ZyXEL USG110/210/310 User Guide - Page 728

Chapter 38 IDP signature or click the Edit icon to edit an existing signature. You can also delete custom signatures here or save them to your computer. Note: The Zyxel Device checks all signatures and continues searching even after a match is found. If two or more rules have conflicting actions for the same packet, then the Zyxel Device applies the more restrictive action (reject-both, reject-receiver or reject-sender, drop, none in this order). If a packet matches a rule for reject-receiver and it also matches a rule for reject-sender, then the Zyxel Device will reject-both. Figure 507 Configuration > UTM Profile > IDP > Custom Signatures The following table describes the fields in this screen. Table 265 Configuration > UTM Profile> IDP > Custom Signatures LABEL DESCRIPTION Custom Signature Rules Add Edit Remove Export Use this part of the screen to create, edit, delete or export (save to your computer) custom signatures. Click this to create a new entry. Select an entry and click this to be able to modify it. Select an entry and click this to delete it. To save an entry or entries as a file on your computer, select them and click Export. Click Save in the file download dialog box and then select a location and name for the file. # SID Name Custom signatures must end with the 'rules' file name extension, for example, MySig.rules. This is the entry's index number in the list. SID is the signature ID that uniquely identifies a signature. Click the SID header to sort signatures in ascending or descending order. It is automatically created when you click the Add icon to create a new signature. You can edit the ID, but it cannot already exist and it must be in the 9000000 to 9999999 range. This is the name of your custom signature. Duplicate names can exist, but it is advisable to use unique signature names that give some hint as to intent of the signature and the type of attack it is supposed to prevent. ZyWALL USG Series User's Guide 728