Page 1 ZyWALL 5/35/70 Series Internet Security Appliance User’s Guide Version 4.04 03/2008 Edition 1 DEFAULT LOGIN IP Address http://192.168.1.1 Password 1234 www.zyxel.com...
Page 3: About This User's Guide
Help us help you. Send all User Guide-related comments, questions or suggestions for improvement to the following address, or use e-mail instead. Thank you! The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan.
Page 4: Document Conventions
Document Conventions Document Conventions Warnings and Notes These are how warnings and notes are shown in this User’s Guide. Warnings tell you about things that could harm you or your device. Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations.
Page 5 Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The ZyWALL icon is not an exact representation of your device. ZyWALL Server Switch ZyWALL 5/35/70 Series User’s Guide Computer Notebook computer Firewall Telephone Router Document Conventions...
Page 6: Safety Warnings
Safety Warnings For your safety, be sure to read and follow all warning notices and instructions. • Do NOT use this product near water, for example, in a wet basement or near a swimming pool. • Do NOT expose your device to dampness, dust or corrosive liquids. •...
Page 7 Safety Warnings This product is recyclable. Dispose of it properly. ZyWALL 5/35/70 Series User’s Guide...
Page 8 Safety Warnings ZyWALL 5/35/70 Series User’s Guide...
Page 9: Table Of Contents
Introduction ... 49 Getting to Know Your ZyWALL ... 51 Hardware Installation ... 55 Introducing the Web Configurator ... 61 Wizard Setup ... 87 Tutorials ... 109 Registration Screens ... 141 Network ... 147 LAN Screens ... 149 Bridge Screens ... 161 WAN Screens ...
Page 10 Contents Overview Reports, Logs and Maintenance ... 537 Reports Screens ... 539 Logs Screens ... 555 Maintenance Screens ... 585 SMT ... 603 Introducing the SMT ... 605 SMT Menu 1 - General Setup ... 613 WAN and Dial Backup Setup ... 619 LAN Setup ...
Page 11: Table Of Contents
About This User's Guide ... 3 Document Conventions... 4 Safety Warnings... 6 Contents Overview ... 9 Table of Contents... 11 List of Figures ... 29 List of Tables... 41 Part I: Introduction... 49 Chapter 1 Getting to Know Your ZyWALL... 51 1.1 ZyWALL Internet Security Appliance Overview ...
Page 12 Table of Contents 3.2 Accessing the ZyWALL Web Configurator ... 61 3.3 Resetting the ZyWALL ... 63 3.3.1 Procedure To Use The Reset Button ... 63 3.3.2 Uploading a Configuration File Via Console Port ... 63 3.4 Navigating the ZyWALL Web Configurator ... 64 3.4.1 Title Bar ...
Page 13 5.1.5 Using the Dynamic VPN Rule for More VPN Tunnels ...119 5.2 Security Settings for VPN Traffic ...119 5.2.1 IDP for From VPN Traffic Example ... 120 5.2.2 IDP for To VPN Traffic Example ... 121 5.3 Firewall Rule for VPN Example ... 122 5.3.1 Configuring the VPN Rule ...
Page 14 Table of Contents 8.1 Overview ... 161 8.1.1 What You Can Do in the Bridge Screens ... 161 8.1.2 What You Need To Know About Bridging ... 162 8.2 The Bridge Screen ... 163 8.3 The Bridge Port Roles Screen ... 164 8.4 Bridge Technical Reference ...
Page 15 Chapter 11 WLAN Screens ... 219 11.1 Overview ... 219 11.1.1 What You Can Do in the WLAN Screens ... 219 11.1.2 What You Need to Know About WLAN ... 220 11.2 The WLAN Screen ... 220 11.3 WLAN Static DHCP ... 223 11.4 WLAN IP Alias ...
Page 16 Table of Contents 13.7 The Firewall Thresholds Screen ... 264 13.8 The Firewall Services Screen ... 266 13.8.1 The Firewall Edit Custom Service Screen ... 267 13.8.2 My Service Firewall Rule Example ... 268 13.9 Technical Reference ... 271 Chapter 14 Intrusion Detection and Prevention (IDP) Screens ...
Page 17 16.1.1 What You Can Do in the Antispam Screens ... 313 16.1.2 What You Need to Know About Antispam ... 314 16.2 The General Screen ... 315 16.3 The External DB Screen 16.4 The Lists Screen ... 320 16.5 Anti-Spam Lists Edit Screen ... 322 16.6 Technical Reference ...
Page 18 Table of Contents 19.11 Telecommuter VPN/IPSec Examples ... 382 19.11.1 Telecommuters Sharing One VPN Rule Example ... 383 19.11.2 Telecommuters Using Unique VPN Rules Example ... 383 19.12 VPN and Remote Management ... 385 19.13 Hub-and-spoke VPN ... 385 19.13.1 Hub-and-spoke VPN Example ... 386 19.13.2 Hub-and-spoke Example VPN Rule Addresses ...
Page 19 Chapter 22 Network Address Translation (NAT)... 435 22.1 Overview ... 435 22.1.1 What You Can Do Using the NAT Screens ... 435 22.1.2 What You Need To Know About NAT ... 435 22.1.3 Before You Begin ... 436 22.2 The NAT Overview Screen ... 436 22.3 The NAT Address Mapping Screen ...
Page 20 Table of Contents 25.2 The Summary Screen ... 467 25.2.1 Maximize Bandwidth Usage Example ... 470 25.2.2 Reserving Bandwidth for Non-Bandwidth Class Traffic ... 471 25.3 The Class Setup Screen ... 471 25.4 Bandwidth Manager Class Configuration 25.4.1 Bandwidth Borrowing Example ... 476 25.5 Bandwidth Management Statistics ...
Page 21 27.9 The SNMP Screen ... 510 27.9.1 Configuring the SNMP Screen ... 512 27.10 The DNS Screen ... 513 27.11 The CNM Screen ... 514 27.12 Configuring the CNM Screen ... 514 27.13 Remote Management Technical Reference ... 516 Chapter 28 UPnP Screens ...
Page 22 Table of Contents 31.2.4 System Reports Specifications ... 545 31.3 The IDP Screen ... 545 31.4 The Anti-Virus Screen 31.5 The Anti-Spam Screen ... 549 31.6 The E-mail Report Screen ... 551 Chapter 32 Logs Screens ... 555 32.1 Overview ... 555 32.1.1 What You Can Do in the Log Screens ...
Page 23 34.3 Navigating the SMT Interface ... 606 34.3.1 Main Menu ... 607 34.3.2 SMT Menus Overview ... 609 34.4 Changing the System Password ... 610 34.5 Resetting the ZyWALL ...611 Chapter 35 SMT Menu 1 - General Setup ... 613 35.1 Introduction to General Setup ...
Page 24 Table of Contents 39.1 Configuring DMZ Setup ... 645 39.2 DMZ Port Filter Setup ... 645 39.3 TCP/IP Setup ... 646 39.3.1 IP Address ... 646 39.3.2 IP Alias Setup ... 647 Chapter 40 Route Setup... 649 40.1 Configuring Route Setup ... 649 40.2 Route Assessment ...
Page 25 44.3 Configuring a Server behind NAT ... 681 44.4 General NAT Examples ... 683 44.4.1 Internet Access Only ... 683 44.4.2 Example 2: Internet Access with a Default Server ... 685 44.4.3 Example 3: Multiple Public IP Addresses With Inside Servers ... 685 44.4.4 Example 4: NAT Unfriendly Application Programs ...
Page 26 Table of Contents 48.3.2 Console Port Speed ... 716 48.4 Log and Trace ... 717 48.4.1 Viewing Error Log ... 717 48.4.2 Syslog Logging ... 718 48.4.3 Call-Triggering Packet ... 721 48.5 Diagnostic ... 722 48.5.1 WAN DHCP ... 723 Chapter 49 Firmware and Configuration File Maintenance ...
Page 27 50.2.1 Budget Management ... 740 50.2.2 Call History ... 741 50.3 Time and Date Setting ... 742 Chapter 51 Remote Management... 745 51.1 Remote Management ... 745 51.1.1 Remote Management Limitations ... 747 Chapter 52 IP Policy Routing ... 749 52.1 IP Routing Policy Summary ...
Page 28 Table of Contents Appendix C Wireless LANs ... 787 Appendix D Windows 98 SE/Me Requirements for Anti-Virus Message Display ... 801 Appendix E Legal Information ... 805 Appendix F Customer Support ... 809 Index... 815 ZyWALL 5/35/70 Series User’s Guide...
Page 29: List Of Figures
List of Figures List of Figures Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem ... 52 Figure 2 VPN Application ... 53 Figure 3 3G WAN Application ... 53 Figure 4 Attaching Rubber Feet ... 56 Figure 5 Attaching Mounting Brackets and Screws ... 57 Figure 6 Rack Mounting ...
Page 30 List of Figures Figure 39 VPN Wizard Setup Complete ... 104 Figure 40 Anti-Spam Wizard: Email Server Location Setting ... 105 Figure 41 Anti-Spam Wizard: Direction Recommendations ... 106 Figure 42 Anti-Spam Wizard: Direction Configuration ... 107 Figure 43 Anti-Spam Wizard: Setup Complete ... 108 Figure 44 Dynamic VPN Rule Example ...
Page 31 List of Figures Figure 82 LAN and WAN ... 149 Figure 83 NETWORK > LAN ... 153 Figure 84 NETWORK > LAN > Static DHCP ... 156 Figure 85 Physical Network & Partitioned Logical Networks ... 157 Figure 86 NETWORK > LAN > IP Alias ... 157 Figure 87 NETWORK >...
Page 32 List of Figures Figure 125 WLAN Port Role Example ... 226 Figure 126 NETWORK > WLAN > Port Roles ... 227 Figure 127 NETWORK > WLAN > Port Roles: Change Complete ... 227 Figure 128 WLAN Overview ... 229 Figure 129 ZyWALL Wireless Security Levels ... 230 Figure 130 WIRELESS >...
Page 33 List of Figures Figure 168 SECURITY > IDP > Signature: Query View ... 285 Figure 169 SECURITY > IDP > Signature: Query by Partial Name ... 287 Figure 170 SECURITY > IDP > Signature: Query by Complete ID ... 288 Figure 171 Signature Query by Attribute.
Page 34 List of Figures Figure 211 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy ... 368 Figure 212 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy > Port Forwarding ... 373 Figure 213 SECURITY > VPN > VPN Rules (IKE) > Move Network Policy ... 374 Figure 214 SECURITY >...
Page 35 List of Figures Figure 254 Multiple Servers Behind NAT Example ... 442 Figure 255 Port Translation Example ... 443 Figure 256 ADVANCED > NAT > Port Forwarding ... 444 Figure 257 Trigger Port Forwarding Process: Example ... 445 Figure 258 ADVANCED > NAT > Port Triggering ... 446 Figure 259 NAT Overview ...
Page 36 List of Figures Figure 297 SSL Client Authentication ... 502 Figure 298 Secure Web Configurator Login Screen ... 502 Figure 299 SSH Example 1: Store Host Key ... 503 Figure 300 SSH Example 2: Test ... 503 Figure 301 SSH Example 2: Log in ... 503 Figure 302 Secure FTP: Firmware Upload Example ...
Page 37 List of Figures Figure 340 MAINTENANCE > General Setup ... 586 Figure 341 MAINTENANCE > Password ... 587 Figure 342 MAINTENANCE > Time and Date ... 588 Figure 343 Synchronization in Process ... 590 Figure 344 Synchronization is Successful ... 590 Figure 345 Synchronization Fail ...
Page 38 List of Figures Figure 383 Menu 4: Internet Access Setup (Ethernet) ... 640 Figure 384 Internet Access Setup (PPTP) ... 642 Figure 385 Internet Access Setup (PPPoE) ... 643 Figure 386 Menu 5: DMZ Setup ... 645 Figure 387 Menu 5.1: DMZ Port Filter Setup ... 645 Figure 388 Menu 5: DMZ Setup ...
Page 39 List of Figures Figure 426 Example 3: Menu 11.1.2 ... 687 Figure 427 Example 3: Menu 15.1.1.1 ... 687 Figure 428 Example 3: Final Menu 15.1.1 ... 688 Figure 429 Example 3: Menu 15.2.1 ... 688 Figure 430 NAT Example 4 ... 689 Figure 431 Example 4: Menu 15.1.1.1: Address Mapping Rule ...
Page 40 List of Figures Figure 469 Restore Using FTP Session Example ... 732 Figure 470 System Maintenance: Restore Configuration ... 732 Figure 471 System Maintenance: Starting Xmodem Download Screen ... 732 Figure 472 Restore Configuration Example ... 732 Figure 473 Successful Restoration Confirmation Screen ... 733 Figure 474 Telnet Into Menu 24.7.1: Upload System Firmware ...
Page 41: List Of Tables
List of Tables List of Tables Table 1 ZyWALL Model Specific Features ... 52 Table 2 Front Panel Lights ... 59 Table 3 Title Bar: Web Configurator Icons ... 64 Table 4 Web Configurator HOME Screen in Router Mode ... 65 Table 5 Web Configurator HOME Screen in Bridge Mode ...
Page 42 List of Tables Table 39 Load Balancing: Weighted Round Robin ... 180 Table 40 Load Balancing: Spillover ... 181 Table 41 Private IP Address Ranges ... 182 Table 42 NETWORK > WAN > WAN (Ethernet Encapsulation) ... 184 Table 43 NETWORK > WAN > WAN (PPPoE Encapsulation) ... 187 Table 44 NETWORK >...
Page 43 List of Tables Table 82 SECURITY > IDP > Signature: Query View ... 285 Table 83 SECURITY > IDP > Anomaly ... 290 Table 84 SECURITY > IDP > Update ... 292 Table 85 SECURITY > ANTI-VIRUS > General ... 302 Table 86 SECURITY >...
Page 44 List of Tables Table 125 SECURITY > CERTIFICATES > Directory Servers ... 425 Table 126 SECURITY > CERTIFICATES > Directory Server > Add ... 426 Table 127 SECURITY > AUTH SERVER > Local User Database ... 430 Table 128 SECURITY > AUTH SERVER > RADIUS ... 430 Table 129 NAT Mapping Types ...
Page 45 List of Tables Table 168 REPORTS > Anti-Spam ... 549 Table 169 REPORTS > E-mail Report ... 552 Table 170 LOGS > View Log ... 556 Table 171 Log Description Example ... 557 Table 172 LOGS > Log Settings ... 559 Table 173 System Maintenance Logs ...
Page 46 List of Tables Table 211 Menu 1: General Setup (Bridge Mode) ... 614 Table 212 Menu 1.1: Configure Dynamic DNS ... 615 Table 213 Menu 1.1.1: DDNS Host Summary ... 616 Table 214 Menu 1.1.1: DDNS Edit Host ... 617 Table 215 MAC Address Cloning in WAN Setup ...
Page 47 List of Tables Table 254 System Maintenance Menu Syslog Parameters ... 718 Table 255 System Maintenance Menu Diagnostic ... 724 Table 256 Filename Conventions ... 726 Table 257 General Commands for GUI-based FTP Clients ... 728 Table 258 General Commands for GUI-based TFTP Clients ... 729 Table 259 Budget Management ...
Page 48 List of Tables ZyWALL 5/35/70 Series User’s Guide...
Page 49: Introduction
Introduction Getting to Know Your ZyWALL (51) Hardware Installation (55) Introducing the Web Configurator (61) Wizard Setup (87) Tutorials (109) Registration Screens (141)
Page 51: Getting To Know Your Zywall
H A P T E R Getting to Know Your ZyWALL This chapter introduces the main features and applications of the ZyWALL. ZyWALL Internet Security Appliance Overview The ZyWALL is loaded with security features including VPN, firewall, content filtering, anti- spam, IDP (Intrusion Detection and Prevention), anti-virus and certificates.
Page 52: Applications For The Zywall
Chapter 1 Getting to Know Your ZyWALL Chapter 55 on page 769 Table 1 ZyWALL Model Specific Features FEATURE Two WAN Ports 3G Card Supported Load Balancing Changing Port Roles between LAN and DMZ Changing Port Roles between LAN and WLAN Table Key: A Y in a model’s column shows that the model has the specified feature.
Page 53: Vpn Application
1.3.2 VPN Application ZyWALL VPN is an ideal cost-effective way to securely connect branch offices, business partners and telecommuters over the Internet without the need (and expense) for leased lines between sites. Figure 2 VPN Application 1.3.3 3G WAN Application (ZyWALL 5 Only) Insert a 3G card to have the ZyWALL (in router mode) wirelessly access the Internet via a 3G base station.
Page 54: Ways To Manage The Zywall
Chapter 1 Getting to Know Your ZyWALL 1.4 Ways to Manage the ZyWALL Use any of the following methods to manage the ZyWALL. • Web Configurator. This is recommended for everyday management of the ZyWALL using a (supported) web browser. •...
Page 55: Hardware Installation
H A P T E R The ZyWALL can be placed on a desktop or rack-mounted on a standard EIA rack. Use the brackets in a rack-mounted installation. 2.1 General Installation Instructions Read all the safety warnings in the beginning of this User's Guide before you begin and make sure you follow them.
Page 56: Rack-Mounted Installation Requirements
Chapter 2 Hardware Installation Figure 4 Attaching Rubber Feet Do not block the ventilation holes. Leave space between ZyWALLs when stacking. 2.3 Rack-mounted Installation Requirements The ZyWALL can be mounted on an EIA standard size, 19-inch rack or in a wiring closet with other equipment.
Page 57: Rack-Mounted Installation
2.4 Rack-Mounted Installation 1 Align one bracket with the holes on one side of the ZyWALL and secure it with the bracket screws (smaller than the rack-mounting screws). 2 Attach the other bracket in a similar fashion. Figure 5 Attaching Mounting Brackets and Screws 3 After attaching both mounting brackets, position the ZyWALL in the rack by lining up the holes in the brackets with the appropriate holes on the rack.
Page 58: Card, Wlan Card And Zywall Turbo Card Installation
Chapter 2 Hardware Installation 2.5 3G Card, WLAN Card and ZyWALL Turbo Card Installation Do not insert or remove a card with the ZyWALL turned on. Make sure the ZyWALL is off before inserting or removing an 802.11b/g-compliant wireless LAN PCMCIA or CardBus card, 3G card or ZyWALL Turbo Card (to avoid damage). Slide the connector end of the card into the slot as shown next.
Page 59: Front Panel Lights
2.6 Front Panel Lights Figure 8 ZyWALL 70 Front Panel Figure 9 ZyWALL 35 Front Panel Figure 10 ZyWALL 5 Front Panel The following table describes the lights. Table 2 Front Panel Lights COLOR Green Green Green CARD Green LAN 10/100 (ZyWALL 70 Green only)
Page 60 Chapter 2 Hardware Installation Table 2 Front Panel Lights (continued) COLOR WAN1/2 10/ Green WAN 10/100 Orange DMZ 10/100 (ZyWALL 70 Green only) Orange LAN/DMZ 10/ Green (ZyWALL 35 and ZyWALL 5) Orange STATUS DESCRIPTION The WAN connection is not ready, or has failed. The ZyWALL has a successful 10 Mbps WAN connection.
Page 61: Introducing The Web Configurator
H A P T E R This chapter describes how to access the ZyWALL web configurator and provides an overview of its screens. 3.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy ZyWALL setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions.
Page 62: Figure 11 Change Password Screen
Chapter 3 Introducing the Web Configurator 5 You should see a screen asking you to change your password (highly recommended) as shown next. Type a new password (and retype it to confirm) and click Apply or click Ignore. Figure 11 Change Password Screen 6 Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device.
Page 63: Resetting The Zywall
3.3 Resetting the ZyWALL If you forget your password or cannot access the web configurator, you will need to reload the factory-default configuration file or use the RESET button on the back of the ZyWALL. Uploading this configuration file replaces the current configuration file with the factory- default configuration file.
Page 64: Navigating The Zywall Web Configurator
Chapter 3 Introducing the Web Configurator 3.4 Navigating the ZyWALL Web Configurator The following summarizes how to navigate the web configurator from the HOME screen. This guide uses the ZyWALL 70 screenshots as an example. The screens may vary slightly for different ZyWALL models.
Page 65: Main Window
3.4.2 Main Window The main window shows the screen you select in the navigation panel. It is discussed in more detail in the rest of this document. Right after you log in, the HOME screen is displayed. The screen varies according to the device mode you select in the MAINTENANCE >...
Page 66 Chapter 3 Introducing the Web Configurator Table 4 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION System Name This is the System Name you enter in the MAINTENANCE > General screen. It is for identification purposes. Click the field label to go to the screen where you can specify a name for this ZyWALL.
Page 67 Table 4 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Status For the LAN, DMZ and WLAN ports, this displays the port speed and duplex setting. Ethernet port connections can be in half-duplex or full-duplex mode. Full- duplex refers to a device's ability to send and receive simultaneously, while half- duplex indicates that traffic can flow in only one direction at a time.
Page 68 Chapter 3 Introducing the Web Configurator Table 4 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Virus Detected This displays how many virus-infected files the ZyWALL has detected since it last started up. It also displays the percentage of virus-infected files out of the total number of files that the ZyWALL has scanned (since it last started up).
Page 69 Table 4 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Last Connection This displays how long the 3G connection has been up. Up Time Tx Bytes This displays the total number of data frames transmitted. Rx Bytes This displays the total number of data frames received. 3G Card This displays the manufacturer of your 3G card.
Page 70 Chapter 3 Introducing the Web Configurator Table 4 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Disable budget This field displays if you have enabled budget control but insert a 3G card with a control different user account from the one for which you configured budget control. Select this option to disable budget control.
Page 71: Home Screen: Bridge Mode
3.4.4 HOME Screen: Bridge Mode The following screen displays when the ZyWALL is set to bridge mode. In bridge mode, the ZyWALL functions as a transparent firewall (also known as a bridge firewall). The ZyWALL bridges traffic traveling between the ZyWALL's interfaces and still filters and inspects packets.
Page 72 Chapter 3 Introducing the Web Configurator Table 5 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION Bootbase This is the bootbase version and the date created. Version Firmware This is the ZyNOS Firmware version and the date created. ZyNOS is ZyXEL's Version proprietary Network Operating System design.
Page 73 Table 5 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION Bridge Hello This is the interval of BPDUs (Bridge Protocol Data Units) from the root bridge. Time Bridge Max Age This is the predefined interval that a bridge waits to get a Hello message (BPDU) from the root bridge.
Page 74: Navigation Panel
Chapter 3 Introducing the Web Configurator Table 5 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION Spam Mail This displays how many spam e-mails the ZyWALL has detected since it last Detected started up. It also displays the percentage of spam e-mail out of the total number of e-mails that the ZyWALL has scanned (since it last started up).
Page 75: Table 7 Screens Summary
Table 6 Bridge and Router Mode Features Comparison FEATURE Bridge WLAN Wireless Card Firewall Anti-Virus Anti-Spam Content Filter Certificates Authentication Server Static Route Policy Route Bandwidth Management Remote Management UPnP Custom Application Reports Logs Maintenance Table Key: A Y in a mode’s column shows that the device mode has the specified feature. The information in this table was correct at the time of writing, although it may be subject to change.
Page 76 Chapter 3 Introducing the Web Configurator Table 7 Screens Summary (continued) LINK Static DHCP IP Alias Port Roles (ZyWALL 5 and ZyWALL BRIDGE Bridge Port Roles General WAN1 WAN2 3G (WAN2) Traffic Redirect Dial Backup Static DHCP IP Alias Port Roles WLAN WLAN Static DHCP...
Page 77 Table 7 Screens Summary (continued) LINK FIREWALL Default Rule Rule Summary This screen shows a summary of the firewall rules, and allows you Anti-Probing Threshold Service General Signature Anomaly Update Backup & Restore ANTI-VIRUS General Signature Update Backup & Restore ANTI-SPAM General External DB...
Page 78 Chapter 3 Introducing the Web Configurator Table 7 Screens Summary (continued) LINK CERTIFICATES My Certificates Use this screen to view a summary list of certificates and manage Trusted CAs Trusted Remote Hosts Directory Servers AUTH SERVER Local User Database RADIUS ADVANCED NAT Overview Address...
Page 79 Table 7 Screens Summary (continued) LINK REMOTE MGMT TELNET SNMP UPnP UPnP Ports Custom APP Custom APP REPORTS Reports Anti-Virus Anti-Spam E-mail Report LOGS View Log Log Settings ZyWALL 5/35/70 Series User’s Guide Chapter 3 Introducing the Web Configurator FUNCTION Use this screen to configure through which interface(s) and from which IP address(es) users can use HTTPS or HTTP to manage the ZyWALL.
Page 80: Port Statistics
Chapter 3 Introducing the Web Configurator Table 7 Screens Summary (continued) LINK MAINTENANCE General Password Time and Date Use this screen to change your ZyWALL’s time and date. Device Mode F/W Upload Backup & Restore Restart Diagnosis LOGOUT 3.4.6 Port Statistics Click Port Statistics in the HOME screen.
Page 81: Show Statistics: Line Chart
Table 8 HOME > Port Statistics (continued) LABEL DESCRIPTION Status For the WAN interface(s) and the Dial Backup port, this displays the port speed and duplex setting if you’re using Ethernet encapsulation or the remote node name for a PPP connection and Down (line is down or not connected), Idle (line (ppp) idle), Dial (starting to trigger a call) or Drop (dropping a call) if you’re using PPPoE encapsulation.
Page 82: Dhcp Table
Chapter 3 Introducing the Web Configurator The following table describes the labels in this screen. Table 9 HOME > Show Statistics > Line Chart LABEL DESCRIPTION Click the icon to go back to the Show Statistics screen. Port Select the check box(es) to display the throughput statistics of the corresponding interface(s).
Page 83: Vpn Status
Table 10 HOME > Show DHCP Table (continued) LABEL DESCRIPTION MAC Address The MAC (Media Access Control) or Ethernet address on a LAN (Local Area Network) is unique to your computer (six pairs of hexadecimal notation). A network interface card such as an Ethernet adapter has a hardwired address that is assigned at the factory.
Page 84: Bandwidth Monitor
Chapter 3 Introducing the Web Configurator Table 11 HOME > VPN Status LABEL DESCRIPTION IPSec Algorithm This field displays the security protocols used for an SA. Both AH and ESP increase ZyWALL processing requirements and communications latency (delay). Automatic Select a number of seconds or None from the drop-down list box to update all Refresh Interval screen statistics automatically at the end of every time interval or to not update the screen statistics.
Page 85 Table 12 ADVANCED > BW MGMT > Monitor LABEL Automatic Refresh Interval Refresh A. If you allocate all the root class’s bandwidth to the bandwidth classes, the default class still displays a budget of 2 kbps (the minimum amount of bandwidth that can be assigned to a bandwidth class). ZyWALL 5/35/70 Series User’s Guide Chapter 3 Introducing the Web Configurator DESCRIPTION...
Page 86 Chapter 3 Introducing the Web Configurator ZyWALL 5/35/70 Series User’s Guide...
Page 87: Wizard Setup
H A P T E R This chapter provides information on the Wizard Setup screens in the web configurator. The Internet access wizard is only applicable when the ZyWALL is in router mode. 4.1 Wizard Setup Overview The web configurator's setup wizards help you configure Internet and VPN connection settings.
Page 88: Internet Access
Chapter 4 Wizard Setup 4.2 Internet Access The Internet access wizard screen has three variations depending on what encapsulation type you use. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you don’t have that information. 4.2.1 ISP Parameters The ZyWALL offers three choices of encapsulation.
Page 89: Figure 24 Isp Parameters: Pppoe Encapsulation
Table 13 ISP Parameters: Ethernet Encapsulation LABEL DESCRIPTION IP Address Select Dynamic If your ISP did not assign you a fixed IP address. This is the Assignment default selection. Select Static If the ISP assigned a fixed IP address. The fields below are available only when you select Static. My WAN IP Enter your WAN IP address in this field.
Page 90: Table 14 Isp Parameters: Pppoe Encapsulation
Chapter 4 Wizard Setup The following table describes the labels in this screen. Table 14 ISP Parameters: PPPoE Encapsulation LABEL DESCRIPTION ISP Parameter for Internet Access Encapsulation Choose an encapsulation method from the pull-down list box. PPP over Ethernet forms a dial-up connection. Service Name Type the name of your service provider.
Page 91: Figure 25 Isp Parameters: Pptp Encapsulation
Figure 25 ISP Parameters: PPTP Encapsulation The following table describes the labels in this screen. Table 15 ISP Parameters: PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down list box. To configure a PPTP client, you must configure the User Name and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 92: Internet Access Wizard: Second Screen
Chapter 4 Wizard Setup Table 15 ISP Parameters: PPTP Encapsulation LABEL WAN IP Address Assignment IP Address Assignment My WAN IP Address First DNS Server Second DNS Server Back Apply 4.2.2 Internet Access Wizard: Second Screen Click Next to go to the screen where you can register your ZyWALL and activate the free content filtering, anti-spam, anti-virus and IDP trial applications.
Page 93: Internet Access Wizard: Registration
Figure 27 Internet Access Setup Complete 4.2.3 Internet Access Wizard: Registration If you clicked Next in the previous screen (see displays. Use this screen to register the ZyWALL with myZyXEL.com. You must register your ZyWALL before you can activate trial applications of services like content filtering, anti- spam, anti-virus and IDP.
Page 94: Internet Access Wizard: Status
Chapter 4 Wizard Setup The following table describes the labels in this screen. Table 16 Internet Access Wizard: Registration LABEL Device Registration New myZyXEL.com account Existing myZyXEL.com account User Name Check Password Confirm Password E-Mail Address Country Back Next After you fill in the fields and click Next, the following screen shows indicating the registration is in progress.
Page 95: Internet Access Wizard: Service Activation
Figure 30 Internet Access Wizard: Status A screen similar to the following appears if the registration was not successful. Click Return to go back to the Device Registration screen and check your settings. Figure 31 Internet Access Wizard: Registration Failed 4.2.5 Internet Access Wizard: Service Activation If the ZyWALL has been registered, the Device Registration screen is read-only and the Service Activation screen appears indicating what trial applications are activated after you...
