A packet filtering firewall builds a flow table based on source IP addresses, source ports, destination IP addresses, destination ports, and transport-layer protocol. There is a limit on the flow table size since it occupies memory resources. If the flow table size reaches the limit, traffic of new services will fail to be forwarded because they cannot obtain flow table resources. To address this issue, configure the packet filtering firewall bypass function in an interzone. This configuration allows traffic to be forwarded based on inter-zone ACL rules, without the need of building flow table entries.

After the packet filtering firewall bypass function is configured, the firewall supports only the packet filtering and packet filtering log functions.

To view the communication packets of a device within a specified period, run the clear firewall statistics system normal command to clear the previous packet statistics on the device first.

To view the packets in a zone within a specified period, run the clear firewall statistics zone command to clear the previous packet statistics in the zone first.

Usage Scenario

ASPF filters application-layer protocol packets. It is a status-based packet filtering method. ASPF can detect the sessions that attempt to traverse the application layer and deny the undesired packets.

Prerequisites

An interzone has been created using the firewall interzone command.

The display firewall app session table command displays information about a specified application session table or all application session tables. The application session table information is displayed only when some traffic is sent to the application layer.

You can run this command to view statistics on firewall Session entries and Servermap entries to facilitate firewall related fault diagnosis and troubleshooting.

Session entry: includes 5-tuple information (the protocol number, source IP address, source port number, destination IP address, and destination port number). When each session passes through the firewall, a session entry is created on the firewall.

Servermap entry: includes 3-tuple information (the protocol number, source IP address, and destination IP address). When the firewall uses a multi-channel protocol for communication, Servermap entries are created.

None

None

None

You can use the display firewall interzone command to obtain information about an interzone.

None

You can run this command to check information about a firewall session table.

When you run the display firewall statistics system command without specifying any parameters, the upper and lower thresholds for controlling the TCP, UDP, ICMP, TCP proxy, and IP fragment packets (session number) are displayed.

The display firewall statistics zone command displays the number of current sessions and historical sessions in the inbound or outbound direction of a zone and the number of HTTP, FTP, or DNS packets in a certain direction.

After the traffic monitoring function is enabled and the session thresholds of each protocol are set, you can run the display firewall statistics zone-ip command to view the traffic monitoring information of the zone.

None

None

This command displays the timeout interval of sessions on the firewall session table or NAT session table.

The display port-mapping command displays the port mappings, including the mappings between application-layer protocols and ports, condition (ACL) in which each mapping takes effect, and the type of each mapping (defined by the system or user).

You can run this command to check information about a firewall session table, NAT session table, or a common session table.

After an IP address is added to the blacklist by the firewall blacklist command, the firewall denies the packets from this IP address until this entry ages.

An IP address cannot exist in both the whitelist and blacklist.

The blacklist entry with an aging time is not written into the configuration file. You can view it using the display firewall blacklist command.

Usage Scenario

Configurations of the blacklist take effect only after you run the firewall blacklist enable command to enable the blacklist function.

Precautions

A blacklist entry can be manually configured or automatically generated.

After you run the firewall defend ip-sweep enable command to enable defense against address scanning attacks, the device adds attacking IP addresses to the blacklist.

After you run the firewall defend port-scan enable command to enable defense against port scanning attacks, the device adds attacking ports to the blacklist.

You can batch configure entries in the blacklist and whitelist by loading a configuration file.

[FirewallBlacklist]
IPAddress = 10.10.10.1
VPNName = vpna
[FirewallBlacklist]
IPAddress = 10.10.10.2
VPNName = 

[FirewallWhitelist]
IPAddress = 10.10.10.3
VPNName = vpnb
[FirewallWhitelist]
IPAddress = 10.20.20.1
VPNName = 

An invalid configuration file cannot be loaded. For example, if a configuration file contains an invalid IP address or excess entries, the invalid IP address cannot be added and the excess entries do not take effect; however, the valid IP addresses and the entries in the range can still take effect.

By using this command, you can save the blacklist and whitelist to the configuration file configuration-file-name. Only the entries with the aging time being 0 can be saved.

The configuration file configuration-file-name must be available before this command is executed.

None

A Fraggle attack is similar to a Smurf attack, except that the Fraggle attack sends UDP packets, rather than ICMP packets. Therefore, the Fraggle attack packets can traverse some firewalls that prevent ICMP packets.

A Fraggle attack can be successful because both UDP port 7 (ECHO) and port 19 (Chargen) return responses after receiving UDP packets. The details are as follows:

• UDP port 7 returns a response (similar to the ICMP ECHO-Reply packet) after receiving a packet.
• UDP port 19 generates a character stream after receiving the packet.

The two UDP ports send a lot of response packets, which occupy high network bandwidth.

An attacker can send a UDP packet to the target network. The source address of the UDP packet is the IP address of the attacked host and its destination address is the broadcast address or network address of the host's subnet. The destination port number of the packet is 7 or 19. All the hosts on the subnet then send response packets to the attacked host. This generates heavy traffic and hence congests the network or makes the host break down.

Usage Scenario

ICMP Flood attack sends a large number of ICMP packets (such as ping packets) to the attacked host in a short time and requests for responses. The host is then overloaded and cannot process normal tasks.

ICMP Flood attack defense parameters configured for an IP address take precedence over those configured for a zone. If ICMP Flood attack defense is configured for both an IP address and the zone where the IP address resides, the configuration for the IP address takes effect. If you cancel the configuration for the IP address, the configuration for the zone takes effect.

Precautions

Parameters of ICMP Flood attack defense take effect only after ICMP Flood defense is enabled using the firewall defend icmp-flood enable command.

Usage Scenario

ICMP Flood attack sends a large number of ICMP packets (such as ping packets) to the attacked host in a short time and requests for responses. The host is then overloaded and cannot process normal tasks.

Precaution

You can run firewall defend icmp-flood command to set parameters for ICMP Flood attack defense.

None

None

None.

Parameters of address sweeping attack defense take effect only after address sweeping attack defense is enabled using the firewall defend ip-sweep enable command.

Usage Scenario

An IP sweeping attack detects the IP addresses of the target hosts by using scanning tools. The attacker then determines the hosts that exist on the target network according to the responses received.

Precaution

You can run firewall defend ip-sweep command to set parameters for IP address sweep attack defense.

None.

Usage Scenario

Similar to a "Ping of Death" attack, a Large-ICMP attack sends the oversized ICMP packets to attack a system. The difference is that the length of Large-ICMP packet does not exceed the maximum length of an IP packet (65535 bytes). Large-ICMP packets also have great impact on some operating systems. To prevent Large-ICMP attack, set the maximum length of ICMP packets on the firewall.

Precautions

The maximum length of ICMP packets allowed to pass takes effect only after large-ICMP attack defense is enabled using the firewall defend large-icmp enable command.

Usage Scenario

Similar to a "Ping of Death" attack, a large-ICMP attack sends the oversize ICMP packets to attack a system. The difference is that the length of Large-ICMP packet does not exceed the maximum length of an IP packet (65535 bytes). Large-ICMP packets also have great impact on some operating systems.

Precaution

You can run firewall defend large-icmp command to set Large-ICMP attack defense.

None

Parameters of port scanning attack defense take effect only after port scanning attack defense is enabled using the firewall defend port-scan enable command.

Usage Scenario

Port scanning attack detects the ports of the target hosts by using scanning tools. The attacker then finds out the hosts that exist on the target network according to the responses and the ports that are used to provide services.

Precaution

You can run the firewall defend port-scan command to set parameters for port scanning attack defense.

None

Usage Scenario

Flood attack defense parameters configured for an IP address take precedence over those configured for a zone. If Flood attack defense is configured for both an IP address and the zone where the IP address resides, the configuration for the IP address takes effect. If you cancel the configuration for the IP address, the configuration for the zone takes effect.

Precautions

Parameters of SYN Flood attack defense take effect only after SYN Flood attack defense is enabled using the firewall defend syn-flood enable command.

Usage Scenario

The TCP/IP protocol stack permits only a certain number of TCP connections due to resource restriction. SYN Flood attacks utilize this feature. The attacker forges a SYN packet with a forged or nonexistent source address to initiate a connection to the server. When receiving this packet, the server replies with a SYN-ACK message. The receiver of the SYN-ACK packet does not exist, so a half-connection is caused. If the attacker sends a large number of such packets, a lot of half-connections will be produced on the attacked host and the resources of the attacked host will be exhausted. Therefore, authorized users cannot access the host till the half-connections expire. If the number of connections is not limited, SYN Flood will consume the system resources such as memory.

Precaution

You can run firewall defend syn-flood command to set parameters for SYN Flood attack defense.

None

None.

