What You Need To Know - ZyXEL Communications ZyWALL 110 User Manual

21.3.1 What You Need to Know

Stateful Inspection
The ZyWALL/USG uses stateful inspection in its security policies. The ZyWALL/USG restricts access
by screening data packets against defined access rules. It also inspects sessions. For example,
traffic from one zone is not allowed unless it is initiated by a computer in another zone first.
Zones
A zone is a group of interfaces. Group the ZyWALL/USG's interfaces into different zones based on
your needs. You can configure security policies for data passing between zones or even between
interfaces.
Default Directional Security Policy Behavior
Security Policies can be grouped based on the direction of travel of packets to which they apply.
Here is the The ZyWALL/USG has default Security Policy behavior for traffic going through the
ZyWALL/USG in various directions.
Table 151 Directional Security Policy Behavior
FROM ZONE TO ZONE
From any to Device
From LAN1 to any (other than
the ZyWALL/USG)
From LAN2 to any (other than
the ZyWALL/USG)
From LAN1 to Device
From LAN2 to Device
From WAN to Device
From any to any
To-Device Policies
Policies with Device as the To Zone apply to traffic going to the ZyWALL/USG itself. By default:
• The Security Policy allows only LAN, or WAN computers to access or manage the ZyWALL/USG.
• The ZyWALL/USG allows DHCP traffic from any interface to the ZyWALL/USG.
• The ZyWALL/USG drops most packets from the WAN zone to the ZyWALL/USG itself and
generates a log except for AH, ESP, GRE, HTTPS, IKE, NATT.
When you configure a Security Policy rule for packets destined for the ZyWALL/USG itself, make
sure it does not conflict with your service control rule. The ZyWALL/USG checks the security policy
before the service control rules for traffic destined for the ZyWALL/USG.
Chapter 21 Security Policy
BEHAVIOR
DHCP traffic from any interface to the ZyWALL/USG is allowed.
Traffic from the LAN1 to any of the networks connected to the ZyWALL/USG is
allowed.
Traffic from the LAN2 to any of the networks connected to the ZyWALL/USG is
allowed.
Traffic from the LAN1 to the ZyWALL/USG itself is allowed.
Traffic from the LAN2 to the ZyWALL/USG itself is allowed.
The default services listed in
the WAN to the ZyWALL/USG itself. All other WAN to ZyWALL/USG traffic is
dropped.
Traffic that does not match any
traffic from the WAN to any of the networks behind the ZyWALL/USG.
This also includes traffic to or from interfaces that are not assigned to a zone
(extra-zone traffic).
ZyWALL/USG Series User's Guide
365
To-Device Policies on page 365
Security policy
is dropped. This includes
are allowed from