Page 96: Vpn Wizard Gateway Setting
Chapter 4 Wizard Setup Figure 33 Internet Access Wizard: Activated Services 4.3 VPN Wizard Gateway Setting Use this screen to name the VPN gateway policy (IKE SA) and identify the IPSec routers at either end of the VPN tunnel. Click VPN Setup in the Wizard Setup Welcome screen VPN configuration wizard.
Page 97: Vpn Wizard Network Setting
Table 17 VPN Wizard: Gateway Setting LABEL DESCRIPTION My ZyWALL When the ZyWALL is in router mode, enter the WAN IP address or the domain name of your ZyWALL or leave the field set to 0.0.0.0. The following applies if the My ZyWALL field is configured as 0.0.0.0: When the WAN interface operation mode is set to Active/Passive, the ZyWALL uses the IP address (static or dynamic) of the WAN interface that is in use.
Page 98: Figure 35 Vpn Wizard: Network Setting
Chapter 4 Wizard Setup Figure 35 VPN Wizard: Network Setting The following table describes the labels in this screen. Table 18 VPN Wizard: Network Setting LABEL DESCRIPTION Network Policy Property Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 99: Vpn Wizard Ike Tunnel Setting (Ike Phase 1)
Table 18 VPN Wizard: Network Setting LABEL DESCRIPTION Starting IP When the Remote Network field is configured to Single, enter a (static) IP address Address on the network behind the remote IPSec router. When the Remote Network field is configured to Range IP, enter the beginning (static) IP address, in a range of computers on the network behind the remote IPSec router.
Page 100: Vpn Wizard Ipsec Setting (Ike Phase 2)
Chapter 4 Wizard Setup The following table describes the labels in this screen. Table 19 VPN Wizard: IKE Tunnel Setting LABEL Negotiation Mode Encryption Algorithm Authentication Algorithm Key Group SA Life Time (Seconds) Pre-Shared Key Back Next 4.6 VPN Wizard IPSec Setting (IKE Phase 2) Use this screen to specify the authentication, encryption and other settings needed to negotiate a phase 2 IPSec SA.
Page 101: Figure 37 Vpn Wizard: Ipsec Setting
Figure 37 VPN Wizard: IPSec Setting The following table describes the labels in this screen. Table 20 VPN Wizard: IPSec Setting LABEL DESCRIPTION Encapsulation Mode Tunnel is compatible with NAT, Transport is not. Tunnel mode encapsulates the entire IP packet to transmit it securely. A Tunnel mode is required for gateway services to provide access to internal systems.
Page 102: Vpn Wizard Status Summary
Chapter 4 Wizard Setup Table 20 VPN Wizard: IPSec Setting (continued) LABEL Perfect Forward Secret (PFS) Back Next 4.7 VPN Wizard Status Summary This read-only screen shows the status of the current VPN setting. Use the summary table to check whether what you have configured is correct. Figure 38 VPN Wizard: VPN Status DESCRIPTION Perfect Forward Secrecy (PFS) is disabled (None) by default in phase 2 IPSec...
Page 103: Table 21 Vpn Wizard: Vpn Status
The following table describes the labels in this screen. Table 21 VPN Wizard: VPN Status LABEL DESCRIPTION Gateway Policy Property Name This is the name of this VPN gateway policy. Gateway Policy Setting My ZyWALL This is the WAN IP address or the domain name of your ZyWALL in router mode or the ZyWALL’s IP address in bridge mode.
Page 104: Vpn Wizard Setup Complete
Chapter 4 Wizard Setup Table 21 VPN Wizard: VPN Status (continued) LABEL IPSec Protocol Encryption Algorithm Authentication Algorithm SA Life Time (Seconds) Perfect Forward Secret (PFS) Back Finish 4.8 VPN Wizard Setup Complete Congratulations! You have successfully set up the VPN rule for your ZyWALL. If you already had VPN rules configured, the wizard adds the new VPN rule after the last existing VPN rule.
Page 105: Anti-Spam Wizard: Direction Recommendations
Figure 40 Anti-Spam Wizard: Email Server Location Setting The following table describes the labels in this screen. Table 22 Anti-Spam Wizard: Email Server Location Setting LABEL DESCRIPTION Intranet These are the networks directly connected to the ZyWALL. • Select WLAN if you have an e-mail server(s) connected to the ZyWALL’s WLAN. •...
Page 106: Anti-Spam Wizard: Direction Configuration
Chapter 4 Wizard Setup Figure 41 Anti-Spam Wizard: Direction Recommendations • For e-mail servers on the LAN, DMZ, or WLAN the ZyWALL recommends checking traffic that comes from the WAN to the zone(s) where the e-mail server is located. This is to check for spam coming to the ZyWALL’s e-mail server from outside e-mail servers.
Page 107: Figure 42 Anti-Spam Wizard: Direction Configuration
Figure 42 Anti-Spam Wizard: Direction Configuration The following table describes the labels in this screen. Table 23 Anti-Spam Wizard: Direction Configuration LABEL Enable Anti-Spam From, To ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Select this check box to check traffic for spam SMTP (TCP port 25 and POP3 (TCP port 110) e-mail.
Page 108: Anti-Spam Wizard: Setup Complete
Chapter 4 Wizard Setup Table 23 Anti-Spam Wizard: Direction Configuration LABEL Back Next 4.12 Anti-Spam Wizard: Setup Complete Congratulations! You have successfully set up the directions that the anti-spam feature checks for spam. This does not enable the anti-spam feature. Go to the SECURITY > ANTI-SPAM screens to enable anti-spam.
Page 109: Tutorials
H A P T E R This chapter gives examples of how to configure some of your ZyWALL’s key features. See the related chapter on a feature for more details. 5.1 Dynamic VPN Rule Configuration Dynamic VPN rules allow VPN connections from IPSec routers with dynamic WAN IP addresses.
Page 110: Configure Bob's User Account
Chapter 5 Tutorials Table 24 Dynamic VPN Rule Tutorial Settings FIELD Local Network (network behind the local ZyWALL) Note: Use static IP addresses or static DHCP to make sure the computers behind the ZyWALLs always use these IP addresses. Remote Network (network behind the peer ZyWALL) Pre-Shared Key (password) Extended Authentication Extended Authentication Username and Password...
Page 111 Chapter 5 Tutorials 1 Click SECURITY > VPN > VPN Rules (IKE), and then the add gateway policy ( icon to display the Edit Gateway Policy screen. Use this screen to configure the VPN gateway policy that identifies the ZyWALLs. The company’s ZyWALL (A) and the telecommuter’s ZyWALL (B) gateway policy edit screens are shown next.
Page 112: Figure 45 Vpn Gateway Policy Edit Screens
Chapter 5 Tutorials Figure 45 VPN Gateway Policy Edit Screens Remote Device (B) Company Device (A) 2 After you click Apply, the A-B_Gateways gateway policy displays as shown next. Click SECURITY > VPN and the A-B_Gateways’ add network policy ( ) icon.
Page 113: Figure 46 Security > Vpn > Add Network Policy (Zywall A)
Chapter 5 Tutorials Figure 46 SECURITY > VPN > Add Network Policy (ZyWALL A) 3 Edit the VPN-Network Policy -Edit screen to configure network policies. A network policy identifies the devices behind the IPSec routers at either end of a VPN tunnel and specifies the authentication, encryption and other settings needed to negotiate a phase 2 IPSec SA.
Page 114: Figure 47 Vpn Network Policy Edit Screens
Chapter 5 Tutorials Figure 47 VPN Network Policy Edit Screens Company Device (A) Telecommuter Device (B) ZyWALL 5/35/70 Series User’s Guide...
Page 115: Figure 48 Activate Vpn Rule (Zywall B)
4 After you click Apply, the network policy displays with the gateway policy. 5 In the ZyWALL B, select "X-Y_Networks" in the Activating VPN Rule field to activate the VPN rule. The color of "X-Y_Networks" VPN policy changes to pink. Figure 48 Activate VPN Rule (ZyWALL B) 6 Review the settings on both ZyWALLs as shown next.
Page 116: Configure Zero Configuration Mode On Zywall B
Chapter 5 Tutorials Figure 49 Tutorial: VPN Summary Screens Comparison Example Company Device (A) Telecommuter Device (B) You have configured the company’s ZyWALL (A) and the telecommuter’s ZyWALL (B). 5.1.3 Configure Zero Configuration Mode on ZyWALL B The ZyWALL P1’s zero configuration mode provides a simplified user mode for the web configurator interface.
Page 117: Testing Your Vpn Configuration
3 Select Zero Configuration Mode. 4 Click Apply. The system reboots automatically and restarts in zero configuration mode. 5.1.4 Testing Your VPN Configuration Test the VPN configuration before giving the ZyWALL P1 to Bob. 1 ZyWALL A should already be connected to the Internet using it’s public WAN IP address.
Page 118: Figure 51 Telecommuter Pinging A Network X Ip Address Example
Chapter 5 Tutorials 3 Open a web browser (like Internet Explorer) to connect to the ZyWALL P1’s LAN IP address (http://192.168.167.1 in this example). 4 The user mode screen for VPN authentication displays. Enter the user name "SalesManager" and password "Manager1234". Click Activate. 5 ZyWALL B automatically initiates and negotiates the VPN tunnel with ZyWALL A after you pass the authentication.
Page 119: Using The Dynamic Vpn Rule For More Vpn Tunnels
When you can ping IP address 10.0.0.2 from the computer with IP address 192.168.167.2 behind ZyWALL B, you know the VPN tunnel works. 5.1.5 Using the Dynamic VPN Rule for More VPN Tunnels Other remote users (like sales people and telecommuters) using IPSec routers with dynamic WAN IP addresses can also use the same gateway and network policy on ZyWALL A.
Page 120: Idp For From Vpn Traffic Example
Chapter 5 Tutorials The security settings apply to VPN traffic going to or from the ZyWALL’s VPN tunnels. They do not apply to other VPN traffic for which the ZyWALL is not one of the gateways (VPN pass-through traffic). You can turn on content filtering for all of the ZyWALL’s VPN traffic (regardless of its direction of travel).
Page 121: Idp For To Vpn Traffic Example
Figure 54 IDP Configuration for Traffic From VPN 5.2.2 IDP for To VPN Traffic Example You can also apply security settings to the To VPN packet direction to protect the remote networks from attacks, intrusions, viruses and spam originating from your own network. For example, you can use IDP to protect the remote networks from intrusions that might come in through your ZyWALL’s VPN tunnels.
Page 122: Firewall Rule For Vpn Example
Chapter 5 Tutorials 1 Click SECURITY > IDP > General. 2 Select the To VPN column’s first check box (with the interface label) to select all of the To VPN packet directions. 3 Click Apply. Figure 56 IDP Configuration for To VPN Traffic 5.3 Firewall Rule for VPN Example The firewall provides even more fine-tuned control for VPN tunnels.
Page 123: Configuring The Vpn Rule
Figure 57 Firewall Rule for VPN 5.3.1 Configuring the VPN Rule This section shows how to configure a VPN rule on device A to let the network behind B access the FTP server. You would also have to configure a corresponding rule on device B. 1 Click Security >...
Page 124: Figure 59 Security > Vpn > Vpn Rules (Ike)> Add Gateway Policy
Chapter 5 Tutorials Figure 59 SECURITY > VPN > VPN Rules (IKE)> Add Gateway Policy 3 Click the Add Network Policy icon. ZyWALL 5/35/70 Series User’s Guide...
Page 125: Figure 60 Security > Vpn > Vpn Rules (Ike): With Gateway Policy Example
Figure 60 SECURITY > VPN > VPN Rules (IKE): With Gateway Policy Example 4 Use this screen to specify which computers behind the routers can use the VPN tunnel. Configure the fields that are circled as follows and click Apply. You may notice that the example does not specify the port numbers.
Page 126: Figure 61 Security > Vpn > Vpn Rules (Ike)> Add Network Policy
Chapter 5 Tutorials Figure 61 SECURITY > VPN > VPN Rules (IKE)> Add Network Policy ZyWALL 5/35/70 Series User’s Guide...
Page 127: Configuring The Firewall Rules
5.3.2 Configuring the Firewall Rules Suppose you have several VPN tunnels but you only want to allow device B’s network to access the FTP server. You also only want FTP traffic to go to the FTP server, so you want to block all other traffic types (like chat, e-mail, web and so on).
Page 128: Figure 63 Security > Firewall > Rule Summary > Edit: Allow
Chapter 5 Tutorials Figure 63 SECURITY > FIREWALL > Rule Summary > Edit: Allow 5 The rule displays in the summary list of VPN to LAN firewall rules. ZyWALL 5/35/70 Series User’s Guide...
Page 129: Figure 64 Security > Firewall > Rule Summary: Allow
Figure 64 SECURITY > FIREWALL > Rule Summary: Allow 5.3.2.2 Default Firewall Rule to Block Other Access Example Now you configure the default firewall rule to block all VPN to LAN traffic. This blocks any other types of access from VPN tunnels to the LAN FTP server. This means that you need to configure more firewall rules if you want to allow any other VPN tunnels to access the LAN.
Page 130: How To Set Up A 3G Wan Connection
Chapter 5 Tutorials Figure 65 SECURITY > FIREWALL > Default Rule: Block From VPN To LAN 5.4 How to Set up a 3G WAN Connection This section shows you how to configure and set up a 3G WAN connection on the ZyWALL. In this example, you have set up WAN 1 and want the ZyWALL to use both of the WAN interfaces (the physical WAN port and 3G card) for Internet access at the same time.
Page 131: Configuring 3G Wan Settings
2 If you have a wireless card or Turbo card in the ZyWALL, remove it. 3 Slide the connector end of the 3G card into the slot. 4 Connect the ZyWALL’s power. 5.4.2 Configuring 3G WAN Settings You should already have an activated user account and network access information from the service provider.
Page 132: Checking Wan Connections
Chapter 5 Tutorials 5.4.3 Checking WAN Connections 1 Go to the web configurator’s Home screen. 2 In the network status table, make sure the status for WAN 1 and WAN 2 is not Down and there is an IP address. If the WAN 2 connection is not up, make sure you have entered the correct information in the NETWORK >...
Page 133: Configuring Content Filtering
Figure 68 Tutorial: NETWORK > WAN > General 5.6 Configuring Content Filtering You can use the ZyWALL’s content filtering policies to apply specific content filtering settings to specific users. You can even filter certain things at certain times. For example, you decide to set the default policy to block access to several categories of web content including things like pornography, hacking, nudity, and arts and entertainment, and so on.
Page 134: Block Categories Of Web Content
Chapter 5 Tutorials Use the REGISTRATION screens (see account, register your device and activate the external content filtering service. 1 Click SECURITY > CONTENT FILTER. 2 Enable the content filter and external database content filtering. 3 Click Apply. Figure 69 SECURITY > CONTENT FILTER > General 5.6.2 Block Categories of Web Content Here is how to block access to web pages by category of content.
Page 135: Figure 70 Security > Content Filter > Policy
Figure 70 SECURITY > CONTENT FILTER > Policy 2 Select Active. 3 Select the categories to block. 4 Click Apply. Figure 71 SECURITY > CONTENT FILTER > Policy > External Database (Default) ZyWALL 5/35/70 Series User’s Guide Chapter 5 Tutorials...
Page 136: Assign Bob's Computer A Specific Ip Address
Chapter 5 Tutorials 5.6.3 Assign Bob’s Computer a Specific IP Address You will configure a content filtering policy for traffic from Bob’s computer’s IP address. Do the following to have the ZyWALL always give Bob’s computer the same IP address (192.168.1.33 in this example).
Page 137: Set The Content Filter Schedule
Figure 74 SECURITY > CONTENT FILTER > Policy > Insert 5.6.5 Set the Content Filter Schedule You want to let Bob access arts and entertainment web pages, but only during lunch. So you configure a schedule to only apply the Bob policy from 12:00 to 13:00. For the rest of the time, the ZyWALL applies the default content filter policy (which blocks access to arts and entertainment web pages).
Page 138: Block Categories Of Web Content For Bob
Chapter 5 Tutorials Figure 76 SECURITY > CONTENT FILTER > Policy > Schedule (Bob) 5.6.6 Block Categories of Web Content for Bob Now you select the categories of web pages to block Bob from accessing. 1 Click SECURITY > CONTENT FILTER > Policy and then the Bob policy’s external database icon.
Page 139: Figure 78 Security > Content Filter > Policy > External Database (Bob)
Chapter 5 Tutorials 3 Select the categories to block. This is very similar to Section 5.6.2 on page 134, except you do not select the arts and entertainment category. 4 Click Apply. Figure 78 SECURITY > CONTENT FILTER > Policy > External Database (Bob) ZyWALL 5/35/70 Series User’s Guide...
Page 140 Chapter 5 Tutorials ZyWALL 5/35/70 Series User’s Guide...
Page 141: Registration Screens
H A P T E R 6.1 Overview The registration screens let you activate and update your account with myZyXEL.com, allowing you access to subscription services required for the ZyWALL’s security features. 6.1.1 What You Can Do in the Registration Screens •...
Page 142: The Registration Screen
Chapter 6 Registration Screens IDP allows the ZyWALL to detect malicious or suspicious packets and respond immediately. Signatures This is the pattern of code used by a particular virus. The ZyWALL compares files with a database of signatures to identify possible viruses. The ID&P and anti-virus features use the same signature files on the ZyWALL to detect and scan for viruses.
Page 143: Figure 79 Registration > Registration
Figure 79 REGISTRATION > Registration The following table describes the labels in this screen. Table 25 REGISTRATION > Registration LABEL Device Registration New myZyXEL.com account Existing myZyXEL.com account User Name Check Password Confirm Password E-Mail Address Country Service Activation Content Filtering 1- month Trial Anti Spam 3-month Trial...
Page 144: The Service Screen
Chapter 6 Registration Screens Table 25 REGISTRATION > Registration LABEL Apply Reset If the ZyWALL is registered already, this screen is read-only and indicates whether trial services are activated. Use the Service screen to update your service subscription status. Figure 80 REGISTRATION > Registration: Registered Device 6.3 The Service Screen After you activate a trial, you can also use the Service screen to register and enter your iCard’s PIN number (license key).
Page 145: Figure 81 Registration > Service
Figure 81 REGISTRATION > Service The following table describes the labels in this screen. Table 26 REGISTRATION > Service LABEL Service Management Service Status Registration Type Expiration Day License Upgrade License Key Service License Refresh ZyWALL 5/35/70 Series User’s Guide DESCRIPTION This field displays the service name available on the ZyWALL.
Page 146 Chapter 6 Registration Screens ZyWALL 5/35/70 Series User’s Guide...
Page 147: Network
Network LAN Screens (149) Bridge Screens (161) WAN Screens (169) DMZ Screens (207) WLAN Screens (219) Wireless Screens (229)
Page 149: Lan Screens
H A P T E R 7.1 Overview A network is a shared communication system to which many computers are attached. The Local Area Network (LAN) includes the computers and networking devices in your home or office that you connect to the ZyWALL’s LAN ports. The Wide Area Network (WAN) is another network (most likely the Internet) that you connect to the ZyWALL’s WAN port.
Page 150: What You Need To Know About Lan
Chapter 7 LAN Screens • Use the IP Alias screen ZyWALL’s LAN ports. • Use the Port Roles screen ZyWALL. The Port Roles screen is available on the ZyWALL 5 and ZyWALL 35. 7.1.2 What You Need to Know About LAN IP Address and Subnet Mask Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.
Page 151 Regardless of your particular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assignment, please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466, Guidelines for Management of IP Address Space. MAC Address Every Ethernet device has a unique MAC (Media Access Control) address.
Page 152: The Lan Screen
Chapter 7 LAN Screens Multicast Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1. IGMP (Internet Group Management Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data.
Page 153: Figure 83 Network > Lan
Figure 83 NETWORK > LAN The following table describes the labels in this screen. Table 27 NETWORK > LAN LABEL DESCRIPTION LAN TCP/IP IP Address Type the IP address of your ZyWALL in dotted decimal notation. 192.168.1.1 is the factory default. Alternatively, click the right mouse button to copy and/or paste the IP address.
Page 154 Chapter 7 LAN Screens Table 27 NETWORK > LAN (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported but RIP-2 carries more information.
Page 155: The Lan Static Dhcp Screen
Table 27 NETWORK > LAN (continued) LABEL DESCRIPTION Windows NetBIOS (Network Basic Input/Output System) are TCP or UDP packets that Networking enable a computer to connect to and communicate with a LAN. For some dial-up (NetBIOS over services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls. TCP/IP) However it may sometimes be necessary to allow NetBIOS packets to pass through to the WAN in order to find a computer on the WAN.
Page 156: The Lan Ip Alias Screen
Chapter 7 LAN Screens Figure 84 NETWORK > LAN > Static DHCP The following table describes the labels in this screen. Table 28 NETWORK > LAN > Static DHCP LABEL MAC Address IP Address Apply Reset 7.4 The LAN IP Alias Screen IP alias allows you to partition a physical network into different logical networks over the same Ethernet interface.
Page 157: Figure 85 Physical Network & Partitioned Logical Networks
Chapter 7 LAN Screens The ZyWALL has a single LAN interface. Even though more than one of ports 1~4 may be in the LAN port role, they are all still part of a single physical Ethernet interface and all use the same IP address.
Page 158: The Lan Port Roles Screen
Chapter 7 LAN Screens The following table describes the labels in this screen. Table 29 NETWORK > LAN > IP Alias LABEL Enable IP Alias 1, IP Address IP Subnet Mask RIP Direction RIP Version Apply Reset 7.5 The LAN Port Roles Screen Use the Port Roles screen to set ports as part of the LAN, DMZ and/or WLAN interface.
Page 159: Figure 87 Network > Lan > Port Roles
The radio buttons correspond to Ethernet ports on the front panel of the ZyWALL. On the ZyWALL 70, ports 1 to 4 are all DMZ ports by default. On the ZyWALL 5 or ZyWALL 35, ports 1 to 4 are all LAN ports by default. Your changes are also reflected in the DMZ Port Roles and WLAN Port Roles screens.
Page 160 Chapter 7 LAN Screens ZyWALL 5/35/70 Series User’s Guide...
Page 161: Bridge Screens
H A P T E R 8.1 Overview The ZyWALL can act as a bridge between a switch and a wired LAN or between two routers. This chapter describes how to configure bridge settings. This chapter is only applicable when the ZyWALL is in bridge mode.
Page 162: What You Need To Know About Bridging
Chapter 8 Bridge Screens 8.1.2 What You Need To Know About Bridging Bridge Loop Be careful to avoid bridge loops when you enable bridging in the ZyWALL. Bridge loops cause broadcast traffic to circle the network endlessly, resulting in possible throughput degradation and disruption of communications.
Page 163: The Bridge Screen
8.2 The Bridge Screen Select Bridge and click Apply in the MAINTENANCE > Device Mode screen to have the ZyWALL function as a bridge. You can use the firewall and VPN in bridge mode. See the user’s guide for a list of other features that are available in bridge mode.
Page 164: The Bridge Port Roles Screen
Chapter 8 Bridge Screens Table 31 NETWORK > Bridge (continued) LABEL First/Second/Third DNS Server Rapid Spanning Tree Protocol Setup Enable Rapid Spanning Tree Protocol Bridge Priority Bridge Hello Time Bridge Max Age Forward Delay Bridge Port RSTP Active RSTP Priority 0(Highest)~240(Lowest) RSTP Path Cost 1(Lowest)~65535(Highe...
Page 165: Figure 93 Network > Bridge > Port Roles
The radio buttons correspond to Ethernet ports on the front panel of the ZyWALL. On the ZyWALL 70, ports 1 to 4 are all DMZ ports by default. On the ZyWALL 5 or ZyWALL 35, ports 1 to 4 are all LAN ports by default. Figure 93 NETWORK >...
Page 166: Bridge Technical Reference
Chapter 8 Bridge Screens 8.4 Bridge Technical Reference STP Terminology The root bridge is the base of the spanning tree. Path cost is the cost of transmitting a frame from the root bridge to that port. It is assigned according to the speed of the link to which a port is attached.
Page 167: Table 34 Stp Port States
STP Port States STP assigns five port states (see next table) to eliminate packet looping. A bridge port is not allowed to go directly from blocking state to forwarding state so as to eliminate transient loops. Table 34 STP Port States PORT STATE DESCRIPTION Disabled...
Page 168 Chapter 8 Bridge Screens ZyWALL 5/35/70 Series User’s Guide...
Page 169: Wan Screens
H A P T E R 9.1 Overview This chapter discusses the ZyWALL’s WAN screens. Use these screens to configure your ZyWALL for Internet access. A WAN (Wide Area Network) connection is an outside connection to another network or the Internet.
Page 170: What You Can Do In The Wan Screens
Chapter 9 WAN Screens 9.1.1 What You Can Do in the WAN Screens • Use the General screen priority, and connection test settings for the ZyWALL. • Use the WAN 1 and 2 screens WAN2 interfaces for Internet access on the ZyWALL. •...
Page 171 You can use policy routing to specify the WAN interface that specific services go through. An ISP may give traffic from certain (more expensive) connections priority over the traffic from other accounts. You could route delay intolerant traffic (like voice over IP calls) through this kind of connection.
Page 172: Before You Begin
Chapter 9 WAN Screens Lets say that you have the WAN operation mode set to active/passive, meaning the ZyWALL uses the second highest priority WAN interface as a back up. The WAN 1 route has a metric of "2", the WAN 2 route has a metric of "3", the traffic-redirect route has a metric of "14" and the dial-backup route has a metric of "15".
Page 173: Configuring The General Screen
Figure 97 Incorrect WAN IP WAN 1 1 LAN user A wants to download a file from a remote server on the Internet. The ZyWALL is using active/active load balancing and sends the request to an update server (B) through WAN 1. 2 Update server B sends a file list to LAN user A.
Page 174: Figure 98 Network > Wan > General
Chapter 9 WAN Screens Figure 98 NETWORK > WAN > General ZyWALL 5/35/70 Series User’s Guide...
Page 175: Table 35 Network > Wan > General
The following table describes the labels in this screen. Table 35 NETWORK > WAN > General LABEL DESCRIPTION Active/Passive Select the Active/Passive (fail over) operation mode to have the ZyWALL use the (Fail Over) Mode second highest priority WAN interface as a back up. This means that the ZyWALL will normally use the highest priority (primary) WAN interface (depending on the priorities you configure in the Route Priority fields).
Page 176 Chapter 9 WAN Screens Table 35 NETWORK > WAN > General (continued) LABEL DESCRIPTION Check Fail Type how many WAN connection checks can fail (1-10) before the connection is Tolerance considered "down" (not connected). The ZyWALL still checks a "down" connection to detect if it reconnects.
Page 177: Configuring Load Balancing
Table 35 NETWORK > WAN > General (continued) LABEL DESCRIPTION Allow Trigger Dial Select this option to allow NetBIOS packets to initiate calls. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 9.2.2 Configuring Load Balancing To configure load balancing on the ZyWALL, click NETWORK >...
Page 178: Figure 100 Load Balancing: Least Load First
Chapter 9 WAN Screens Since WAN 2 has a smaller load balancing index (meaning that it is less utilized than WAN 1), the ZyWALL will send the subsequent new session traffic through WAN 2. Table 36 Least Load First: Example 1 INTERFACE WAN 1 WAN 2...
Page 179: Weighted Round Robin
The following table describes the related fields in this screen. Table 38 Load Balancing: Least Load First LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on Mode the ZyWALL. Load Balancing Set the load balancing method to Least Load First. Algorithm WAN Interface Select this option to have the ZyWALL send all of a local computer’s traffic through...
Page 180: Spillover
Chapter 9 WAN Screens Figure 101 Weighted Round Robin Algorithm Example To load balance using the weighted round robin method, select Weighted Round Robin in the Load Balancing Algorithm field. Figure 102 Load Balancing: Weighted Round Robin The following table describes the related fields in this screen. Table 39 Load Balancing: Weighted Round Robin LABEL DESCRIPTION...
Page 181: Figure 103 Spillover Algorithm Example
In cases where the primary WAN interface uses an unlimited access Internet connection and the secondary WAN uses a per-use timed access plan, the ZyWALL will only use the secondary WAN interface when the traffic load reaches the upper threshold on the primary WAN interface.
Page 182: The Wan1 And Wan2 Screen
Chapter 9 WAN Screens Table 40 Load Balancing: Spillover (continued) LABEL DESCRIPTION WAN Interface Select this option to have the ZyWALL send all of a local computer’s traffic through to Local Host the same WAN interface for the period of time that you specify (1 to 600 seconds). Mapping This is useful when a redirect server forwards a local user’s request for a file and Timeout...
Page 183: Wan Ethernet Encapsulation
Regardless of your particular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assignment, please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466, Guidelines for Management of IP Address Space. DNS Server Address Assignment Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa, for instance, the IP address of www.zyxel.com is 204.217.0.2.
Page 184: Figure 105 Network > Wan > Wan (Ethernet Encapsulation)
Chapter 9 WAN Screens Figure 105 NETWORK > WAN > WAN (Ethernet Encapsulation) The following table describes the labels in this screen. Table 42 NETWORK > WAN > WAN (Ethernet Encapsulation) LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 185 Table 42 NETWORK > WAN > WAN (Ethernet Encapsulation) (continued) LABEL DESCRIPTION Login Server IP Type the authentication server IP address here if your ISP gave you one. Address This field is not available for Telia Login. Login Server Type the domain name of the Telia login server, for example login1.telia.com. (Telia Login only) Relogin The Telia server logs the ZyWALL out if the ZyWALL does not log in periodically.
Page 186: Pppoe Encapsulation
Chapter 9 WAN Screens Table 42 NETWORK > WAN > WAN (Ethernet Encapsulation) (continued) LABEL DESCRIPTION Multicast Version Choose None (default), IGMP-V1 or IGMP-V2. IGMP (Internet Group Management Protocol) is a session-layer protocol used to establish membership in a Multicast group –...
Page 187: Figure 106 Network > Wan > Wan (Pppoe Encapsulation)
Figure 106 NETWORK > WAN > WAN (PPPoE Encapsulation) The following table describes the labels in this screen. Table 43 NETWORK > WAN > WAN (PPPoE Encapsulation) LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Select PPPoE for a dial-up connection using PPPoE. Service Name Type the PPPoE service name provided to you by your ISP.
