Configuring Attack Alert; Figure 10-13 Anti-Probing; Table 10-7 Anti-Probing - ZyXEL Communications ZyWALL 5 User Manual

ZyWALL 5 Internet Security Appliance
The following table describes the labels in this screen.
LABEL
Respond to PING The ZyWALL does not respond to any incoming Ping requests when Disable is
on selected. Select LAN to reply to incoming LAN Ping requests. Select WAN to reply to
incoming WAN Ping requests. Select DMZ to reply to incoming DMZ Ping requests.
Otherwise select LAN & WAN & DMZ to reply to both incoming LAN and WAN and DMZ
Ping requests.
Do not respond to Select this option to prevent hackers from finding the ZyWALL by probing for unused
requests for ports. If you select this option, the ZyWALL will not respond to port request(s) for unused
unauthorized ports, thus leaving the unused ports and the ZyWALL unseen. By default this option is
services. not selected and the ZyWALL will reply with an ICMP Port Unreachable packet for a port
probe on its unused UDP ports, and a TCP Reset packet for a port probe on its unused
TCP ports.
Note that the probing packets must first traverse the ZyWALL 's firewall mechanism
before reaching this anti-probing mechanism. Therefore if the firewall mechanism blocks
a probing packet, the ZyWALL reacts based on the firewall policy, which by default, is to
send a TCP reset packet for a blocked TCP packet. You can use the command "sys
firewall tcprst rst [on|off]" to change this policy. When the firewall mechanism blocks a
UDP packet, it drops the packet without sending a response packet.
Apply Click Apply to save your changes back to the ZyWALL.
Reset Click Reset to begin configuring this screen afresh.

10.10 Configuring Attack Alert

Attack alerts are the first defense against DOS attacks. In the Threshold screen, shown later, you may
choose to generate an alert whenever an attack is detected. For DoS attacks, the ZyWALL uses
thresholds to determine when to drop sessions that do not become fully established. These thresholds
apply globally to all sessions.
You can use the default threshold values, or you can change them to values more suitable to your
security requirements.
10-18

Figure 10-13 Anti-Probing

Table 10-7 Anti-Probing

DESCRIPTION
Firewall Screens