Chapter 9 Firewalls

Figure 91 Security > Firewall > Threshold

The following table describes the labels in this screen.

Table 57 Security > Firewall > Threshold

LABEL

DESCRIPTION

Denial of Service

The ZyXEL Device measures both the total number of existing half-open

Thresholds

sessions and the rate of session establishment attempts. Both TCP and UDP

 

half-open sessions are counted in the total number and rate measurements.

 

Measurements are made once a minute.

 

 

One Minute Low

This is the rate of new half-open sessions per minute that causes the firewall to

 

stop deleting half-open sessions. The ZyXEL Device continues to delete half-

 

open sessions as necessary, until the rate of new connection attempts drops

 

below this number.

 

 

One Minute High

This is the rate of new half-open sessions per minute that causes the firewall to

 

start deleting half-open sessions. When the rate of new connection attempts rises

 

above this number, the ZyXEL Device deletes half-open sessions as required to

 

accommodate new connection attempts.

 

For example, if you set the one minute high to 100, the ZyXEL Device starts

 

deleting half-open sessions when more than 100 session establishment attempts

 

have been detected in the last minute. It stops deleting half-open sessions when

 

the number of session establishment attempts detected in a minute goes below

 

the number set as the one minute low.

 

 

Maximum

This is the number of existing half-open sessions that causes the firewall to stop

Incomplete Low

deleting half-open sessions. The ZyXEL Device continues to delete half-open

 

requests as necessary, until the number of existing half-open sessions drops

 

below this number.

 

 

Maximum

This is the number of existing half-open sessions that causes the firewall to start

Incomplete High

deleting half-open sessions. When the number of existing half-open sessions

 

rises above this number, the ZyXEL Device deletes half-open sessions as

 

required to accommodate new connection requests. Do not set Maximum

 

Incomplete High to lower than the current Maximum Incomplete Low number.

 

For example, if you set the maximum incomplete high to 100, the ZyXEL Device

 

starts deleting half-open sessions when the number of existing half-open

 

sessions rises above 100. It stops deleting half-open sessions when the number

 

of existing half-open sessions drops below the number set as the maximum

 

incomplete low.

 

 

 

165

P-660HN-F1 User’s Guide