ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual
Firewall Security and Content Filtering
5-11
v1.0, July 2008
see that no application is listening at that port, and (3) reply with an ICMP Destination
Unreachable packet.
When the victimized system is flooded, it is forced to send many ICMP packets,
eventually making it unreachable by other clients. The attacker may also spoof the IP
address of the UDP packets, ensuring that the excessive ICMP return packets do not reach
him, thus making the attacker’s network location anonymous.
If flood checking is enabled, the firewall will not accept more than 20 simultaneous, active
UDP connections from a single computer on the LAN.
–
Disable Ping Reply on LAN Ports
. To prevent the firewall from responding to Ping
requests from the LAN, click this checkbox.
•
VPN Pass through.
When the firewall is in NAT mode, all packets going to the Remote VPN
Gateway are first filtered through NAT and then encrypted per the VPN policy.
For example, if a VPN Client or Gateway on the LAN side of this firewall wants to connect to
another VPN endpoint on the WAN (placing this firewall between two VPN end points),
encrypted packets are sent to this firewall. Since this firewall filters the encrypted packets
through NAT, the packets become invalid unless VPN pass through is enabled.
When VPN pass through is enabled, the VPN tunnel will pass the VPN traffic without any
filtering. Tunnels can be:
–
IPsec
–
PPTP
–
L2TP
To enable the appropriate Attack Checks for your environment:
1.
Select
Security > Firewall
from the main/submenu.
2.
Click the
Attack Checks
tab and the Attack Checks screen displays.