Page 188 Chapter 9 WAN Screens Table 43 NETWORK > WAN > WAN (PPPoE Encapsulation) (continued) LABEL DESCRIPTION Nailed-Up Select Nailed-Up if you do not want the connection to time out. Idle Timeout This value specifies the time in seconds that elapses before the ZyWALL automatically disconnects from the PPPoE server.
Page 189: Pptp Encapsulation
Table 43 NETWORK > WAN > WAN (PPPoE Encapsulation) (continued) LABEL DESCRIPTION Spoof WAN MAC You can configure the WAN port's MAC address by either using the factory Address from assigned default MAC Address or cloning the MAC address of a computer on your LAN.
Page 190: Figure 107 Network > Wan > Wan (Pptp Encapsulation)
Chapter 9 WAN Screens Figure 107 NETWORK > WAN > WAN (PPTP Encapsulation) The following table describes the labels in this screen. Table 44 NETWORK > WAN > WAN (PPTP Encapsulation) LABEL ISP Parameters for Internet Access Encapsulation User Name Password Retype to Confirm DESCRIPTION...
Page 191 Table 44 NETWORK > WAN > WAN (PPTP Encapsulation) (continued) LABEL DESCRIPTION Authentication The ZyWALL supports PAP (Password Authentication Protocol) and CHAP Type (Challenge Handshake Authentication Protocol). CHAP is more secure than PAP; however, PAP is readily available on more platforms. Use the drop-down list box to select an authentication protocol for outgoing calls.
Page 192: The 3G (Wan2) Screen
Chapter 9 WAN Screens Table 44 NETWORK > WAN > WAN (PPTP Encapsulation) (continued) LABEL RIP Version Enable Multicast Multicast Version Spoof WAN MAC Address from LAN Clone the computer’s MAC address – IP Address Apply Reset 9.4 The 3G (WAN2) Screen Use this screen to configure your 3G (WAN2) settings.
Page 193 Chapter 9 WAN Screens The actual data rate you obtain varies depending the 3G card you use, the signal strength to the service provider’s base station, and so on. If the signal strength of a 3G network is too low, the 3G card may switch to an available 2.5G or 2.75G network.
Page 194: Figure 108 Network > Wan > 3G (Wan 2)
Chapter 9 WAN Screens Figure 108 NETWORK > WAN > 3G (WAN 2) The following table describes the labels in this screen. Table 45 NETWORK > WAN > 3G (WAN 2) LABEL DESCRIPTION Enable Select this option to enable WAN 2. 3G Card The fields below display only when you enable WAN 2.
Page 195 Table 45 NETWORK > WAN > 3G (WAN 2) (continued) LABEL DESCRIPTION Network Type Select the type of the network (UMTS/HSDPA only, GPRS/EDGE only, GSM all or WCDMA all) to which you want the card to connect. See for more information. Otherwise, select Automatically to have the card connect to an available network using the default settings on the 3G card.
Page 196 Chapter 9 WAN Screens Table 45 NETWORK > WAN > 3G (WAN 2) (continued) LABEL DESCRIPTION Idle Timeout This value specifies the time in seconds that elapses before the ZyWALL automatically disconnects from the ISP. WAN IP Address Assignment Get automatically Select this option If your ISP did not assign you a fixed IP address.
Page 197: The Traffic Redirect Screen
Table 45 NETWORK > WAN > 3G (WAN 2) (continued) LABEL DESCRIPTION Actions when Specify the actions the ZyWALL takes when the time or data limit is exceeded. over budget Select Log to create a log. Select Alert to create an alert. This option is available only when you select Log. If you select Log, you can also select recurring every to have the ZyWALL send a log (and alert if selected) for this event periodically.
Page 198: Configuring The Traffic Redirect Screen
Chapter 9 WAN Screens Figure 110 Traffic Redirect LAN Setup 9.6 Configuring the Traffic Redirect Screen To change your ZyWALL’s traffic redirect settings, click NETWORK > WAN > Traffic Redirect. The screen appears as shown. For the ZyWALL 5, if the traffic redirect feature does not work after you configure the ZyWALL’s traffic redirect settings in the Traffic Redirect screen, you may need to turn on the WAN ping check by entering sys rn pingDrop in the command interpreter.
Page 199: The Dial Backup Screen
9.7 The Dial Backup Screen Click NETWORK > WAN > Dial Backup to display the Dial Backup screen. Use this screen to configure the backup WAN dial-up connection. Not all fields are available on all models. Figure 112 NETWORK > WAN > Dial Backup ZyWALL 5/35/70 Series User’s Guide Chapter 9 WAN Screens...
Page 200: Table 47 Network > Wan > Dial Backup
Chapter 9 WAN Screens The following table describes the labels in this screen. Table 47 NETWORK > WAN > Dial Backup LABEL Dial Backup Setup Enable Dial Backup Select this check box to turn on dial backup. Basic Settings Login Name Password Retype to Confirm Authentication...
Page 201: The Advanced Modem Setup Screen
Table 47 NETWORK > WAN > Dial Backup (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). Choose RIP-1, RIP-2B or RIP-2M. RIP-1 is universally supported;...
Page 202: Configuring The Advanced Modem Setup Screen
Chapter 9 WAN Screens AT Command Strings For regular telephone lines, the default Dial string tells the modem that the line uses tone dialing. ATDT is the command for a switch that requires tone dialing. If your switch requires pulse dialing, change the string to ATDP. For ISDN lines, there are many more protocols and operational modes.
Page 203: Figure 113 Network > Wan > Dial Backup > Edit
Figure 113 NETWORK > WAN > Dial Backup > Edit The following table describes the labels in this screen. Table 48 NETWORK > WAN > Dial Backup > Edit LABEL DESCRIPTION AT Command Strings Dial Type the AT Command string to make a call. Drop Type the AT Command string to drop a call.
Page 204: Wan Technical Reference
Chapter 9 WAN Screens Table 48 NETWORK > WAN > Dial Backup > Edit (continued) LABEL DESCRIPTION Retry Interval Type a number of seconds for the ZyWALL to wait before trying another call after a (sec) call has failed. This applies before a phone number is blacklisted. Drop Timeout Type the number of seconds for the ZyWALL to wait before dropping the DTR (sec)
Page 205 Chapter 9 WAN Screens A. The International Telecommunication Union (ITU) is an international organization within which governments and the private sector coordinate global telecom networks and services. ZyWALL 5/35/70 Series User’s Guide...
Page 206 Chapter 9 WAN Screens ZyWALL 5/35/70 Series User’s Guide...
Page 207: Dmz Screens
H A P T E R 10.1 Overview The DeMilitarized Zone (DMZ) provides a way for public servers (Web, e-mail, FTP, etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death). These public servers can also still be accessed from the secure LAN.
Page 208: What You Need To Know About Dmz
Chapter 10 DMZ Screens 10.1.2 What You Need To Know About DMZ DMZ and Security It is highly recommended that you connect all of your public servers to the DMZ port(s). It is also highly recommended that you keep all sensitive information off of the public servers connected to the DMZ port.
Page 209: Dmz Private And Public Ip Address Example
Figure 115 DMZ Public Address Example 10.1.4 DMZ Private and Public IP Address Example The following figure shows a network setup with both private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected computers (A through C) use private IP addresses that are in one subnet.
Page 210: The Dmz Screen
Chapter 10 DMZ Screens Figure 116 DMZ Private and Public Address Example 10.2 The DMZ Screen Use this screen to configure TCP/IP, DHCP, IP/MAC binding and NetBIOS settings on the DMZ. The DMZ and the connected computers can have private or public IP addresses. When the DMZ uses public IP addresses, the WAN and DMZ ports must use public IP addresses that are on separate subnets.
Page 211: Figure 117 Network > Dmz
Figure 117 NETWORK > DMZ The following table describes the labels in this screen. Table 50 NETWORK > DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address Type the IP address of your ZyWALL’s DMZ port in dotted decimal notation. Note: Make sure the IP addresses of the LAN, WAN, WLAN and IP Subnet Mask The subnet mask specifies the network number portion of an IP address.
Page 212 Chapter 10 DMZ Screens Table 50 NETWORK > DMZ (continued) LABEL RIP Version Multicast DHCP Setup DHCP IP Pool Starting Address Pool Size DHCP Server Address DHCP WINS Server 1, 2 Filter (IP/MAC Binding Drop packets that do not match static IP or Dynamic IP/ MAC binding Exempt packets in...
Page 213: The Static Dhcp Screen
Table 50 NETWORK > DMZ (continued) LABEL DESCRIPTION Windows Networking (NetBIOS over TCP/IP) Allow between Select this check box to forward NetBIOS packets from the LAN to the DMZ and DMZ and LAN from the DMZ to the LAN. If your firewall is enabled with the default policy set to block DMZ to LAN traffic, you also need to configure a DMZ to LAN firewall rule that forwards NetBIOS traffic.
Page 214: The Ip Alias Screen
Chapter 10 DMZ Screens Figure 118 NETWORK > DMZ > Static DHCP The following table describes the labels in this screen. Table 51 NETWORK > DMZ > Static DHCP LABEL MAC Address IP Address Apply Reset 10.4 The IP Alias Screen Configure IP alias settings to partition a physical network into different logical networks over the same Ethernet interface.
Page 215: Figure 119 Network > Dmz > Ip Alias
To change your ZyWALL’s IP alias settings, click NETWORK > DMZ > IP Alias. The screen appears as shown. Figure 119 NETWORK > DMZ > IP Alias The following table describes the labels in this screen. Table 52 NETWORK > DMZ > IP Alias LABEL DESCRIPTION Enable IP Alias 1,...
Page 216: The Dmz Port Roles Screen
Chapter 10 DMZ Screens Table 52 NETWORK > DMZ > IP Alias (continued) LABEL Apply Reset 10.5 The DMZ Port Roles Screen Use the Port Roles screen to set ports as part of the LAN, DMZ and/or WLAN interface. Section 7.5 on page 158 To change your ZyWALL’s port role settings, click NETWORK >...
Page 217 Chapter 10 DMZ Screens ZyWALL 5/35/70 Series User’s Guide...
Page 218 Chapter 10 DMZ Screens ZyWALL 5/35/70 Series User’s Guide...
Page 219: Wlan Screens
H A P T E R 11.1 Overview A wireless LAN can be as simple as two computers with wireless LAN adapters communicating in a peer-to-peer network or as complex as a number of computers with wireless LAN adapters communicating through access points which bridge network traffic to the wired LAN.
Page 220: What You Need To Know About Wlan
Chapter 11 WLAN Screens • Use the Port Roles screen and connect an Access Point (AP) to the WLAN interface to extend the ZyWALL’s wireless LAN coverage. 11.1.2 What You Need to Know About WLAN DHCP Section 7.1.2 on page 150 Like the LAN, the ZyWALL can also assign TCP/IP configuration via DHCP to computers connected to the WLAN ports.
Page 221: Figure 122 Network > Wlan
Figure 122 NETWORK > WLAN The following table describes the labels in this screen. Table 54 NETWORK > WLAN LABEL DESCRIPTION WLAN TCP/IP IP Address Type the IP address of your ZyWALL’s WLAN interface in dotted decimal notation. Alternatively, click the right mouse button to copy and/or paste the IP address. Note: Make sure the IP addresses of the LAN, WAN, WLAN and IP Subnet Mask The subnet mask specifies the network number portion of an IP address.
Page 222 Chapter 11 WLAN Screens Table 54 NETWORK > WLAN (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported but RIP-2 carries more information.
Page 223: Wlan Static Dhcp
Table 54 NETWORK > WLAN (continued) LABEL DESCRIPTION Windows NetBIOS (Network Basic Input/Output System) are TCP or UDP packets that Networking enable a computer to connect to and communicate with a LAN. For some dial-up (NetBIOS over services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls. TCP/IP) However it may sometimes be necessary to allow NetBIOS packets to pass through to the WAN in order to find a computer on the WAN.
Page 224: Wlan Ip Alias
Chapter 11 WLAN Screens Figure 123 NETWORK > WLAN > Static DHCP The following table describes the labels in this screen. Table 55 NETWORK > WLAN > Static DHCP LABEL MAC Address IP Address Apply Reset 11.4 WLAN IP Alias IP alias allows you to partition a physical network into different logical networks over the same Ethernet interface.
Page 225: Figure 124 Network > Wlan > Ip Alias
To change your ZyWALL’s IP alias settings, click NETWORK > WLAN > IP Alias. The screen appears as shown. Figure 124 NETWORK > WLAN > IP Alias The following table describes the labels in this screen. Table 56 NETWORK > WLAN > IP Alias LABEL DESCRIPTION Enable IP Alias 1,...
Page 226: Wlan Port Roles
Chapter 11 WLAN Screens Table 56 NETWORK > WLAN > IP Alias (continued) LABEL Apply Reset 11.5 WLAN Port Roles Use the Port Roles screen to set ports as part of the LAN, DMZ and/or WLAN interface. Connect wireless LAN Access Points (APs) to WLAN interfaces to extend the ZyWALL’s wireless LAN coverage.
Page 227: Figure 126 Network > Wlan > Port Roles
Figure 126 NETWORK > WLAN > Port Roles The following table describes the labels in this screen. Table 57 NETWORK > WLAN > Port Roles LABEL DESCRIPTION Select a port’s LAN radio button to use the port as part of the LAN. The port will use the LAN IP address.
Page 228 Chapter 11 WLAN Screens ZyWALL 5/35/70 Series User’s Guide...
Page 229: Wireless Screens
H A P T E R 12.1 Overview In this section you can enable your wireless card and configure wireless security. You can configure the ZyWALL to use data encryption and user authentication methods to help protect data transmitted on your network and to ensure only devices with permission to access your network can do so.
Page 230: Figure 129 Zywall Wireless Security Levels
Chapter 12 Wireless Screens The figure below shows the possible wireless security levels on your ZyWALL. Figure 129 ZyWALL Wireless Security Levels If you do not enable any wireless security on your ZyWALL, your network is accessible to any wireless networking device that is within range. ESSID ESSID (Extended Service Set IDentity) identifies the Service Set with which a wireless station is associated.
Page 231 • An optional network RADIUS server for remote user authentication and accounting. EAP Authentication EAP (Extensible Authentication Protocol) is an authentication protocol that runs on top of the IEEE 802.1x transport mechanism in order to support multiple types of user authentication. By using EAP to interact with an EAP-compatible RADIUS server, the access point helps a wireless station and a RADIUS server perform authentication.
Page 232: Wireless Card
Chapter 12 Wireless Screens Finding Out More • See Section 12.4 on page 244 12.2 Wireless Card The wireless card provides wireless functionality to your ZyWALL. Turn the ZyWALL off before you install or remove the wireless LAN card. See the product specifications chapter for a list of compatible ZyXEL WLAN cards (and the WLAN security features each card supports) and how to install a WLAN card.
Page 233: Table 58 Wireless > Wi-Fi > Wireless Card: No Security
The following table describes the labels in this screen. Table 58 WIRELESS > Wi-Fi > Wireless Card: No Security LABEL DESCRIPTION Enable The wireless LAN through a wireless LAN card is turned off by default, before you Wireless Card enable the wireless LAN you should configure some security by setting MAC filters and/or 802.1x security;...
Page 234: Static Wep
Chapter 12 Wireless Screens Table 58 WIRELESS > Wi-Fi > Wireless Card: No Security (continued) LABEL DESCRIPTION Security Select one of the security settings. No Security Static WEP WPA-PSK 802.1x + Dynamic WEP 802.1x + Static WEP 802.1x + No WEP No Access 802.1x + Static WEP No Access 802.1x + No WEP Select No Security to allow wireless stations to communicate with the access points...
Page 235: Wpa-Psk
Figure 131 WIRELESS > Wi-Fi > Wireless Card: Static WEP The following table describes the wireless LAN security labels in this screen. Table 59 WIRELESS > Wi-Fi > Wireless Card: Static WEP LABEL DESCRIPTION Security Select Static WEP from the drop-down list. WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized Encryption wireless stations from accessing data transmitted over the wireless network.
Page 236: Figure 132 Wireless > Wi-Fi > Wireless Card: Wpa-Psk
Chapter 12 Wireless Screens Figure 132 WIRELESS > Wi-Fi > Wireless Card: WPA-PSK The following wireless LAN security fields become available when you select WPA-PSK in the Security drop down list-box. Table 60 WIRELESS > Wi-Fi > Wireless Card: WPA-PSK LABEL DESCRIPTION Security...
Page 237: Wpa
12.2.3 WPA Click WIRELESS > Wi-Fi > Wireless Card to display the Wireless Card screen. Select WPA from the Security list. Figure 133 WIRELESS > Wi-Fi > Wireless Card: WPA The following wireless LAN security fields become available when you select WPA in the Security drop down list-box.
Page 238: Ieee 802.1X + Dynamic Wep
Chapter 12 Wireless Screens Table 61 WIRELESS > Wi-Fi > Wireless Card: WPA (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 12.2.4 IEEE 802.1x + Dynamic WEP Click WIRELESS >...
Page 239: Ieee 802.1X + Static Wep
Table 62 WIRELESS > Wi-Fi > Wireless Card: 802.1x + Dynamic WEP LABEL DESCRIPTION Authentication Click RADIUS to go to the RADIUS screen where you can configure the ZyWALL Databases to check an external RADIUS server. Dynamic WEP Select 64-bit WEP or 128-bit WEP to enable data encryption. Key Exchange Apply Click Apply to save your changes back to the ZyWALL.
Page 240: Ieee 802.1X + No Wep
Chapter 12 Wireless Screens Table 63 WIRELESS > Wi-Fi > Wireless Card: 802.1x + Static WEP (continued) LABEL DESCRIPTION Key 1 to Key 4 If you chose 64-bit WEP in the WEP Encryption field, then enter any 5 characters (ASCII string) or 10 hexadecimal characters ("0-9", "A-F") preceded by 0x for each key.
Page 241: No Access 802.1X + Static Wep
Figure 136 WIRELESS > Wi-Fi > Wireless Card: 802.1x + No WEP The following wireless LAN security fields become available when you select 802.1x + No WEP in the Security drop down list-box. Table 64 WIRELESS > Wi-Fi > Wireless Card: 802.1x + No WEP LABEL DESCRIPTION Security...
Page 242: No Access 802.1X + No Wep
Chapter 12 Wireless Screens Figure 137 WIRELESS > Wi-Fi > Wireless Card: No Access 802.1x + Static WEP The following wireless LAN security fields become available when you select No Access 802.1x + Static WEP in the Security drop down list-box. Table 65 WIRELESS >...
Page 243: Mac Filter
12.3 MAC Filter The MAC filter screen allows you to configure the ZyWALL to give exclusive access to specific devices (Allow Association) or exclude specific devices from accessing the ZyWALL (Deny Association). You need to know the MAC addresses of the devices to configure this screen.
Page 244: Technical Reference
Chapter 12 Wireless Screens 12.4 Technical Reference IRADIUS RADIUS user is a simple package exchange in which your ZyWALL acts as a message relay between the wireless station and the network RADIUS server. See RFC 2138 and RFC 2139 for more on RADIUS. Types of RADIUS Messages The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user authentication:...
Page 245: Figure 139 Eap Authentication
Figure 139 EAP Authentication The details below provide a general description of how IEEE 802.1x EAP authentication works. • The wireless station sends a start message to the ZyWALL. • The ZyWALL sends a request identity message to the wireless station for identity information.
Page 246: Figure 140 Wpa-Psk Authentication
Chapter 12 Wireless Screens The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data packets, altering them and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match, it is assumed that the data has been tampered with and the packet is dropped.
Page 247: Figure 141 Wpa With Radius Application Example
2 The RADIUS server then checks the user's identification against its database and grants or denies network access accordingly. 3 The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy and management system, using the pair-wise key to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients.
Page 248 Chapter 12 Wireless Screens ZyWALL 5/35/70 Series User’s Guide...
Page 249: Security
Security Firewall Screens (251) Intrusion Detection and Prevention (IDP) Screens (277) Anti-Virus Screens (299) Anti-Spam Screens (313) Content Filtering Screens (327) Content Filtering Reports (349) IPSec VPN (357) Certificates (399) Authentication Server Screens (427)
Page 251: Firewall Screens
H A P T E R This chapter shows you how to configure your ZyWALL’s firewall. 13.1 Overview A firewall is a system that enforces an access-control policy between two networks. It is generally a mechanism used to protect a trusted network from an untrusted network. The ZyWALL physically separates the LAN, DMZ, WLAN and the WAN and acts as a secure gateway for all data passing between the networks.
Page 252: What You Can Do Using The Firewall Screens
Chapter 13 Firewall Screens 13.1.1 What You Can Do Using the Firewall Screens • Use the Default Rule screens settings when the ZyWALL is set to router mode or bridge mode. • Use the Rule Summary screens • Use the Anti-Probing screen ZyWALL’s interfaces will respond to Ping requests and whether or not the ZyWALL is to respond to probing for unused ports.
Page 253: Figure 143 Blocking All Lan To Wan Irc Traffic Example
Figure 143 Blocking All LAN to WAN IRC Traffic Example Your firewall would have the following configuration. Table 67 Blocking All LAN to WAN IRC Traffic Example SOURCE Default • The first row blocks LAN access to the IRC service on the WAN. •...
Page 254: The Firewall Default Rule Screen
Chapter 13 Firewall Screens Figure 144 Limited LAN to WAN IRC Traffic Example Your firewall would have the following configuration. Table 68 Limited LAN to WAN IRC Traffic Example SOURCE 192.168.1.7 Default • The first row allows the LAN computer at IP address 192.168.1.7 to access the IRC service on the WAN.
Page 255: Figure 145 Security > Firewall > Default Rule (Router Mode)
Figure 145 SECURITY > FIREWALL > Default Rule (Router Mode) The following table describes the labels in this screen. Table 69 SECURITY > FIREWALL > Default Rule (Router Mode) LABEL DESCRIPTION 0-100% This bar displays the percentage of the ZyWALL’s firewall rules storage space that is currently in use.
Page 256: The Firewall Default Rule (Bridge Mode) Screen
Chapter 13 Firewall Screens Table 69 SECURITY > FIREWALL > Default Rule (Router Mode) (continued) LABEL DESCRIPTION From, To The firewall rules are grouped by the direction of packet travel. The number of rules for each packet direction displays. Click Edit to go to a summary screen of the rules for that packet direction.
Page 257: Figure 146 Security > Firewall > Default Rule (Bridge Mode)
Figure 146 SECURITY > FIREWALL > Default Rule (Bridge Mode) The following table describes the labels in this screen. Table 70 SECURITY > FIREWALL > Default Rule (Bridge Mode) LABEL DESCRIPTION 0-100% This bar displays the percentage of the ZyWALL’s firewall rules storage space that is currently in use.
Page 258 Chapter 13 Firewall Screens Table 70 SECURITY > FIREWALL > Default Rule (Bridge Mode) (continued) LABEL DESCRIPTION From, To The firewall rules are grouped by the direction of packet travel. The number of rules for each packet direction displays. Click Edit to go to a summary screen of the rules for that packet direction.
Page 259: The Firewall Rule Summary Screen
13.5 The Firewall Rule Summary Screen Click SECURITY > FIREWALL > Rule Summary to open the screen. This screen displays a list of the configured firewall rules. The ordering of your rules is very important as rules are applied in the order that they are listed.
Page 260: The Firewall Edit Rule Screen
Chapter 13 Firewall Screens Table 71 SECURITY > FIREWALL > Rule Summary LABEL DESCRIPTION Source Address This drop-down list box displays the source addresses or ranges of addresses to which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any.
Page 261: Figure 148 Security > Firewall > Rule Summary > Edit
Chapter 13 Firewall Screens Figure 148 SECURITY > FIREWALL > Rule Summary > Edit ZyWALL 5/35/70 Series User’s Guide...
Page 262: Table 72 Security > Firewall > Rule Summary > Edit
Chapter 13 Firewall Screens The following table describes the labels in this screen. Table 72 SECURITY > FIREWALL > Rule Summary > Edit LABEL DESCRIPTION Rule Name Enter a descriptive name of up to 31 printable ASCII characters (except Extended ASCII characters) for the firewall rule.
Page 263: The Anti-Probing Screen
Table 72 SECURITY > FIREWALL > Rule Summary > Edit LABEL DESCRIPTION Action for Use the drop-down list box to select what the firewall is to do with packets that Matched Packets match this rule. Select Drop to silently discard the packets without sending a TCP reset packet or an ICMP destination-unreachable message to the sender.
Page 264: The Firewall Thresholds Screen
Chapter 13 Firewall Screens The following table describes the labels in this screen. Table 73 SECURITY > FIREWALL > Anti-Probing LABEL Respond to PING Do not respond to requests for unauthorized services. Apply Reset 13.7 The Firewall Thresholds Screen For DoS attacks, the ZyWALL uses thresholds to determine when to start dropping sessions that do not become fully established (half-open sessions).
Page 265: Table 74 Security > Firewall > Threshold
The following table describes the labels in this screen. Table 74 SECURITY > FIREWALL > Threshold LABEL DESCRIPTION Disable DoS Attack Select the check boxes of any interfaces (or all VPN tunnels) for which you want Protection on the ZyWALL to not use the Denial of Service protection thresholds. This disables DoS protection on the selected interface (or all VPN tunnels).
Page 266: The Firewall Services Screen
Chapter 13 Firewall Screens 13.8 The Firewall Services Screen Click SECURITY > FIREWALL > Service to open the screen as shown next. Use this screen to configure custom services for use in firewall rules or view the services that are predefined in the ZyWALL.
Page 267: The Firewall Edit Custom Service Screen
Table 75 SECURITY > FIREWALL > Service (continued) LABEL DESCRIPTION Protocol This is the IP protocol type. There may be more than one IP protocol type. Attribute This is the IP port number or ICMP type and code that defines the service. 13.8.1 The Firewall Edit Custom Service Screen Click SECURITY >...
Page 268: My Service Firewall Rule Example
Chapter 13 Firewall Screens 13.8.2 My Service Firewall Rule Example The following Internet firewall rule example allows a hypothetical My Service connection from the Internet. 1 In the Service screen, click Add to open the Edit Custom Service screen. Figure 153 My Service Firewall Rule Example: Service 2 Configure it as follows and click Apply.
Page 269: Figure 155 My Service Firewall Rule Example: Rule Summary
Figure 155 My Service Firewall Rule Example: Rule Summary 6 Enter the name of the firewall rule. 7 Select Any in the Destination Address(es) box and then click Delete. 8 Configure the destination address fields as follows and click Add. Figure 156 My Service Firewall Rule Example: Rule Edit 9 In the Edit Rule screen, use the arrows between Available Services and Selected Service(s) to configure it as follows.
Page 270: Figure 157 My Service Firewall Rule Example: Rule Configuration
Chapter 13 Firewall Screens Figure 157 My Service Firewall Rule Example: Rule Configuration ZyWALL 5/35/70 Series User’s Guide...
Page 271: Technical Reference
Rule 1 allows a My Service connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN. Figure 158 My Service Firewall Rule Example: Rule Summary 13.9 Technical Reference This technical reference contains the following sections: • Packet Direction Examples •...
Page 272 Chapter 13 Firewall Screens By default, the ZyWALL drops packets traveling in the following directions. • WAN 1 to LAN These rules specify which computers connected to WAN 1 can access • WAN to WAN Chapter 5 on page 109 To VPN Packet Direction The ZyWALL can apply firewall rules to traffic before encrypting it to send through a VPN tunnel.
Page 273: Figure 159 From Lan To Vpn Example
Figure 159 From LAN to VPN Example From VPN Packet Direction You can also apply firewall rules to traffic that comes in through the ZyWALL’s VPN tunnels. The ZyWALL decrypts the VPN traffic and then applies the firewall rules. From VPN means traffic that came into the ZyWALL through a VPN tunnel and is going to the selected “to”...
Page 274: Figure 161 From Vpn To Vpn Example
Chapter 13 Firewall Screens From VPN To VPN Packet Direction From VPN To VPN firewall rules apply to traffic that comes in through one of the ZyWALL’s VPN tunnels and terminates at the ZyWALL (like for remote management) or goes out through another of the ZyWALL’s VPN tunnels (this is called hub-and-spoke VPN, Section 19.13 on page 385 firewall rules before re-encrypting it or allowing the traffic to terminate at the ZyWALL.
Page 275: Figure 162 Using Ip Alias To Solve The Triangle Route Problem
3 The reply from the WAN goes to the ZyWALL. 4 The ZyWALL then sends it to the computer on the LAN in Subnet 1. Figure 162 Using IP Alias to Solve the Triangle Route Problem DoS Thresholds For TCP, half-open means that the session has not reached the established state-the TCP three- way handshake has not yet been completed.
Page 276: Security Considerations
Chapter 13 Firewall Screens 1 The maximum number of opened sessions. 2 The minimum capacity of server backlog in your LAN network. 3 The CPU power of servers in your LAN network. 4 Network bandwidth. 5 Type of traffic for certain servers. Reduce the threshold values if your network is slower than average for any of these factors (especially if you have servers that are slow or handle many tasks and are often busy).
Page 277: Intrusion Detection And Prevention (Idp) Screens
H A P T E R Intrusion Detection and Prevention (IDP) Screens 14.1 Overview An IDP system can detect malicious or suspicious packets and respond instantaneously. It can detect anomalies based on violations of protocol standards (RFCs – Requests for Comments) or traffic flows and abnormal flows such as port scans.
Page 278: What You Need To Know About The Zywall Idp
Chapter 14 Intrusion Detection and Prevention (IDP) Screens • Use the Update screen new signature downloads. • Use the Backup & Restore screen with your custom configured settings, restore previously saved IDP signatures (with your custom configured settings) or revert to the original ZSRT-defined signature Active, Log, Alert and/or Action settings.
Page 279: Before You Begin
Finding out More Section 14.7 on page 294 14.1.3 Before You Begin To use IDP on the ZyWALL, you need to insert the ZyWALL Turbo Card into the rear panel slot of the ZyWALL. See the ZyWALL Turbo Card guide for details. Turn the ZyWALL off before you install or remove the ZyWALL Turbo card.
