User's Manual

Chapter 14 Firewall 152
•Use the Rules screen (Section 14.4 on page 155) to view the configured firewall rules and add,
edit or remove a firewall rule.
•Use the Dos screen (Section 14.5 on page 161) to set the thresholds that the Device uses to
determine when to start dropping sessions that do not become fully established (half-open
sessions).
14.1.2 What You Need to Know About Firewall
SYN Attack
A SYN attack floods a targeted system with a series of SYN packets. Each packet causes the targeted
system to issue a SYN-ACK response. While the targeted system waits for the ACK that follows the
SYN-ACK, it queues up all outstanding SYN-ACK responses on a backlog queue. SYN-ACKs are
moved off the queue only when an ACK comes back or when an internal timer terminates the three-
way handshake. Once the queue is full, the system will ignore all incoming SYN requests, making
the system unavailable for legitimate users.
DoS
Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the
Internet. Their goal is not to steal information, but to disable a device or network so users no longer
have access to network resources. The Device is pre-configured to automatically detect and thwart
all known DoS attacks.
DDoS
A Distributed DoS (DDoS) attack is one in which multiple compromised systems attack a single
target, thereby causing denial of service for users of the targeted system.
LAND Attack
In a Local Area Network Denial (LAND) attack, hackers flood SYN packets into the network with a
spoofed source IP address of the target system. This makes it appear as if the host computer sent
the packets to itself, making the system unavailable while the target system tries to respond to
itself.
Ping of Death
Ping of Death uses a "ping" utility to create and send an IP packet that exceeds the maximum 65,536
bytes of data allowed by the IP specification. This may cause systems to crash, hang or reboot.
SPI
Stateful Packet Inspection (SPI) tracks each connection crossing the firewall and makes sure it is
valid. Filtering decisions are based not only on rules but also context. For example, traffic from the
WAN may only be allowed to cross the firewall in response to a request from the LAN.