-
Why isn’t the EICAR test file (or malware) blocked by Anti-Malware/Sandbox on USG FLEX H?
Q: I downloaded the EICAR test file (or a known-malicious file) and it wasn’t blocked, even though Anti-Malware/Sandbox is enabled. Why? A: This is almost always an SSL Inspection issue, not an Anti-Malware/Sandbox configuration problem. If the file was downloaded over HTTPS, the FLEX H cannot inspect that traffic at all…
-
Is there a way to prevent a known-good file from being destroyed in the first place?
Yes — add it to Security Service > Anti-Malware > Allow List by SHA-256 hash, MD5 hash, or file name pattern, before it gets caught. Note: This Allow List applies to both Anti-Malware and Sandbox scanning
-
Can I quarantine a malicious file instead of destroying it, so I can review it later?
No. Anti-Malware and Sandboxing on USG FLEX H only support two actions: Destroy or Allow. There is no quarantine option. Why not? It comes down to how scanning works on FLEX H. Scanning runs in streaming mode: the file is inspected while it’s being downloaded, not after it’s fully received. If a malicious file is detected…
-
What can I do if a DNS Threat Filter query's category is incorrect?
If you believe a DNS Threat Filter query's category is incorrect, you can click this link to submit a request for it to be reviewed. https://trustedsource.org/en/feedback/url?action=checksingle&url=&product=01-ts
-
What happens when "Allow HTTP(S) traffic for allow lists only" is enabled?
If your Content Filter appears to block legitimate websites unexpectedly—even when they don't belong to a blocked category—check whether the "Allow HTTP(S) traffic for allow lists only" setting is enabled in your Content Filter profile. What does "Allow HTTP(S) traffic for allow lists only" do? When enabled, this feature…
-
Unable to access the page of Email Security and Anti-Malware on USG FLEX 500
Question: Why am I encountering an error "CLI Number: 16, Error Number: -36009, Error Message: Invalid Email Security profile number." on the Email Security and indefinite loading on Anti-Malware tab on my USG FLEX 500? Answer: This issue often occurs when specific Email Security and Anti-Malware configuration settings are…
-
How to restrict a single computer to access only one specific website on USG FLEX?
Scenario You want to block a specific computer on your network from accessing all websites except one, while allowing all other computers on the same subnet to browse freely. This is achievable using Policy Control rules on the USG FLEX. For this example: Subnet: 192.168.1.0/24 — all computers can access any website…
-
Can Sophos Network Extension SSL inspection work with Firewall SSL inspection feature?
Question: Can Sophos Network Extension SSL inspection work with Firewall SSL inspection feature? Answer: It would cause browsing problem. Sophos will detect the zyxel ssl inspection as MITM attack, so drops the HTTPS traffic. First, HTTPS traffic will be intercepted by Sophos, and certificate will be re-sighed. Then the…
-
Which device should I link the renewed license in Device-HA mode?
Question: I set up Device-HA a few months ago, and there is no license issue at the moment. Now I would like to register a new license for the device. Which device should I link the renewed license to on the myZyxel.com server? Answer: You can check the Device-HA Pro settings page. There you will find the Serial Number…
-
Why does the URL Threat Filter work without a Gold Security Pack license?
Question: URL Threat Filter on the firewall appears to be functioning normally, even though the Gold Security Pack license is not activated. We can adjust settings, and the security logs show recent block times. How is this possible? Answer: URL Threat Filter (Cloud Query) functionality can operate when the Content…
-
Why does the firewall's URL Threat Filter work without a Gold Security Pack?
Question: The firewall does not have a Gold Security Pack license, but the URL Threat Filter appears to function normally. How can this be explained? Answer: The URL Threat Filter (Cloud Query) functionality can operate if the device possesses the Content Filtering service.
-
The device insight view show nothing, How to check ?
Question: The device insight view show nothing, How to check ? Answer: 1)The device insight only support "Internal" interface type, please try to change the interface from "General" to "Internal" 2)If the issue is still persist, Please kindly contact Zyxel Support for further checking.
-
Why is the Content Filter not working and unable to block certain websites?
Question : Why is the Content Filter not working and unable to block certain websites? Answer : Because the website may rely on DNS over HTTPS/TLS packets, the user needs to select the "drop" action for the "Action When Detecting DNS over HTTPS/TLS Packets" option in the DNS Threat Filter function.
-
Allowing Specific Hosts to Access Blocked Applications Using Application Patrol
Overview This guide explains how to configure Application Patrol on a Zyxel firewall (such as ATP 500) to block applications for all network users while allowing access for specific IP addresses. Scenario You want to restrict access to certain application categories (such as YouTube) for all users on your network except…
-
Why am I seeing "hash query internal error: network(curl) error!"?
Question: Why am I seeing "hash query internal error: network(curl) error!"? Answer: Please check this domain can be resovled "nslookup api.defense-center.cloud.zyxel.com" also responed time when you saw logs. If the result is good and the response speed is well. Please contact us for further checking.
-
What is the meaning of the Threshold of Flood Detection in ADP?
Question : What is the meaning of the Threshold of Flood Detection in ADP? Answer : Threshold means the number of packets per second that match the flood detection criteria. For instance, if over 1000 ICMP packets are sent from an IP address per second, the IP will be blocked by the ICMP Flood protection of DoS Prevention…
-
How to Configure DNS Content Filter (On-Premises)
Background With increased browser support, users are encouraged to switch to TLS 1.3 due to its enhanced security features. However, websites using TLS 1.3 may not be categorized by URL content filtering without enabling SSL inspection. To address this limitation, DNS query-based categorization can be used as an…
-
Destination Address have been blocked due to flooding detection
Question: My server which exposed internet have been blocked from Firewall due to flooding detection Answer: The flooding detection will block destination IP.
-
How to block a specific device using the Device Insight block list?
Scenario : The user may want to block a specific device, and this article will guide you on how to use the Device Insight block list to achieve this purpose. Answer : Navigate to Configuration > Object >Device Insight > Enable this feature. Navigate to Monitor > Network Status > Device Insight > Select the device that you…
-
How to check historically suspicious IP addresses using the Country Map in Secureporter?
Question: The firewall may detect some security-related event logs, and users may want to check historically suspicious source IPs using the Country Map feature in Secureporter. This article will guide you on how to do that. Answer : Step 1: Please ensure the on-premise firewall is already connected to SecuReporter. Step…