TMS zl Management and Configuration Guide ST.1.1.100430

10-57
Troubleshooting
Troubleshooting the TMS zl Module in Routing Mode
Signature Is Triggered Too Frequently
If an IPS signature is triggered, you should always investigate and find out if
network security is being threatened. This is especially true if the IPS signature
is triggered excessively.
When an IPS signature is triggered frequently by the same device, you may
sometimes find that a particular system behaves in a way that seems suspi-
cious or mirrors the behavior of a known security problem. In this case, you
may want to create an access policy for just that device’s traffic and disable
IPS only on that access policy. Alternatively, you may want to disable the
signature altogether. The first option is generally preferred so that the TMS zl
Module can continue to protect your network from the attack that is detected
by that particular signature.
If you want to disable IPS only for a particular device, create a new access
policy that affects only that device. Clear the Enable IPS on this Policy option
so that IPS does not check the traffic that matches this access policy.
To disable the signature itself, complete the following steps:
1. Click Intrusion Prevention > Signatures.
2. Click View.
Figure 10-11.Intrusion Prevention > Signatures > View Window