Page 280: Table 77 Security > Idp > General Setup
Chapter 14 Intrusion Detection and Prevention (IDP) Screens The following table describes the labels in this screen. Table 77 SECURITY > IDP > General Setup LABEL General Setup Enable Intrusion Detection and Protection Turbo Card From, To Apply Reset DESCRIPTION Select this check box to enable IDP on the ZyWALL.
Page 281: The Signatures Screen
14.3 The Signatures Screen The rules that define how to identify and respond to intrusions are called “signatures”. Click SECURITY > IDP > Signatures to see the ZyWALL’s signatures. 14.3.1 Attack Types Click SECURITY > IDP > Signature. The Attack Type list box displays all intrusion types supported by the ZyWALL.
Page 282: Intrusion Severity
Chapter 14 Intrusion Detection and Prevention (IDP) Screens Table 78 SECURITY > IDP > Signature: Attack Types (continued) TYPE Web Attack SPAM Other 14.3.2 Intrusion Severity Intrusions are assigned a severity level based on the following table. The intrusion severity level then determines the default signature action.
Page 283: Configuring The Idp Signatures Screen
14.3.4 Configuring The IDP Signatures Screen Click SECURITY >IDP > Signature to see the ZyWALL’s “group view” signature screen where you can view signatures by attack type. To search for signatures based on other criteria such as signature name or ID, then click the Switch to query view link to go to the “query view”...
Page 284: The Query View Screen
Chapter 14 Intrusion Detection and Prevention (IDP) Screens Table 81 SECURITY > IDP > Signature: Group View (continued) LABEL DESCRIPTION Active Select the check box in the heading row to automatically select all check boxes and enable all signatures. Clear it to clear all entries and disable all signatures on the current page. For example, you could clear all check boxes for signatures that targets operating systems not in your network.
Page 285: Figure 168 Security > Idp > Signature: Query View
Figure 168 SECURITY > IDP > Signature: Query View The following table describes the fields in this screen. Table 82 SECURITY > IDP > Signature: Query View LABEL DESCRIPTION Back to group Click this button to go to the IDP group view screen where IDP signatures are view grouped by attack type.
Page 286 Chapter 14 Intrusion Detection and Prevention (IDP) Screens Table 82 SECURITY > IDP > Signature: Query View (continued) LABEL DESCRIPTION Configure The results display in a table showing the criteria as selected in the search. Click a Signatures column’s header to sort the entries by that attribute. Go To Navigate between signatures found.
Page 287: Figure 169 Security > Idp > Signature: Query By Partial Name
14.3.5.1 Query Example 1 1 From the “group view” signature screen, click the Switch to query view link. 1 Select Signature Search. 2 Select By Name or By ID from the list box. 3 Enter a name (complete or partial) or complete ID to display all relevant signatures in the signature database.
Page 288: Figure 170 Security > Idp > Signature: Query By Complete Id
Chapter 14 Intrusion Detection and Prevention (IDP) Screens Figure 170 SECURITY > IDP > Signature: Query by Complete ID 14.3.5.2 Query Example 2 1 From the “group view” signature screen, click the Switch to query view link. 1 Select Signature Search By Attributes. 2 Select the Severity, Type, Platform, Active, Log, Alert and/or Action items.
Page 289: The Anomaly Screen
Figure 171 Signature Query by Attribute. 14.4 The Anomaly Screen This section introduces ADP (Anomaly Detection and Prevention). An ADP system protects against anomalies based on violations of protocol standards (RFCs – Requests for Comments) and abnormal flows such as port scans. Protocol anomaly detection includes HTTP Inspection, TCP Decoder, UDP Decoder and ICMP Decoder.
Page 290: Figure 172 Security > Idp > Anomaly
Chapter 14 Intrusion Detection and Prevention (IDP) Screens Figure 172 SECURITY > IDP > Anomaly The following table describes the labels in this screen. Table 83 SECURITY > IDP > Anomaly LABEL DESCRIPTION Protocol Anomaly HTTP Inspection/TCP Decoder/UDP Decoder/ICMP Decoder Name This is the name of the protocol anomaly rule.
Page 291: The Update Screen
Table 83 SECURITY > IDP > Anomaly (continued) LABEL DESCRIPTION Action Select what the ZyWALL should do when a packet matches a rule. No Action: The ZyWALL takes no action when a packet matches the signature(s). Drop Packet: The packet is silently discarded. Drop Session: When the firewall is enabled, subsequent TCP/IP packets belonging to the same connection are dropped.
Page 292: Configuring The Idp Update Screen
Chapter 14 Intrusion Detection and Prevention (IDP) Screens 14.5.2 Configuring The IDP Update Screen When scheduling signature updates, you should choose a day and time when your network is least busy so as to minimize disruption to your network. Your custom signature configurations are not over-written when you download new signatures.
Page 293: The Backup And Restore Screen
Table 84 SECURITY > IDP > Update (continued) LABEL DESCRIPTION Release Date This field displays the time (hour, minutes second) and date (month, date, year) that the above signature set was created. Last Update This field displays the last date and time you downloaded new signatures to the ZyWALL.
Page 294: Technical Reference
Chapter 14 Intrusion Detection and Prevention (IDP) Screens Figure 174 SECURITY > IDP > Backup & Restore To back up IDP signatures, click Backup and then choose a location and filename for the IDP configuration set. To restore previously saved IDP signatures, type in the location where the previously saved file resides on your computer or click Browse ...
Page 295: Ids And Idp
IDS and IDP An Intrusion Detection System (IDS) can detect suspicious activity, but does not take action against attacks. On the other hand an IDP is a proactive defense mechanisms designed to detect malicious packets within normal network traffic and take an action (block, drop, log, send an alert) against the offending traffic automatically before it does any damage.
Page 296 Chapter 14 Intrusion Detection and Prevention (IDP) Screens SQL Slammer Worm W32.SQLExp.Worm is a worm that targets the systems running Microsoft SQL Server 2000, as well as Microsoft Desktop Engine (MSDE) 2000. The worm sends 376 bytes to UDP port 1434, the SQL Server Resolution Service Port.
Page 297 Chapter 14 Intrusion Detection and Prevention (IDP) Screens W32/MyDoom-A is a worm that is spread by email. When the infected attachment is launched, the worm gathers e-mail addresses from address books and from files with the following extensions: WAB, TXT, HTM, SHT, PHP, ASP, DBX, TBB, ADB and PL. W32/ MyDoom-A creates a file called Message in the temp folder and runs Notepad to display the contents, which displays random characters.
Page 298 Chapter 14 Intrusion Detection and Prevention (IDP) Screens ZyWALL 5/35/70 Series User’s Guide...
Page 299: Anti-Virus Screens
H A P T E R 15.1 Overview This section shows you how to configure the ZyWALL to scan files transmitted through the enabled interfaces into your network. As a network-based anti-virus scanner, the ZyWALL helps stop threats at the network edge before they reach the local host computers. The following figure shows the ZyWALL virus-scanning files going to the LAN from WAN1 and WAN2.
Page 300: What You Need To Know About Antivirus
Chapter 15 Anti-Virus Screens 15.1.2 What You Need to Know About Antivirus Virus A computer virus is a small program designed to corrupt and/or alter the operation of other legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates itself.
Page 301: The General Screen
• Simultaneous downloads of a file using multiple connections. For example, when you use FlashGet to download sections of a file simultaneously. • Encrypted traffic (such as on a VPN) or password-protected files. • Traffic through custom (non-standard) ports. • ZIP file(s) within a ZIP file. ZyWALL Turbo Card To use the anti-virus scanner on the ZyWALL, you need to insert the ZyWALL Turbo Card into the rear panel slot of the ZyWALL.
Page 302: Figure 176 Security > Anti-Virus > General
Chapter 15 Anti-Virus Screens Figure 176 SECURITY > ANTI-VIRUS > General The following table describes the labels in this screen. Table 85 SECURITY > ANTI-VIRUS > General LABEL General Setup Enable Anti-Virus Enable ZIP File Scan Turbo Card Available Service DESCRIPTION Select this check box to check traffic for viruses.
Page 303: The Signature Screen
Table 85 SECURITY > ANTI-VIRUS > General (continued) LABEL DESCRIPTION Service This field displays the services for which the ZyWALL can scan traffic for viruses. Select a service to be able to enable or disable anti-virus scanning on it’s traffic. Here are the services and default port numbers.
Page 304: Figure 177 Security > Anti-Virus > Signature: Query View
Chapter 15 Anti-Virus Screens Figure 177 SECURITY > ANTI-VIRUS > Signature: Query View The following table describes the labels in this screen. Table 86 SECURITY > ANTI-VIRUS > Signature: Query View LABEL DESCRIPTION Query Signatures Select the criteria on which to perform the search. Signature Search Select this radio button if you would like to search the signatures by name or ID.
Page 305: Signature Search Example
Table 86 SECURITY > ANTI-VIRUS > Signature: Query View (continued) LABEL DESCRIPTION Configure The signature search results display in a table showing the SID, Name, Severity, Signatures Attack Type, Platform, Service, Activation, Log, and Action criteria as selected in the search. Click the SID column header to sort search results by SID. Go to Page Navigate between the pages of signature search results.
Page 306: The Update Screen
Chapter 15 Anti-Virus Screens Figure 179 Query Example Search Results 15.4 The Update Screen The ZyWALL comes with built-in signatures created by the ZyXEL Security Response Team (ZSRT). These are regularly updated as new intrusions evolve. Use the Update screen to immediately download or schedule new signature downloads.
Page 307: Mysecurityzone
15.4.1 mySecurityZone mySecurityZone is a web portal that provides all security-related information such as intrusion and anti-virus information for ZyXEL security products. You should have already registered your ZyWALL on myZyXEL.com at: http://www.myzyxel.com/myzyxel/. You can use your myZyXEL.com username and password to log into mySecurityZone. 15.4.2 Configuring Anti-virus Update When scheduling signature updates, you should choose a day and time when your network is least busy so as to minimize disruption to your network.
Page 308 Chapter 15 Anti-Virus Screens The following table describes the labels in this screen. LABEL DESCRIPTION Signature Information Current Pattern This field displays the signatures version number currently used by the ZyWALL. Version This number is defined by the ZyXEL Security Response Team (ZSRT) who maintain and update them.
Page 309: The Backup And Restore Screen
15.5 The Backup and Restore Screen Click ANTI-VIRUS > Backup & Restore. The screen displays as shown next. You can change the pre-defined Active, Log, Alert, Send Windows Message and/or Destroy File settings of individual signatures. Figure 181 SECURITY > ANTI-VIRUS > Backup and Restore Use the Backup &...
Page 310: Technical Reference
Chapter 15 Anti-Virus Screens 15.6 Technical Reference Types of Computer Viruses The following table describes some of the common computer viruses. Table 87 Common Computer Virus Types TYPE File Infector Boot Sector Virus Macro Virus E-mail Virus Polyrmorphic Virus Computer Virus Infection and Prevention The following describes a simple life cycle of a computer virus.
Page 311 A network-based anti-virus (NAV) scanner is often deployed as a dedicated security device (such as your ZyWALL) on the network edge. NAV scanners inspect real-time data traffic (such as E-mail messages or web) that tends to bypass HAV scanners. The following lists some of the benefits of NAV scanners.
Page 312 Chapter 15 Anti-Virus Screens ZyWALL 5/35/70 Series User’s Guide...
Page 313: Anti-Spam Screens
H A P T E R 16.1 Overview The ZyWALL’s anti-spam feature identifies unsolicited commercial or junk e-mail (spam). You can set the ZyWALL to mark or discard spam. The ZyWALL can use an anti-spam external database to help identify spam. Use the whitelist to identify legitimate e-mail. Use the blacklist to identify spam e-mail.
Page 314: What You Need To Know About Antispam
Chapter 16 Anti-Spam Screens 16.1.2 What You Need to Know About Antispam MIME Headers MIME (Multipurpose Internet Mail Extensions) allows varied media types to be used in e- mail. MIME headers describe an e-mail’s content encoding and type. For example, it may show which program generated the e-mail and what type of text is used in the e-mail body.
Page 315: The General Screen
SpamBulk Engine The e-mail fingerprint ID that the ZyWALL generates and sends to the anti-spam external database only includes the parts of the e-mail that are the most difficult for spammers (senders of spam) to change or fake. The anti-spam external database maintains a database of e-mail fingerprint IDs.
Page 316: Figure 183 Security > Anti-Spam > General
Chapter 16 Anti-Spam Screens The anti-spam external database checks for spoofing of e-mail attributes (like the IP address) and uses statistical analysis to detect phishing. Click SECURITY > ANTI-SPAM to open the Anti-Spam General screen. The following screen appears. Figure 183 SECURITY > ANTI-SPAM > General The following table describes the labels in this screen.
Page 317 Table 88 SECURITY > ANTI-SPAM > General LABEL From, To Action for Spam Mails X-Header Phishing Tag Spam Tag ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Select the directions of travel of packets that you want to check. Select or clear a row or column’s first check box (with the interface label) to select or clear the interface’s whole row or column.
Page 318: The External Db Screen
Chapter 16 Anti-Spam Screens Table 88 SECURITY > ANTI-SPAM > General LABEL Forward SMTP & POP3 mail with tag in mail subject Discard SMTP mail. Forward POP3 mail with tag in mail subject Action taken when mail sessions threshold is reached Apply Reset...
Page 319: Figure 184 Security > Anti-Spam > External Db
Figure 184 SECURITY > ANTI-SPAM > External DB The following table describes the labels in this screen. Table 89 SECURITY > ANTI-SPAM > External DB LABEL External Database Enable External Database Spam Threshold ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Enable the anti-spam external database feature to have the ZyWALL calculate a digest of an e-mail and send it to an anti-spam external database.
Page 320: The Lists Screen
Chapter 16 Anti-Spam Screens Table 89 SECURITY > ANTI-SPAM > External DB (continued) LABEL Action for No Spam Score Tag for No Spam Score Forward SMTP & POP3 mail with tag in mail subject Discard SMTP mail. Forward POP3 mail with tag in mail subject External Database Service Status...
Page 321: Figure 185 Security > Anti-Spam > Lists
Figure 185 SECURITY > ANTI-SPAM > Lists The following table describes the labels in this screen. Table 90 SECURITY > ANTI-SPAM > Lists LABEL DESCRIPTION Resource Usage Whitelist & Blacklist This bar displays the percentage of the ZyWALL’s anti-spam whitelist and Storage Space in blacklist storage space that is currently in use.
Page 322: Anti-Spam Lists Edit Screen
Chapter 16 Anti-Spam Screens Table 90 SECURITY > ANTI-SPAM > Lists (continued) LABEL Use Blacklist Active Type Content Modify Insert Apply Reset 16.5 Anti-Spam Lists Edit Screen Click SECURITY > ANTI-SPAM > Lists to display the Anti-Spam Lists screen. Use this screen to configure an anti-spam whitelist entry to identify legitimate e-mail or a blacklist entry to identify spam e-mail.
Page 323: Table 91 Security > Anti-Spam > Lists > Edit
The following table describes the labels in this screen. Table 91 SECURITY > ANTI-SPAM > Lists > Edit LABEL DESCRIPTION Rule Edit Active Turn this entry on to have the ZyWALL use it as part of the whitelist or blacklist. You must also turn on the use of the corresponding list (in the Anti-Spam Customization screen) and the anti-spam feature (in the Anti-Spam General screen).
Page 324: Technical Reference
Chapter 16 Anti-Spam Screens Table 91 SECURITY > ANTI-SPAM > Lists > Edit LABEL DESCRIPTION Value This field displays when you select the MIME Header type. Type the value part of an MIME header (up to 63 ASCII characters). In an MIME header, the part that comes after the colon is the value. For example, if you want the whitelist or blacklist entry to check for the MIME header “X-MSMail-Priority: Normal”, enter “Normal”...
Page 325: Spamcontent Engine
SpamContent Engine The SpamContent engine examines the e-mail’s content to decide if it would generally be considered offensive. The vocabulary design, format and layout are considered as part of thousands of checks on message attributes that include the following. • To Field •...
Page 326 Chapter 16 Anti-Spam Screens ZyWALL 5/35/70 Series User’s Guide...
Page 327: Content Filtering Screens
H A P T E R Content Filtering Screens 17.1 Overview Content filtering allows you to block certain web features, such as cookies, and/or block access to specific websites. With content filtering, you can do the following: • Restrict web features. The ZyWALL can block web features such as ActiveX controls, Java applets, cookies and disable web proxies.
Page 328: General Screen
Chapter 17 Content Filtering Screens Figure 187 Content Filtering Lookup Procedure 1 A computer behind the ZyWALL tries to access a web site. 2 The ZyWALL looks up the web site in its cache. If an attempt to access the web site was made in the past, a record of that web site’s category will be in the ZyWALL’s cache.
Page 329: Figure 188 Security > Content Filter > General
Use the REGISTRATION screens (see account, register your device and activate the external content filtering service. Figure 188 SECURITY > CONTENT FILTER > General The following table describes the labels in this screen. Table 92 SECURITY > CONTENT FILTER > General LABEL General Setup Enable Content Filter...
Page 330 Chapter 17 Content Filtering Screens Table 92 SECURITY > CONTENT FILTER > General LABEL Matched Web Pages Unrated Web Pages When Content Filter Server Is Unavailable Content Filter Server Unavailable Timeout Enable Report Service License Status DESCRIPTION Select Block to prevent users from accessing web pages that match the categories that you select below.
Page 331: The Policy Screen
Table 92 SECURITY > CONTENT FILTER > General LABEL Message to display when a site is blocked Denied Access Message Redirect URL Apply Reset 17.3 The Policy Screen Click SECURITY >CONTENT FILTER > Policy to display the following screen. Use this screen to configure content filtering policies on your ZyWALL.
Page 332: Content Filter Policy: General
Chapter 17 Content Filtering Screens The following table describes the labels in this screen. Table 93 SECURITY > CONTENT FILTER > Policy LABEL Content Filter Storage Space in Use The following fields summarize the content filter policies you have created. Name Active Group Address...
Page 333: Figure 190 Security > Content Filter > Policy > General
Figure 190 SECURITY > CONTENT FILTER > Policy > General The following table describes the labels in this screen. Table 94 SECURITY > CONTENT FILTER > Policy > General LABEL Active Policy Name Restrict Web Features Address Setup Address Type ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Screens DESCRIPTION...
Page 334: Content Filter Policy: External Database
Chapter 17 Content Filtering Screens Table 94 SECURITY > CONTENT FILTER > Policy > General (continued) LABEL Start IP Address End IP Address Subnet Mask Modify Delete Apply Cancel 17.5 Content Filter Policy: External Database Click SECURITY > CONTENT FILTER > Policy and then a policy’s external database icon to display the following screen.
Page 335: Table 95 Security > Content Filter > Policy > External Database
The following table describes the labels in this screen. Table 95 SECURITY > CONTENT FILTER > Policy > External Database LABEL Policy Name Active Select Categories Select All Categories Clear All Categories Adult/Mature Content Pornography Sex Education Intimate Apparel/Swimsuit Nudity Alcohol/Tobacco Illegal/Questionable ZyWALL 5/35/70 Series User’s Guide...
Page 336 Chapter 17 Content Filtering Screens Table 95 SECURITY > CONTENT FILTER > Policy > External Database (continued) LABEL Gambling Violence/Hate/Racism Weapons Abortion Hacking Phishing Arts/Entertainment Business/Economy Alternative Spirituality/Occult Selecting this category excludes pages that promote and provide Illegal Drugs DESCRIPTION Selecting this category excludes pages where a user can place a bet or participate in a betting pool (including lotteries) online.
Page 337 Table 95 SECURITY > CONTENT FILTER > Policy > External Database (continued) LABEL Education Cultural/Charitable Organization Financial Services Brokerage/Trading Online Games Government/Legal Military Political/Activist Groups Health Computers/Internet Search Engines/Portals ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Screens DESCRIPTION Selecting this category excludes pages that offer educational information, distance learning and trade school information or programs.
Page 338 Chapter 17 Content Filtering Screens Table 95 SECURITY > CONTENT FILTER > Policy > External Database (continued) LABEL Spyware/Malware Sources Spyware Effects/Privacy Concerns Job Search/Careers News/Media Personals/Dating Reference Open Image/Media Search Chat/Instant Messaging Email Blogs/Newsgroups DESCRIPTION Selecting this category excludes pages which distribute spyware and other malware.
Page 339 Table 95 SECURITY > CONTENT FILTER > Policy > External Database (continued) LABEL Religion Social Networking Online Storage Remote Access Tools Shopping Auctions Real Estate Society/Lifestyle Sexuality/Alternative Lifestyles Restaurants/Dining/Food Sports/Recreation/Hobbies ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Screens DESCRIPTION Selecting this category excludes pages that promote and provide information on conventional or unconventional religious or quasi-...
Page 340 Chapter 17 Content Filtering Screens Table 95 SECURITY > CONTENT FILTER > Policy > External Database (continued) LABEL Travel Vehicles Humor/Jokes Software Downloads Pay to Surf Peer-to-Peer Streaming Media/MP3s Proxy Avoidance For Kids Web Advertisements Web Hosting Advanced/Basic Test Web Site Attribute Test if Web site is blocked Test Against Local Cache Test Against Internet Server...
Page 341: Content Filter Policy: Customization
17.6 Content Filter Policy: Customization Click SECURITY > CONTENT FILTER > Policy and then a policy’s customization icon to display the following screen. Use this screen to select good (allowed) web site addresses for this policy and bad (blocked) web site addresses. You can also block web sites based on whether the web site’s address contains a keyword.
Page 342: Content Filter Policy: Schedule
Chapter 17 Content Filtering Screens The following table describes the labels in this screen. Table 96 SECURITY > CONTENT FILTER > Policy > Customization LABEL Policy Name Web Site List Customization Enable Web site customization Disable all Web traffic except for trusted Web sites Don't block Java/ActiveX/ Cookies/Web proxy to...
Page 343: Content Filter Object
Figure 193 SECURITY > CONTENT FILTER > Policy > Schedule The following table describes the labels in this screen. Table 97 SECURITY > CONTENT FILTER > Policy > Schedule LABEL Policy Name Schedule Setup Always Everyday from/to Customization Apply Cancel 17.8 Content Filter Object Click SECURITY >...
Page 344: Figure 194 Security > Content Filter > Object
Chapter 17 Content Filtering Screens Use this screen to configure a list of allowed web site addresses for this policy and a list of blocked web site addresses. You can also block web sites based on whether the web site’s address contains a keyword.
Page 345: Table 98 Security > Content Filter > Object
The following table describes the labels in this screen. Table 98 SECURITY > CONTENT FILTER > Object LABEL Trusted Web Sites Add Trusted Web Site Trusted Web Sites Delete Forbidden Web Site List Add Forbidden Web Site Forbidden Web Sites Delete Keyword Blocking Add Keyword...
Page 346: Content Filtering Cache
Chapter 17 Content Filtering Screens 17.9 Content Filtering Cache Click SECURITY > CONTENT FILTER > Cache to display the CONTENT FILTER Cache screen. Use this screen to view and configure your ZyWALL’s URL caching. You can also configure how long a categorized web site address remains in the cache as well as view those web site addresses to which access has been allowed or blocked based on the responses from the external content filtering server.
Page 347 Chapter 17 Content Filtering Screens ZyWALL 5/35/70 Series User’s Guide...
Page 348 Chapter 17 Content Filtering Screens ZyWALL 5/35/70 Series User’s Guide...
Page 349: Content Filtering Reports
H A P T E R Content Filtering Reports 18.1 Overview This chapter describes how to view content filtering reports after you have activated the category-based content filtering subscription service. Chapter 6 on page 141 and activate the subscription services using the REGISTRATION screens. 18.2 Checking Content Filtering Activation After you activate content filtering, you need to wait up to five minutes for content filtering to be turned on.
Page 350: Figure 196 Myzyxel.com: Login
Chapter 18 Content Filtering Reports Figure 196 myZyXEL.com: Login 3 A welcome screen displays. Click your ZyWALL’s model name and/or MAC address under Registered ZyXEL Products. You can change the descriptive name for your ZyWALL using the Rename button in the Service Management screen (see on page 351).
Page 351: Figure 198 Myzyxel.com: Service Management
Figure 198 myZyXEL.com: Service Management 5 Enter your ZyXEL device's MAC address (in lower case) in the Name field. You can find this MAC address in the Service Management screen Type your myZyXEL.com account password in the Password field. 6 Click Submit. Figure 199 Blue Coat: Login 7 In the Web Filter Home screen, click the Reports tab.
Page 352: Figure 200 Content Filtering Reports Main Screen
Chapter 18 Content Filtering Reports Figure 200 Content Filtering Reports Main Screen 8 Select items under Global Reports or Single User Reports to view the corresponding reports. Figure 201 Blue Coat: Report Home 9 Select a time period in the Date Range field, either Allowed or Blocked in the Action Taken field and a category (or enter the user name if you want to view single user reports) and click Run Report.The screens vary according to the report type you selected in the Report Home screen.
Page 353: Figure 202 Global Report Screen Example
Chapter 18 Content Filtering Reports Figure 202 Global Report Screen Example 11 You can click a category in the Categories report or click URLs in the Report Home screen to see the URLs that were requested. ZyWALL 5/35/70 Series User’s Guide...
Page 354: Web Site Submission
Chapter 18 Content Filtering Reports Figure 203 Requested URLs Example 18.4 Web Site Submission You may find that a web site has not been accurately categorized or that a web site’s contents have changed and the content filtering category needs to be updated. Use the following procedure to submit the web site for review.
Page 355: Figure 204 Web Page Review Process Screen
Chapter 18 Content Filtering Reports Figure 204 Web Page Review Process Screen 3 Type the web site’s URL in the field and click Submit to have the web site reviewed. ZyWALL 5/35/70 Series User’s Guide...
Page 356 Chapter 18 Content Filtering Reports ZyWALL 5/35/70 Series User’s Guide...
Page 357: Ipsec Vpn
H A P T E R 19.1 Overview A virtual private network (VPN) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing. It is used to transport traffic over the Internet or any insecure network that uses TCP/IP for communication.
Page 358: What You Need To Know About Ipsec Vpn
Chapter 19 IPSec VPN • Use the VPN Global Setting screen (see that apply to all of your VPN tunnels. 19.1.2 What You Need to Know About IPSec VPN An IPSec VPN tunnel is usually established in two phases. Each phase establishes a security association (SA), a contract indicating what security parameters the ZyWALL and the remote IPSec router will use.
Page 359: Figure 207 Gateway And Network Policies
Figure 207 Gateway and Network Policies This figure helps explain the main fields in the VPN setup. Figure 208 IPSec Fields Summary Negotiation Mode It takes several steps to establish an IKE SA. The negotiation mode determines the number of steps to use.
Page 360: The Vpn Rules (Ike) Screen
Chapter 19 IPSec VPN You can usually provide a static IP address or a domain name for the ZyWALL. Sometimes, your ZyWALL might also offer another alternative, such as using the IP address of a port or interface. You can usually provide a static IP address or a domain name for the remote IPSec router as well.
Page 361: The Vpn Rules (Ike) Gateway Policy Edit Screen
Table 100 SECURITY > VPN > VPN Rules (IKE) (continued) LABEL DESCRIPTION Gateway Policies The first row of each VPN rule represents the gateway policy. The gateway policy identifies the IPSec routers at either end of a VPN tunnel (My ZyWALL and Remote Gateway) and specifies the authentication, encryption and other settings needed to negotiate a phase 1 IKE SA (click the edit icon to display the other settings).
Page 362: Figure 210 Security > Vpn > Vpn Rules (Ike) > Edit Gateway Policy
Chapter 19 IPSec VPN Use this screen to configure a VPN gateway policy. The gateway policy identifies the IPSec routers at either end of a VPN tunnel (My ZyWALL and Remote Gateway) and specifies the authentication, encryption and other settings needed to negotiate a phase 1 IKE SA. Figure 210 SECURITY >...
Page 363: Table 101 Security > Vpn > Vpn Rules (Ike) > Edit Gateway Policy
The following table describes the labels in this screen. Table 101 SECURITY > VPN > VPN Rules (IKE) > Edit Gateway Policy LABEL DESCRIPTION Property Name Type up to 32 characters to identify this VPN gateway policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 364 Chapter 19 IPSec VPN Table 101 SECURITY > VPN > VPN Rules (IKE) > Edit Gateway Policy (continued) LABEL Fall back to Primary Remote Gateway when possible Fall Back Check Interval* Authentication Key Pre-Shared Key Certificate Local ID Type Content DESCRIPTION Select this to have the ZyWALL change back to using the primary remote gateway if the connection becomes available again.
Page 365 Table 101 SECURITY > VPN > VPN Rules (IKE) > Edit Gateway Policy (continued) LABEL DESCRIPTION Peer ID Type Select from the following when you set Authentication Key to Pre-shared Key. Select IP to identify the remote IPSec router by its IP address. Select DNS to identify the remote IPSec router by a domain name.
Page 366 Chapter 19 IPSec VPN Table 101 SECURITY > VPN > VPN Rules (IKE) > Edit Gateway Policy (continued) LABEL Server Mode Client Mode User Name Password IKE Proposal Negotiation Mode Encryption Algorithm Authentication Algorithm SA Life Time (Seconds) Key Group DESCRIPTION Select Server Mode to have this ZyWALL authenticate extended authentication clients that request this VPN connection.
Page 367: The Network Policy Edit Screen
Table 101 SECURITY > VPN > VPN Rules (IKE) > Edit Gateway Policy (continued) LABEL DESCRIPTION Enable Multiple Select this to allow the ZyWALL to use any of its phase 1 key groups and Proposals encryption and authentication algorithms when negotiating an IKE SA. When you enable multiple proposals, the ZyWALL allows the remote IPSec router to select which phase 1 key groups and encryption and authentication algorithms to use for the IKE SA, even if they are less secure than the ones you...
Page 368: Figure 211 Security > Vpn > Vpn Rules (Ike) > Edit Network Policy
Chapter 19 IPSec VPN Figure 211 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy ZyWALL 5/35/70 Series User’s Guide...
