ZyXEL Communications ZYWALL 70 - V4.04 Podręcznik Użytkownika Pobierz pdf (Strona 96)

Appendix 4 Traffic Redirect/Static Route Application Note

Why traffic redirect/static route be blocked by ZyWALL

ZyWALL is the ideal secure gateway for all data passing between the Internet and

the LAN. For some reasons (load balance or backup line), users want traffics be re-routed

to another Internet access devices while still be protected by ZyWALL. The network

topology is the most important issue. Here is the common example that people

misemploy the LAN traffic redirect and static route.

Figure 5-1 Triangle Route

Figure 5-1 indicates the triangle route topology. It works fine with turn off

firewall. Let’s take a look into the perspective toward this situation.

Step 1. PC sends outgoing traffics through ZyWALL because default gateway assigned

to it.

Step 2. Then, ZyWALL will redirect the traffics to another gateway (ISDN/Router) as we

expect.

Step 3. But the return traffics do not go through ZyWALL because the gateway (say,

P201) and the PC are on the same IP network. Any traffic will easily inject into

the protected network area through the unprotected gateway.

Step 4. When firewall turns on, it could be worse. ZyWALL will check the outgoing

traffics by ACL and create dynamic sessions to allow legal return traffics. For

Anti-DoS reason, ZyWALL will send RST packets to the PC and the peer

because it never received TCP SYN/ACK packet.

That causes all of outgoing TCP traffics being reset!

How traffic redirect/static route works under protection - Solutions

(1) Gateway on alias IP network

IP alias allows you to partition a physical network into different logical IP

networks over the same Ethernet interface. The ZyWALL supports three logical LAN

interfaces via its single physical Ethernet interface with the ZyWALL itself as the

gateway for each LAN network. Division of protected LAN and the other gateway into

different subnets will trigger the incoming traffic back to ZyWALL and it can work as

1 2 ... 91 92 93 94 95 96 97 98 99 100 101 ... 111 112

Brak uwag

ZyXEL Communications ZYWALL 70 - V4.04 Podręcznik Użytkownika Strona 96