User manual ZYXEL P-660HHW VERSION 3.40

[. . . ] P-660H/HW/W-T Series ADSL 2+ Gateway User's Guide Version 3. 40 6/2005 P-660H/HW/W-T Series User' Guide Copyright Copyright © 2005 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. [. . . ] Simole Service Discovery Protocol (SSDP) is a discovery service searching for Universal Plug and Play devices on your home network or upstream Internet gateways using DUDP port 1900. Login Host Protocol used for (Terminal Access Controller Access Control System). Telnet is the login and terminal emulation protocol common on the Internet and in UNIX environments. Its primary function is to allow users to log into remote host systems. Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP, but uses the UDP (User Datagram Protocol) rather than TCP (Transmission Control Protocol). Another videoconferencing solution. SNMP(TCP/UDP:161) SNMP-TRAPS (TCP/ UDP:162) SQL-NET(TCP:1521) SSDP(UDP:1900) SSH(TCP/UDP:22) STRMWORKS(UDP:1558) SYSLOG(UDP:514) TACACS(UDP:49) TELNET(TCP:23) TFTP(UDP:69) VDOLIVE(TCP:7000) 11. 11 Anti-Probing If an outside user attempts to probe an unsupported port on your Prestige, an ICMP response packet is automatically returned. The Prestige supports anti-probing, which prevents the ICMP response packet from being sent. This keeps outsiders from discovering your Prestige when unsupported ports are probed. Internet Control Message Protocol (ICMP) is a message control and error-reporting protocol between a host server and a gateway to the Internet. ICMP uses Internet Protocol (IP) datagrams, but the messages are processed by the TCP/IP software and directly apparent to the application user. Click Firewall in the navigation panel and click Anti Probing to display the screen as shown. Chapter 11 Firewall Configuration 148 P-660H/HW/W-T Series User' Guide Figure 61 Firewall: Anti Probing The following table describes the labels in this screen. Table 43 Firewall: Anti Probing LABEL Respond to PING on DESCRIPTION The Prestige does not respond to any incoming Ping requests when Disable is selected. Otherwise select LAN & WAN to reply to both incoming LAN and WAN Ping requests. Select this option to prevent hackers from finding the Prestige by probing for unused ports. If you select this option, the Prestige will not respond to port request(s) for unused ports, thus leaving the unused ports and the Prestige unseen. By default this option is not selected and the Prestige will reply with an ICMP Port Unreachable packet for a port probe on its unused UDP ports, and a TCP Reset packet for a port probe on its unused TCP ports. Note that the probing packets must first traverse the Prestige 's firewall mechanism before reaching this anti-probing mechanism. Therefore if the firewall mechanism blocks a probing packet, the Prestige reacts based on the firewall policy, which by default, is to send a TCP reset packet for a blocked TCP packet. You can use the command "sys firewall tcprst rst [on|off]" to change this policy. When the firewall mechanism blocks a UDP packet, it drops the packet without sending a response packet. Click Reset to begin configuring this screen afresh. Do not respond to requests for unauthorized services. Back Apply Reset 11. 12 DoS Thresholds For DoS attacks, the Prestige uses thresholds to determine when to drop sessions that do not become fully established. You can use the default threshold values, or you can change them to values more suitable to your security requirements. Refer to Section 11. 12. 3 on page 151 to configure thresholds. 149 Chapter 11 Firewall Configuration P-660H/HW/W-T Series User' Guide 11. 12. 1 Threshold Values Tune these parameters when something is not working and after you have checked the firewall counters. [. . . ] MAC address filters are not dependent on how you configure these security features. Table 162 Wireless Security Relational Matrix AUTHENTICATION ENCRYPTION ENTER METHOD/ KEY METHOD MANUAL KEY MANAGEMENT PROTOCOL Open Open None WEP No No Yes Yes Shared WEP No Yes Yes WPA WPA WPA-PSK WPA-PSK WEP TKIP WEP TKIP No No Yes Yes ENABLE IEEE 802. 1X No Enable with Dynamic WEP Key Enable without Dynamic WEP Key Disable Enable with Dynamic WEP Key Enable without Dynamic WEP Key Disable Yes Yes Yes Yes 429 Appendix L P-660H/HW/W-T Series User' Guide APPENDIX M Internal SPTGEN Internal SPTGEN Overview Internal SPTGEN (System Parameter Table Generator) is a configuration text file useful for efficient configuration of multiple Prestiges. Internal SPTGEN lets you configure, save and upload multiple menus at the same time using just one configuration text file ­ eliminating the need to navigate and configure individual SMT menus for each Prestige. The Configuration Text File Format All Internal SPTGEN text files conform to the following format: <field identification number = field name = parameter values allowed = input>, where <input> is your input conforming to <parameter values allowed>. The figure shown next is an example of an Internal SPTGEN text file. Figure 269 Configuration Text File Format: Column Descriptions / Menu 1 General Setup 10000000 = Configured 10000001 = System Name 10000002 = Location 10000003 = Contact Person's Name 10000004 = Route IP 10000005 = Route IPX 10000006 = Bridge <0(No)| 1(Yes)> <Str> <Str> <Str> <0(No)| 1(Yes)> <0(No)| 1(Yes)> <0(No)| 1(Yes)> =1 = Prestige = = =1 =0 =0 Note: DO NOT alter or delete any field except parameters in the Input column. For more text file examples, refer to the Example Internal SPTGEN Screens Appendix. Internal SPTGEN File Modification - Important Points to Remember Each parameter you enter must be preceded by one "="sign and one space. Appendix M 430 P-660H/HW/W-T Series User' Guide Some parameters are dependent on others. [. . . ]