F3215-HP Load Balancing Module Security Configuration Guide-6PW101

166
3. Click Apply.
Table 18 Configuration items
Item Descri
p
tion
Security Zone
Specify a security zone to be configured with virtual fragment reassembly.
The virtual fragment reassembly feature is effective in only the inbound direction
of a security zone.
Enable Virtual Fragment
Reassembly
Click the box to enable the virtual fragment reassembly feature.
Specify max number of
concurrent reassemblies
Specify the maximum number of concurrent reassemblies. When this value is
reached, the device discards all subsequent packets and sends a syslog
message.
This option is available after the virtual fragment reassembly feature is enabled.
Specify max number of
fragments per reassembly
Specify the maximum number of fragments in each reassembly. When this
value is reached, the device discards all subsequent fragments of the
reassembly and sends a syslog.
This option is available after the virtual fragment reassembly feature is enabled.
Specify timeout value of the
datagram being
reassembled
Set the aging time for each reassembly. If the fragments of a datagram (in a
reassembly) are not reassembled within this time, all the fragments of the
datagram are discarded.
This option is available after the virtual fragment reassembly feature is enabled.
Drop all the incoming
fragments
Click the box to discard all incoming fragments.
This option is available after the virtual fragment reassembly feature is enabled.
Virtual fragment reassembly configuration example
Network requirements
As shown in Figure 67, the host accesses the router through the LB module and NAT is enabled on
interface GigabitEthernet 0/1 of the LB module. Enable virtual fragment reassembly for security zone
Trust on the LB module to ensure secure and efficient NAT.
Figure 67 Network diagram
Configuring the host
Configure a static route to the router. (Details not shown.)
Configuring the LB module
1. Configure IP addresses for the interfaces and assign the interfaces to security zones. (Details not
shown.)