IDP not registering anything - is that good or bad?

[Deleted User]
[Deleted User] Posts: 51  Ally Member
Friend Collector First Comment
So my USG40W has been running in "production" for a couple of weeks and the one and only "protection" thing I am paying for, besides the FW, is IDP.

I have enables IDP Statistics from start, even several days before Zyxel_Stanley mentioned it in another thread, I quote his post:

@SecCon

The IDP service will scan all the passed packets and compare with the system database to prevent the threats passing through the network. 

This mechanism brings some overhead to the system more or less. It is normal behavior.

You can enable IDP statistics function.

It will list all of history that IDP detected and blocked history in this page.



It has scanned almost half a million of sessions in that time (482.227) and registered nothing.

As comparison (I really don't know how relevant) my Log has registered 284 Security Policy Control events from only the last TWO HOURS (ACCESS BLOCK) .

Am I so fortunate that IDP is out of a job? How can that be?


All Replies

  • CHS
    CHS Posts: 177  Master Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited May 2021
    SecCon 
    In my office, there are 40~50 staff working in this building.
    Here is IDP history view on my device.
    It looks there is no intrusion or related vulnerability in your network till now. You may monitor it for longer time.

  • [Deleted User]
    [Deleted User] Posts: 51  Ally Member
    Friend Collector First Comment
    CHS said:
    SecCon 
    In my office, there are 40~50 staff working in this building.
    Here is IDP history view on my device.
    It looks there is no intrusion or related vulnerability in your network till now. You may monitor it for longer time.
    You seem to have 4,7 million sessions there and 10 times the amount of users. I guess you are right, long term is the idea...  what is the time span? 1700 severe events? Is that due to user interaction or something else?

Security Highlight