ZyXEL Communications ZyWALL 5 User Manual page 521

LOG MESSAGE
Exceed TCP MAX
incomplete, sent TCP
RST
Peer TCP state out of
order, sent TCP RST
Firewall session time
out, sent TCP RST
Exceed MAX incomplete,
sent TCP RST
Access block, sent TCP
RST
LOG MESSAGE
[ TCP | UDP | ICMP | IGMP | Generic
] packet filter matched (set: %d,
rule: %d)
LOG MESSAGE
Firewall default policy: ICMP
<Packet Direction>, <type:%d>,
<code:%d>
Firewall rule [NOT] match:
ICMP <Packet Direction>,
<rule:%d>, <type:%d>,
<code:%d>
Triangle route packet
forwarded: ICMP
Packet without a NAT table
entry blocked: ICMP
Log Descriptions
Chart P-4 TCP Reset Logs
The router sent a TCP reset packet when the number of TCP incomplete
connections exceeded the user configured threshold. (the TCP incomplete
count is per destination host.) Note: Refer to TCP Maximum Incomplete in
the Firewall Attack Alerts screen.
The router sent a TCP reset packet when a TCP connection state was out of
order.
Note: The firewall refers to RFC793 Figure 6 to check the TCP state.
The router sent a TCP reset packet when a dynamic firewall session timed
out.
The default timeout values are as follows:
ICMP idle timeout: 3 minutes
UDP idle timeout: 3 minutes
TCP connection (three way handshaking) timeout: 270 seconds
TCP FIN-wait timeout: 2 MSL (Maximum Segment Lifetime set in the TCP
header).
TCP idle (established) timeout (s): 150 minutes
TCP reset timeout: 10 seconds
The router sent a TCP reset packet when the number of incomplete
connections (TCP and UDP) exceeded the user-configured threshold.
(Incomplete count is for all TCP and UDP connections through the firewall.)
Note: When the number of incomplete connections (TCP + UDP) > "Maximum
Incomplete High", the router sends TCP RST packets for TCP connections
and destroys TOS (firewall dynamic sessions) until incomplete connections <
"Maximum Incomplete Low".
The router sends a TCP RST packet and generates this log if you turn on the
firewall TCP reset mechanism (via CI command: "sys firewall tcprst").
Chart P-5 Packet Filter Logs
Attempted access matched a configured filter rule (denoted
by its set and rule number) and was blocked or forwarded
according to the rule.
Chart P-6 ICMP Logs
ICMP access matched the default policy and was blocked or
forwarded according to the user's setting. See the section on ICMP
messages for type and code details.
ICMP access matched (or didn't match) a firewall rule (denoted by
its number) and was blocked or forwarded according to the rule.
See the section on ICMP messages for type and code details.
The firewall allowed a triangle route session to pass through.
The router blocked a packet that didn't have a corresponding NAT
table entry.
ZyWALL 5 Internet Security Appliance
DESCRIPTION
DESCRIPTION
DESCRIPTION
P-3