ZyXEL Communications 200 Series User Manual
Chapter 19 Firewall
ZyWALL USG 100/200 Series User’s Guide
344
• Besides configuring the firewall, you also need to configure virtual servers (NAT port
for more information.
• The ordering of your rules is very important as rules are applied in sequence.
Figure 247 Firewall
The following table describes the labels in this screen.
Table 113 Firewall
LABEL
DESCRIPTION
Global Setting
Enable Firewall
Select this check box to activate the firewall. The ZyWALL performs access control
when the firewall is activated.
when the firewall is activated.
Allow
Asymmetrical
Route
Asymmetrical
Route
If an alternate gateway on LAN1 has an IP address in the same subnet as the
ZyWALL’s LAN1 IP address, return traffic may not go through the ZyWALL. This is
called an asymmetrical or “triangle” route. This causes the ZyWALL to reset the
connection, as the connection has not been acknowledged.
Select this check box to have the ZyWALL permit the use of asymmetrical route
topology on the network (not reset the connection).
ZyWALL’s LAN1 IP address, return traffic may not go through the ZyWALL. This is
called an asymmetrical or “triangle” route. This causes the ZyWALL to reset the
connection, as the connection has not been acknowledged.
Select this check box to have the ZyWALL permit the use of asymmetrical route
topology on the network (not reset the connection).
Note: Allowing asymmetrical routes may let traffic from the WAN go
directly to LAN1 without passing through the ZyWALL. A
better solution is to use virtual interfaces to put the ZyWALL
and the backup gateway on separate subnets.
better solution is to use virtual interfaces to put the ZyWALL
and the backup gateway on separate subnets.
Maximum
session per host
session per host
Each NAT session establishes a corresponding firewall session. Use this field to
limit the number of concurrent NAT/firewall sessions each client computer can have.
Peer to peer applications, such as file sharing applications, may use a large number
of NAT sessions. Not limiting the number of session per host could allow a single
client to use all of the available NAT sessions so no additional NAT sessions can be
established and other users cannot access the Internet.
With a few clients using peer to peer applications, you can raise this number to
improve their performance. With heavy peer to peer application use, lower this
number to ensure no single client uses too many of the available NAT sessions.
limit the number of concurrent NAT/firewall sessions each client computer can have.
Peer to peer applications, such as file sharing applications, may use a large number
of NAT sessions. Not limiting the number of session per host could allow a single
client to use all of the available NAT sessions so no additional NAT sessions can be
established and other users cannot access the Internet.
With a few clients using peer to peer applications, you can raise this number to
improve their performance. With heavy peer to peer application use, lower this
number to ensure no single client uses too many of the available NAT sessions.