Zone Alarm Security Suite behind a router...

[Bebosan]

Hi !

I am having some cind of paranoia because after three days ZA inbound protection havent detect any intrusions from out side...So my question is how should I set my ZA(should I make my Routers IP like TRUSTED or INTERNET )or if there are some outher solutions to set I am realy waiting for Your response...The thing is all oder firewalls have detected intrusions(I dont know if they were real or that was just router talking with my PC and they marked that like intrusion...)but now since I installed ZA Security Suite it looks like I havent configured my firewall good so all intrusions seems to ZA like they are O.K.

Please any sugestions and tips,tricks....I would realy be greatfull...

Thank You

and have nice summer !!!

 

[tazuk]

A couple of questions for you..

Does the ZA Security Suite include ZA Pro (I use ZAPro on my desktop but not the full Suite)?

What other firewalls are showing intrusion attempts - ZA (Free) / other? According to the logs, are the intrusion attempts from inside your network?

Does your router include a firewall, and is it configured?

TazUk

Blue-screening PCs since 1998

 

[Bebosan]

Hi !
First...thank You for fast reply...Than,I have ZA Security Suite with all this( Firewall,Anti-Virus,Anti-Spyware,IM Security,E-Mail,...and the rest what have ZA firewall(free)...
The intrusions were shown by Symantec Internet Security,Trend Micro Internet Security,...)specialy when I opened some ports,like MSN(on firewall-router)...
I have on my router wery small defense but there is NAT,firewall somekind,...DOS atack difense,...So it is kinda strange....NO INTRUSIONS DETECTED SINCE INSTALL(around three days)...

 

[tazuk]

I wouldn't necessarily be overly concerned about the lack of intrusions on ZoneAlarm. Each product reacts in different ways dependant on it's configuration. For example, I'm running ZA Free v6 on this laptop, which shows only 4 attempted intrusions since install (8 days ago), which is very few considering that I use the laptop for multiple networks and as a development and nbetwork admin tool.

If you had to open some ports on your router to use MSN etc then it sounds like the firewall is configured by default (which is good).

Did you leave the ZA firewall in it's default configuration (done automatically on installation)?

If you are still concerned, try running a test against the relevant PC using a suitable site such as Symantec or using the tools available here. These should give you a reasonable idea of how secure things are.

HTH

TazUk

Blue-screening PCs since 1998

 

[Bebosan]

Is it possible because my router is hiding my IP/NAT controll and+ ZA also have some kind hiding it...that it just didnt happen....Because I worry like I dont have protection which is working while there were no intrusion atempts....Any ideas...

 

[Bebosan]

How should I test my protection for real,so I would see if there is some protection around my web-conection and my PC...

Thanx

 

[tazuk]

see the last paragraph of my last post and follow the links.

TazUk

Blue-screening PCs since 1998

 

[Bebosan]

Well on Gibson Research(

http://www.grc.com)

I get true stealth secured ports on my PC....and Symantec`s security scan engine say`s the same only it cant find any anti-virus software...
Is there still anyone...if so please tell me what should I do...Still no intrusion attemption...Am I losing them inside?
so ZA doesnt detect nothing??

Thanx

 

[tazuk]

What type of intrusions are your other firewalls showing?

Have you checked the ZA pro logs to see what (if anything) it's blocking? Not all blocked activity is reported as an intrusion on the main status tabs.

You could try accessing your ZA Suite PC from a PC without permission to do so within your network, and see whether the intrusion is detected and blocked.

TazUk

Blue-screening PCs since 1998

 

[eyec]

are you sure these are intrusions?

the internet has a vast amount of traffic being routed and just because this "normal" traffic hits your firewall does not necessarily mean someone is trying to break in.

if you notice (in the ZA logs) a concerted attempt from a specific IP address trying to probe various ports, then you may have an intrusion attempt. lacking that is is just normal traffic.