ZyXEL Communications P-660HN-F1A, User Manual

Page: 208 / 430

Chapter 10 Firewalls
P-660HN-F1A User’s Guide
208
10.5.4.1 The “Triangle Route” Problem
A traffic route is a path for sending or receiving data packets between two
Ethernet devices. You may have more than one connection to the Internet
(through one or more ISPs). If an alternate gateway is on the LAN (and its IP
address is in the same subnet as the P-660HN-F1A’s LAN IP address), the “triangle
route” (also called asymmetrical route) problem may occur. The steps below
describe the “triangle route” problem.
1
A computer on the LAN initiates a connection by sending out a SYN packet to a
receiving server on the WAN.
2
The P-660HN-F1A reroutes the SYN packet through Gateway A on the LAN to the
WAN.
3
The reply from the WAN goes directly to the computer on the LAN without going
through the P-660HN-F1A.
As a result, the P-660HN-F1A resets the connection, as the connection has not
been acknowledged.
Figure 83 “Triangle Route” Problem
10.5.4.2 Solving the “Triangle Route” Problem
If you have the P-660HN-F1A allow triangle route sessions, traffic from the WAN
can go directly to a LAN computer without passing through the P-660HN-F1A and
its firewall protection.
Another solution is to use IP alias. IP alias allows you to partition your network
into logical sections over the same Ethernet interface. Your P-660HN-F1A supports
up to three logical LAN interfaces with the P-660HN-F1A being the gateway for
each logical network.
1
2
3
WAN
LAN
A
ISP 1
ISP 2