zyxel.com/products_services/smb.shtml?t=s (complete URL)
• www.zyxel.com (hostname)
• *.zyxel.* (hostname with wildcards)
• If the external blacklist file contains any invalid entries, the Zyxel Device will not use the file.
• The external black list file can contain up to 50,000 entries. A warning message displays when the maximum is reached.
The following table describes the labels in this screen.
Label | Description |
|---|---|
URL Blocking For External DB | |
Enable URL Blocking For External DB | Select this check box to have the Zyxel Device block the incoming packets that come from the listed addresses in the black list file on the server. Select Enable under URL Blocking in the Configuration > Security Service > Reputation Filter > URL Threat Filter > General screen for the black list to take effect. |
Add | Click this to create a new entry. |
Edit | Select an entry and click this to be able to modify it. |
Remove | Select an entry and click this to delete it. |
# | This is the entry’s index number in the list. |
Name | Enter an identifying name for the black list file. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. |
Source | Enter the exact file name, path and IP address of the server containing the black list file. For example, http://172.16.107.20/blacklist-files/myip-ebl.txt The server must be reachable from the Zyxel Device. |
Description | Enter a description of the black list file. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. |
New IP reputation signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the IP reputation signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for IP reputation service in order to be able to download new signatures from myZyxel (see the Registration screens). Schedule signature updates for a day and time when your network is least busy to minimize disruption to your network. | |
Update Now | Click this to have the Zyxel Device immediately check for new signatures at myZyxel. If new signatures are found, they are then downloaded to the Zyxel Device. |
Auto Update | Click this to have the Zyxel Device automatically check for new signatures regularly at the time and day specified. You should select a time when your network is not busy for minimal interruption. |
Daily | Select this to have the Zyxel Device check for new signatures every day at the specified time. The time format is the 24 hour clock, so ‘23’ means 11 PM for example. |
Weekly | Select this option to have the Zyxel Device check for new signatures once a week on the day and at the time specified. |
Apply | Click Apply to save your changes back to the Zyxel Device. |
Reset | Click Reset to return the screen to its last-saved settings. |
URL Threat Filter Profile
To use multiple profiles for this feature, run the following commands in the Zyxel Device Command Line Interface (CLI).
Router# configure terminal Router(config)# secure-policy-style advance Router(config)# show secure-policy-style status secure-policy-style: advance |
After you run these command, go to the feature screen again in the web configurator. You will be prompted to log out and then log in again.
After you log in again, you will see the new profile screen for this feature.
The following table describes the labels in this screen.
Label | Description |
|---|---|
Add | Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. |
Edit | Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. |
Remove | Select an entry and click Remove to delete the selected entry. |
# | This field is a sequential value showing the number of the profile. The profile order is not important. |
Name | This displays the name of the profile created. |
Description | This displays the description of the profile. |
Add or Edit a URL Threat Filter Profile
Click Add to create a new entry or select an existing entry and click Edit to open the following screen where you can create or modify the entry’s settings.
The following table describes the labels in this screen.
label | description |
|---|---|
Configuration | |
Profile Name | Type the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. These are valid, unique profile names: • MyProfile • mYProfile • Mymy12_3-4 These are invalid profile names: • 1mYProfile • My Profile • MyProfile? • Whatalongprofilename123456789012 |
Description | Type a description for the profile rule to help identify the purpose of rule. You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. This field is optional. |
Action | Set what action the Zyxel Device takes when it detects a connection attempt to or from the web pages of the specified categories. block: Select this action to have the Zyxel Device block access to the web pages that match the categories that you select above. warn: Select this action to have the Zyxel Device display a warning message to the access requesters for the web pages before allowing users to access web pages that match the categories that you select above. pass: Select this action to have the Zyxel Device allow access to the web pages that match the categories that you select above. |
Log | These are the log options: • no: Do not create a log when it detects a connection attempt to or from the web pages of the specified categories. • log: Create a log on the Zyxel Device when it detects a connection attempt to or from the web pages of the specified categories. • log alert: An alert is an emailed log for more serious events that may need more immediate attention. Select this option to have the Zyxel Device send an alert when a connection matches web pages of the specified categories. |
Scan Options | |
Check White List | Select this check box to have the Zyxel Device not perform the URL Threat filter check on URLs that match the white list entries. |
Check Black List | Select this check box to have the Zyxel Device perform the URL Threat filter check on URLs that match the black list entries. |
Check External Black List | Select this check box to have the Zyxel Device perform the URL Threat filter check on URLs that match the external black list entries. |
