Chapter 19 Firewall

•Besides configuring the firewall, you also need to configure virtual servers (NAT port forwarding) to allow computers on the WAN to access LAN devices. See Chapter 16 on page 309 for more information.

•The ordering of your rules is very important as rules are applied in sequence.

Figure 247 Firewall

The following table describes the labels in this screen.

Table 113 Firewall

LABEL

DESCRIPTION

Global Setting

 

 

 

Enable Firewall

Select this check box to activate the firewall. The ZyWALL performs access control

 

when the firewall is activated.

 

 

Allow

If an alternate gateway on LAN1 has an IP address in the same subnet as the

Asymmetrical

ZyWALL’s LAN1 IP address, return traffic may not go through the ZyWALL. This is

Route

called an asymmetrical or “triangle” route. This causes the ZyWALL to reset the

 

connection, as the connection has not been acknowledged.

 

Select this check box to have the ZyWALL permit the use of asymmetrical route

 

topology on the network (not reset the connection).

 

Note: Allowing asymmetrical routes may let traffic from the WAN go

 

directly to LAN1 without passing through the ZyWALL. A

 

better solution is to use virtual interfaces to put the ZyWALL

 

and the backup gateway on separate subnets.

 

 

Maximum

Each NAT session establishes a corresponding firewall session. Use this field to

session per host

limit the number of concurrent NAT/firewall sessions each client computer can have.

 

Peer to peer applications, such as file sharing applications, may use a large number

 

of NAT sessions. Not limiting the number of session per host could allow a single

 

client to use all of the available NAT sessions so no additional NAT sessions can be

 

established and other users cannot access the Internet.

 

With a few clients using peer to peer applications, you can raise this number to

 

improve their performance. With heavy peer to peer application use, lower this

 

number to ensure no single client uses too many of the available NAT sessions.

344

 

ZyWALL USG 100/200 Series User’s Guide