User manual ZYXEL ZW50

[. . . ] ZyWALL 50 Internet Security Gateway User's Guide Version 3. 50 November 2001 ZyWALL 50 Internet Security Gateway Copyright Copyright © 2001 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. [. . . ] Enter a subject that you want to appear in the subject field of your e-mail here (see Figure 9-4). If you leave this field blank then the default "Firewall Alert From ZyWALL" displays as your e-mail subject. Enter the e-mail address (username@mydomain. com) of whoever is responsible for maintaining the firewall, e. g. , your system administrator. If this field is left blank, alert messages will not be sent via e-mail. Enter an e-mail address to identify the ZyWALL as the sender of the e-mail messages i. e. , a "return-to-sender" address for backup purposes. DESCRIPTION OPTIONS Mail Subject E-mail Alerts To Return address Log Timer Log Schedule This pop-up menu is used to configure the frequency of log messages being sent as e-mail: daily, weekly, hourly, only when the log is full or none. If the Weekly or the Daily option is selected, specify a time of day when the e-mail should be sent. If the Weekly option is selected, then also specify which day of the week the email should be sent. If the When Log is Full option is selected, an alert is sent when the log fills up. Click which day of the week you want to send the alert from the drop down list box. Click the up or down arrows to the right of the list box to choose a time to send the alerts. When Log is Full Hourly Daily Weekly None Day for Sending Alerts Time for Sending Alerts Sunday through Saturday When you have finished, click Apply to save your customized settings and exit this screen, Cancel to exit this screen without saving, or Help for online HTML help on fields in this screen. Using the ZyWALL Web Configurator 9-5 ZyWALL 50 Internet Security Gateway 9. 3. 3 SMTP Error Messages If there are difficulties in sending e-mail the following error messages appear. Please see the Support Notes on the included disk for information on other types of error messages. E-mail error messages appear in SMT menu 24. 3. 1 as "SMTP action request failed. Table 9-2 SMTP Error Messages -1 means ZyWALL out of socket -2 means tcp SYN fail -3 means smtp server OK fail -4 means HELO fail -5 means MAIL FROM fail -6 means RCPT TO fail -7 means DATA fail -8 means mail data send fail 9. 3. 4 Example E-mail Log An "End of Log" message displays for each mail in which a complete log has been sent. The following is an example of a log sent by e-mail. 9-6 Using the ZyWALL Web Configurator ZyWALL 50 Internet Security Gateway Subject: Firewall Alert From ZyWALL Date: Fri, 07 Apr 2000 10:05:42 From: user@zyxel. com To: user@zyxel. com 1|Apr 7 00 |From:192. 168. 1. 1 To:192. 168. 1. 255 |default policy |forward | 09:54:03 |UDP src port:00520 dest port:00520 |<1, 00> | 2|Apr 7 00 |From:192. 168. 1. 131 To:192. 168. 1. 255 |default policy |forward | 09:54:17 |UDP src port:00520 dest port:00520 |<1, 00> | 3|Apr 7 00 |From:192. 168. 1. 6 To:10. 10. 10. 10 |match |forward | 09:54:19 |UDP src port:03516 dest port:00053 |<1, 01> | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . {snip}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . {snip}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126|Apr 7 00 |From:192. 168. 1. 1 To:192. 168. 1. 255 |match |forward | 10:05:00 |UDP src port:00520 dest port:00520 |<1, 02> | 127|Apr 7 00 |From:192. 168. 1. 131 To:192. 168. 1. 255 |match |forward | 10:05:17 |UDP src port:00520 dest port:00520 |<1, 02> | 128|Apr 7 00 |From:192. 168. 1. 1 To:192. 168. 1. 255 |match |forward | 10:05:30 |UDP src port:00520 dest port:00520 |<1, 02> | End of Firewall Log The date format here is Day-Month-Year. You may edit the subject title The date format here is Month-Day-Year. The time format is Hour-Minute-Second. "End of Log" message shows that a complete log has been sent. Figure 9-4 E-mail Log 9. 4 Attack Alert Attack alerts are the first defense against DOS attacks. In the Attack Alert screen, shown later, you may choose to generate an alert whenever an attack is detected. For DoS attacks, the ZyWALL uses thresholds to determine when to drop sessions that do not become fully established. You can use the default threshold values, or you can change them to values more suitable to your security requirements. 9. 4. 1 Threshold Values Tune these parameters when something is not working and after you have checked the firewall counters. [. . . ] 10-13 S SA Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24-1 Safety Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-7 Schedule Sets Duration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24-1 X Index ZyWALL 50 Internet Security Gateway T TCP Maximum Incomplete. . . . . . [. . . ]