Can i Allow list a IP addredd against ADP Scan-Detection on USG FLex 500?

Emerald

Afternoon,

were using ADP Scan-Detection, however there are network inventory applications on a server within the network that trips this alarm every few hours.

Can we permit this IP at all please ?

crit                adp                    ACCESS FORWARD                                 

     Rule_id:1 from LAN to Any, [type:Scan-Detection(33)] tcp filtered distributed portscan Action:No Action

I see Security Policy > ADP > allow list

have created a object (lan ip of the server with issue) then any dest & serivice) but still getting alerts

Any pointers apreciated

Zyxel_Cooldia

Hi @Emerald,
ADP Allow list is mainly for Flooding Detection. It is unable to set IP white list for other ADP items.

lalaland

In general ADP attack items, source IP can be fake IP. it seems meaningless to whitelisting source in ADP.