Security Threat Categories | Select the categories of FQDNs that may pose a security threat to network devices behind the Zyxel Device. |
Anonymizers | Sites and proxies that act as an intermediary for surfing to other Web sites in an anonymous fashion, whether to circumvent Web filtering or for other reasons. |
Browser Exploits | Sites that contain browser exploits. A browser exploit is any content that forces a web browser to perform operations that you do not explicitly intend. |
Malicious Downloads | Sites that have been identified as containing malicious downloads or malware harmful to a user's computer. |
Malicious Sites | Sites that install unwanted software on a user's computer with the intent to enable third-party monitoring or make system changes without the user's consent. |
Phishing | Sites that are used for deceptive or fraudulent purposes, such as stealing financial or other user account information. These sites are most often designed to appear as legitimate sites in order to mislead users into entering their credentials. |
Spam URLs | Sites that have been promoted through spam techniques. |
Spyware Adware Keyloggers | Sites that contain spyware, adware or keyloggers. • Spyware is a program installed on your computer, usually without your explicit knowledge, that captures and transmits personal information or Internet browsing habits and details to companies. Companies use this information to analyze browsing habits, to gather marketing data, and to sell your information to others. • Key logger programs try to capture and steal your passwords and watch and record everything you do on your computer. • Adware programs typically display blinking advertisements or pop-up windows when you perform a certain action. Adware programs are often installed in exchange for another service, such as the right to use a program without paying for it. |
OK | Click OK to save your changes back to the Zyxel Device. |
Cancel | Click Cancel to exit this screen without saving. |
Link a Profile
To link a profile to a policy, go to the Configuration > Security Policy > Policy Control screen, select a policy, and then click Edit. In the Edit Policy screen under Profile, select which profile you want to use for each security service.
URL Threat Filter Advance Screen
The Configuration > Security Service > Reputation Filter > URL Threat Filter screen also changes when using profiles.
The following table describes the labels in this screen.
label | description |
|---|---|
URL Blocking | |
Enable | Select this option to turn on URL blocking on the Zyxel Device. |
Inspect all traffic, setting: | Select this to have all traffic inspected by the default_profile. You cannot rename or delete the default_profile profile, but you can edit it by clicking the link here. |
Inspect by policy | If you configured a specific profile in the Profile tab for this service, select this to have specific traffic inspected by that profile. You must bind the profile to a policy in Security Policy > Policy Control. |
Message to display when a site is blocked | |
Denied Access Message | Enter a message to be displayed when the URL Threat filter blocks access to a web page. Use up to 127 characters (0-9a-zA-Z;/?:@&=+$\.-_!~*'()%,”). For example, “Access to this web page is not allowed. Please contact the network administrator”. It is also possible to leave this field blank if you have a URL specified in the Redirect URL field. In this case if the URL Threat filter blocks access to a web page, the Zyxel Device just opens the web page you specified without showing a denied access message. |
Redirect URL | Enter the URL of the web page to which you want to send users when their web access is blocked by the URL Threat filter. The web page you specify here opens in a new frame below the denied access message. Use “http://” or “https://” followed by up to 262 characters (0-9a-zA-Z;/?:@&=+$\.-_!~*'()%). For example, http://192.168.1.17/blocked access. |
Test URL Threat Category | |
URL to test | Enter a URL using http://domain or https://domain and click the Query button to check if the domain belongs to a URL threat category. |
Signature Information | The signatures for DNS Filter and URL Threat Filter are the same. These signatures are continually updated as new malware evolves. New signatures can be downloaded to the Zyxel Device periodically if you have subscribed for the URL Threat filter signatures service. You need to create an account at myZyxel, register your Zyxel Device and then subscribe for URL Threat filter service in order to be able to download new signatures from myZyxel (see the Registration screens). The following fields display information on the current signature set that the Zyxel Device is using. |
Current Version | This field displays the signature set version number currently used by the Zyxel Device. This number gets larger as new signatures are added. |
Signature Number | This field displays the number of signatures in this set. |
Released Date | This field displays the date and time the set was released. |
Update Signatures | Click this to go to the Configuration > Licensing > Signature Update screen to check for new signatures at myZyxel. You can schedule or immediately download signatures. |
Apply | Click Apply to save your changes. |
Reset | Click Reset to return the screen to its last-saved settings. |
Remove Profiles
To remove profiles and revert to the default general security policy style, you must first make sure to change Inspect by policy to Inspect all traffic in the following security services: Anti-Malware, DNS Filter, URL Threat Filter, IDP, Email Security.
Note: All profiles that you created will be removed from Security Policy > Policy Control.
Run the following commands in the Zyxel Device Command Line Interface (CLI).
Router# configure terminal Router(config)# secure-policy-style general Router(config)# show secure-policy-style status secure-policy-style: general |
Wait a minute and then go to the feature screen again in the web configurator. You will be prompted to log out and then log in again.
After you log in again, you will not see the profile screen for this feature.