Chapter 27 Application Patrol
"The ZyWALL allows the first eight packets to go through the firewall, regardless of the application patrol policy for the application. The ZyWALL examines these first eight packets to identify the application.
The second approach is called service ports. In this approach, the ZyWALL only uses OSI
27.3Configurable Application Policies
The ZyWALL has policies for individual applications. For each policy, you can specify the default action the ZyWALL takes once it identifies one of the service’s connections.
•Forward - the ZyWALL routes the packets for this application.
•Drop - the ZyWALL does not route the packets for this application, and it does not notify the client of this decision.
•Reject - the ZyWALL does not route the packets for this application, and it notifies the client of this decision.
You can also specify custom policies that have the ZyWALL forward, drop, or reject a service’s connections based on criteria that you specify (like the source zone, destination zone, original destination port of the connection, schedule, user, source, and destination information). Your custom policies take priority over the policy’s default settings.
27.4 Bandwidth Management
When you allow an application, you can restrict the bandwidth it uses or even the bandwidth that particular features in the application (like voice, video, or file sharing) use. This restriction may be ineffective in certain cases, however, such as using MSN to send files via P2P.
The application patrol bandwidth management is more flexible and powerful than the bandwidth management in policy routes. Application patrol controls TCP and UDP traffic. Use policy routes to manage other types of traffic (like ICMP).
"Bandwidth management in policy routes has priority over application patrol bandwidth management. It is recommended to use application patrol bandwidth management for TCP and UDP traffic and remove it from the policy routes.
380 |
| |
ZyWALL USG 1000 User’s Guide |
| |
|
|
|