Page 369: Table 102 Security > Vpn > Vpn Rules (Ike) > Edit Network Policy
The following table describes the labels in this screen. Table 102 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy LABEL DESCRIPTION Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 370 Chapter 19 IPSec VPN Table 102 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy (continued) LABEL Port Forwarding Rules Type Private Starting IP Address Private Ending IP Address Virtual Starting IP Address Virtual Ending IP Address Local Network Address Type Starting IP Address DESCRIPTION...
Page 371 Table 102 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy (continued) LABEL DESCRIPTION Ending IP Address/ When the Address Type field is configured to Single Address, this field is N/A. Subnet Mask When the Address Type field is configured to Range Address, enter the end (static) IP address, in a range of computers on the LAN behind your ZyWALL.
Page 372: The Network Policy Edit: Port Forwarding Screen
Chapter 19 IPSec VPN Table 102 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy (continued) LABEL SA Life Time (Seconds) Perfect Forward Secret (PFS) Enable Replay Detection Enable Multiple Proposals Apply Cancel 19.5 The Network Policy Edit: Port Forwarding Screen Click SECURITY >...
Page 373: Figure 212 Security > Vpn > Vpn Rules (Ike) > Edit Network Policy > Port Forwarding
Figure 212 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy > Port Forwarding The following table describes the labels in this screen. Table 103 SECURITY > VPN > VPN Rules (IKE) > Edit Network Policy > Port Forwarding LABEL DESCRIPTION Default Server...
Page 374: The Network Policy Move Screen
Chapter 19 IPSec VPN 19.6 The Network Policy Move Screen Click the move ( Network Policy Move screen. A VPN (Virtual Private Network) tunnel gives you a secure connection to another computer or network. Each VPN tunnel uses a single gateway policy and one or more network policies. •...
Page 375: The Vpn Rules (Manual) Screen
19.7 The VPN Rules (Manual) Screen Refer to Figure 208 on page 359 configurator. Click SECURITY > VPN > VPN Rules (Manual) to open the VPN Rules (Manual) screen. Use this screen to manage the ZyWALL’s list of VPN rules (tunnels) that use manual keys. You may want to configure a VPN rule that uses manual key management if you are having problems with IKE key management.
Page 376: The Vpn Rules (Manual): Edit Screen
Chapter 19 IPSec VPN Table 105 SECURITY > VPN > VPN Rules (Manual) (continued) LABEL DESCRIPTION Encap. This field displays Tunnel or Transport mode (Tunnel is the default selection). IPSec Algorithm This field displays the security protocols used for an SA. Both AH and ESP increase ZyWALL processing requirements and communications latency (delay).
Page 377: Table 106 Security > Vpn > Vpn Rules (Manual) > Edit
The following table describes the labels in this screen. Table 106 SECURITY > VPN > VPN Rules (Manual) > Edit LABEL DESCRIPTION Property Active Select this check box to activate this VPN policy. Name Type up to 32 characters to identify this VPN policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 378 Chapter 19 IPSec VPN Table 106 SECURITY > VPN > VPN Rules (Manual) > Edit (continued) LABEL DESCRIPTION Ending IP When the Address Type field is configured to Single Address, this field is N/A. Address/Subnet When the Address Type field is configured to Range Address, enter the end Mask (static) IP address, in a range of computers on the network behind the remote IPSec router.
Page 379: The Vpn Sa Monitor Screen
Table 106 SECURITY > VPN > VPN Rules (Manual) > Edit (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 19.9 The VPN SA Monitor Screen In the web configurator, click SECURITY >...
Page 380: Figure 217 Overlap In A Dynamic Vpn Rule
Chapter 19 IPSec VPN Local and Remote IP Address Conflict Resolution Normally, you do not configure your local VPN policy rule’s IP addresses to overlap with the remote VPN policy rule’s IP addresses. For example, you usually would not configure both with 192.168.1.0.
Page 381: Figure 218 Overlap In Ip Alias And Vpn Remote Networks
Figure 218 Overlap in IP Alias and VPN Remote Networks In this case, if you want to send packets from network A to an overlapped IP (ex. 10.1.2.241) that is in the IP alias network M, you have to set Local and Remote IP Address Conflict Resolution to The Local Network.
Page 382: Telecommuter Vpn/Ipsec Examples
Chapter 19 IPSec VPN Table 108 SECURITY > VPN > Global Setting (continued) LABEL Gateway Domain Name Update Timer Adjust TCP Maximum Segment Size Local and Remote IP Address Conflict Resolution Apply Reset 19.11 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyWALL at headquarters.
Page 383: Telecommuters Sharing One Vpn Rule Example
19.11.1 Telecommuters Sharing One VPN Rule Example See the following figure and table for an example configuration that allows multiple telecommuters (A, B and C in the figure) to use one VPN rule to simultaneously access a ZyWALL at headquarters (HQ in the figure). The telecommuters do not have domain names mapped to the WAN IP addresses of their IPSec routers.
Page 384: Figure 221 Telecommuters Using Unique Vpn Rules Example
Chapter 19 IPSec VPN See the following table and figure for an example where three telecommuters each use a different VPN rule for a VPN connection with a ZyWALL located at headquarters. The ZyWALL at headquarters (HQ in the figure) identifies each incoming SA by its ID type and content and uses the appropriate VPN rule to establish the VPN connection.
Page 385: Vpn And Remote Management
Table 110 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS Telecommuter C (telecommuterc.dydns.org) Local ID Type: E-mail Local ID Content: myVPN@myplace.com Local IP Address: 192.168.4.15 19.12 VPN and Remote Management You can allow someone to use a service (like Telnet or HTTP) through a VPN tunnel to manage the ZyWALL.
Page 386: Hub-And-Spoke Vpn Example
Chapter 19 IPSec VPN Figure 223 VPN Topologies Hub-and-spoke VPN reduces the number of VPN connections that you have to set up and maintain in the network. Small office or telecommuter IPSec routers that support a limited number of VPN tunnels are also able to use VPN to connect to more networks. Hub-and-spoke VPN makes it easier for the hub router to manage the traffic between the spoke routers.
Page 387: Hub-And-Spoke Example Vpn Rule Addresses
Figure 224 Hub-and-spoke VPN Example 19.13.2 Hub-and-spoke Example VPN Rule Addresses The VPN rules for this hub-and-spoke example would use the following address settings. Branch Office A: • Remote Gateway: 10.0.0.1 • Local IP address: 192.168.167.0/255.255.255.0 • Remote IP address: 192.168.168.0~192.168.169.255 Headquarters: Rule 1: •...
Page 388: Ipsec Vpn Background Information
Chapter 19 IPSec VPN • The hub router must have at least one separate VPN rule for each spoke. In the local IP address, specify the IP addresses of the hub-and-spoke networks with which the spoke is to be able to have a VPN tunnel. This may require you to use more than one VPN rule. •...
Page 389: Figure 226 Ike Sa: Main Negotiation Mode, Steps 3 - 4: Dh Key Exchange
Diffie-Hellman (DH) Key Exchange The ZyWALL and the remote IPSec router use a DH key exchange to establish a shared secret, which is used to generate encryption keys for IKE SA and IPSec SA. In main mode, the DH key exchange is done in steps 3 and 4, as illustrated below. Figure 226 IKE SA: Main Negotiation Mode, Steps 3 - 4: DH Key Exchange The DH key exchange is based on DH key groups.
Page 390: Table 111 Vpn Example: Matching Id Type And Content
Chapter 19 IPSec VPN The ZyWALL and the remote IPSec router each has its own identity, so each one must store two sets of information, one for itself and one for the other router. Local ID type and ID content refers to the ID type and ID content that applies to the router itself, and peer ID type and ID content refers to the ID type and ID content that applies to the other router in the IKE The ZyWALL’s local and peer ID type and ID content must match the remote IPSec router’s peer and local ID type and ID content, respectively.
Page 391 You must set up the certificates for the ZyWALL and remote IPSec router before you can use certificates in IKE SA. See more information about certificates. Extended Authentication Extended authentication is often used when multiple IPSec routers use the same VPN tunnel to connect to a single IPSec router.
Page 392: Figure 228 Vpn/Nat Example
Chapter 19 IPSec VPN VPN, NAT, and NAT Traversal In the following example, there is another router (A) between router X and router Y. Figure 228 VPN/NAT Example If router A does NAT, it might change the IP addresses, port numbers, or both. If router X and router Y try to establish a VPN tunnel, the authentication fails because it depends on this information.
Page 393 You can configure a remote network as 0.0.0.0 (any) when: • Forwarding all outgoing traffic to the remote gateway. • The remote network's addresses are unknown or there are many remote networks using one VPN rule (see one VPN rule). It is not recommended to set a VPN rule’s local and remote network settings both to 0.0.0.0 (any).
Page 394: Figure 229 Virtual Mapping Of Local And Remote Network Ip Addresses
Chapter 19 IPSec VPN Figure 229 Virtual Mapping of Local and Remote Network IP Addresses Computers on network X use IP addresses 192.168.1.2 to 192.168.1.4 to access local network devices and IP addresses 172.21.2.2 to 172.21.2.27 to access the remote network devices. Computers on network Y use IP addresses 192.168.1.2 to 192.168.1.27 to access local network devices and IP addresses 10.0.0.2 to 10.0.0.4 to access the remote network devices.
Page 395: Ipsec Sa Proposal And Perfect Forward Secrecy
In tunnel mode, the ZyWALL uses the active protocol to encapsulate the entire IP packet. As a result, there are two IP headers: • Outside header: The outside IP header contains the IP address of the ZyWALL or remote IPSec router, whichever is the destination. •...
Page 396: Additional Ipsec Vpn Topics
Chapter 19 IPSec VPN Additional IPSec VPN Topics This section discusses other IPSec VPN topics that apply to either IKE SAs or IPSec SAs or both. Relationships between the topics are also highlighted. SA Life Time SAs have a lifetime that specifies how long the SA lasts until it times out. When an SA times out, the ZyWALL automatically renegotiates the SA in the following situations: •...
Page 397: Figure 231 Ipsec High Availability
Figure 231 IPSec High Availability When setting up an IPSec high availability VPN tunnel, the remote IPSec router: • Must have multiple WAN connections • Only needs one corresponding IPSec rule • Should only have IPSec high availability settings in its corresponding IPSec rule if your ZyWALL has multiple WAN connections •...
Page 398 Chapter 19 IPSec VPN ZyWALL 5/35/70 Series User’s Guide...
Page 399: Certificates
H A P T E R 20.1 Overview The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. A certificate contains the certificate owner’s identity and public key. Certificates provide a way to exchange public keys for use in authentication. 20.1.1 What You Can Do in the Certificate Screens •...
Page 400: Verifying A Certificate
Chapter 20 Certificates The ZyWALL uses certificates based on public-key cryptology to authenticate users attempting to establish a connection. The method used to secure the data that you send through an established connection depends on the type of connection. For example, a VPN tunnel might use the triple DES encryption algorithm.
Page 401: The My Certificates Screen
Figure 233 Certificate Details 4 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation. Possible examples would be over the telephone or through an HTTPS connection.
Page 402: Figure 234 Security > Certificates > My Certificates
Chapter 20 Certificates Figure 234 SECURITY > CERTIFICATES > My Certificates The following table describes the labels in this screen. Table 113 SECURITY > CERTIFICATES > My Certificates LABEL PKI Storage Space in Use Replace Name Type Subject DESCRIPTION This bar displays the percentage of the ZyWALL’s PKI storage space that is currently in use.
Page 403: The My Certificate Details Screen
Table 113 SECURITY > CERTIFICATES > My Certificates (continued) LABEL DESCRIPTION Issuer This field displays identifying information about the certificate’s issuing certification authority, such as a common name, organizational unit or department, organization or company and country. With self-signed certificates, this is the same information as in the Subject field.
Page 404: Figure 235 Security > Certificates > My Certificates > Details
Chapter 20 Certificates Figure 235 SECURITY > CERTIFICATES > My Certificates > Details The following table describes the labels in this screen. Table 114 SECURITY > CERTIFICATES > My Certificates > Details LABEL Name Certificate Information Type Version Serial Number Subject DESCRIPTION This field displays the identifying name of this certificate.
Page 405 Table 114 SECURITY > CERTIFICATES > My Certificates > Details (continued) LABEL DESCRIPTION Issuer This field displays identifying information about the certificate’s issuing certification authority, such as Common Name, Organizational Unit, Organization and Country. With self-signed certificates, this is the same as the Subject Name field. Signature Algorithm This field displays the type of algorithm that was used to sign the certificate.
Page 406: The My Certificate Export Screen
Chapter 20 Certificates 20.3 The My Certificate Export Screen Click SECURITY > CERTIFICATES > My Certificates and then a certificate’s export icon to open the My Certificate Export screen. Follow the instructions in this screen to choose the file format to use for saving the certificate from the ZyWALL to a computer. You can export a certificate in one of these file formats: •...
Page 407: The My Certificate Import Screen
20.4 The My Certificate Import Screen You can only import a certificate that matches a corresponding certification request that was generated by the ZyWALL (the certification request contains the private key). The certificate you import replaces the corresponding request in the My Certificates screen. One exception is that you can import a PKCS#12 format certificate without a corresponding certification request since the certificate includes the private key.
Page 408: Figure 237 Security > Certificates > My Certificates > Import
Chapter 20 Certificates Figure 237 SECURITY > CERTIFICATES > My Certificates > Import The following table describes the labels in this screen. Table 116 SECURITY > CERTIFICATES > My Certificates > Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. Browse Click Browse to find the certificate file you want to upload.
Page 409: The My Certificate Create Screen
20.5 The My Certificate Create Screen Click SECURITY > CERTIFICATES > My Certificates > Create to open the My Certificate Create screen. Use this screen to have the ZyWALL create a self-signed certificate, enroll a certificate with a certification authority or generate a certification request. Figure 239 SECURITY >...
Page 410: Figure 240 Security > Certificates > My Certificates > Create (Advanced)
Chapter 20 Certificates Figure 240 SECURITY > CERTIFICATES > My Certificates > Create (Advanced) The following table describes the labels in this screen. Table 118 SECURITY > CERTIFICATES > My Certificates > Create LABEL Certificate Name Subject Information The fields below display when you click << Basic. DESCRIPTION Type up to 31 ASCII characters (not including spaces) to identify this certificate.
Page 411 Table 118 SECURITY > CERTIFICATES > My Certificates > Create (continued) LABEL Common Name Organizational Unit Organization Country The fields below display when you click Advanced >>. Subject Name ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Select a radio button to identify the certificate’s owner by IP address, domain name or e-mail address.
Page 412 Chapter 20 Certificates Table 118 SECURITY > CERTIFICATES > My Certificates > Create (continued) LABEL Subject Alternative Name Key Length << Basic/Advanced >> Enrollment Options Create a self-signed certificate Create a certification request and save it locally for later manual enrollment Create a certification request and enroll for a certificate...
Page 413: The Trusted Cas Screen
Table 118 SECURITY > CERTIFICATES > My Certificates > Create (continued) LABEL RA Signing Certificate If you select Enrollment via an RA, select the CA’s RA signing certificate from RA Encryption Certificate Request Authentication Reference Number Apply Cancel • After you click Apply in the My Certificate Create screen, you see a screen that tells you the ZyWALL is generating the self-signed certificate or certification request.
Page 414: Figure 241 Security > Certificates > Trusted Cas
Chapter 20 Certificates Figure 241 SECURITY > CERTIFICATES > Trusted CAs The following table describes the labels in this screen. Table 119 SECURITY > CERTIFICATES > Trusted CAs LABEL PKI Storage Space in Use Name Subject Issuer Valid From Valid To CRL Issuer DESCRIPTION This bar displays the percentage of the ZyWALL’s PKI storage space that is...
Page 415: The Trusted Ca Details Screen
Table 119 SECURITY > CERTIFICATES > Trusted CAs (continued) LABEL DESCRIPTION Modify Click the details icon to open a screen with an in-depth list of information about the certificate. Use the export icon to save the certificate to a computer. Click the icon and then Save in the File Download screen.
Page 416: Figure 242 Security > Certificates > Trusted Cas > Details
Chapter 20 Certificates Figure 242 SECURITY > CERTIFICATES > Trusted CAs > Details The following table describes the labels in this screen. Table 120 SECURITY > CERTIFICATES > Trusted CAs > Details LABEL Name Property Check incoming certificates issued by this CA against a DESCRIPTION This field displays the identifying name of this certificate.
Page 417 Table 120 SECURITY > CERTIFICATES > Trusted CAs > Details (continued) LABEL DESCRIPTION Certification Path Click the Refresh button to have this read-only text box display the end entity’s certificate and a list of certification authority certificates that shows the hierarchy of certification authorities that validate the end entity’s certificate.
Page 418: The Trusted Ca Import Screen
Chapter 20 Certificates Table 120 SECURITY > CERTIFICATES > Trusted CAs > Details (continued) LABEL CRL Distribution Points MD5 Fingerprint SHA1 Fingerprint Certificate in PEM (Base-64) Encoded Format Apply Cancel 20.8 The Trusted CA Import Screen Click SECURITY > CERTIFICATES > Trusted CAs to open the Trusted CAs screen and then click Import to open the Trusted CA Import screen.
Page 419: The Trusted Remote Hosts Screen
Figure 243 SECURITY > CERTIFICATES > Trusted CAs > Import The following table describes the labels in this screen. Table 121 SECURITY > CERTIFICATES > Trusted CAs Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. Browse Click Browse to find the certificate file you want to upload.
Page 420: Figure 244 Security > Certificates > Trusted Remote Hosts
Chapter 20 Certificates Figure 244 SECURITY > CERTIFICATES > Trusted Remote Hosts The following table describes the labels in this screen. Table 122 SECURITY > CERTIFICATES > Trusted Remote Hosts LABEL PKI Storage Space in Use Issuer (My Default Self-signed Certificate) Name Subject...
Page 421: The Trusted Remote Hosts Import Screen
20.10 The Trusted Remote Hosts Import Screen Click SECURITY > CERTIFICATES > Trusted Remote Hosts to open the Trusted Remote Hosts screen and then click Import to open the Trusted Remote Host Import screen. You may have peers with certificates that you want to trust, but the certificates were not signed by one of the certification authorities on the Trusted CAs screen.
Page 422: The Trusted Remote Host Certificate Details Screen
Chapter 20 Certificates 20.11 The Trusted Remote Host Certificate Details Screen Click SECURITY > CERTIFICATES > Trusted Remote Hosts to open the Trusted Remote Hosts screen. Click the details icon to open the Trusted Remote Host Details screen. You can use this screen to view in-depth information about the trusted remote host’s certificate and/or change the certificate’s name.
Page 423: Table 124 Security > Certificates > Trusted Remote Hosts > Details
The following table describes the labels in this screen. Table 124 SECURITY > CERTIFICATES > Trusted Remote Hosts > Details LABEL Name Certification Path Refresh Certificate Information Type Version Serial Number Subject Issuer Signature Algorithm Valid From Valid To Key Algorithm Subject Alternative Name Key Usage...
Page 424: The Directory Servers Screen
Chapter 20 Certificates Table 124 SECURITY > CERTIFICATES > Trusted Remote Hosts > Details (continued) LABEL MD5 Fingerprint SHA1 Fingerprint Certificate in PEM (Base-64) Encoded Format Apply Cancel 20.12 The Directory Servers Screen Click SECURITY > CERTIFICATES > Directory Servers to open the Directory Servers screen.
Page 425: The Directory Server Add Or Edit Screen
The following table describes the labels in this screen. Table 125 SECURITY > CERTIFICATES > Directory Servers LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use. When the storage space is almost full, you should consider deleting expired or unnecessary certificates before adding more certificates.
Page 426: Table 126 Security > Certificates > Directory Server > Add
Chapter 20 Certificates The following table describes the labels in this screen. Table 126 SECURITY > CERTIFICATES > Directory Server > Add LABEL Directory Service Setting Name Access Protocol Server Address Server Port Login Setting Login Password Apply Cancel A. At the time of writing, LDAP is the only choice of directory server access protocol. DESCRIPTION Type up to 31 ASCII characters (spaces are not permitted) to identify this directory server.
Page 427: Authentication Server Screens
H A P T E R Authentication Server Screens 21.1 Overview This chapter discusses how to configure the ZyWALL’s authentication server feature. A ZyWALL set to be a VPN extended authentication server can use either the local user database internal to the ZyWALL or an external RADIUS server for an unlimited number of users.
Page 428: The Local User Database Screen
Chapter 21 Authentication Server Screens 21.2 The Local User Database Screen Click SECURITY > AUTH SERVER to open the Local User Database screen. The local user database is a list of user profiles stored on the ZyWALL. The ZyWALL can use this list of user profiles to authenticate users.
Page 429: Figure 249 Security > Auth Server > Local User Database
Chapter 21 Authentication Server Screens Figure 249 SECURITY > AUTH SERVER > Local User Database ZyWALL 5/35/70 Series User’s Guide...
Page 430: The Radius Screen
Chapter 21 Authentication Server Screens The following table describes the labels in this screen. Table 127 SECURITY > AUTH SERVER > Local User Database LABEL DESCRIPTION Active Select this check box to enable the user profile. User Name Enter the user name of the user profile. Password Enter a password up to 31 characters long for this user profile.
Page 431 Table 128 SECURITY > AUTH SERVER > RADIUS LABEL Accounting Server Active Server IP Address Port Number Apply Reset ZyWALL 5/35/70 Series User’s Guide Chapter 21 Authentication Server Screens DESCRIPTION Enter a password (up to 31 alphanumeric characters) as the key to be shared between the external authentication server and the ZyWALL.
Page 432 Chapter 21 Authentication Server Screens ZyWALL 5/35/70 Series User’s Guide...
Page 433: Advanced
Advanced Network Address Translation (NAT) (435) Static Route Screens (451) Policy Route Screens (457) Bandwidth Management Screens (465) DNS Screens (479) Remote Management Screens (491) UPnP Screens (519) Custom Application Screen (529) ALG Screen (531)
Page 435: Network Address Translation (Nat)
H A P T E R Network Address Translation 22.1 Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network.
Page 436: Before You Begin
Chapter 22 Network Address Translation (NAT) The following table summarizes the NAT mapping types. Table 129 NAT Mapping Types TYPE One-to-One Many-to-One (SUA/PAT) Many-to-Many Overload Many-One-to-One Server Port numbers do not change for One-to-One and Many-One-to-One NAT mapping types. SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping: Many-to-One and Server.
Page 437: Figure 251 Advanced > Nat > Nat Overview
Figure 251 ADVANCED > NAT > NAT Overview The following table describes the labels in this screen. Table 130 ADVANCED > NAT > NAT Overview LABEL DESCRIPTION Global Settings Max. This read-only field displays the highest number of NAT sessions that the ZyWALL Concurrent will permit at one time.
Page 438: The Nat Address Mapping Screen
Chapter 22 Network Address Translation (NAT) Table 130 ADVANCED > NAT > NAT Overview (continued) LABEL DESCRIPTION Address Select SUA if you have just one public WAN IP address for your ZyWALL. This lets Mapping Rules the ZyWALL use its permanent, pre-defined NAT address mapping rules. Select Full Feature if you have multiple public WAN IP addresses for your ZyWALL.
Page 439: Figure 252 Advanced > Nat > Address Mapping
Figure 252 ADVANCED > NAT > Address Mapping The following table describes the labels in this screen. Table 131 ADVANCED > NAT > Address Mapping LABEL DESCRIPTION SUA Address This read-only table displays the default address mapping rules. Mapping Rules Full Feature Address Mapping...
Page 440: Nat Address Mapping Edit
Chapter 22 Network Address Translation (NAT) Table 131 ADVANCED > NAT > Address Mapping (continued) LABEL DESCRIPTION Global Start IP This refers to the Inside Global IP Address (IGA), that is the starting global IP address. 0.0.0.0 is for a dynamic IP address from your ISP with Many-to-One and Server mapping types.
Page 441: The Port Forwarding Screen
The following table describes the labels in this screen. Table 132 ADVANCED > NAT > Address Mapping > Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. 1. One-to-One: One-to-One mode maps one local IP address to one global IP address.
Page 442: Port Forwarding: Services And Port Numbers
Chapter 22 Network Address Translation (NAT) If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup. 22.4.2 Port Forwarding: Services and Port Numbers The ZyWALL provides the additional safety of the DMZ ports for connecting your publicly accessible servers.
Page 443: Port Translation
22.4.5 Port Translation The ZyWALL can translate the destination port number or a range of port numbers of packets coming from the WAN to another destination port number or range of port numbers on the local network. When you use port forwarding without port translation, a single server on the local network can use a specific port number and be accessible to the outside world through a single WAN IP address.
Page 444: Figure 256 Advanced > Nat > Port Forwarding
Chapter 22 Network Address Translation (NAT) The last port forwarding rule is reserved for Roadrunner services. The rule is activated only when you set the WAN Encapsulation to Ethernet and the Service Type to something other than Standard. Figure 256 ADVANCED > NAT > Port Forwarding The following table describes the labels in this screen.
Page 445: The Port Triggering Screen
Table 133 ADVANCED > NAT > Port Forwarding LABEL DESCRIPTION Name Enter a name to identify this port-forwarding rule. Incoming Enter a port number here. To forward only one port, enter it again in the second Port(s) field. To specify a range of ports, enter the last port to be forwarded in the second field.
Page 446: Configuring Port Triggering
Chapter 22 Network Address Translation (NAT) 2 Port 7070 is a “trigger” port and causes the ZyWALL to record Jane’s computer IP address. The ZyWALL associates Jane's computer IP address with the "incoming" port range of 6970-7170. 3 The Real Audio server responds using a port number ranging between 6970-7170. 4 The ZyWALL forwards the traffic to Jane’s computer IP address.
Page 447: Technical Reference
Table 134 ADVANCED > NAT > Port Triggering LABEL DESCRIPTION Incoming Incoming is a port (or a range of ports) that a server on the WAN uses when it sends out a particular service. The ZyWALL forwards the traffic with this port (or range of ports) to the client computer on the LAN that requested the service.
Page 448: Figure 259 Nat Overview
Chapter 22 Network Address Translation (NAT) What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.
Page 449: Figure 260 Nat Application With Ip Alias
NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyWALL can communicate with three distinct WAN networks. More examples follow at the end of this chapter. Figure 260 NAT Application With IP Alias Port Restricted Cone NAT ZyWALL ZyNOS version 4.00 and later uses port restricted cone NAT.
Page 450: Figure 261 Port Restricted Cone Nat Example
Chapter 22 Network Address Translation (NAT) Figure 261 Port Restricted Cone NAT Example ZyWALL 5/35/70 Series User’s Guide...
Page 451: Static Route Screens
H A P T E R 23.1 Overview This chapter shows you how to configure static routes for your ZyWALL. The ZyWALL usually uses the default gateway to route outbound traffic from local computers to the Internet. To have the ZyWALL send data to devices not reachable through the default gateway, use static routes.
Page 452: The Ip Static Route Screen
Chapter 23 Static Route Screens • Use the IP Static Route Edit screen required information for a static route. 23.2 The IP Static Route Screen Click ADVANCED > STATIC ROUTE to open the IP Static Route screen (some of the screen’s blank rows are not shown).
Page 453: Figure 263 Advanced > Static Route > Ip Static Route
Figure 263 ADVANCED > STATIC ROUTE > IP Static Route The following table describes the labels in this screen. Table 135 ADVANCED > STATIC ROUTE > IP Static Route LABEL DESCRIPTION This is the number of an individual static route. Name This is the name that describes or identifies this route.
Page 454: The Ip Static Route Edit Screen
Chapter 23 Static Route Screens Table 135 ADVANCED > STATIC ROUTE > IP Static Route LABEL DESCRIPTION Gateway This is the IP address of the gateway. The gateway is a router or switch on the same network segment as the ZyWALL’s interface. The gateway helps forward packets to their destinations.
Page 455 Table 136 ADVANCED > STATIC ROUTE > IP Static Route > Edit LABEL DESCRIPTION Private This parameter determines if the ZyWALL will include this route to a remote node in its RIP broadcasts. Select this check box to keep this route private and not included in RIP broadcasts. Clear this check box to propagate this route to other hosts through RIP broadcasts.
Page 456 Chapter 23 Static Route Screens ZyWALL 5/35/70 Series User’s Guide...
Page 457: Policy Route Screens
H A P T E R 24.1 Overview This chapter covers setting and applying policies used for IP routing. Traditionally, routing is based on the destination address only and the ZyWALL takes the shortest path to forward a packet. IP Policy Routing (IPPR) provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator.
Page 458: The Policy Route Summary Screen
Chapter 24 Policy Route Screens Routing Policy Individual routing policies are used as part of the overall IPPR process. A policy defines the matching criteria and the action to take when a packet meets the criteria. The action is taken only when all the criteria are met.
Page 459: Figure 265 Advanced > Policy Route > Policy Route Summary
Figure 265 ADVANCED > POLICY ROUTE > Policy Route Summary The following table describes the labels in this screen. Table 137 ADVANCED > POLICY ROUTE > Policy Route Summary LABEL DESCRIPTION This is the number of an individual policy route. Active This field shows whether the policy is active or inactive.
Page 460: The Policy Route Edit Screen
Chapter 24 Policy Route Screens Table 137 ADVANCED > POLICY ROUTE > Policy Route Summary LABEL DESCRIPTION Gateway Enter the IP address of the gateway. The gateway is a router or switch on the same network segment as the device's LAN or WAN port. The gateway helps forward packets to their destinations.
Page 461: Figure 266 Advanced > Policy Route > Edit
Figure 266 ADVANCED > POLICY ROUTE > Edit The following table describes the labels in this screen. Table 138 ADVANCED > POLICY ROUTE > Edit LABEL DESCRIPTION Criteria Active Select the check box to activate the policy. Rule Index This is the index number of the policy route. IP Protocol Select Predefined and then the IP protocol from ALL(0), ICMP(1), IGMP(2), TCP(6), UDP(17), GRE(47), ESP(50) or AH(51).
