R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

100
3. Click Apply.
Table 40 Configuration items
Item Descri
p
tion
Security Zone Specify a security zone to be configured with virtual fragment reassembly.
Enable Virtual Fragment
Reassembly
Select the box to enable the virtual fragment reassembly feature.
Specify max number of
concurrent reassemblies
Specify the maximum number of concurrent reassemblies. When this value is
reached, the firewall discards all subsequent packets and sends a syslog
message.
This option is available after the virtual fragment reassembly feature is enabled.
Specify max number of
fragments per reassembly
Specify the maximum number of fragments in each reassembly. When this
value is reached, the firewall discards all subsequent fragments of the
reassembly and sends a syslog.
This option is available after the virtual fragment reassembly feature is enabled.
Specify timeout value of the
datagram being
reassembled
Set the aging time for each reassembly. If the fragments of a datagram (in a
reassembly) are not reassembled within this time, all the fragments of the
datagram are discarded.
This option is available after the virtual fragment reassembly feature is enabled.
Drop all the incoming
fragments
Select the box to discard all incoming fragments.
This option is available after the virtual fragment reassembly feature is enabled.
Virtual fragment reassembly configuration example
Network requirements
As shown in Figure 98, the host accesses the router through the Firewall, and NAT is enabled on interface
GigabitEthernet 0/1 of the Firewall. Enable virtual fragment reassembly for security zone Trust on the
Firewall to ensure secure and efficient NAT.
Figure 98 Network diagram
Configuring the Host.
Configure a static route to the router. (Details not shown.)
Configuring the Firewall.
1. Assign IP addresses to the interfaces and assign the interfaces to the security zones. (Details not
shown.)
2. Configure a static address mapping: