Configurable Application Policies; Bandwidth Management - ZyXEL Communications Unified Security Gateway ZyWALL 300 User Manual

Chapter 27 Application Patrol
The ZyWALL allows the first eight packets to go through the firewall,
regardless of the application patrol policy for the application. The ZyWALL
examines these first eight packets to identify the application.
The second approach is called service ports. In this approach, the ZyWALL only uses OSI
level-3 information, such as IP address and port, to identify what application is using the
connection. This approach is available in case the ZyWALL identifies a lot of "false positives"
for a particular application.

27.3 Configurable Application Policies

The ZyWALL has policies for individual applications. For each policy, you can specify the
default action the ZyWALL takes once it identifies one of the service's connections.
• Forward - the ZyWALL routes the packets for this application.
• Drop - the ZyWALL does not route the packets for this application, and it does not notify
the client of this decision.
• Reject - the ZyWALL does not route the packets for this application, and it notifies the
client of this decision.
You can also specify custom policies that have the ZyWALL forward, drop, or reject a
service's connections based on criteria that you specify (like the source zone, destination zone,
original destination port of the connection, schedule, user, source, and destination
information). Your custom policies take priority over the policy's default settings.

27.4 Bandwidth Management

When you allow an application, you can restrict the bandwidth it uses or even the bandwidth
that particular features in the application (like voice, video, or file sharing) use. This restriction
may be ineffective in certain cases, however, such as using MSN to send files via P2P.
The application patrol bandwidth management is more flexible and powerful than the
bandwidth management in policy routes. Application patrol controls TCP and UDP traffic.
Use policy routes to manage other types of traffic (like ICMP).
Bandwidth management in policy routes has priority over application patrol
bandwidth management. It is recommended to use application patrol
bandwidth management for TCP and UDP traffic and remove it from the policy
routes.
380
ZyWALL USG 300 User's Guide