ZyXEL Communications P-661H Series manual 168

Chapter 9 Firewall Configuration

Figure 97 Firewall: Thresholds

The following table describes the labels in this screen.

Table 66 Firewall: Thresholds

LABEL	DESCRIPTION
Denial of Service	The ZyXEL Device measures both the total number of existing half-open sessions
Thresholds	and the rate of session establishment attempts. Both TCP and UDP half-open
	sessions are counted in the total number and rate measurements. Measurements
	are made once a minute.
One Minute Low	This is the rate of new half-open sessions per minute that causes the firewall to
	stop deleting half-open sessions. The ZyXEL Device continues to delete half-open
	sessions as necessary, until the rate of new connection attempts drops below this
	number.
One Minute High	This is the rate of new half-open sessions per minute that causes the firewall to
	start deleting half-open sessions. When the rate of new connection attempts rises
	above this number, the ZyXEL Device deletes half-open sessions as required to
	accommodate new connection attempts.
	For example, if you set the one minute high to 100, the ZyXEL Device starts
	deleting half-open sessions when more than 100 session establishment attempts
	have been detected in the last minute. It stops deleting half-open sessions when
	the number of session establishment attempts detected in a minute goes below
	the number set as the one minute low.
Maximum	This is the number of existing half-open sessions that causes the firewall to stop
Incomplete Low	deleting half-open sessions. The ZyXEL Device continues to delete half-open
	requests as necessary, until the number of existing half-open sessions drops
	below this number.
Maximum	This is the number of existing half-open sessions that causes the firewall to start
Incomplete High	deleting half-open sessions. When the number of existing half-open sessions rises
	above this number, the ZyXEL Device deletes half-open sessions as required to
	accommodate new connection requests. Do not set Maximum Incomplete High
	to lower than the current Maximum Incomplete Low number.
	For example, if you set the maximum incomplete high to 100, the ZyXEL Device
	starts deleting half-open sessions when the number of existing half-open sessions
	rises above 100. It stops deleting half-open sessions when the number of existing
	half-open sessions drops below the number set as the maximum incomplete low.

168
	P-661H/HW Series User’s Guide