Page 462 Chapter 24 Policy Route Screens Table 138 ADVANCED > POLICY ROUTE > Edit (continued) LABEL DESCRIPTION Length Choose from Equal, Not Equal, Less, Greater, Less or Equal or Greater or Comparison Equal. Application Select a predefined application (FTP, H.323 or SIP) for the policy rule. If you do not want to use a predefined application, select Custom.
Page 463 Table 138 ADVANCED > POLICY ROUTE > Edit (continued) LABEL DESCRIPTION Gateway Select User-Defined and enter the IP address of the gateway if you want to specify the IP address of the gateway. The gateway is an immediate neighbor of your ZyWALL that will forward the packet to the destination.
Page 464 Chapter 24 Policy Route Screens ZyWALL 5/35/70 Series User’s Guide...
Page 465: Bandwidth Management Screens
H A P T E R Bandwidth Management 25.1 Overview Bandwidth management allows you to allocate an interface’s outgoing capacity to specific types of traffic. It can also help you make sure that the ZyWALL forwards certain types of traffic, such as Voice-over-IP (VoIP), with minimum delay. Bandwidth management addresses questions such as: •...
Page 466: Application And Subnet-Based Bandwidth Management Example
Chapter 25 Bandwidth Management Screens Proportional Bandwidth Allocation Bandwidth management allows you to define how much bandwidth each class gets; however, the actual bandwidth allotted to each class decreases or increases in proportion to actual available bandwidth. Application-based Bandwidth Management You can create bandwidth classes based on individual applications (like VoIP, Web, FTP, E- mail and Video for example).
Page 467: Over Allotment Of Bandwidth Example
25.1.4 Over Allotment of Bandwidth Example It is possible to set the bandwidth management speed for an interface higher than the interface’s actual transmission speed. Higher priority traffic gets to use up to its allocated bandwidth, even if it takes up all of the interface’s available bandwidth. This could stop lower priority traffic from being sent.
Page 468: Figure 268 Advanced > Bw Mgmt > Summary
Chapter 25 Bandwidth Management Screens You can configure up to one bandwidth filter per bandwidth class. You can also configure bandwidth classes without bandwidth filters. However, it is recommended that you configure sub-classes with filters for any classes that you configure without filters. The ZyWALL leaves the bandwidth budget allocated and unused for a class that does not have a filter or sub-classes with filters.
Page 469: Table 141 Advanced > Bw Mgmt > Summary
The following table describes the labels in this screen. Table 141 ADVANCED > BW MGMT > Summary LABEL DESCRIPTION Class These read-only labels represent the physical interfaces. Select an interface’s check box to enable bandwidth management on that interface. Bandwidth management applies to all traffic flowing out of the router through the interface, regardless of the traffic’s source.
Page 470: Maximize Bandwidth Usage Example
Chapter 25 Bandwidth Management Screens 25.2.1 Maximize Bandwidth Usage Example Here is an example of a ZyWALL that has maximize bandwidth usage enabled on an interface. The following table shows each bandwidth class’s bandwidth budget. The classes are set up based on subnets.
Page 471: Reserving Bandwidth For Non-Bandwidth Class Traffic
25.2.1.2 Fairness-based Allotment of Unused and Unbudgeted Bandwidth The following table shows the amount of bandwidth that each class gets. Table 144 Fairness-based Allotment of Unused and Unbudgeted Bandwidth Example BANDWIDTH CLASSES AND ALLOTMENTS Root Class: 10240 kbps Suppose that all of the classes except for the administration class need more bandwidth. •...
Page 472: Figure 269 Advanced > Bw Mgmt > Class Setup
Chapter 25 Bandwidth Management Screens Figure 269 ADVANCED > BW MGMT > Class Setup The following table describes the labels in this screen. Table 145 ADVANCED > BW MGMT > Class Setup LABEL DESCRIPTION Interface Select an interface for which you want to set up bandwidth management classes. Bandwidth management controls outgoing traffic on an interface, not incoming.
Page 473: Bandwidth Manager Class Configuration
Table 145 ADVANCED > BW MGMT > Class Setup (continued) LABEL DESCRIPTION Destination Port This is the destination port for connections to which this bandwidth management class applies. Source IP This is the source IP address for connections to which this bandwidth management Address class applies.
Page 474: Figure 270 Advanced > Bw Mgmt > Class Setup > Add Sub-Class
Chapter 25 Bandwidth Management Screens Figure 270 ADVANCED > BW MGMT > Class Setup > Add Sub-Class The following table describes the labels in this screen. Table 146 ADVANCED > BW MGMT > Class Setup > Add Sub-Class LABEL Class Configuration Class Name Bandwidth Budget (kbps)
Page 475 Table 146 ADVANCED > BW MGMT > Class Setup > Add Sub-Class (continued) LABEL Enable Bandwidth Filter Service Destination Address Type Destination IP Address Destination End Address / Subnet Mask Destination Port ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Management Screens DESCRIPTION Select Enable Bandwidth Filter to have the ZyWALL use this bandwidth filter when it performs bandwidth management.
Page 476: Bandwidth Borrowing Example
Chapter 25 Bandwidth Management Screens Table 146 ADVANCED > BW MGMT > Class Setup > Add Sub-Class (continued) LABEL Source Address Type Do you want your rule to apply to packets coming from a particular (single) IP, Source IP Address Source End Address / Subnet Mask Source Port...
Page 477: Bandwidth Management Statistics
• The Research Software and Hardware classes can both borrow unused bandwidth from the Research class because the Research Software and Hardware classes both have bandwidth borrowing enabled. • The Research Software and Hardware classes can also borrow unused bandwidth from the Root class because the Research class also has bandwidth borrowing enabled.
Page 478: The Monitor Screen
Chapter 25 Bandwidth Management Screens 25.6 The Monitor Screen Click ADVANCED > BW MGMT > Monitor to open the following screen. Use this screen to view the device’s bandwidth usage and allotments. Figure 272 ADVANCED > BW MGMT > Monitor The following table describes the labels in this screen.
Page 479: Dns Screens
H A P T E R 26.1 Overview This chapter shows you how to configure the DNS screens. DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.
Page 480 Chapter 26 DNS Screens 3 You can manually enter the IP addresses of other DNS servers. These servers can be public or private. A DNS server could even be behind a remote IPSec router (see on page 480). Address Record An address record contains the mapping of a fully qualified domain name (FQDN) to an IP address.
Page 481: The System Screen
Figure 273 Private DNS Server Example If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote private network. DDNS DDNS (Dynamic DNS) allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.).
Page 482: Figure 274 Advanced > Dns > System Dns
Chapter 26 DNS Screens Figure 274 ADVANCED > DNS > System DNS The following table describes the labels in this screen. LABEL Address Record FQDN Wildcard IP Address Modify Name Server Record DESCRIPTION An address record specifies the mapping of a fully qualified domain name (FQDN) to an IP address.
Page 483: The Add Address Record Screen
LABEL DESCRIPTION Domain Zone A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name. From This field displays whether the IP address of a DNS server is from a WAN interface (and which it is) or specified by the user.
Page 484: The Insert Name Server Record Screen
Chapter 26 DNS Screens The following table describes the labels in this screen. Table 148 ADVANCED > DNS > Add (Address Record) LABEL FQDN IP Address Enable Wildcard Apply Cancel 26.2.2 The Insert Name Server Record Screen Click Insert in the System screen to open this screen. Use this screen to insert a name server record.A name server record contains a DNS server’s IP address.
Page 485: The Dns Cache Screen
The following table describes the labels in this screen. LABEL DESCRIPTION Domain Zone This field is optional. A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name.
Page 486: Figure 277 Advanced > Dns > Cache
Chapter 26 DNS Screens Figure 277 ADVANCED > DNS > Cache The following table describes the labels in this screen. LABEL DNS Cache Setup Cache Positive DNS Resolutions Maximum TTL Cache Negative DNS Resolutions Negative Cache Period Apply Reset DNS Cache Entry Flush Refresh Cache Type...
Page 487: The Dhcp Screen
LABEL DESCRIPTION Remaining Time This is the number of seconds left before the DNS resolution entry is discarded (sec) from the cache. Modify Click the delete icon to remove the DNS resolution entry from the cache. 26.4 The DHCP Screen Click ADVANCED >...
Page 488: The Ddns Screen
Chapter 26 DNS Screens LABEL Apply Reset 26.5 The DDNS Screen First of all, you need to have registered a dynamic DNS account with www.dyndns.com. This is for people with a dynamic IP from their ISP or DHCP server that would still like to have a domain name.
Page 489: Configuring The Dynamic Dns Screen
High Availability A DNS server maps a domain name to a port's IP address. If that WAN port loses its connection, high availability allows the router to substitute another port's IP address for the domain name mapping. 26.6 Configuring the Dynamic DNS Screen To change your ZyWALL’s DDNS, click ADVANCED >...
Page 490 Chapter 26 DNS Screens LABEL Domain Name 1~5 DDNS Type Offline Wildcard WAN Interface IP Address Update Policy Apply Reset DESCRIPTION Enter the host names in these fields. Select the type of service that you are registered for from your Dynamic DNS service provider if you have selected WWW.DynDNS.COM.
Page 491: Remote Management Screens
H A P T E R Remote Management Screens 27.1 Overview This chapter provides information on the remote management screens. Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers. The following figure shows secure and insecure management of the ZyWALL coming in from the WAN.
Page 492: What You Need To Know About Remote Management
Chapter 27 Remote Management Screens 27.1.2 What You Need To Know About Remote Management Firewall Rules When you configure remote management to allow management from any network except the LAN, you still need to configure a firewall rule to allow access. See for details on configuring firewall rules.
Page 493: Https Example
27.2 HTTPS Example If you haven’t changed the default HTTPS port on the ZyWALL, then in your browser enter “https://ZyWALL IP Address/” as the web site address where “ZyWALL IP Address” is the IP address or domain name of the ZyWALL you wish to access. 27.2.1 Internet Explorer Warning Messages When you attempt to access the ZyWALL HTTPS server, a Windows dialog box pops up asking if you trust the server certificate.
Page 494: Avoiding The Browser Warning Messages
Chapter 27 Remote Management Screens Figure 282 Security Certificate 1 (Netscape) Figure 283 Security Certificate 2 (Netscape) 27.2.3 Avoiding the Browser Warning Messages The following describes the main reasons that your browser displays warnings about the ZyWALL’s HTTPS server certificate and what you can do to avoid seeing the warnings. •...
Page 495: Login Screen
6a Click REMOTE MGMT. Write down the name of the certificate displayed in the Server Certificate field. 6b Click CERTIFICATES. Find the certificate and check its Subject column. CN stands for certificate’s common name (see Use this procedure to have the ZyWALL use a certificate with a common name that matches the ZyWALL’s actual IP address.
Page 496: Enrolling And Importing Ssl Client Certificates (Example)
Chapter 27 Remote Management Screens Figure 286 Device-specific Certificate Click Ignore in the Replace Certificate screen to use the common ZyWALL certificate. You will then see this information in the My Certificates screen. Figure 287 Common ZyWALL Certificate 27.2.5 Enrolling and Importing SSL Client Certificates (Example) The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyWALL.
Page 497: Installing The Ca's Certificate (Example)
Figure 288 ZyWALL Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). 27.2.6 Installing the CA’s Certificate (Example) 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown next.
Page 498: Installing Your Personal Certificate(S) (Example)
Chapter 27 Remote Management Screens Figure 289 CA Certificate Example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. 27.2.7 Installing Your Personal Certificate(s) (Example) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment.
Page 499: Figure 290 Personal Certificate Import Wizard 1
Figure 290 Personal Certificate Import Wizard 1 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. Figure 291 Personal Certificate Import Wizard 2 3 Enter the password given to you by the CA.
Page 500: Figure 292 Personal Certificate Import Wizard 3
Chapter 27 Remote Management Screens Figure 292 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 293 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process.
Page 501: Using A Certificate When Accessing The Zywall (Example)
Figure 294 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 295 Personal Certificate Import Wizard 6 27.2.8 Using a Certificate When Accessing the ZyWALL (Example) Use the following procedure to access the ZyWALL via HTTPS. 1 Enter ‘https://ZyWALL IP Address/ in your browser’s web address field.
Page 502: Secure Telnet Using Ssh Examples
Chapter 27 Remote Management Screens Figure 297 SSL Client Authentication 3 You next see the web configurator login screen. Figure 298 Secure Web Configurator Login Screen 27.2.9 Secure Telnet Using SSH Examples This section shows two examples using a command interface and a graphical interface SSH client program to remotely access the ZyWALL.
Page 503: Figure 299 Ssh Example 1: Store Host Key
Figure 299 SSH Example 1: Store Host Key Enter the password to log in to the ZyWALL. The SMT main menu displays next. 27.2.9.2 Example 2: Linux This section describes how to access the ZyWALL using the OpenSSH client program that comes with most Linux distributions.
Page 504: The Www Screen
Chapter 27 Remote Management Screens 3 The SMT main menu displays next. 27.2.9.3 Secure FTP Using SSH Example This section shows an example on file transfer using the OpenSSH client program. The configuration and connection steps are similar for other SSH client programs. Refer to your SSH client program user’s guide.
Page 505: Configuring The Www Screen
requires it to do so (select Authenticate Client Certificates in the REMOTE MGMT > WWW screen). Authenticate Client Certificates is optional and if selected means the SSL- client must send the ZyWALL a certificate. You must apply for a certificate for the browser from a CA that is a trusted CA on the ZyWALL.
Page 506: Figure 304 Advanced > Remote Mgmt > Www
Chapter 27 Remote Management Screens Figure 304 ADVANCED > REMOTE MGMT > WWW The following table describes the labels in this screen. Table 149 ADVANCED > REMOTE MGMT > WWW LABEL DESCRIPTION HTTPS Server Select the Server Certificate that the ZyWALL will use to identify itself. The Certificate ZyWALL is the SSL server and must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the ZyWALL).
Page 507: The Ssh Screen
Table 149 ADVANCED > REMOTE MGMT > WWW (continued) LABEL DESCRIPTION Server Access Select the interface(s) through which a computer may access the ZyWALL using this service. Secure Client IP A secure client is a “trusted” computer that is allowed to communicate with the Address ZyWALL using this service.
Page 508: The Telnet Screen
Chapter 27 Remote Management Screens It is recommended that you disable Telnet and FTP when you configure SSH for secure connections. Figure 306 ADVANCED > REMOTE MGMT > SSH The following table describes the labels in this screen. Table 150 ADVANCED > REMOTE MGMT > SSH LABEL DESCRIPTION Server Host Key...
Page 509: The Ftp Screen
It is recommended that you disable Telnet and FTP when you configure SSH for secure connections. Figure 307 ADVANCED > REMOTE MGMT > Telnet The following table describes the labels in this screen. Table 151 ADVANCED > REMOTE MGMT > Telnet LABEL DESCRIPTION Server Port...
Page 510: The Snmp Screen
Chapter 27 Remote Management Screens It is recommended that you disable Telnet and FTP when you configure SSH for secure connections. Figure 308 ADVANCED > REMOTE MGMT > FTP The following table describes the labels in this screen. Table 152 ADVANCED > REMOTE MGMT > FTP LABEL DESCRIPTION Server Port...
Page 511: Figure 309 Snmp Management Model
Figure 309 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyWALL). An agent translates the local management information from the managed device into a form compatible with SNMP.
Page 512: Configuring The Snmp Screen
Chapter 27 Remote Management Screens SNMP Traps The ZyWALL will send traps to the SNMP manager when any one of the following events occurs: Table 153 SNMP Traps TRAP # TRAP NAME coldStart (defined in RFC-1215) warmStart (defined in RFC- 1215) authenticationFailure (defined in RFC-1215)
Page 513: The Dns Screen
The following table describes the labels in this screen. Table 154 ADVANCED > REMOTE MGMT > SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests.
Page 514: The Cnm Screen
Chapter 27 Remote Management Screens Figure 311 ADVANCED > REMOTE MGMT > DNS The following table describes the labels in this screen. Table 155 ADVANCED > REMOTE MGMT > DNS LABEL DESCRIPTION Server Port The DNS service port number is 53 and cannot be changed here. Service Access Select the interface(s) through which a computer may send DNS queries to the ZyWALL.
Page 515: Figure 312 Advanced > Remote Mgmt > Cnm
Figure 312 ADVANCED > REMOTE MGMT > CNM The following table describes the labels in this screen. Table 156 ADVANCED > REMOTE MGMT > CNM LABEL Registration Information Registration Status Last Registration Time This field displays the last date (year-month-date) and time (hours-minutes- Refresh Vantage CNM Setup Enable...
Page 516: Remote Management Technical Reference
Chapter 27 Remote Management Screens Table 156 ADVANCED > REMOTE MGMT > CNM (continued) LABEL Encryption Algorithm Encryption Key Apply Reset 27.13 Remote Management Technical Reference How SSH Works The following table summarizes how a secure connection is established between two remote hosts.
Page 517 The client automatically saves any new server public keys. In subsequent connections, the server public key is checked against the saved version on the client computer. 2 Encryption Method Once the identification is verified, both the client and server must agree on the type of encryption method to use.
Page 518 Chapter 27 Remote Management Screens ZyWALL 5/35/70 Series User’s Guide...
Page 519: Upnp Screens
H A P T E R 28.1 Overview This chapter introduces the Universal Plug and Play feature. This chapter is only applicable when the ZyWALL is in router mode. Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices.
Page 520: Upnp Examples
Chapter 28 UPnP Screens Cautions with UPnP The automated nature of NAT traversal applications in establishing their own services and opening firewall ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments. When a UPnP device joins a network, it announces its presence with a multicast message.
Page 521 28.2.1.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windows Me. 1 Click Start, Settings and Control Panel. Double-click Add/Remove Programs. 2 Click on the Windows Setup tab and select Communication in the Components selection box. Click Details.
Page 522: Using Upnp In Windows Xp Example
Chapter 28 UPnP Screens 28.2.1.2 Installing UPnP in Windows XP Follow the steps below to install UPnP in Windows XP. 1 Click Start, Settings and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components ….
Page 523 28.2.2.1 Auto-discover Your UPnP-enabled Network Device 1 Click Start and Control Panel. Double-click Network Connections. An icon displays under Internet Gateway. 2 Right-click the icon and select Properties. 3 In the Internet Connection Properties window, click Settings to see the port mappings that were automatically created.
Page 524 Chapter 28 UPnP Screens When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 4 Select the Show icon in notification area when connected check box and click OK. An icon displays in the system tray.
Page 525 Follow the steps below to access the web configurator. 1 Click Start and then Control Panel. 2 Double-click Network Connections. 3 Select My Network Places under Other Places. 4 An icon with the description for each UPnP-enabled device displays under Local Network.
Page 526: The Upnp Screen
Chapter 28 UPnP Screens 6 Right-click the icon for your ZyXEL device and select Properties. A properties window displays with basic information about the ZyXEL device. 28.3 The UPnP Screen Click ADVANCED > UPnP to display the UPnP screen. Figure 314 ADVANCED > UPnP The following table describes the fields in this screen.
Page 527: The Ports Screen
Table 157 ADVANCED > UPnP LABEL Allow users to make configuration changes through UPnP Allow UPnP to pass through Firewall Outgoing WAN Interface Apply Reset 28.4 The Ports Screen Click ADVANCED > UPnP > Ports to display the UPnP Ports screen. Use this screen to view the NAT port mapping rules that UPnP creates on the ZyWALL.
Page 528 Chapter 28 UPnP Screens Table 158 ADVANCED > UPnP > Ports (continued) LABEL DESCRIPTION This is the index number of the UPnP-created NAT mapping rule entry. Remote Host This field displays the source IP address (on the WAN) of inbound IP packets. Since this is often a wildcard, the field may be blank.
Page 529: Custom Application Screen
H A P T E R Custom Application Screen 29.1 Overview Use custom application to have the ZyWALL’s ALG, anti-spam, anti-virus, and content filtering features monitor traffic on custom ports, in addition to the default ports. 29.1.1 What You Can Do in the Custom Application Screen Use the Custom App screen settings on the ZyWALL.
Page 530: Figure 316 Advanced > Custom App
Chapter 29 Custom Application Screen Changes in the Custom APP screen do not apply to the firewall. Figure 316 ADVANCED > Custom APP The following table describes the labels in this screen. Table 159 ADVANCED > Custom APP LABEL DESCRIPTION Application Select the application for which you want the ZyWALL to monitor specific ports.
Page 531: Alg Screen
H A P T E R 30.1 Overview This chapter covers how to use the ZyWALL’s ALG feature to allow certain applications to pass through the ZyWALL. An Application Layer Gateway (ALG) manages a specific protocol (such as SIP, H.323 or FTP) at the application layer.
Page 532 Chapter 30 ALG Screen ALG and the Firewall The ZyWALL uses the dynamic port that the session uses for data transfer in creating an implicit temporary firewall rule for the session’s traffic. The firewall rule only allows the session’s traffic to go through in the direction that the ZyWALL determines from its inspection of the data payload of the application’s packets.
Page 533: Figure 317 H.323 Alg Example
• You must configure the firewall and port forwarding to allow incoming (peer-to-peer) calls from the WAN to a private IP address on the LAN, DMZ or WLAN. The following example shows H.323 signaling (1) and audio (2) sessions between H.323 devices A and Figure 317 H.323 ALG Example •...
Page 534: Figure 319 H.323 Calls From The Wan With Multiple Outgoing Calls
Chapter 30 ALG Screen Figure 319 H.323 Calls from the WAN with Multiple Outgoing Calls • The H.323 ALG operates on TCP packets with a port 1720 destination. • The ZyWALL allows H.323 audio connections. • The ZyWALL can also apply bandwidth management to traffic that goes through the H.323 ALG.
Page 535: The Alg Screen
Figure 320 SIP ALG Example SIP Signaling Session Timeout Most SIP clients have an “expire” mechanism indicating the lifetime of signaling sessions. The SIP user agent sends registration packets to the SIP server periodically and keeps the session alive in the ZyWALL. If the SIP client does not have this mechanism and makes no calls during the ZyWALL SIP timeout default (60 minutes), the ZyWALL SIP ALG drops any incoming calls after the timeout period.
Page 536: Figure 321 Advanced > Alg
Chapter 30 ALG Screen Figure 321 ADVANCED > ALG The following table describes the labels in this screen. Table 160 ADVANCED > ALG LABEL DESCRIPTION Enable FTP Select this check box to allow FTP sessions to pass through the ZyWALL. FTP (File Transfer Program) is a program that enables fast transfer of files, including large files that may not be possible by e-mail.
Page 537: Reports, Logs And Maintenance
Reports, Logs and Maintenance Reports Screens (539) Logs Screens (555) Maintenance Screens (585)
Page 539: Reports Screens
H A P T E R 31.1 Overview The Reports screens display statistics about network usage and IDP, anti-virus and anti-spam statistics. You can also configure how reports are emailed. 31.1.1 What You Can Do in the Reports Screens • Use the Traffic Statistics screen an interface.
Page 540: Figure 322 Reports > Traffic Statistics
Chapter 31 Reports Screens The web site hit count may not be 100% accurate because sometimes when an individual web page loads, it may contain references to other web sites that also get counted as hits. Figure 322 REPORTS > Traffic Statistics Enabling the ZyWALL’s reporting function decreases the overall throughput by about 1 Mbps.
Page 541: Viewing Web Site Hits
Table 161 REPORTS > Traffic Statistics LABEL DESCRIPTION Report Type Use the drop-down list box to select the type of reports to display. Web Site Hits displays the web sites that have been visited the most often from the LAN and how many times they have been visited. Protocol/Port displays the protocols or service ports that have been used the most and the amount of traffic for the most used protocols or service ports.
Page 542: Viewing Host Ip Address
Chapter 31 Reports Screens Figure 323 REPORTS > Traffic Statistics: Web Site Hits Example The following table describes the label in this screen. Table 162 REPORTS > Traffic Statistics: Web Site Hits Report LABEL DESCRIPTION Web Site This column lists the domain names of the web sites visited most often from computers on the LAN, DMZ or WLAN.
Page 543: Viewing Protocol/Port
Computers take turns using dynamically assigned LAN, DMZ or WLAN IP addresses. The ZyWALL continues recording the bytes sent to or from a LAN, DMZ or WLAN IP address when it is assigned to a different computer. Figure 324 REPORTS > Traffic Statistics: Host IP Address Example The following table describes the labels in this screen.
Page 544: Figure 325 Reports > Traffic Statistics: Protocol/Port Example
Chapter 31 Reports Screens Figure 325 REPORTS > Traffic Statistics: Protocol/Port Example The following table describes the labels in this screen. Table 164 REPORTS > Traffic Statistics: Protocol/ Port LABEL DESCRIPTION Protocol/Port This column lists the protocols or service ports for which the most traffic has gone through the ZyWALL.
Page 545: System Reports Specifications
31.2.4 System Reports Specifications The following table lists detailed specifications on the reports feature. Table 165 Report Specifications LABEL DESCRIPTION Number of web sites/protocols or ports/IP addresses listed: Hit count limit: Up to 2 four billion. Bytes count Up to 2 limit: starts over at 0 if it passes 2 31.3 The IDP Screen...
Page 546: Table 166 Reports > Idp
Chapter 31 Reports Screens The following table describes the labels in this screen. Table 166 REPORTS > IDP LABEL DESCRIPTION Collect Select this check box to have the ZyWALL collect IDP statistics. Statistics The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here.
Page 547: The Anti-Virus Screen
Figure 327 REPORTS > IDP > Source The statistics display as follows when you display the top entries by destination. Figure 328 REPORTS > IDP > Destination 31.4 The Anti-Virus Screen Click REPORTS > Anti-Virus to display the Anti-Virus screen. This screen displays anti- virus statistics.
Page 548: Figure 330 Reports > Anti-Virus > Source
Chapter 31 Reports Screens The following table describes the labels in this screen. Table 167 REPORTS > Anti-Virus LABEL DESCRIPTION Collect Select this check box to have the ZyWALL collect anti-virus statistics. Statistics The collection starting time displays after you click Apply. All of the statistics in this screen are for the time period starting at the time displayed here.
Page 549: The Anti-Spam Screen
Figure 331 REPORTS > Anti-Virus > Destination 31.5 The Anti-Spam Screen Click REPORTS > Anti-Spam to display the Anti-Spam screen. This screen displays anti- spam statistics. Figure 332 REPORTS > Anti-Spam The following table describes the labels in this screen. Table 168 REPORTS >...
Page 550 Chapter 31 Reports Screens Table 168 REPORTS > Anti-Spam (continued) LABEL DESCRIPTION Phishing Mail This field displays the number of e-mails that the ZyWALL has classified as phishing. Detected No Score Mail This field displays the number of e-mails for which the ZyWALL did not receive a Detected spam score.
Page 551: The E-Mail Report Screen
Figure 333 REPORTS > Anti-Spam > Source The statistics display as follows when you display the score distribution. Figure 334 REPORTS > Anti-Spam > Score Distribution 31.6 The E-mail Report Screen You can configure the ZyWALL to email a report including the information on network traffic, IDP, anti-virus and anti-spam statistics provided in the report screens.
Page 552: Figure 335 Reports > E-Mail Report
Chapter 31 Reports Screens Figure 335 REPORTS > E-mail Report The following table describes the labels in this screen. Table 169 REPORTS > E-mail Report LABEL DESCRIPTION General Setup Enable E-mail Select this to turn on the e-mail report feature. You must then specify a valid e-mail Report server in order to send reports.
Page 553 Table 169 REPORTS > E-mail Report (continued) LABEL DESCRIPTION Send Report Click this to send the report e-mail immediately. Schedule Reporting Select the frequency of the report e-mail from the drop-down box. Options are None, Frequency Hourly, Daily and Weekly. If you select Daily or Weekly, specify a time of day for the ZyWALL to generate and send diagnostic e-mails.
Page 554 Chapter 31 Reports Screens ZyWALL 5/35/70 Series User’s Guide...
Page 555: Logs Screens
H A P T E R 32.1 Overview In the log screens you can configure general log settings and view the ZyWALL’s logs. The logs cover categories such as system maintenance, system errors, access control, allowed or blocked web sites, blocked web features (such as ActiveX controls, java and cookies), attacks (such as DoS) and IPSec.
Page 556: Log Description Example
Chapter 32 Logs Screens Figure 336 LOGS > View Log The following table describes the labels in this screen. Table 170 LOGS > View Log LABEL DESCRIPTION Display The categories that you select in the Log Settings page (see 558) display in the drop-down list box. Select a category of logs to view;...
Page 557: About The Certificate Not Trusted Log
5|06/08/2004 05:58:20 |172.21.4.187:137 |ACCESS BLOCK Firewall default policy: UDP (W to W/ZW) Table 171 Log Description Example LABEL DESCRIPTION This is log number five. time The log was generated on June 8, 2004 at 5:58 and 20 seconds AM. source The log was generated due to a NetBIOS packet sent from IP address 172.21.4.187 port 137.
Page 558: The Log Settings Screen
Chapter 32 Logs Screens Figure 337 myZyXEL.com: Download Center 3 Click the link in the Certificate Download screen. Figure 338 myZyXEL.com: Certificate Download 32.3 The Log Settings Screen To change your ZyWALL’s log settings, click LOGS > Log Settings. The screen appears as shown.
Page 559: Figure 339 Logs > Log Settings
Figure 339 LOGS > Log Settings The following table describes the labels in this screen. Table 172 LOGS > Log Settings LABEL E-mail Settings Mail Server ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Enter the server name or the IP address of the mail server for the e-mail addresses specified below.
Page 560 Chapter 32 Logs Screens Table 172 LOGS > Log Settings (continued) LABEL Mail Subject Mail Sender Send Log To Send Alerts To SMTP Authentication User Name Password Schedule Log Schedule Day for Sending Log Time for Sending Log Syslog Logging Active Syslog Server Log Facility...
Page 561: Technical Reference
Table 172 LOGS > Log Settings (continued) LABEL Active Log Consolidation Period Apply Reset 32.4 Technical Reference Log Descriptions This section provides descriptions of example log messages. The variables “%d”, “%x” and “%s” respectively refer to decimal numbers, hexadecimal numbers and strings (a list of upper/lower case letters or numbers). Table 173 System Maintenance Logs LOG MESSAGE Time set from NTP server:...
