ZyXEL Communications P-792H User Manual page 136

Chapter 9 Firewalls
9.5.4.1 The "Triangle Route" Problem
A traffic route is a path for sending or receiving data packets between two
Ethernet devices. You may have more than one connection to the Internet
(through one or more ISPs). If an alternate gateway is on the LAN (and its IP
address is in the same subnet as the P-792H v2's LAN IP address), the "triangle
route" (also called asymmetrical route) problem may occur. The steps below
describe the "triangle route" problem.
A computer on the LAN initiates a connection by sending out a SYN packet to a
1
receiving server on the WAN.
The P-792H v2 reroutes the SYN packet through Gateway A on the LAN to the
2
WAN.
The reply from the WAN goes directly to the computer on the LAN without going
3
through the P-792H v2.
As a result, the P-792H v2 resets the connection, as the connection has not been
acknowledged.
Figure 58 "Triangle Route" Problem
9.5.4.2 Solving the "Triangle Route" Problem
If you have the P-792H v2 allow triangle route sessions, traffic from the WAN can
go directly to a LAN computer without passing through the P-792H v2 and its
firewall protection.
Another solution is to use IP alias. IP alias allows you to partition your network
into logical sections over the same Ethernet interface. Your P-792H v2 supports up
to three logical LAN interfaces with the P-792H v2 being the gateway for each
logical network.
136
LAN
1
2
3
WAN
ISP 1
ISP 2
A
P-792H v2 User's Guide