ZyXEL Communications 2WE manual 168

ZyWALL 2 and ZyWALL 2WE

Table 15-1 Attack Alert

FIELD	DESCRIPTION	DEFAULT VALUES
One Minute High	This is the rate of new half-open sessions	100 half-open sessions per
	that causes the firewall to start deleting	minute. The above numbers
	half-open sessions. When the rate of new	cause the ZyWALL to start
	connection attempts rises above this	deleting half-open sessions
	number, the ZyWALL deletes half-open	when more than 100 session
	sessions as required to accommodate	establishment attempts have
	new connection attempts.	been detected in the last minute,
		and to stop deleting half-open
		sessions when fewer than 80
		session establishment attempts
		have been detected in the last
		minute.
Maximum Incomplete	This is the number of existing half-open	80 existing half-open sessions.
Low	sessions that causes the firewall to stop
	deleting half-open sessions. The ZyWALL
	continues to delete half-open requests as
	necessary, until the number of existing
	half-open sessions drops below this
	number.
Maximum Incomplete	This is the number of existing half-open	100 existing half-open sessions.
High	sessions that causes the firewall to start	The above values causes the
	deleting half-open sessions. When the	ZyWALL to start deleting half-
	number of existing half-open sessions	open sessions when the number
	rises above this number, the ZyWALL	of existing half-open sessions
	deletes half-open sessions as required to	rises above 100, and to stop
	accommodate new connection requests.	deleting half-open sessions with
	Do not set Maximum Incomplete High to	the number of existing half-open
	lower than the current Maximum	sessions drops below 80.
	Incomplete Low number.
TCP Maximum	This is the number of existing half-open	10 existing half-open TCP
Incomplete	TCP sessions with the same destination	sessions.
	host IP address that causes the firewall to
	start dropping half-open sessions to that
	same destination host IP address. Enter a
	number between 1 and 250. As a general
	rule, you should choose a smaller number
	for a smaller network, a slower system or
	limited bandwidth.

15-6 Firewall Configuration