Page 562 Chapter 32 Logs Screens Table 173 System Maintenance Logs (continued) LOG MESSAGE Starting Connectivity Monitor Time initialized by Daytime Server Time initialized by Time server Time initialized by NTP server Connect to Daytime server fail Connect to Time server fail Connect to NTP server fail Too large ICMP packet has been dropped...
Page 563: Table 174 System Error Logs
Table 173 System Maintenance Logs (continued) LOG MESSAGE Remote node is connecting. Remote node is dropping Table 174 System Error Logs LOG MESSAGE %s exceeds the max. number of session per host! setNetBIOSFilter: calloc error readNetBIOSFilter: calloc error WAN%d connection is up WAN connection is down.
Page 564: Table 176 Tcp Reset Logs
Chapter 32 Logs Screens Table 175 Access Control Logs (continued) LOG MESSAGE Triangle route packet forwarded: [ TCP | UDP | IGMP | ESP | GRE | OSPF ] Packet without a NAT table entry blocked: [ TCP | UDP | IGMP | ESP | GRE | OSPF ] Router sent blocked web site message: TCP...
Page 565: Table 177 Packet Filter Logs
Table 176 TCP Reset Logs (continued) LOG MESSAGE Firewall session time out, sent TCP RST Exceed MAX incomplete, sent TCP RST Access block, sent TCP Table 177 Packet Filter Logs LOG MESSAGE [ TCP | UDP | ICMP | IGMP | Generic ] packet filter matched (set: %d, rule: %d) or type and code details, see...
Page 566: Table 179 Cdr Logs
Chapter 32 Logs Screens Table 179 CDR Logs LOG MESSAGE board %d line %d channel %d, call %d, %s C01 Outgoing Call dev=%x ch=%x %s board %d line %d channel %d, call %d, %s C02 OutCall Connected %d %s board %d line %d channel %d, call %d, %s C02 Call Terminated Table 180 PPP Logs...
Page 567: Table 182 Upnp Logs
Table 181 3G Logs (continued) LOG MESSAGE 3G SIM authentication failed because of no response from SIM card. 3G card has no response, card is restarted. 3G SIM card PIN code is incorrect. The 3G card is not activated. 3G Modem is locked. SIM card not inserted or damaged.
Page 568: Table 183 Content Filtering Logs
Chapter 32 Logs Screens Table 183 Content Filtering Logs LOG MESSAGE %s: Keyword blocking %s: Not in trusted web list %s: Forbidden Web site The web site is in the forbidden web site list. %s: Contains ActiveX %s: Contains Java applet %s: Contains cookie %s: Proxy mode...
Page 569 Table 184 Attack Logs (continued) LOG MESSAGE ip spoofing - WAN [ TCP | UDP | IGMP | ESP | GRE | OSPF ] ip spoofing - WAN ICMP (type:%d, code:%d) icmp echo : ICMP (type:%d, code:%d) syn flood TCP ports scan TCP teardrop TCP teardrop UDP...
Page 570: Table 185 Remote Management Logs
Chapter 32 Logs Screens Table 185 Remote Management Logs LOG MESSAGE Remote Management: FTP denied Remote Management: TELNET denied Remote Management: HTTP or UPnP denied Remote Management: WWW denied Remote Management: HTTPS denied Remote Management: SSH denied Remote Management: ICMP Ping response denied Remote Management: SNMP denied Remote Management: DNS denied...
Page 571: Table 187 Ipsec Logs
Table 187 IPSec Logs LOG MESSAGE Discard REPLAY packet Inbound packet authentication failed Receive IPSec packet, but no corresponding tunnel exists Rule <%d> idle time out, disconnect WAN IP changed to <IP> Inbound packet decryption failed Cannot find outbound SA for rule <%d>...
Page 572 Chapter 32 Logs Screens Table 188 IKE Logs (continued) LOG MESSAGE No proposal chosen Local / remote IPs of incoming request conflict with rule <%d> Cannot resolve Secure Gateway Addr for rule <%d> Peer ID: <peer id> <My remote type> -<My local type> vs.
Page 573 Table 188 IKE Logs (continued) LOG MESSAGE ERROR !!! build_id(): Unable to obtain my DSS keys Build Phase 1 ID Adjust TCP MSS to %d Rule <%d> input idle time out, disconnect XAUTH succeed! Remote user: <Username> XAUTH fail! Remote user: <Username>...
Page 574: Table 189 Pki Logs
Chapter 32 Logs Screens Table 188 IKE Logs (continued) LOG MESSAGE Rule [%d] Tunnel built successfully Rule [%d] Peer's public key not found Rule [%d] Verify peer's signature failed Rule [%d] Sending IKE request Rule [%d] Receiving IKE request Swap rule to rule [%d] Rule [%d] Phase 1 key length mismatch Rule [%d] phase 1 mismatch...
Page 575 Table 189 PKI Logs (continued) LOG MESSAGE Enrollment failed Failed to resolve <CMP CA server url> Rcvd ca cert: <subject name> Rcvd user cert: <subject name> Rcvd CRL <size>: <issuer name> Rcvd ARL <size>: <issuer name> Failed to decode the received ca cert Failed to decode the received user cert...
Page 576: Table 190 802.1X Logs
Chapter 32 Logs Screens CODE DESCRIPTION Certificate was not added to the cache. Certificate decoding failed. Certificate was not found (anywhere). Certificate chain looped (did not find trusted root). Certificate contains critical extension that was not handled. Certificate issuer was not valid (CA specific information missing). (Not used) CRL is too old.
Page 577: Table 191 Acl Setting Notes
Table 190 802.1X Logs (continued) LOG MESSAGE User logout because of no authentication response from user. User logout because of idle timeout expired. User logout because of user request. Local User Database does not support authentication mothed. No response from RADIUS. Pls check RADIUS Server.
Page 578: Table 192 Icmp Notes
Chapter 32 Logs Screens Table 191 ACL Setting Notes (continued) PACKET DIRECTION (D to WL) (WL to D) (WL to WL) Table 192 ICMP Notes TYPE CODE DIRECTION DESCRIPTION DMZ to WLAN ACL set for packets traveling from the DMZ to the WLAN. WLAN to DMZ ACL set for packets traveling from the WLAN to the DMZ.
Page 579: Table 193 Idp Logs
Table 192 ICMP Notes (continued) TYPE CODE DESCRIPTION Information Reply Information reply message Table 193 IDP Logs LOG MESSAGE The buffer size is too small! The format of the user config file is incorrect! The system is doing signature update now , please wait! No data! IDP %s!
Page 580 Chapter 32 Logs Screens Table 194 AV Logs (continued) LOG MESSAGE SMTP Virus infected - %s! POP3 Virus infected - %s! HTTP Bypass - %s! FTPDATA Bypass - %s! The device bypassed the scanning of files in FTP data connections. %s is SMTP Bypass - %s! POP3 Bypass - %s! Can not find the...
Page 581: Table 195 As Logs
Table 194 AV Logs (continued) LOG MESSAGE SMTP Block. The session is over maximun ZIP sessions %PACKET_DIRECTION% POP3 Block. The session is over maximun ZIP sessions %PACKET_DIRECTION% Zip file unsupported - %s! %PACKET_DIRECTION% Table 195 AS Logs LOG MESSAGE Mail is in the Black List - Mail From:%EMAIL_ADDRESS% Subject:%MAIL_SUBJECT%!
Page 582 Chapter 32 Logs Screens Table 195 AS Logs (continued) LOG MESSAGE Mail From:Email address Subject:Mail Subject! Remove rating server [%Rating Server IP Address%] from server list! "This is a phishing mail - Spam Score:%d Mail From:%EMAIL_ADDRESS% Subject:%MAIL_SUBJECT%! " Invalid parameter for AsEngine! Mail Parser buffer is overflow!
Page 583: Table 196 Syslog Logs
Syslog Logs There are two types of syslog: event logs and traffic logs. The device generates an event log when a system event occurs, for example, when a user logs in or the device is under attack. The device generates a traffic log when a "session" is terminated. A traffic log summarizes the session's type, when it started and stopped the amount of traffic that was sent and received and so on.
Page 584: Table 197 Rfc-2408 Isakmp Payload Types
Chapter 32 Logs Screens Table 196 Syslog Logs (continued) LOG MESSAGE Event Log: <Facility*8 + Severity>Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP:dstPort>" ob="<0|1>" ob_mac="<mac address>" msg="<msg>" note="<note>" devID="<mac address>" cat="IDP" class="<idp class>" sid="<idp sid> act="<idp action>" count="1" Event Log: <Facility*8 + Severity>Mon dd hr:mm:ss hostname src="<srcIP:srcPort>"...
Page 585: Maintenance Screens
H A P T E R 33.1 Overview This chapter displays information on the maintenance screens. The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your ZyWALL. 33.1.1 What You Can Do in the Maintenance Screens •...
Page 586: The Password Screen
Chapter 33 Maintenance Screens • In Windows XP, click Start, My Computer, View system information and then click the Computer Name tab. Note the entry in the Full computer name field and enter it as the ZyWALL System Name. Click MAINTENANCE to open the General screen. Use this screen to configure administrative and system-related information.
Page 587: The Time And Date Screen
Figure 341 MAINTENANCE > Password The following table describes the labels in this screen. Table 199 MAINTENANCE > Password LABEL DESCRIPTION Old Password Type the default password or the existing password you use to access the system in this field. If you forget the password, you may have to use the hardware RESET button.
Page 588: Figure 342 Maintenance > Time And Date
Chapter 33 Maintenance Screens When the ZyWALL uses the NTP time server pools, it randomly selects one pool and tries to synchronize with a server in it. If the synchronization fails, then the ZyWALL goes through the rest of the list in order from the first one tried until either it is successful or all the pre- defined NTP time server pools have been tried.
Page 589 Table 200 MAINTENANCE > Time and Date (continued) LABEL DESCRIPTION Manual Select this radio button to enter the time and date manually. If you configure a new time and date, Time Zone and Daylight Saving at the same time, the new time and date you entered has priority and the Time Zone and Daylight Saving settings do not affect it.
Page 590: Time Server Synchronization Example
Chapter 33 Maintenance Screens Table 200 MAINTENANCE > Time and Date (continued) LABEL End Date Apply Reset 33.4.1 Time Server Synchronization Example Click the Synchronize Now button to get the time and date from the predefined time server or the time server you specified in the Time Server Address field. When the System Time and Date Synchronization in Process screen appears, wait up to one minute.
Page 591: The Device Mode Screen
Figure 345 Synchronization Fail 33.5 The Device Mode Screen Use this screen to configure your ZyWALL as a router or a bridge. In router mode, the ZyWALL functions as a router. In bridge mode, the ZyWALL functions as a transparent firewall (also known as a bridge firewall).
Page 592: Configuring The Device Mode Screen (Router)
Chapter 33 Maintenance Screens • If no association is found, the frame is flooded to all ports except the inbound port. Broadcasts and multicasts also are flooded in this way. • If the associated port is the same as the incoming port, then the frame is dropped (filtered). Transparent Firewalls A transparent firewall (also known as a transparent, in-line, shadow, stealth or bridging firewall) has the following advantages over “router firewalls”:...
Page 593: Configuring The Device Mode Screen (Bridge)
Figure 346 MAINTENANCE > Device Mode (Router Mode) The following table describes the labels in this screen. Table 202 MAINTENANCE > Device Mode (Router Mode) LABEL DESCRIPTION Current Device Mode Device Mode This displays whether the ZyWALL is functioning as a router or a bridge. Device Mode Setup Router When the ZyWALL is in router mode, there is no need to select or clear this radio...
Page 594: Figure 347 Maintenance > Device Mode (Bridge Mode)
Chapter 33 Maintenance Screens In bridge mode, the ZyWALL cannot get an IP address from a DHCP server. The LAN, WAN, DMZ and WLAN interfaces all have the same (static) IP address and subnet mask. You can configure the ZyWALL's IP address in order to access the ZyWALL for management. If you connect your computer directly to the ZyWALL, you also need to assign your computer a static IP address in the same subnet as the ZyWALL's IP address in order to access the ZyWALL.
Page 595: The F/W Upload Screen
Table 203 MAINTENANCE > Device Mode (Bridge Mode) (continued) LABEL DESCRIPTION Bridge When the ZyWALL is in bridge mode, there is no need to select or clear this radio button. IP Address Click Bridge to go to the Bridge screen where you can view and/or change the bridge settings.
Page 596: Figure 349 Firmware Upload In Process
Chapter 33 Maintenance Screens Do not turn off the ZyWALL while firmware upload is in progress! After you see the Firmware Upload in Process screen, wait two minutes before logging into the ZyWALL again. Figure 349 Firmware Upload In Process The ZyWALL automatically restarts in this time causing a temporary network disconnect.
Page 597: The Backup And Restore Screen
33.9 The Backup and Restore Screen Section 49.5 on page 733 Click MAINTENANCE > Backup & Restore. Information related to factory defaults, backup configuration, and restoring configuration appears as shown next. Figure 352 MAINTENANCE > Backup and Restore Backup Configuration Backup configuration allows you to back up (save) the ZyWALL’s current configuration to a file on your computer.
Page 598: Figure 353 Configuration Upload Successful
Chapter 33 Maintenance Screens After you see a “restore configuration successful” screen, you must then wait one minute before logging into the ZyWALL again. Figure 353 Configuration Upload Successful The ZyWALL automatically restarts in this time causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop.
Page 599: The Restart Screen
Figure 356 Reset Warning Message You can also press the hardware RESET button to reset the factory defaults of your ZyWALL. Refer to Section 3.3 on page 63 33.10 The Restart Screen System restart allows you to reboot the ZyWALL without turning the power off. Click MAINTENANCE >...
Page 600: Figure 358 Maintenance > Diagnostics
Chapter 33 Maintenance Screens Figure 358 MAINTENANCE > Diagnostics The following table describes the labels in this screen. Table 206 MAINTENANCE > Diagnostics LABEL General Setup Enable Diagnostics Perform Diagnostics when CPU utilization exceeds Display on Console E-mail Settings Mail Server Mail Subject Mail Sender DESCRIPTION...
Page 601 Table 206 MAINTENANCE > Diagnostics (continued) LABEL Send Report to SMTP Authentication User Name Password Perform Diagnostics Schedule Periodic Diagnostics Diagnostics Frequency Day for Diagnostics Time for Diagnostics Apply Reset ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Diagnostic files are sent to the e-mail address specified in this field. If this field is left blank, diagnostic files will not be sent via e-mail.
Page 602 Chapter 33 Maintenance Screens ZyWALL 5/35/70 Series User’s Guide...
Page 603: Smt
Introducing the SMT (605) SMT Menu 1 - General Setup (613) WAN and Dial Backup Setup (619) LAN Setup (633) Internet Access (639) DMZ Setup (645) Route Setup (649) Wireless Setup (653) Remote Node Setup (659) IP Static Route Setup (669) Network Address Translation (NAT) (673) Introducing the ZyWALL Firewall (693) Filter Configuration (695)
Page 605: Introducing The Smt
H A P T E R This chapter explains how to access the System Management Terminal and gives an overview of its menus. 34.1 Introduction to the SMT The ZyWALL’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.
Page 606: Entering The Password
Chapter 34 Introducing the SMT Figure 359 Initial Screen Copyright (c) 1994 - 2007 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:A0:C5:01:23:45 initialize ch =1, ethernet address: 00:A0:C5:01:23:46 initialize ch =2, ethernet address: 00:A0:C5:01:23:47 initialize ch =3, ethernet address: 00:A0:C5:01:23:48 initialize ch =4, ethernet address: 00:00:00:00:00:00 AUX port init .
Page 607: Main Menu
This guide uses the ZyWALL 70 menus as an example. The menus may vary slightly for different ZyWALL models. Not all fields or menus are available on all models. Figure 361 Main Menu (Router Mode) Copyright (c) 1994 - 2007 ZyXEL Communications Corp. Getting Started 1. General Setup 2.
Page 608: Figure 362 Main Menu (Bridge Mode)
Chapter 34 Introducing the SMT Figure 362 Main Menu (Bridge Mode) Copyright (c) 1994 - 2007 ZyXEL Communications Corp. Getting Started The following table describes the fields in this menu. Table 208 Main Menu Summary MENU TITLE General Setup WAN Setup...
Page 609: Smt Menus Overview
Table 208 Main Menu Summary MENU TITLE Schedule Setup Exit 34.3.2 SMT Menus Overview The following table gives you an overview of your ZyWALL’s various SMT menus. Table 209 SMT Menus Overview MENUS SUB MENUS 1 General Setup 1.1 Configure Dynamic DNS 2 WAN Setup 2.1 Advanced WAN Setup 3 LAN Setup...
Page 610: Changing The System Password
Chapter 34 Introducing the SMT Table 209 SMT Menus Overview (continued) MENUS SUB MENUS 21 Filter and Firewall 21.1 Filter Set Configuration Setup 21.2 Firewall Setup 22 SNMP Configuration 23 System Password 24 System Maintenance 24.1 System Status 24.2 System Information and Console Port Speed 24.3 Log and Trace 24.4 Diagnostic...
Page 611: Resetting The Zywall
Figure 363 Menu 23: System Password Old Password= ? New Password= ? Retype to confirm= ? Enter here to CONFIRM or ESC to CANCEL: 2 Type your existing password and press [ENTER]. 3 Type your new system password and press [ENTER]. 4 Re-type your new system password for confirmation and press [ENTER].
Page 612 Chapter 34 Introducing the SMT ZyWALL 5/35/70 Series User’s Guide...
Page 613: Smt Menu 1 - General Setup
H A P T E R SMT Menu 1 - General Setup Menu 1 - General Setup contains administrative and system-related information. 35.1 Introduction to General Setup Menu 1 - General Setup contains administrative and system-related information. 35.2 Configuring General Setup 1 Enter 1 in the main menu to open Menu 1 - General Setup.
Page 614: Figure 365 Menu 1: General Setup (Bridge Mode)
Chapter 35 SMT Menu 1 - General Setup Table 210 Menu 1: General Setup (Router Mode) (continued) FIELD DESCRIPTION Device Mode Press [SPACE BAR] and then [ENTER] to select Router Mode. Edit Dynamic Press [SPACE BAR] and then [ENTER] to select Yes or No (default). Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next.
Page 615: Configuring Dynamic Dns
35.2.1 Configuring Dynamic DNS To configure Dynamic DNS, set the ZyWALL to router mode in menu 1 or in the MAINTENANCE Device Mode screen and go to Menu 1 - General Setup and press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1 - Configure Dynamic DNS (shown next).
Page 616: Figure 367 Menu 1.1.1: Ddns Host Summary
Chapter 35 SMT Menu 1 - General Setup Figure 367 Menu 1.1.1: DDNS Host Summary --- - ------------------------------------------------------- Hostname=ZyWALL, Type=Dynamic,WC=Yes,Offline=No,Policy=DDNS Server Detect, WAN1, HA=Yes _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ The following table describes the fields in this screen. Table 213 Menu 1.1.1: DDNS Host Summary FIELD Summary...
Page 617: Figure 368 Menu 1.1.1: Ddns Edit Host
Figure 368 Menu 1.1.1: DDNS Edit Host Hostname= ZyWALL DDNS Type= DynamicDNS Enable Wildcard Option= Yes Enable Off Line Option= N/A Bind WAN= 1 HA= Yes IP Address Update Policy: Let DDNS Server Auto Detect= Yes Use User-Defined= N/A Use WAN IP Address= N/A The following table describes the fields in this screen.
Page 618 Chapter 35 SMT Menu 1 - General Setup Table 214 Menu 1.1.1: DDNS Edit Host (continued) FIELD DESCRIPTION IP Address You can select Yes in either the Let DDNS Server Auto Detect field (recommended) Update Policy: or the Use User-Defined field, but not both. With the Let DDNS Server Auto Detect and Use User-Defined fields both set to No, the DDNS server automatically updates the IP address of the host name(s) with the ZyWALL’s WAN IP address.
Page 619: Wan And Dial Backup Setup
H A P T E R WAN and Dial Backup Setup This chapter describes how to configure the WAN using menu 2 and dial-backup using menus 2.1 and 11.1. 36.1 Introduction to WAN and Dial Backup Setup This chapter explains how to configure settings for your, a dial backup connection using the SMT menus.
Page 620: Dial Backup
Chapter 36 WAN and Dial Backup Setup The following table describes the fields in this screen. Table 215 MAC Address Cloning in WAN Setup FIELD DESCRIPTION (WAN 1/2) MAC Address Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods to assign a MAC Address.
Page 621: Advanced Wan Setup
Figure 370 Menu 2: Dial Backup Setup WAN 1 MAC Address: Assigned By= Factory default IP Address= N/A WAN 2 MAC Address: Assigned By= Factory default IP Address= N/A Dial-Backup: Active= No Port Speed= 115200 AT Command String: Edit Advanced Setup= Yes Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu.
Page 622: Figure 371 Menu 2.1: Advanced Wan Setup
Chapter 36 WAN and Dial Backup Setup To edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in Menu 2 - WAN Setup, press the [SPACE BAR] to select Yes and then press [ENTER].
Page 623: Remote Node Profile (Backup Isp)
Table 218 Advanced WAN Port Setup: Call Control Parameters FIELD DESCRIPTION Call Control Dial Timeout (sec) Enter a number of seconds for the ZyWALL to keep trying to set up an outgoing call before timing out (stopping). The ZyWALL times out and stops if it cannot set up an outgoing call within the timeout value.
Page 624: Table 219 Menu 11.3: Remote Node Profile (Backup Isp)
Chapter 36 WAN and Dial Backup Setup The following table describes the fields in this menu. Table 219 Menu 11.3: Remote Node Profile (Backup ISP) FIELD DESCRIPTION Rem Node Enter a descriptive name for the remote node. This field can be up to eight Name characters.
Page 625: Editing Tcp/Ip Options
36.3.4 Editing TCP/IP Options Move the cursor to the Edit IP field in menu 11.3, then press [SPACE BAR] to select Yes. Press [ENTER] to open Menu 11.3.2 - Remote Node Network Layer Options. Not all fields are available on all models. Figure 373 Menu 11.3.2: Remote Node Network Layer Options Menu 11.3.2 - Remote Node Network Layer Options IP Address Assignment= Static...
Page 626: Editing Login Script
Chapter 36 WAN and Dial Backup Setup Table 220 Menu 11.3.2: Remote Node Network Layer Options FIELD DESCRIPTION Network Network Address Translation (NAT) allows the translation of an Internet protocol Address address used within one network (for example a private IP address used in a local Translation network) to a different IP address known within another network (for example a public IP address used on the Internet).
Page 627: Figure 374 Menu 11.3.3: Remote Node Script
To handle the first prompt, you specify “ogin: ” as the ‘Expect’ string and “myLogin” as the ‘Send’ string in set 1. The reason for leaving out the leading “L” is to avoid having to know exactly whether it is upper or lower case. Similarly, you specify “word: ” as the ‘Expect’ string and your password as the ‘Send’...
Page 628: Remote Node Filter
Chapter 36 WAN and Dial Backup Setup The following table describes the fields in this menu. Table 221 Menu 11.3.3: Remote Node Script FIELD DESCRIPTION Active Press [SPACE BAR] and then [ENTER] to select either Yes to enable the AT strings or No to disable them.
Page 629: Modem Setup
36.3.7 3G Modem Setup From the main menu, enter 2 to open menu 2 on the ZyWALL that supports a 3G card. It is not necessary to configure menu 2 with a Sierra Wireless AC595 3G card. Figure 376 3G Modem Setup in WAN Setup (ZyWALL 5) The following table describes the fields in this screen.
Page 630: Remote Node Profile (3G Wan)
Chapter 36 WAN and Dial Backup Setup Table 222 3G Modem Setup in WAN Setup (ZyWALL 5) (continued) FIELD DESCRIPTION PIN Code A PIN (Personal Identification Number) code is a key to a 3G card. Without the PIN code, you cannot use the 3G card. Enter the 4-digit PIN code (0000 for example) provided by your ISP.
Page 631 Table 223 Menu 11.2: Remote Node Profile (3G WAN) (continued) FIELD DESCRIPTION Retype to Enter your password again to make sure that you have entered is correctly. Confirm Authen This field sets the authentication protocol used for outgoing calls. Options for this field are: CHAP/PAP - Your ZyWALL will accept either CHAP or PAP when requested by this remote node.
Page 632 Chapter 36 WAN and Dial Backup Setup ZyWALL 5/35/70 Series User’s Guide...
Page 633: Lan Setup
H A P T E R This chapter describes how to configure the LAN using Menu 3 - LAN Setup. 37.1 Introduction to LAN Setup This chapter describes how to configure the ZyWALL for LAN and wireless LAN connections. 37.2 Accessing the LAN Menus From the main menu, enter 3 to open Menu 3 - LAN Setup.
Page 634: Tcp/Ip And Dhcp Ethernet Setup Menu
Chapter 37 LAN Setup Figure 379 Menu 3.1: LAN Port Filter Setup Menu 3.1 - LAN Port Filter Setup Input Filter Sets: Output Filter Sets: Press ENTER to Confirm or ESC to Cancel: 37.4 TCP/IP and DHCP Ethernet Setup Menu From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and DHCP Ethernet setup.
Page 635: Figure 381 Menu 3.2: Tcp/Ip And Dhcp Ethernet Setup
Figure 381 Menu 3.2: TCP/IP and DHCP Ethernet Setup Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server Client IP Pool: Starting Address= 192.168.1.33 Size of Client IP Pool= 128 DHCP Server Address= N/A Follow the instructions in the next table on how to configure the DHCP fields. Table 224 Menu 3.2: DHCP Ethernet Setup Fields FIELD DESCRIPTION...
Page 636: Ip Alias Setup
Chapter 37 LAN Setup Table 225 Menu 3.2: LAN TCP/IP Setup Fields (continued) FIELD IP Subnet Mask RIP Direction Version Multicast Edit IP Alias When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
Page 637: Table 226 Menu 3.2.1: Ip Alias Setup
Use the instructions in the following table to configure IP alias parameters. Table 226 Menu 3.2.1: IP Alias Setup FIELD DESCRIPTION IP Alias 1, 2 Choose Yes to configure the LAN network for the ZyWALL. IP Address Enter the IP address of your ZyWALL in dotted decimal notation. IP Subnet Mask Your ZyWALL will automatically calculate the subnet mask based on the IP address that you assign.
Page 638 Chapter 37 LAN Setup ZyWALL 5/35/70 Series User’s Guide...
Page 639: Internet Access
H A P T E R This chapter shows you how to configure your ZyWALL for Internet access. 38.1 Introduction to Internet Access Setup Use information from your ISP along with the instructions in this chapter to set up your ZyWALL to access the Internet.
Page 640: Figure 383 Menu 4: Internet Access Setup (Ethernet)
Chapter 38 Internet Access Figure 383 Menu 4: Internet Access Setup (Ethernet) The following table describes the fields in this menu. Table 227 Menu 4: Internet Access Setup (Ethernet) FIELD DESCRIPTION ISP’s Name This is the descriptive name of your ISP for identification purposes. Encapsulation Press [SPACE BAR] and then press [ENTER] to choose Ethernet.
Page 641: Configuring The Pptp Client
Table 227 Menu 4: Internet Access Setup (Ethernet) (continued) FIELD DESCRIPTION Gateway IP Enter the gateway IP address associated with your static IP. Address Network Network Address Translation (NAT) allows the translation of an Internet protocol Address address used within one network (for example a private IP address used in a local Translation network) to a different IP address known within another network (for example a public IP address used on the Internet).
Page 642: Configuring The Pppoe Client
Chapter 38 Internet Access Figure 384 Internet Access Setup (PPTP) The following table contains instructions about the new fields when you choose PPTP in the Encapsulation field in menu 4. Table 228 New Fields in Menu 4 (PPTP) Screen FIELD DESCRIPTION Encapsulation Press [SPACE BAR] and then press [ENTER] to choose PPTP.
Page 643: Basic Setup Complete
Figure 385 Internet Access Setup (PPPoE) The following table contains instructions about the new fields when you choose PPPoE in the Encapsulation field in menu 4. Table 229 New Fields in Menu 4 (PPPoE) screen FIELD DESCRIPTION Encapsulation Press [SPACE BAR] and then press [ENTER] to choose PPPoE. The encapsulation method influences your choices in the IP Address field.
Page 644 Chapter 38 Internet Access ZyWALL 5/35/70 Series User’s Guide...
Page 645: Dmz Setup
H A P T E R This chapter describes how to configure the ZyWALL’s DMZ using Menu 5 - DMZ Setup. 39.1 Configuring DMZ Setup From the main menu, enter 5 to open Menu 5 – DMZ Setup. Figure 386 Menu 5: DMZ Setup Menu 5 - DMZ Setup 1.
Page 646: Tcp/Ip Setup
Chapter 39 DMZ Setup 39.3 TCP/IP Setup For more detailed information about RIP setup, IP Multicast and IP alias, please refer to Chapter 7 on page 149. 39.3.1 IP Address From the main menu, enter 5 to open Menu 5 - DMZ Setup to configure TCP/IP (RFC 1155). Figure 388 Menu 5: DMZ Setup Menu 5 - DMZ Setup 1.
Page 647: Ip Alias Setup
DMZ, WLAN and LAN IP addresses must be on separate subnets. You must also configure NAT for the DMZ port (see 15.1 and 15.2. 39.3.2 IP Alias Setup Use menu 5.2 to configure the first network. Move the cursor to the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to open Menu 5.2.1 - IP Alias Setup, as shown next.
Page 648 Chapter 39 DMZ Setup ZyWALL 5/35/70 Series User’s Guide...
Page 649: Route Setup
H A P T E R This chapter describes how to configure the ZyWALL's traffic redirect. 40.1 Configuring Route Setup From the main menu, enter 6 to open Menu 6 - Route Setup. Figure 391 Menu 6: Route Setup Menu 6 - Route Setup 1.
Page 650: Traffic Redirect
Chapter 40 Route Setup The following table describes the fields in this menu. Table 230 Menu 6.1: Route Assessment FIELD Probing WAN 1/2 Check Point Probing Traffic Redirection Check Point When you have completed this menu, press [ENTER] at the prompt "Press ENTER to Confirm…" to save your configuration, or press [ESC] at any time to cancel.
