Figure 10-14 Firewall Threshold; Table 10-8 Firewall Threshold - ZyXEL Communications ZyWALL 5 User Manual

ZyWALL 5 Internet Security Appliance
The ZyWALL also sends alerts whenever TCP Maximum Incomplete is exceeded. The global values
specified for the threshold and timeout apply to all TCP connections. Click the FIREWALL link and
then the Threshold tab to bring up the next screen.
The following table describes the labels in this screen.
LABEL
Denial of Service Thresholds
One Minute Low This is the rate of new half-open sessions that causes the firewall to stop deleting half-
open sessions. The ZyWALL continues to delete half-open sessions as necessary,
until the rate of new connection attempts drops below this number.
One Minute High This is the rate of new half-open sessions that causes the firewall to start deleting half-
open sessions. When the rate of new connection attempts rises above this number, the
ZyWALL deletes half-open sessions as required to accommodate new connection
attempts.
The numbers, say 80 in the One Minute Low field and 100 in this field, cause the
ZyWALL to start deleting half-open sessions when more than 100 session
establishment attempts have been detected in the last minute, and to stop deleting
half-open sessions when fewer than 80 session establishment attempts have been
detected in the last minute.
Maximum This is the number of existing half-open sessions that causes the firewall to stop
Incomplete Low deleting half-open sessions. The ZyWALL continues to delete half-open requests as
necessary, until the number of existing half-open sessions drops below this number.
10-20

Figure 10-14 Firewall Threshold

Table 10-8 Firewall Threshold

DESCRIPTION
Firewall Screens