Enforce Tcp Sequence Number Check On Tcp Rst Packet; Use Hub-And-Spoke Policies For Untrust Mip Traffic - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Configuring ScreenOS Devices Guide

Enforce TCP Sequence Number Check on TCP RST Packet

Use Hub-and-Spoke Policies for Untrust MIP Traffic

126
sending the cookie, the security device drops the original SYN packet and deletes the
calculated cookie from memory.
When this option is disabled, traditional SYN-proxy becomes the TCP-negotiating
proxy for the destination server.
By default, this option is disabled.
NOTE: This option is only available on devices running ScreenOS 5.2 and
later.
Use the Check TCP Sequence Number Check on TCP RST Packet option to control how
the security device handles TCP reset (RST) packets with an out-of-sequence TCP
number:
When this option is enabled, the security device monitors the TCP sequence number
in a TCP segment with the RST bit enabled. If the sequence number matches the
previous sequence number for a packet in that session or is the next higher number
incrementally, the device permits the packet to cross the firewall. If the sequence
number does not match either of these expected numbers, the device drops the packet
and sends the host a TCP ACK segment with the correct sequence number.
When this option is disabled, the security device does not monitor the TCP sequence
number in TCP segments that have an RST bit enabled.
By default, this option is disabled.
NOTE: The NetScreen 5000 line does not support this option.
Use this option to control how the security device handles the forwarding of packets
arriving in a VPN tunnel to and from a mapped IP (MIP) address:
When this option is enabled, the security device forwards traffic arriving through a VPN
tunnel to a MIP address on one tunnel interface to the MIP host at the end of another
VPN tunnel. The two tunnels form a hub-and-spoke configuration, with the traffic
looping back on the same outgoing interface.
When this option is disabled, the security device does not forward VPN traffic arriving
at a MIP to a MIP at the other end of the VPN tunnel.
By default, this option is enabled.
NOTE: This option affects traffic forwarding only when the outgoing interface
is bound to the Untrust zone.
Copyright © 2010, Juniper Networks, Inc.