ZyXEL Communications P-202 - Manual (Page 20)

P-202H Plus v2 Support Notes
hosts, this will create a large amount of ICMP echo request packet, the resulting
ICMP traffic will not only clog up the 'intermediary' network, but will also congest
the network of the spoofed source IP address, known as the 'victim' network.
This flood of broadcast traffic consumes all available bandwidth, making
communications impossible.
12. What is IP Spoofing attack?
Many DoS attacks also use IP Spoofing as part of their attack. IP Spoofing may
be used to break into systems, to hide the hacker's identity, or to magnify the
effect of the DoS attack. IP Spoofing is a technique used to gain unauthorized
access to computers by tricking a router or firewall into thinking that the
communications are coming from within the trusted network. To engage in IP
Spoofing, a hacker must modify the packet headers so that it appears that the
packets originate from a trusted host and should be allowed through the router or
firewall.
13. What are the default ACL firewall rules in P-202H Plus v2?
There are two default ACLs pre-configured in the P-202H Plus v2, one allows all
connections from LAN to WAN and the other blocks all connections from WAN to
LAN except of the DHCP packets.
14. Why static/policy route be blocked by P-202H Plus v2?
P-202H Plus v2 is an ideal secure gateway for all data passing between the
Internet and the LAN/DMZ. For some reasons (load balance or backup line),
users may want traffic to be re-routed to another Internet access devices while
still be protected by P-202H Plus v2. In such case, the network topology is the
most important issue. Here is a common example that people mis-deploy the
static route.
All contents copyright © 2006 ZyXEL Communications Corporation.
20