ZyXEL Communications P-660HN-F1A, User Manual

Page: 204 / 430

Chapter 10 Firewalls
P-660HN-F1A User’s Guide
204
One Minute High This is the rate of new half-open sessions per minute that causes the
firewall to start deleting half-open sessions. When the rate of new
connection attempts rises above this number, the P-660HN-F1A
deletes half-open sessions as required to accommodate new
connection attempts.
For example, if you set the one minute high to 100, the P-660HN-F1A
starts deleting half-open sessions when more than 100 session
establishment attempts have been detected in the last minute. It stops
deleting half-open sessions when the number of session establishment
attempts detected in a minute goes below the number set as the one
minute low.
Maximum
Incomplete Low This is the number of existing half-open sessions that causes the
firewall to stop deleting half-open sessions. The P-660HN-F1A
continues to delete half-open requests as necessary, until the number
of existing half-open sessions drops below this number.
Maximum
Incomplete High This is the number of existing half-open sessions that causes the
firewall to start deleting half-open sessions. When the number of
existing half-open sessions rises above this number, the P-660HN-F1A
deletes half-open sessions as required to accommodate new
connection requests. Do not set Maximum Incomplete High to lower
than the current Maximum Incomplete Low number.
For example, if you set the maximum incomplete high to 100, the P-
660HN-F1A starts deleting half-open sessions when the number of
existing half-open sessions rises above 100. It stops deleting half-open
sessions when the number of existing half-open sessions drops below
the number set as the maximum incomplete low.
TCP Maximum
Incomplete An unusually high number of half-open sessions with the same
destination host address could indicate that a DoS attack is being
launched against the host.
Specify the number of existing half-open TCP sessions with the same
destination host IP address that causes the firewall to start dropping
half-open sessions to that same destination host IP address. Enter a
number between 1 and 256. As a general rule, you should choose a
smaller number for a smaller network, a slower system or limited
bandwidth. The P-660HN-F1A sends alerts whenever the TCP
Maximum Incomplete is exceeded.
Action taken
when TCP
Maximum
Incomplete
reached
threshold Select the action that P-660HN-F1A should take when the TCP
maximum incomplete threshold is reached. You can have the P-660HN-
F1A either:
Delete the oldest half open session when a new connection request
comes.
or
Deny new connection requests for the number of minutes that you
specify (between 1 and 255).
Apply Click this to save your changes.
Cancel Click this to restore your previously saved settings.
Table 57 Security > Firewall > Threshold (continued)
LABEL DESCRIPTION