ZyXEL Communications ZYWALL 5 - V4.04 Podręcznik Użytkownika Pobierz pdf (Strona 170)

ZyXEL Confidential

404XD3C0.docx

170/181

Appendix 4 Traffic Redirect/Static Route Application Note

Why traffic redirect/static route be blocked by ZyWALL

ZyWALL is the ideal secure gateway for all data passing between the Internet and

the LAN. For some reasons (load balance or backup line), users want traffics be re-routed

to another Internet access devices while still be protected by ZyWALL. The network

topology is the most important issue. Here is the common example that people misemploy

the LAN traffic redirect and static route.

Figure 4-1 Triangle Route

Figure 4-1 indicates the triangle route topology. It works fine with turn off firewall.

Let’s take a look into the perspective toward this situation.

Step 1. PC sends outgoing traffics through ZyWALL because default gateway assigned to

it.

Step 2. Then, ZyWALL will redirect the traffics to another gateway (ISDN/Router) as we

expect.

Step 3. But the return traffics do not go through ZyWALL because the gateway (say, P201)

and the PC are on the same IP network. Any traffic will easily inject into the

protected network area through the unprotected gateway.

Step 4. When firewall turns on, it could be worse. ZyWALL will check the outgoing

traffics by ACL and create dynamic sessions to allow legal return traffics. For

Anti-DoS reason, ZyWALL will send RST packets to the PC and the peer because

it never received TCP SYN/ACK packet.

That causes all of outgoing TCP traffics being reset!

How traffic redirect/static route works under protection - Solutions

(1) Gateway on alias IP network

IP alias allows you to partition a physical network into different logical IP networks

over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via

its single physical Ethernet interface with the ZyWALL itself as the gateway for each LAN

network. Division of protected LAN and the other gateway into different subnets will

trigger the incoming traffic back to ZyWALL and it can work as normal function.

1 2 ... 165 166 167 168 169 170 171 172 173 174 175 ... 180 181

Brak uwag

ZyXEL Communications ZYWALL 5 - V4.04 Podręcznik Użytkownika Strona 170