Configuring Attack Alert - ZyXEL Communications ZyWALL 10W User Manual

ZyWALL Series Internet Security Gateway
SERVICE
SNMP-
TRAPS(TCP/UDP:162)
SQL-NET(TCP:1521)
SSH(TCP/UDP:22)
STRM WORKS(UDP:1558)
SYSLOG(UDP:514)
TACACS(UDP:49)
TELNET(TCP:23)
TFTP(UDP:69)
VDOLIVE(TCP:7000)

12.11 Configuring Attack Alert

Attack alerts are the first defense against DOS attacks. In the Attack Alert screen, shown later, you may
choose to generate an alert whenever an attack is detected. For DoS attacks, the ZyWALL uses thresholds to
determine when to drop sessions that do not become fully established. These thresholds apply globally to all
sessions.
You can use the default threshold values, or you can change them to values more suitable to your security
requirements.
12.11.1 Threshold Values
Tune these parameters when something is not working and after you have checked the firewall counters.
These default values should work fine for normal small offices with ADSL bandwidth. Factors influencing
choices for threshold values are:
1. The maximum number of opened sessions.
12-24
Table 12-7 Predefined Services
Traps for use with the SNMP (RFC:1215).
Structured Query Language is an interface to access data on many
different types of database systems, including mainframes, midrange
systems, UNIX systems and network servers.
Secure Shell Remote Login Program.
Stream Works Protocol.
Syslog allows you to send system logs to a UNIX server.
Login Host Protocol used for (Terminal Access Controller Access Control
System).
Telnet is the login and terminal emulation protocol common on the Internet
and in UNIX environments. It operates over TCP/IP networks. Its primary
function is to allow users to log into remote host systems.
Trivial File Transfer Protocol is an Internet file transfer protocol similar to
FTP, but uses the UDP (User Datagram Protocol) rather than TCP
(Transmission Control Protocol).
Another videoconferencing solution.
DESCRIPTION
Firewall Screens