Source Routed Packets

 

•	Drop Source Routed IP Packets - (Enabled by default.) Clear this checkbox if you are testing traffic between two specific hosts and you are using source routing.

IP Source Routing is a standard option in IP that allows the sender of a packet to specify some or all of the routers that should be used to get the packet to its destination.

This IP option is typically blocked from use as it can be used by an eavesdropper to receive packets by inserting an option to send packets from A to B via router C. The routing table should control the path that a packet takes, so that it is not overridden by the sender or a downstream router.

Connections

The Connections section provides the ability to fine-tune the firewall to prioritize for either optimal throughput or an increased number of simultaneous connections that are inspected by Deep-Packet Inspection (DPI) services. There is no change in the level of security protection provided by either of the DPI Connections settings below.

•

Maximum SPI Connections (DPI services disabled) - This option does not provide SonicWALL DPI Security Services protection and optimizes the firewall for maximum number of connections with only stateful packet inspection enabled. This option should be used by networks that require only stateful packet inspection, which is not recommended for most Dell SonicWALL network security appliance deployments.

•	Maximum DPI Connections (DPI services enabled) - This is the default and recommended setting for most Dell SonicWALL network security appliance deployments.

•	DPI Connections (DPI services enabled with additional performance optimization) - This option is intended for performance critical deployments. This option trades off the number of maximum DPI connections for an increased firewall DPI inspection throughput.

NOTE: When changing any Connections setting, the Dell SonicWALL security appliance must be restarted for the change to be implemented.

The maximum number of connections also depends on whether App Flow is enabled and if an external collector is configured, as well as the physical capabilities of the particular model of Dell SonicWALL security appliance. Mousing over the question mark icon next to the Connections heading displays a pop-up table of the maximum number of connections for your specific Dell SonicWALL security appliance for the various configuration permutations. The table entry for your current configuration is indicated in the table, as shown in the example below.

Access Rule Service Options

 

•

Force inbound and outbound FTP data connections to use default port 20 - The default configuration allows FTP connections from port 20 but remaps outbound traffic to a port such as 1024. If the check box is selected, any FTP data connection through the security appliance must come from port 20 or the connection is dropped. The event is then logged as a log event on the security appliance.

•	Apply firewall rules for intra-LAN traffic to/from the same interface - Applies firewall rules that is received on a LAN interface and that is destined for the same LAN interface. Typically, this only necessary when secondary LAN subnets are configured.

IP and UDP Checksum Enforcement

 

•	Enable IP header checksum enforcement - Select this to enforce IP header checksums. Packets with incorrect checksums in the IP header are dropped. This option is disabled by default.

•	Enable UDP checksum enforcement - Select this to enforce UDP packet checksums. Packets with incorrect checksums are dropped. This option is disabled by default.