R3721-F3210-F3171-HP High-End Firewalls Attack Protection Configuration Guide-6PW101

• If a host in zone Trust initiates 100 or more connections, Firewall should output alarm logs and

discard subsequent connection request packets from the host. You can select Intrusion Detection >

Statistics from the navigation tree to view how many times that a connection limit per source IP

address has been exceeded and the number of packets dropped.

• If the number of connections to the server in the DMZ reaches or exceeds 10000, Firewall should

output alarm logs and discard subsequent connection request packets. You can select Intrusion

Detection > Statistics from the navigation tree to view how many times that a connection limit per

destination IP address has been exceeded and the number of packets dropped.

• If a SYN flood attack is initiated to the DMZ, Firewall should output alarm logs and discard the

attack packets. You can select Intrusion Detection > Statistics from the navigation tree to view the

number of SYN flood attacks and the number of packets dropped.