Zyxel ZyWALL USG 20 [55/185] Deploying eps

ZyWALL USG Support Notes

2. Deploying EPS

2.1. EPS Introduction

EPS is short for Endpoint Security.

Endpoint refers to PCs, laptops, handhelds, etc. Endpoint Security is a security

concept that assumes each endpoint is responsible for its own security. Network

administrator can set restrict policies to allow only the endpoints that comply with its

defined security requirements to access network resources. The endpoint security

requirement items may contain current anti-virus state, personal firewall, and

operating system patch level, etc.

For example, a local endpoint doesn‟t have any anti-virus software installed. If it surfs

internet, there‟s a high risk that it may be infected with viruses. Then the viruses may

be propagated among the entire local network.

Another example is in SSL VPN case. If the SSL VPN client doesn‟t have anti-virus

software installed, when it accesses the HQ local resources through SSL VPN tunnel,

it may propagate the virus to HQ local subnet.

To prevent such undesired situation, the network administrator can use EPS checking

to restrict endpoints‟ network access privileges. Only the compliant endpoint can get

authority to access certain network resources.

2.1.1. EPS --- WebGUI

Go to Configuration > Object > Endpoint Security to create EPS objects, which can

later be used in User Aware and SSL VPN applications.

Below is the EPS editing page.

For the Passing Criterion, you can choose “Endpoint must comply with at least one

checking item”, or “Endpoint must comply with all checking items”.

If you choose “Endpoint must comply with at least one checking item”, then the client

can pass the EPS checking as long as it matches at least one checking items that listed