Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

When deciding on how many open connections from a single Computer to allow, choose your
number from somewhere between what you would consider a reasonable number of half-open
connections from a single Computer for the type of protocol being used, and how many half-open
connections from a single Computer your system can maintain without getting congested.
FTP Options
UDP
o Enable Syn-Flood protection when the number of half-open connections
exceeds: Unlike setting a hard limit on the number of half-open connections from a
single Computer, the Syn-Flood protection mechanism starts to use Syn-cookies once
the set number of open connections is reached (regardless of whether the connections
come a single Computer or not). The use of syn-cookies means that connections are not
rejected. However, no entry is created for them in the state table, and they are not
passed to the application until an appropriate SYN-ACK is received from the destination
Computer.
o Enable ACK Storm protection when the number of already acknowledged
packets exceeds: Set this option to log an event that an ACK Storm attack has
occurred.
Drop Connection when ACK Storm detected: Set this option to drop the
connection if such an attack is detected.
Active FTP
o Allow Incoming: Allow Active FTP when this Computer is acting as a server.
o Allow Outgoing: Allow Active FTP when this Computer is acting as client.
Passive FTP
o Allow Incoming: Allow Passive FTP when this Computer is acting as a server.
o Allow Outgoing: Allow Passive FTP when this Computer is acting as a client.
Generally speaking, Active FTP is more secure from the server point of view, and Passive FTP is
more secure from the client point of view.
Enable UDP stateful inspection: Check to enable stateful inspection of UDP traffic.
The UDP stateful mechanism drops unsolicited incoming UDP packets. For every outgoing UDP
packet, the rule will update its UDP "stateful" table and will then only allow a UDP response if it occurs
within 60 seconds of the request. If you wish to allow specific incoming UDP traffic, you will have to
create a Force Allow rule. For example, if you are running a DNS server, you will have to create a
Force Allow rule to allow incoming UDP packets to destination port 53.
Without stateful inspection of UDP traffic, an attacker could masquerade as a DNS server and send
unsolicited UDP "replies" from source port 53 to Computers behind a firewall.
ICMP
o Enable UDP stateful logging: Checking this option will enable the logging of UDP
stateful inspection events.
Enable ICMP stateful inspection: Check to enable stateful inspection of ICMP traffic.
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 36 -