TMS zl Management and Configuration Guide ST.1.0.090213

D-53
Troubleshooting
Troubleshooting the TMS zl Module in Routing Mode
Figure D-10. Edit Policy Window
5. Click OK.
Signature Is Triggered Too Frequently
If an IPS signature is triggered, you should always investigate and find out if
network security is being threatened. This is especially true if the IPS signature
is triggered excessively.
When an IPS signature is triggered frequently by the same device, you may
sometimes find that a particular system behaves in a way that seems suspi-
cious or mirrors the behavior of a known security problem. In this case, you
may want to create an access policy for just that device’s traffic and disable
IPS only on that access policy. Alternatively, you may want to disable the
signature altogether. The first option is generally preferred so that the TMS zl
Module can continue to protect your network from the attack that is detected
by that particular signature.