User manual ZYXEL PRESTIGE 202H

[. . . ] Prestige 202H ISDN Router User's Guide Version 3. 40 September 2003 Prestige 202H User's Guide Copyright Copyright © 2003 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice. [. . . ] If the Weekly option is selected, then also specify which day of the week the e-mail should be sent. If the When Log is Full option is selected, an alert is sent when the log fills up. Click which day of the week you want to send the alert from the drop down list box. Click the up or down arrows to the right of the list box to choose a time to send the alerts. Hourly Day for Sending Alerts Time for Sending Alerts Sunday Click Back to return to the previous screen. Use the Help icon to find field descriptions. Configuring Firewall with the Web Configurator 14-5 Prestige 202H User's Guide 14. 3. 2 SMTP Error Messages If there are difficulties in sending e-mail the following error messages appear. Please see the Support Notes on the included disk for information on other types of error messages. E-mail error messages appear in SMT menu 24. 3. 1 as "SMTP action request failed. Table 14-3 SMTP Error Messages -1 means Prestige out of socket -2 means tcp SYN fail -3 means smtp server OK fail -4 means HELO fail -5 means MAIL FROM fail -6 means RCPT TO fail -7 means DATA fail -8 means mail data send fail 14. 3. 3 Example E-mail Log An "End of Log" message displays for each mail in which a complete log has been sent. The following is an example of a log sent by e-mail. 14-6 Configuring Firewall with the Web Configurator Prestige 202H User's Guide Subject: Firewall Alert From Prestige Date: Fri, 07 Apr 2000 10:05:42 From: user@zyxel. com To: user@zyxel. com The date format here is Day-Month-Year. You may edit the subject title 1|Apr 7 00 |From:192. 168. 1. 1 To:192. 168. 1. 255 |default policy |forward | 09:54:03 |UDP src port:00520 dest port:00520 |<1, 00> | 2|Apr 7 00 |From:192. 168. 1. 131 To:192. 168. 1. 255 |default policy |forward | 09:54:17 |UDP src port:00520 dest port:00520 |<1, 00> | 3|Apr 7 00 |From:192. 168. 1. 6 To:10. 10. 10. 10 |match |forward | 09:54:19 |UDP src port:03516 dest port:00053 |<1, 01> | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . {snip}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . {snip}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126|Apr 7 00 |From:192. 168. 1. 1 To:192. 168. 1. 255 |match |forward | 10:05:00 |UDP src port:00520 dest port:00520 |<1, 02> | 127|Apr 7 00 |From:192. 168. 1. 131 To:192. 168. 1. 255 |match |forward | 10:05:17 |UDP src port:00520 dest port:00520 |<1, 02> | 128|Apr 7 00 |From:192. 168. 1. 1 To:192. 168. 1. 255 |match |forward | 10:05:30 |UDP src port:00520 dest port:00520 |<1, 02> | End of Firewall Log The date format here is Month-Day-Year. The time format is Hour-Minute-Second. "End of Log" message shows that a complete log has been sent. Figure 14-5 E-mail Log 14. 4 Attack Alert Attack alerts are real-time reports of DoS attacks. In the Attack Alert screen, shown later, you may choose to generate an alert whenever an attack is detected. For DoS attacks, the Prestige uses thresholds to determine when to drop sessions that do not become fully established. You can use the default threshold values, or you can change them to values more suitable to your security requirements. 14. 4. 1 Threshold Values Tune these parameters when something is not working and after you have checked the firewall counters. The maximum number of opened sessions. Configuring Firewall with the Web Configurator 14-7 Prestige 202H User's Guide 2. Type of traffic for certain servers. If your network is slower than average for any of these factors (especially if you have servers that are slow or handle many tasks and are often busy), then the default values should be reduced. You should make any changes to the threshold values before you continue configuring firewall rules. 14. 4. 2 Half-Open Sessions An unusually high number of half-open sessions (either an absolute number or measured as the arrival rate) could indicate that a Denial of Service attack is occurring. For TCP, "half-open" means that the session has not reached the established state-the TCP three-way handshake has not yet been completed (see Figure 12-2). For UDP, "half-open" means that the firewall has detected no return traffic. The Prestige measures both the total number of existing half-open sessions and the rate of session establishment attempts. [. . . ] 12-7 Schedule Sets Duration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23-3 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . See Syntax Conventions Server . . 7-3, 11-5, 11-7, 11-9, 11-12, 11-13, 11-14, 11-17, 11-18, 22-7, 22-8 Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v, 15-2 Service Type. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14-6 Smurf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ]