6.4.4. Procedure – Creating a new DetectorService

To create a new DetectorService that starts a service based on the traffic in the incoming connection, complete the following steps.

1. Navigate to the Services tab of the Zorp ZMC component and click New.

   

   Figure 6.26. Creating a new DetectorService

2. Enter a name for the service into the opening dialog. Use clear, informative, and consistent service names. It is recommended to include the following information in the service name:

   • source zones, indicating which clients may use the service (for example, intranet)

   • the protocol permitted in the traffic (for example, HTTP)

   • destination zones, indicating which servers may be accessed using the service (for example, Internet)

   Tip
   Name the service that allows internal users to browse the Web intra_HTTP_internet. Use dots to indicate child zones, for example, intra.marketing_HTTP_inter.

3. In the Routing section, select the TransparentRouter option.

4. Click in the Class field and select DetectorService.

5. Commit your changes.

6. Navigate to Zorp > Firewall Rules, and create a firewall rule that uses the DetectorService you created in the previous steps.

7. Click New, select a DetectorPolicy, and select a service that Zorp will start if the traffic matches the DetectorPolicy. If you add more DetectorPolicy-Service pairs, Zorp will evaluate them in order, and start the service set for the first matching DetectorPolicy. If none of the DetectorPolicies match the traffic, Zorp terminates the connection.

   Note

   When using a DetectorService, establishing the connection is slower, because Zorp needs to evaluate the content of the traffic before starting the appropriate service. If the rate of incoming connection requests that use the DetectorService is high, the clients may experience performance problems during connection startup. Note that using a DetectorService has no effect on the performance after the connection has been established.