Nortel BSR222, Configuration, Page: 195 / 451

Chapter 11 Firewall screens 195
Nortel Business Secure Router 222 Configuration — Basics
One Minute High This is the rate of new half-open sessions that causes the firewall
to start deleting half-open sessions. When the rate of new
connection attempts rises above this number, the Business Secure
Router deletes half-open sessions, as required, to accommodate
new connection attempts.
The numbers, for example, 80 in the One Minute Low field and
100 in this field, cause the Business Secure Router to start deleting
half-open sessions when more than 100 session establishment
attempts are detected in the last minute, and to stop deleting
half-open sessions when fewer than 80 session establishment
attempts are detected in the last minute.
Maximum
Incomplete Low This is the number of existing half-open sessions that causes the
firewall to stop deleting half-open sessions. The Business Secure
Router continues to delete half-open requests, as necessary, until
the number of existing half-open sessions drops below this
number.
Maximum
Incomplete High This is the number of existing half-open sessions that causes the
firewall to start deleting half-open sessions. When the number of
existing half-open sessions rises above this number, the Business
Secure Router deletes half-open sessions, as required, to
accommodate new connection requests. Do not set
Maximum
Incomplete High to lower than the current Maximum Incomplete
Low number.
The above values, say 80 in the Maximum Incomplete Low field
and 100 in this field, cause the Business Secure Router to start
deleting half-open sessions when the number of existing half-open
sessions rises above 100, and to stop deleting half-open sessions
with the number of existing half-open sessions drops below 80.
TCP Maximum
Incomplete This is the number of existing half-open TCP sessions with the
same destination host IP address that causes the firewall to start
dropping half-open sessions to that same destination host IP
address. Enter a number between 1 and 256. As a general rule,
choose a smaller number for a smaller network, a slower system or
limited bandwidth.
Blocking Period When TCP Maximum Incomplete is reached you can choose to
either allow or block the next session. If you select the Blocking
Period check box, any new sessions are blocked for the length of
time you specify in the next field (min) and all old incomplete
sessions are cleared during this period. If you want strong security,
it is better to block the traffic for a short time, as it gives the server
some time to digest the loading.
(min) Enter the length of Blocking Period in minutes.
Apply Click Apply to save your changes to the Business Secure Router.
Reset Click Reset to begin configuring this screen afresh.
Table 43 Attack alert
Label Description