ZyXEL Communications ZYWALL10 Table 15-3Attack Alert

ZyWALL 10 Internet Security Gateway

Table 15-3 Attack Alert

FIELD	DESCRIPTION	DEFAULT VALUES
Generate alert when	A detected attack automatically generates
attack detected	a log entry. Check this box to generate an
	alert (as well as a log) whenever an attack
	is detected. See the Logs Chapter for
	more information on logs and alerts.
Denial of Service Thresholds
One Minute Low	This is the rate of new half-open sessions	80 existing half-open
	that causes the firewall to stop deleting	sessions.
	half-open sessions. The ZyWALL
	continues to delete half-open sessions as
	necessary, until the rate of new
	connection attempts drops below this
	number.
One Minute High	This is the rate of new half-open sessions	100 half-open sessions
	that causes the firewall to start deleting	per minute. The above
	half-open sessions. When the rate of new	numbers cause the
	connection attempts rises above this	ZyWALL to start deleting
	number, the ZyWALL deletes half-open	half-open sessions when
	sessions as required to accommodate	more than 100 session
	new connection attempts.	establishment attempts
		have been detected in the
		last minute, and to stop
		deleting half-open
		sessions when fewer than
		80 session establishment
		attempts have been
		detected in the last
		minute.
Maximum Incomplete	This is the number of existing half-open	80 existing half-open
Low	sessions that causes the firewall to stop	sessions.
	deleting half-open sessions. The ZyWALL
	continues to delete half-open requests as
	necessary, until the number of existing
	half-open sessions drops below this
	number.
Maximum Incomplete	This is the number of existing half-open	100 half-open sessions
High	sessions that causes the firewall to start	per minute. The above
	deleting half-open sessions. When the	values causes the
	number of existing half-open sessions	ZyWALL to start deleting

15-10 Introducing the ZyWALL Web Configurator