Tracert attack traces the path of an ICMP timeout packet returned when the value of time to live (TTL) is 0 or an ICMP port-unreachable packet. In this way, the attacker obtains the network structure.

Usage Scenario

UDP Flood attack sends a large number of UDP packets to the attacked host in a short time and requests for responses. The host is then overloaded and cannot process normal tasks.

Flood attack defense parameters configured for an IP address take precedence over those configured for a zone. If Flood attack defense is configured for both an IP address and the zone where the IP address resides, the configuration for the IP address takes effect. If you cancel the configuration for the IP address, the configuration for the zone takes effect.

Precautions

Parameters of UDP Flood attack defense take effect only after UDP Flood attack defense is enabled using the firewall defend udp-flood enable command.

Usage Scenario

UDP Flood attack sends a large number of UDP packets to the attacked host in a short time and requests for responses. The host is then overloaded and cannot process normal tasks.

Precaution

You can run firewall defend udp-flood command to set parameters for ICMP Flood attack defense.

WinNuke attack sends an out-of-band (OOB) data packet to the NetBIOS port (139) of the target host running a Windows operating system. The NetBIOS fragment then overlaps and the host stops responding. An Internet Group Management Protocol (IGMP) fragment packet can also damage the target host because the IGMP packet should not be fragmented. If a host receives an IGMP fragment packet, the host may be attacked.

The packet filtering, ASPF, and attack defense functions take effect only after this command is executed. This command does not need to be executed for other advanced security features, such as IPS, AV, and URL filtering.

Usage Scenario

To configure the firewall in an interzone to filter packets or application-layer services, run the firewall interzone command to enter the interzone view.

Precautions

At least two valid zones must exist on the device; otherwise, the device does not execute the firewall interzone command.

The interzone is determined by two zones, which is irrelevant to the sequence of the two zones in the command.

Only one binary log server can be configured in the system view. Any time a new binary log server is configured, the new one replaces the previous one.

Firewall logs record the operating status of the firewall in real time. By analyzing the logs, the network administrator can find potential security threats to the network and take preventive measures to protect the network.

You can configure the following types of logs on the firewall:

• Blacklist log: records the IP addresses that are added to or deleted from the blacklist.

• Attack defense log: records different types of attacks detected by the firewall.

• Session log: records the sessions that match the specified ACL rules and sessions processed by the NAT server.

• Traffic statistics log: records the events that the traffic rate exceeds the threshold or falls below the threshold.

• Packet filtering log: records information about packet filtering.

Firewall logs are classified into binary logs and text logs depending on the format. Binary logs are sent to the binary log server in real time, and text logs are sent to the text log server at intervals. The firewall log log-interval command sets the interval for sending text logs to the text log server.

Session logs record the sessions that match the specified ACL rules and sessions processed by the NAT server.

Before setting the session thresholds on the firewall, run the firewall statistics system enable command to enable traffic statistics collection on the firewall.

You can run the display firewall statistics system command to check whether traffic statistics collection is enabled.

After traffic statistics collection and monitoring are enabled on the firewall, the upper threshold for the number of protocol packets in the security zone of the firewall is 16384 and the lower threshold is 12288. You can run the firewall statistics system connect-number command to change the threshold of the number of connections on the firewall.

An IP address cannot exist in both the whitelist and blacklist. To move an IP address from one list to the other list, delete the corresponding entry first.

The entries in the whitelist take effect directly and you do not need to enable the whitelist function.

Before configuring a firewall, create zones. Then you can deploy security services according to the security priorities of the zones.

The device considers that the data transmission within a zone is reliable; therefore, it does not enforce any security policy on the intra-zone data transmission.

If an interface is added to a zone, the zone cannot be deleted in the system view. To delete the zone, delete the interface from the zone first.

Usage Scenario

The firewall-nat session aging-time command sets the timeout interval for sessions of each protocol or port. If an entry in a session table is not used within the specified period, the entry expires. For example, the user with IP address 10.110.10.10 initiates a TCP connection through port 2000. If the TCP connection is not used within the timeout interval, the system deletes the TCP connection.

The default session timeout interval of a port is the same as that of the corresponding protocol. The following table lists the default session timeout interval of each protocol.

When configuring the timeout interval for all sessions with a user-defined port as the destination port, you cannot set the port number to a default port number of the preceding protocols.

Precautions

For some services such as voice service, increase the TCP/UDP timeout interval to prevent service interruption.

You can set the session timeout interval for a maximum of 24 ports on the device.