ZyXEL Communications P-660HN-F1 User Manual

 Chapter 9 Firewalls

P-660HN-F1 User’s Guide

Figure 91   Security > Firewall > Threshold

The following table describes the labels in this screen. 

Table 57   Security > Firewall > Threshold

Denial of Service 
Thresholds

The ZyXEL Device measures both the total number of existing half-open 
sessions and the rate of session establishment attempts. Both TCP and UDP 
half-open sessions are counted in the total number and rate measurements. 
Measurements are made once a minute.

One Minute Low

This is the rate of new half-open sessions per minute that causes the firewall to 
stop deleting half-open sessions. The ZyXEL Device continues to delete half-
open sessions as necessary, until the rate of new connection attempts drops 
below this number.

One Minute High

This is the rate of new half-open sessions per minute that causes the firewall to 
start deleting half-open sessions. When the rate of new connection attempts rises 
above this number, the ZyXEL Device deletes half-open sessions as required to 
accommodate new connection attempts.
For example, if you set the one minute high to 100, the ZyXEL Device starts 
deleting half-open sessions when more than 100 session establishment attempts 
have been detected in the last minute. It stops deleting half-open sessions when 
the number of session establishment attempts detected in a minute goes below 
the number set as the one minute low.

Maximum 
Incomplete Low

This is the number of existing half-open sessions that causes the firewall to stop 
deleting half-open sessions. The ZyXEL Device continues to delete half-open 
requests as necessary, until the number of existing half-open sessions drops 
below this number.

Maximum 
Incomplete High

This is the number of existing half-open sessions that causes the firewall to start 
deleting half-open sessions. When the number of existing half-open sessions 
rises above this number, the ZyXEL Device deletes half-open sessions as 
required to accommodate new connection requests. Do not set Maximum 
Incomplete High to lower than the current Maximum Incomplete Low number.
For example, if you set the maximum incomplete high to 100, the ZyXEL Device 
starts deleting half-open sessions when the number of existing half-open 
sessions rises above 100. It stops deleting half-open sessions when the number 
of existing half-open sessions drops below the number set as the maximum 
incomplete low.