ZyXEL Communications P-661H Series User Manual

Chapter 9 Firewall Configuration

P-661H/HW Series User’s Guide

Figure 97   Firewall: Thresholds

The following table describes the labels in this screen.

Table 66   Firewall: Thresholds

Denial of Service 

Thresholds

The ZyXEL Device measures both the total number of existing half-open sessions 

and the rate of session establishment attempts. Both TCP and UDP half-open 

sessions are counted in the total number and rate measurements. Measurements 

are made once a minute.

One Minute Low

This is the rate of new half-open sessions per minute that causes the firewall to 

stop deleting half-open sessions. The ZyXEL Device continues to delete half-open 

sessions as necessary, until the rate of new connection attempts drops below this 

number.

One Minute High

This is the rate of new half-open sessions per minute that causes the firewall to 

start deleting half-open sessions. When the rate of new connection attempts rises 

above this number, the ZyXEL Device deletes half-open sessions as required to 

accommodate new connection attempts.
For example, if you set the one minute high to 100, the ZyXEL Device starts 

deleting half-open sessions when more than 100 session establishment attempts 

have been detected in the last minute. It stops deleting half-open sessions when 

the number of session establishment attempts detected in a minute goes below 

the number set as the one minute low.

Maximum 

Incomplete Low

This is the number of existing half-open sessions that causes the firewall to stop 

deleting half-open sessions. The ZyXEL Device continues to delete half-open 

requests as necessary, until the number of existing half-open sessions drops 

below this number.

Maximum 

Incomplete High

This is the number of existing half-open sessions that causes the firewall to start 

deleting half-open sessions. When the number of existing half-open sessions rises 

above this number, the ZyXEL Device deletes half-open sessions as required to 

accommodate new connection requests. Do not set Maximum Incomplete High 

to lower than the current Maximum Incomplete Low number.
For example, if you set the maximum incomplete high to 100, the ZyXEL Device 

starts deleting half-open sessions when the number of existing half-open sessions 

rises above 100. It stops deleting half-open sessions when the number of existing 

half-open sessions drops below the number set as the maximum incomplete low.