What You Need To Know - ZyXEL Communications ZyWall 110 User Manual

• Use the Anomaly Detection and Prevention (ADP) screens
detect traffic with protocol anomalies and take appropriate action.
• Use the Session Control screens (see
concurrent NAT/security policies traffic sessions a client can use.

21.1.2 What You Need to Know

Stateful Inspection
The ZyWALL/USG uses stateful inspection in its security policies. The ZyWALL/USG restricts access
by screening data packets against defined access rules. It also inspects sessions. For example,
traffic from one zone is not allowed unless it is initiated by a computer in another zone first.
Zones
A zone is a group of interfaces. Group the ZyWALL/USG's interfaces into different zones based on
your needs. You can configure security policies for data passing between zones or even between
interfaces.
Default Directional Security Policy Behavior
Security Policies can be grouped based on the direction of travel of packets to which they apply.
Here is the The ZyWALL/USG has default Security Policy behavior for traffic going through the
ZyWALL/USG in various directions.
Table 149 Directional Security Policy Behavior
FROM ZONE TO ZONE
From any to Device
From LAN1 to any (other than
the ZyWALL/USG)
From LAN2 to any (other than
the ZyWALL/USG)
From LAN1 to Device
From LAN2 to Device
From WAN to Device
From any to any
To-Device Policies
Policies with Device as the To Zone apply to traffic going to the ZyWALL/USG itself. By default:
• The Security Policy allows only LAN, or WAN computers to access or manage the ZyWALL/USG.
• The ZyWALL/USG allows DHCP traffic from any interface to the ZyWALL/USG.
Chapter 21 Security Policy
Section 21.3 on page
BEHAVIOR
DHCP traffic from any interface to the ZyWALL/USG is allowed.
Traffic from the LAN1 to any of the networks connected to the ZyWALL/USG is
allowed.
Traffic from the LAN2 to any of the networks connected to the ZyWALL/USG is
allowed.
Traffic from the LAN1 to the ZyWALL/USG itself is allowed.
Traffic from the LAN2 to the ZyWALL/USG itself is allowed.
The default services listed in
the WAN to the ZyWALL/USG itself. All other WAN to ZyWALL/USG traffic is
dropped.
Traffic that does not match any
traffic from the WAN to any of the networks behind the ZyWALL/USG.
This also includes traffic to or from interfaces that are not assigned to a zone
(extra-zone traffic).
ZyWALL/USG Series User's Guide
356
(Section 21.3 on page
363) to limit the number of
To-Device Policies on page 356
Security policy
is dropped. This includes
363) to
are allowed from