CDR Testing

Dpj

Hello, my first post in this section… We want to setup CDR for customers, but first want to get familiar with it, and find out how we configure it, it does what we want.

Is there a method to test it?

Like download some (innocent) files but files what triggers CDR?

I know Microsoft has some test files, but do they trigger CDR?

Home - Microsoft Defender Testground (i hope this isn't triggered as spam….) just an example from them

Yours dennis

Zyxel_Kay

Hi @Dpj

Could you please share the model of your device? This will help us provide more tailored assistance.

If you're looking to configure CDR on your Nebula Firewall, we recommend checking out this article, which offers a detailed introduction to the feature and guidance on configuration:

https://community.zyxel.com/en/discussion/10423/collaborative-detection-response-cdr-keeps-your-network-more-secured-and-healthy

Zyxel_Kay

Hi @Dpj

Could you please share the model of your device? This will help us provide more tailored assistance.

If you're looking to configure CDR on your Nebula Firewall, we recommend checking out this article, which offers a detailed introduction to the feature and guidance on configuration:

https://community.zyxel.com/en/discussion/10423/collaborative-detection-response-cdr-keeps-your-network-more-secured-and-healthy

Dpj

Hello Kay,

we use currently the USG Flex 200 with UTM License. We are testing if this license is usefull for our customers. Beside how to configure it, we also want to investigate if it does what we want it has to do.

Zyxel_Kay

Hi @Dpj

You can refer to the article mentioned earlier and try configuring CDR on your USG FLEX 200 to see if it meets your requirements.

Julien44

Hi,
What is the port used to display the message on client browsers in case of CDR blocking?
I have already had blocks with CDR but users do not have a message, only a loss of network resources.
(It must be blocked by a policy rule…)
Thanks

Zyxel_Kay

Hi @Julien44

Could you please share which firewall model you are using?

Julien44

Hi,
I have a Zyxel ATP700 Firewall.

Thanks

Zyxel_Kay

Hi @Julien44

Could you please check if the CDR feature is set up correctly? The following article provides guidance on configuring CDR for both on-premises and Nebula mode firewalls. Kindly refer to the instructions and ensure your CDR configuration is complete.
[2024 June Spotlight] The solution you must know: Collaborative Detection & Response (CDR) — Zyxel Community

If you have confirmed that everything is set up properly, please share the destination you are accessing, your firewall management mode (on-premises/Nebula), and a screenshot of the relevant event logs.

If you're using Nebula cloud mode, please enable Zyxel support access and provide your Nebula organization and site name.