Filter
Top Products
Chapter 11 Firewall screens 185
BCM50a Integrated Router Configuration — Basics
One Minute High This is the rate of new half-open sessions that causes the firewall
to start deleting half-open sessions. When the rate of new
connection attempts rises above this number, the BCM50a
Integrated Router deletes half-open sessions, as required, to
accommodate new connection attempts.
The numbers, for example, 80 in the One Minute Low field and
100 in this field, cause the BCM50a Integrated Router to start
deleting half-open sessions when more than 100 session
establishment attempts are detected in the last minute, and to stop
deleting half-open sessions when fewer than 80 session
establishment attempts are detected in the last minute.
Maximum
Incomplete Low
This is the number of existing half-open sessions that causes the
firewall to stop deleting half-open sessions. The BCM50a
Integrated Router continues to delete half-open requests, as
necessary, until the number of existing half-open sessions drops
below this number.
Maximum
Incomplete High
This is the number of existing half-open sessions that causes the
firewall to start deleting half-open sessions. When the number of
existing half-open sessions rises above this number, the BCM50a
Integrated Router deletes half-open sessions, as required, to
accommodate new connection requests. Do not set Maximum
Incomplete High to lower than the current Maximum Incomplete
Low number.
The above values, say 80 in the Maximum Incomplete Low field
and 100 in this field, cause the BCM50a Integrated Router to start
deleting half-open sessions when the number of existing half-open
sessions rises above 100, and to stop deleting half-open sessions
with the number of existing half-open sessions drops below 80.
TCP Maximum
Incomplete
This is the number of existing half-open TCP sessions with the
same destination host IP address that causes the firewall to start
dropping half-open sessions to that same destination host IP
address. Enter a number between 1 and 256. As a general rule,
choose a smaller number for a smaller network, a slower system or
limited bandwidth.
Blocking Period When TCP Maximum Incomplete is reached you can choose to
either allow or block the next session. If you select the Blocking
Period check box, any new sessions are blocked for the length of
time you specify in the next field (min) and all old incomplete
sessions are cleared during this period. If you want strong security,
it is better to block the traffic for a short time, as it gives the server
some time to digest the loading.
(min) Enter the length of Blocking Period in minutes.
Table 41 Attack alert
Label Description