USG FLEX H Series - Security Enhancements

Zyxel_Claudia

The latest uOS 1.30 firmware introduces several critical security enhancements designed to protect networks against advanced TCP-based attacks and optimize management session handling. These improvements strengthen Zyxel’s firewall security, providing customers with a robust solution to maintain network integrity and prevent resource exhaustion caused by suspicious traffic.

1. Invalid TCP Flag Packet Drop

The Invalid TCP Flag Packet Drop feature provides an extra layer of security against abnormal TCP flag combinations, which are often used in network attacks to exhaust firewall resources. When enabled, the firewall automatically drops packets with invalid TCP flag.

• Purpose: Prevents resource-intensive attacks by blocking packets with invalid TCP flags.
• Configuration:
  • Accessible in System > Advanced under Additional Features.
  • Allows administrators to enable packet drop settings for TCP packets with invalid flags.

2. Drop TCP SYN Packet with Abnormal Payload

Drop TCP SYN Packet with Abnormal Payload feature blocks SYN packets that contain payload data. A typical SYN packet in a TCP handshake should not carry payload; if it does, this may indicate a potential attack such as a SYN flood with payload injection.

• Purpose: Prevents attacks where SYN packets carry payload data, which can run out firewalls resources.
• Configuration:
  • Located in System > Advanced under Additional Features. Enable this setting to drop SYN packets with payloads.
  • Options include setting a threshold for payload size to specify when to drop such packets.

3. Enhanced Admin Session Logout

The firmware update also improves Admin Session Management by changing the logout behavior for multiple admin logins. Previously, closing an admin session in one browser tab did not automatically log out sessions in other tabs or browsers, leading to potential security risks and resource limitations.

• New Behavior:
  • When an admin logs out or closes a session in one browser tab, all sessions for that admin account across other tabs and browsers are automatically closed.
  • This change prevents accidental occupancy of the maximum allowed sessions for an admin account, which could previously restrict further admin logins if the session limit was reached.

Summary

These security enhancements provide Zyxel customers with advanced tools to guard against sophisticated network threats and streamline administrative operations, ensuring a secure and resource-efficient environment. These features reinforce Zyxel’s commitment to maintaining robust cybersecurity standards across all network layers.