Firewall - Zte ZXR10 ZSR V2 Series Product Description

ZXR10 ZSR V2 Series Router Product Description
Anti-ARP message flood-ARP Miss message suppression

ARP Miss message suppression avoids the ARP message flood.
3.7.4

Firewall

3.7.4.1 Configure security domains
Divide security domains, including DMZ domain service. As to firewalls, all security
policies are implemented on the basis of security domains. The related firewalls can
only be configured when security domains are divided. The configurations of the
security domain include: the name of the security domain, priority, interfaces to
access the security domain and the DMZ domain. Usually being a filtration subnet,
the DMZ domain is a security area between the intranet and extranet.
3.7.4.2 Packet filtration firewall-fragment message filtration service
Configure ACL to implement packet message filtration. The filtration is implemented
mainly
source/destination port number and message transmission direction of the upper layer
protocol borne by the IP layer of the data packet.
Setting in the firewall of the device, the packet filtration service compares the header of
the packet got from the packet with the preset ACL rules to decide if the packet will be
forwarded or discarded.
The packet filtration service supports the inspection of fragment messages. The packet
filtration firewall identifies different message types: non-fragment messages, first
fragment messages and follow-up fragment messages. All types of messages are
filtered.
3.7.4.3 Stateful firewall
As an extension of the packet filtration firewall, the stateful firewall not only takes the
packet as an independent unit to implement ACL inspection and filtration, but also
considers the relevance between the application layers of the packets. By using all sorts
of stateful tables to monitor TCP/UDP sessions, the stateful firewall makes the ACL table
38
based upon protocol number, source/destination IP addresses,
ZTE Confidential & Proprietary