Page 651: Route Failover
40.4 Route Failover This menu allows you to configure how the ZyWALL uses the route assessment ping check function. Figure 394 Menu 6.3: Route Failover Menu 6.3 - Route Failover Period= 5 Timeout=: 3 Fail Tolerance= 3 Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu.
Page 652 Chapter 40 Route Setup ZyWALL 5/35/70 Series User’s Guide...
Page 653: Wireless Setup
H A P T E R Use menu 7 to set up your ZyWALL as the wireless access point. 41.1 Wireless LAN Setup If you are configuring the ZyWALL from a computer connected to the wireless LAN and you change the ZyWALL’s ESSID or WEP settings, you will lose your wireless connection when you press [ENTER] to confirm.
Page 654: Table 233 Menu 7.1: Wireless Setup
Chapter 41 Wireless Setup The settings of all client stations on the wireless LAN must match those of the ZyWALL. Follow the instructions in the next table on how to configure the wireless LAN parameters. Table 233 Menu 7.1: Wireless Setup FIELD DESCRIPTION Enable...
Page 655: Mac Address Filter Setup
Table 233 Menu 7.1: Wireless Setup FIELD DESCRIPTION Key 1 to Key The WEP keys are used to encrypt data. Both the ZyWALL and the wireless stations must use the same WEP key for data transmission. If you chose 64-bit WEP in the WEP Encryption field, then enter any 5 ASCII characters or 10 hexadecimal characters ("0-9", "A-F").
Page 656: Tcp/Ip Setup
Chapter 41 Wireless Setup The following table describes the fields in this menu. Table 234 Menu 7.1.1: WLAN MAC Address Filter FIELD DESCRIPTION Active To enable MAC address filtering, press [SPACE BAR] to select Yes and press [ENTER]. Filter Action Define the filter action for the list of MAC addresses in the MAC address filter table.
Page 657: Ip Alias Setup
Figure 398 Menu 7.2: TCP/IP and DHCP Ethernet Setup Menu 7.2 - TCP/IP and DHCP Ethernet Setup DHCP= None Client IP Pool: Starting Address= N/A Size of Client IP Pool= N/A DHCP Server Address= N/A The DHCP and TCP/IP setup fields are the same as the ones in Menu 3.2 - TCP/IP and DHCP Ethernet Setup.
Page 658: Figure 399 Menu 7.2.1: Ip Alias Setup
Chapter 41 Wireless Setup Figure 399 Menu 7.2.1: IP Alias Setup Enter here to CONFIRM or ESC to CANCEL: Refer to Table 226 on page 637 Menu 7.2.1 - IP Alias Setup IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A IP Alias 2= No...
Page 659: Remote Node Setup
H A P T E R This chapter shows you how to configure a remote node. 42.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection. Note that when you use menu 4 to set up Internet access, you are actually configuring a remote node.
Page 660: Remote Node Profile Setup
Chapter 42 Remote Node Setup 42.3 Remote Node Profile Setup The following explains how to configure the remote node profile menu. Not all fields are available on all models. 42.3.1 Ethernet Encapsulation There are three variations of menu 11.x depending on whether you choose Ethernet Encapsulation, PPPoE Encapsulation or PPTP Encapsulation.
Page 661: Pppoe Encapsulation
Table 235 Menu 11.1: Remote Node Profile for Ethernet Encapsulation (continued) FIELD DESCRIPTION My Password Enter the password assigned by your ISP when the ZyWALL calls this remote node. Valid for PPPoE encapsulation only. Retype to Type your password again to make sure that you have entered it correctly. Confirm Server This field is valid only when RoadRunner is selected in the Service Type field.
Page 662: Figure 402 Menu 11.1: Remote Node Profile For Pppoe Encapsulation
Chapter 42 Remote Node Setup Figure 402 Menu 11.1: Remote Node Profile for PPPoE Encapsulation Rem Node Name= WAN 1 Active= Yes Encapsulation= PPPoE Service Type= Standard Service Name= Outgoing: My Login= My Password= ******** Retype to Confirm= ******** Authen= CHAP/PAP 42.3.2.1 Outgoing Authentication Protocol Generally speaking, you should employ the strongest authentication protocol possible, for obvious reasons.
Page 663: Pptp Encapsulation
42.3.2.3 Metric Section on page 171 Table 236 Fields in Menu 11.1 (PPPoE Encapsulation Specific) FIELD DESCRIPTION Service Name If you are using PPPoE encapsulation, then type the name of your PPPoE service here. Only valid with PPPoE encapsulation. Authen This field sets the authentication protocol used for outgoing calls.
Page 664: Edit Ip
Chapter 42 Remote Node Setup Figure 403 Menu 11.1: Remote Node Profile for PPTP Encapsulation Rem Node Name= WAN 1 Active= Yes Encapsulation= PPTP Service Type= Standard Outgoing: My Login= My Password= ******** Retype to Confirm= ******** Authen= CHAP/PAP PPTP: My IP Addr= 10.0.0.140 My IP Mask= 255.255.255.0 Server IP Addr= 10.0.0.138...
Page 665: Figure 404 Menu 11.1.2: Remote Node Network Layer Options For Ethernet Encapsulation
Figure 404 Menu 11.1.2: Remote Node Network Layer Options for Ethernet Encapsulation Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic Rem IP Addr= N/A Rem Subnet Mask= N/A My WAN Addr= N/A Network Address Translation= SUA Only NAT Lookup Set= 255 Metric= 1 Private= No...
Page 666: Remote Node Filter
Chapter 42 Remote Node Setup Table 238 Remote Node Network Layer Options Menu Fields (continued) FIELD DESCRIPTION NAT Lookup If you select SUA Only in the Network Address Translation field, it displays 255 and indicates the SMT will use the pre-configured Set 255 (read only) in menu 15.1. If you select Full Feature or None in the Network Address Translation field, it displays 1, 2 or 3 and indicates the SMT will use the pre-configured Set 1 in menu 15.1 for the first WAN port, Set 2 in menu 15.1 for the second WAN port and Set 3 for...
Page 667: Figure 405 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation)
Figure 405 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 406 Menu 11.1.4: Remote Node Filter (PPPoE or PPTP Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters=...
Page 668 Chapter 42 Remote Node Setup ZyWALL 5/35/70 Series User’s Guide...
Page 669: Ip Static Route Setup
H A P T E R This chapter shows you how to configure static routes with your ZyWALL. 43.1 IP Static Route Setup Enter 12 from the main menu. Select one of the IP static routes as shown next to configure IP static routes in menu 12.1.
Page 670: Figure 407 Menu 12: Ip Static Route Setup
Chapter 43 IP Static Route Setup Figure 407 Menu 12: IP Static Route Setup 1. Reserved 2. Reserved 3. ________ 4. ________ 5. ________ 6. ________ 7. ________ 8. ________ 9. ________ 10. ________ 11. ________ 12. ________ 13. ________ 14.
Page 671 Table 239 Menu 12. 1: Edit IP Static Route FIELD DESCRIPTION Destination IP This parameter specifies the IP network address of the final destination. Routing is Address always based on network number. If you need to specify a route to a single host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the network number to be identical to the host ID.
Page 672 Chapter 43 IP Static Route Setup ZyWALL 5/35/70 Series User’s Guide...
Page 673: Network Address Translation (Nat)
H A P T E R Network Address Translation This chapter discusses how to configure NAT on the ZyWALL. 44.1 Using NAT You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyWALL. 44.1.1 SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server.
Page 674: Chapter 44 Network Address Translation (Nat)
Chapter 44 Network Address Translation (NAT) Figure 409 Menu 4: Applying NAT for Internet Access Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet IP Address Assignment= Dynamic Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: The following figure shows how you apply NAT to the remote node in menu 11.1.
Page 675: Nat Setup
The following table describes the fields in this menu. Table 240 Applying NAT in Menus 4 & 11.1.2 FIELD DESCRIPTION Network When you select this option the SMT will use Address Mapping Set 1 Address (menu 15.1 - see Translation can configure any of the mapping types described in 435.
Page 676: Address Mapping Sets
Chapter 44 Network Address Translation (NAT) Configure DMZ, WLAN and LAN IP addresses in NAT menus 15.1 and 15.2. DMZ, WLAN and LAN IP addresses must be on separate subnets. 44.2.1 Address Mapping Sets Enter 1 to bring up Menu 15.1 - Address Mapping Sets. Figure 412 Menu 15.1: Address Mapping Sets Menu 15.1 - Address Mapping Sets Enter Menu Selection Number:...
Page 677: Table 241 Sua Address Mapping Rules
Menu 15.1.255 is read-only. Table 241 SUA Address Mapping Rules FIELD DESCRIPTION Set Name This is the name of the set you selected in menu 15.1 or enter the name of a new set you want to create. This is the index or rule number. Local Start IP Local Start IP is the starting local IP address (ILA).
Page 678: Figure 414 Menu 15.1.1: First Set
Chapter 44 Network Address Translation (NAT) Figure 414 Menu 15.1.1: First Set Set Name= NAT_SET Local Start IP --------------- 0.0.0.0 The Type, Local and Global Start/End IPs are configured in menu 15.1.1.1 (described later) and the values are displayed here. 44.2.1.3 Ordering Your Rules Ordering your rules is important because the ZyWALL applies the rules in the order that you specify.
Page 679: Table 242 Fields In Menu 15.1.1
Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so as old rule 5 becomes rule 4, old rule 6 becomes rule 5 and old rule 7 becomes rule 6. Table 242 Fields in Menu 15.1.1 FIELD DESCRIPTION Set Name Enter a name for this set of rules.
Page 680: Figure 415 Menu 15.1.1.1: Editing/Configuring An Individual Rule In A Set
Chapter 44 Network Address Translation (NAT) Figure 415 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set Menu 15.1.1.1 Address Mapping Rule Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu. Table 243 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set FIELD DESCRIPTION Type...
Page 681: Configuring A Server Behind Nat
44.3 Configuring a Server behind NAT If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup. Follow these steps to configure a server behind NAT: 1 Enter 15 in the main menu to go to Menu 15 - NAT Setup.
Page 682: Figure 418 15.2.X.x: Nat Server Configuration
Chapter 44 Network Address Translation (NAT) 4 Select Edit Rule in the Select Command field; type the index number of the NAT server you want to configure in the Select Rule field and press [ENTER] to open Menu 15.2.x.x - NAT Server Configuration (see the next figure). Figure 418 15.2.x.x: NAT Server Configuration 15.2.1.2 - NAT Server Configuration ------------------------------------------------...
Page 683: General Nat Examples
Figure 419 Menu 15.2.1: NAT Server Setup Rule ------------------------------------------------------ Select Command= None You assign the private network IP addresses. The NAT network appears as a single host on the Internet. A is the FTP/Telnet/SMTP server. Figure 420 Server Behind NAT Example 44.4 General NAT Examples The following are some examples of NAT configuration.
Page 684: Figure 421 Nat Example 1
Chapter 44 Network Address Translation (NAT) Figure 421 NAT Example 1 Figure 422 Menu 4: Internet Access & NAT Example Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet IP Address Assignment= Dynamic Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: From menu 4 shown above, simply choose the SUA Only option from the Network Address Translation field.
Page 685: Example 2: Internet Access With A Default Server
44.4.2 Example 2: Internet Access with a Default Server Figure 423 NAT Example 2 In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2.1 to specify the Default Server behind the NAT as shown in the next figure.
Page 686: Figure 425 Nat Example 3
Chapter 44 Network Address Translation (NAT) 2 Map the second IGA to our second inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses). 3 Map the other outgoing LAN traffic to IGA3 (Many : 1 mapping). 4 You also map your third IGA to the web server and mail server on the LAN.
Page 687: Figure 426 Example 3: Menu 11.1.2
Figure 426 Example 3: Menu 11.1.2 Menu 11.1.2 - Remote Node Network Layer Options The following figure shows how to configure the first rule. Figure 427 Example 3: Menu 15.1.1.1 Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Global IP: Server Mapping Set= N/A Press ENTER to Confirm or ESC to Cancel: ZyWALL 5/35/70 Series User’s Guide...
Page 688: Figure 428 Example 3: Final Menu 15.1.1
Chapter 44 Network Address Translation (NAT) Figure 428 Example 3: Final Menu 15.1.1 Set Name= Example3 Local Start IP --------------- 1. 192.168.1.10 192.168.1.11 3. 0.0.0.0 Now configure the IGA3 to map to our web server and mail server on the LAN. 1 Enter 15 from the main menu.
Page 689: Example 4: Nat Unfriendly Application Programs
44.4.4 Example 4: NAT Unfriendly Application Programs Some applications do not support NAT Mapping using TCP or UDP port address translation. In this case it is better to use Many-One-to-One mapping as port numbers do not change for Many-One-to-One (and One-to-One) NAT mapping types. The following figure illustrates this.
Page 690: Trigger Port Forwarding
Chapter 44 Network Address Translation (NAT) Figure 432 Example 4: Menu 15.1.1: Address Mapping Rules Set Name= Example4 Local Start IP --------------- 192.168.1.10 Action= Edit Press ENTER to Confirm or ESC to Cancel: 44.5 Trigger Port Forwarding Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side.
Page 691: Figure 433 Menu 15.3.1: Trigger Port Setup
Only one LAN computer can use a trigger port (range) at a time. Enter 3 in menu 15 to display Menu 15.3 - Trigger Ports. For a ZyWALL with multiple WAN interfaces, enter 1 or 2 from menu 15.3 to go to Menu 15.3.1 or Menu 15.3.2 - Trigger Port Setup and configure trigger port rules for the first or second WAN interface.
Page 692 Chapter 44 Network Address Translation (NAT) Table 245 Menu 15.3.1: Trigger Port Setup (continued) FIELD DESCRIPTION End Port Enter a port number or the ending port number in a range of port numbers. Press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.
Page 693: Introducing The Zywall Firewall
H A P T E R Introducing the ZyWALL Firewall This chapter shows you how to get started with the ZyWALL firewall. 45.1 Using ZyWALL SMT Menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown next.
Page 694: Figure 435 Menu 21.2: Firewall Setup
Chapter 45 Introducing the ZyWALL Firewall Figure 435 Menu 21.2: Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off. Refer to the User's Guide for details about the firewall default policies.
Page 695: Filter Configuration
H A P T E R This chapter shows you how to create and apply filters. 46.1 Introduction to Filters Your ZyWALL uses filters to decide whether to allow passage of a data packet and/or to make a call. There are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and protocol filters, which are discussed later.
Page 696: The Filter Structure Of The Zywall
Chapter 46 Filter Configuration 46.1.1 The Filter Structure of the ZyWALL A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descriptive name. The ZyWALL allows you to configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system.
Page 697: Figure 437 Filter Rule Process
Chapter 46 Filter Configuration Figure 437 Filter Rule Process You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.
Page 698: Configuring A Filter Set
Chapter 46 Filter Configuration 46.2 Configuring a Filter Set The ZyWALL includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below. 1 Enter 21 in the main menu to open menu 21. Figure 438 Menu 21: Filter and Firewall Setup Menu 21 - Filter and Firewall Setup Enter Menu Selection Number:...
Page 699: Configuring A Filter Rule
Table 246 Abbreviations Used in the Filter Rules Summary Menu FIELD DESCRIPTION Active: “Y” means the rule is active. “N” means the rule is inactive. Type The type of filter rule: “GEN” for Generic, “IP” for TCP/IP. Filter Rules These parameters are displayed here. More.
Page 700: Configuring A Tcp/Ip Filter Rule
Chapter 46 Filter Configuration 46.2.2 Configuring a TCP/IP Filter Rule This section shows you how to configure a TCP/IP filter rule. TCP/IP rules allow you to base the rule on the fields in the IP and the upper layer protocol, for example, UDP and TCP headers.
Page 701 Table 248 Menu 21.1.1.1: TCP/IP Filter Rule FIELD DESCRIPTION Port # Comp Press [SPACE BAR] and then [ENTER] to select the comparison to apply to the destination port in the packet against the value given in Destination: Port #. Options are None, Equal, Not Equal, Less and Greater. Source IP Addr Enter the source IP Address of the packet you wish to filter.
Page 702: Configuring A Generic Filter Rule
Chapter 46 Filter Configuration Figure 441 Executing an IP Filter 46.2.3 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. The purpose of generic rules is to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly. ZyWALL 5/35/70 Series User’s Guide...
Page 703: Figure 442 Menu 21.1.1.1: Generic Filter Rule
For generic rules, the ZyWALL treats a packet as a byte stream as opposed to an IP or IPX packet. You specify the portion of the packet to check with the Offset (from 0) and the Length fields, both in bytes. The ZyWALL applies the Mask (bit-wise ANDing) to the data portion before comparing the result against the Value to determine a match.
Page 704: Example Filter
Chapter 46 Filter Configuration Table 249 Generic Filter Rule Menu Fields FIELD DESCRIPTION Select the logging option from the following: None - No packets will be logged. Action Matched - Only packets that match the rule parameters will be logged. Action Not Matched - Only packets that do not match the rule parameters will be logged.
Page 705: Figure 444 Example Filter: Menu 21.1.3.1
Figure 444 Example Filter: Menu 21.1.3.1 Filter #: 3,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 Destination: IP Addr= 0.0.0.0 TCP Estab= No More= No Action Matched= Drop Action Not Matched= Forward Press Space Bar to Toggle. The port number for the telnet service (TCP protocol) is 23.
Page 706: Filter Types And Nat
Chapter 46 Filter Configuration After you’ve created the filter set, you must apply it. 1 Enter 11 from the main menu to go to menu 11. 2 Enter 1 or 2 to open Menu 11.x - Remote Node Profile. 3 Go to the Edit Filter Sets field, press [SPACE BAR] to select Yes and press [ENTER]. 4 This brings you to menu 11.1.4.
Page 707: Firewall
46.5.1.1 When To Use Filtering 1 To block/allow LAN packets by their MAC addresses. 2 To block/allow special IP packets which are neither TCP nor UDP, nor ICMP packets. 3 To block/allow both inbound (WAN to LAN) and outbound (LAN to WAN) traffic between the specific inside host/network "A"...
Page 708: Applying Lan Filters
Chapter 46 Filter Configuration If you do not activate the firewall, it is advisable to apply filters. 46.6.1 Applying LAN Filters LAN traffic filter sets may be useful to block certain packets, reduce traffic and prevent security breaches. Go to menu 3.1 (shown next) and enter the number(s) of the filter set(s) that you want to apply as appropriate.
Page 709: Applying Remote Node Filters
46.6.3 Applying Remote Node Filters Go to menu 11.1.4 (shown below – note that call filter sets are only present for PPPoE encapsulation) and enter the number(s) of the filter set(s) as appropriate. You can cascade up to four filter sets by entering their numbers separated by commas. The ZyWALL already has filters to prevent NetBIOS traffic from triggering calls, and block incoming telnet, FTP and HTTP connections.
Page 710 Chapter 46 Filter Configuration ZyWALL 5/35/70 Series User’s Guide...
Page 711: Snmp Configuration
H A P T E R This chapter explains SNMP configuration menu 22. 47.1 SNMP Configuration To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The “community” for Get, Set and Trap fields is SNMP terminology for password.
Page 712: Snmp Traps
Chapter 47 SNMP Configuration Table 250 SNMP Configuration Menu Fields (continued) FIELD DESCRIPTION Destination Type the IP address of the station to send your SNMP traps to. When you have completed this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel”...
Page 713: System Information & Diagnosis
H A P T E R System Information & Diagnosis This chapter covers SMT menus 24.1 to 24.4. 48.1 Introduction to System Status This chapter covers the diagnostic tools that help you to maintain your ZyWALL. These tools include updates on system status, port status and log and trace capabilities. Select menu 24 in the main menu to open Menu 24 - System Maintenance, as shown below.
Page 714: Figure 452 Menu 24.1: System Maintenance: Status
Chapter 48 System Information & Diagnosis 3 There are three commands in Menu 24.1 - System Maintenance - Status. Entering 1 or 2 drops the WAN1 or WAN2 connection, 9 resets the counters and [ESC] takes you back to the previous screen. Figure 452 Menu 24.1: System Maintenance: Status Port Status...
Page 715: System Information And Console Port Speed
Table 252 System Maintenance: Status Menu Fields (continued) FIELD DESCRIPTION Cols This is the number of collisions on this port. Tx B/s This field shows the transmission speed in Bytes per second on this port. Rx B/s This field shows the reception speed in Bytes per second on this port. Up Time This is the total amount of time the line has been up.
Page 716: Console Port Speed
Chapter 48 System Information & Diagnosis Figure 454 Menu 24.2.1: System Maintenance: Information The following table describes the fields in this screen. Table 253 Fields in System Maintenance: Information FIELD Name Routing ZyNOS F/W Version Country Code Ethernet Address IP Address IP Mask DHCP When finished viewing, press [ESC] or [ENTER] to exit.
Page 717: Log And Trace
Figure 455 Menu 24.2.2: System Maintenance: Change Console Port Speed Menu 24.2.2 - System Maintenance - Change Console Port Speed Space Bar to Toggle. 48.4 Log and Trace There are two logging facilities in the ZyWALL. The first is the error logs and trace records that are stored locally.
Page 718: Syslog Logging
Chapter 48 System Information & Diagnosis Figure 457 Examples of Error and Information Messages 52 Thu Jul 1 05:54:53 2004 PP05 53 Thu Jul 1 05:54:53 2004 PINI 54 Thu Jul 1 05:54:56 2004 PP05 -WARN 55 Thu Jul 1 05:54:56 2004 PP0d 57 Thu Jul 1 05:54:56 2004 PP0d 58 Thu Jul...
Page 719 1 CDR CDR Message Format SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String ); String = board xx line xx channel xx, call xx, str board = the hardware board ID line = the WAN ID in a board Channel = channel ID within the WAN call = the call reference number which starts from 1 and increments by 1 for each new call str = C01 Outgoing Call dev xx ch xx (dev:device No.
Page 720 Chapter 48 System Information & Diagnosis Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D).
Page 721: Call-Triggering Packet
5 Firewall log Firewall Log Message Format SdcmdSyslogSend(SYSLOG_FIREWALL, SYSLOG_NOTICE, buf); buf = IP[Src=xx.xx.xx.xx : spo=xxxx Dst=xx.xx.xx.xx : dpo=xxxx | prot | rule | action] Src: Source Address spo: Source port (empty means no source port information) Dst: Destination Address dpo: Destination port (empty means no destination port information) prot: Protocol ("TCP","UDP","ICMP", "IGMP", "GRE", "ESP") rule: <a,b>...
Page 722: Diagnostic
Chapter 48 System Information & Diagnosis Figure 459 Call-Triggering Packet Example IP Frame: ENET0-RECV Size: Frame Type: IP Header: IP Version Header Length Type of Service Total Length Identification Flags Fragment Offset Time to Live Protocol Header Checksum Source IP Destination IP TCP Header: Source Port...
Page 723: Wan Dhcp
Figure 460 Menu 24.4: System Maintenance: Diagnostic (ZyWALL 5) Menu 24.4 - System Maintenance - Diagnostic TCP/IP 1. Ping Host 2. WAN DHCP Release 3. WAN DHCP Renewal 4. PPPoE/PPTP/3G Setup Test System 11. Reboot System Enter Menu Selection Number: WAN= Host IP Address= N/A 48.5.1 WAN DHCP...
Page 724: Table 255 System Maintenance Menu Diagnostic
Chapter 48 System Information & Diagnosis Table 255 System Maintenance Menu Diagnostic FIELD Ping Host WAN DHCP Release WAN DHCP Renewal Internet Setup Test PPPoE/PPTP/3G Setup Test Reboot System Host IP Address Enter the number of the selection you would like to perform or press [ESC] to cancel. DESCRIPTION Enter 1 to ping any machine (with an IP address) on your LAN, DMZ, WLAN or WAN.
Page 725: Firmware And Configuration File Maintenance
H A P T E R Firmware and Configuration File This chapter tells you how to back up and restore your configuration file as well as upload new firmware and a new configuration file. 49.1 Introduction Use the instructions in this chapter to change the ZyWALL’s configuration file or upgrade its firmware.
Page 726: Firmware And Configuration File Maintenance
Chapter 49 Firmware and Configuration File Maintenance The following table is a summary. Please note that the internal filename refers to the filename on the ZyWALL and the external filename refers to the filename not on the ZyWALL, that is, on your computer, local network or FTP site and so the name (but not the extension) may vary.
Page 727: Using The Ftp Command From The Command Line
Figure 462 Telnet into Menu 24.5 Menu 24.5 - Backup Configuration To transfer the configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your router. Then type "admin"...
Page 728: Gui-Based Ftp Clients
Chapter 49 Firmware and Configuration File Maintenance 49.3.4 GUI-based FTP Clients The following table describes some of the commands that you may see in GUI-based FTP clients. Table 257 General Commands for GUI-based FTP Clients COMMAND Host Address Login Type Transfer Type Initial Remote Directory Initial Local Directory...
Page 729: Tftp Command Example
4 Launch the TFTP client on your computer and connect to the ZyWALL. Set the transfer mode to binary before starting data transfer. 5 Use the TFTP client (see the example below) to transfer files between the ZyWALL and the computer. The file name for the configuration file is “rom-0” (rom-zero, not capital Note that the telnet connection must be active and the SMT in CI mode before and during the TFTP transfer.
Page 730: Restore Configuration
Chapter 49 Firmware and Configuration File Maintenance Figure 464 System Maintenance: Backup Configuration Ready to backup Configuration via Xmodem. Do you want to continue (y/n): 2 The following screen indicates that the Xmodem download has started. Figure 465 System Maintenance: Starting Xmodem Download Screen You can enter ctrl-x to terminate operation any time.
Page 731: Restore Using Ftp
FTP is the preferred method for restoring your current computer configuration to your ZyWALL since FTP is faster. Please note that you must wait for the system to automatically restart after the file transfer is complete. WARNING! Do not interrupt the file transfer process as this may PERMANENTLY DAMAGE YOUR ZyWALL.
Page 732: Restore Using Ftp Session Example
Chapter 49 Firmware and Configuration File Maintenance 49.4.2 Restore Using FTP Session Example Figure 469 Restore Using FTP Session Example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec.
Page 733: Uploading Firmware And Configuration Files
4 After a successful restoration you will see the following screen. Press any key to restart the ZyWALL and return to the SMT menu. Figure 473 Successful Restoration Confirmation Screen Save to ROM Hit any key to start system reboot. 49.5 Uploading Firmware and Configuration Files This section shows you how to upload firmware and configuration files.
Page 734: Configuration File Upload
Chapter 49 Firmware and Configuration File Maintenance Figure 474 Telnet Into Menu 24.7.1: Upload System Firmware Menu 24.7.1 - System Maintenance - Upload System Firmware To upload the system firmware, follow the procedure below: 1. Launch the FTP client on your workstation. 2.
Page 735: Ftp File Upload Command From The Dos Prompt Example
49.5.3 FTP File Upload Command from the DOS Prompt Example 1 Launch the FTP client on your computer. 2 Enter “open”, followed by a space and the IP address of your ZyWALL. 3 Press [ENTER] when prompted for a username. 4 Enter your password as requested (the default is “1234”).
Page 736: Tftp Upload Command Example
Chapter 49 Firmware and Configuration File Maintenance 2 Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 – System Maintenance. 3 Enter the command “sys stdio 0” to disable the console timeout, so the TFTP transfer will not be interrupted.
Page 737: Example Xmodem Firmware Upload Using Hyperterminal
Figure 477 Menu 24.7.1 As Seen Using the Console Port Menu 24.7.1 - System Maintenance - Upload System Firmware To upload system firmware: 1. Enter "y" at the prompt below to go into debug mode. 2. Enter "atur" after "Enter Debug Mode" message. 3.
Page 738: Example Xmodem Configuration Upload Using Hyperterminal
Chapter 49 Firmware and Configuration File Maintenance Figure 479 Menu 24.7.2 As Seen Using the Console Port Menu 24.7.2 - System Maintenance - Upload System Configuration File To upload system configuration file: 1. Enter "y" at the prompt below to go into debug mode. 2.
Page 739: System Maintenance Menus 8 To 10
H A P T E R System Maintenance Menus 8 to This chapter leads you through SMT menus 24.8 to 24.10. 50.1 Command Interpreter Mode The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions.
Page 740: Call Control Support
Chapter 50 System Maintenance Menus 8 to 10 50.2 Call Control Support The ZyWALL provides two call control functions: budget management and call history. Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1.
Page 741: Call History
The total budget is the time limit on the accumulated time for outgoing calls to a remote node. When this limit is reached, the call will be dropped and further outgoing calls to that remote node will be blocked. After each period, the total budget is reset. The default for the total budget is 0 minutes and the period is 0 hours, meaning no budget control.
Page 742: Time And Date Setting
Chapter 50 System Maintenance Menus 8 to 10 Table 260 Call History FIELD DESCRIPTION Rate This is the transfer rate of the call. #call This is the number of calls made to or received from that telephone number. This is the length of time of the longest telephone call. This is the length of time of the shortest telephone call.
Page 743: Figure 486 Menu 24.10 System Maintenance: Time And Date Setting
Figure 486 Menu 24.10 System Maintenance: Time and Date Setting Menu 24.10 - System Maintenance - Time and Date Setting Time Protocol= NTP (RFC-1305) Time Server Address= 0.pool.ntp.org Current Time: New Time (hh:mm:ss): Current Date: New Date (yyyy-mm-dd): Time Zone= GMT Daylight Saving= No Start Date (mm-nth-week-hr): End Date (mm-nth-week-hr):...
Page 744 Chapter 50 System Maintenance Menus 8 to 10 Table 261 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION Start Date (mm- Configure the day and time when Daylight Saving Time starts if you selected Yes nth-week-hr) in the Daylight Saving field. The hr field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time starts in most parts of the United States on the second Sunday of March.
Page 745: Remote Management
H A P T E R This chapter covers remote management found in SMT menu 24.11. 51.1 Remote Management Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers. When you configure remote management to allow management from any network except the LAN, you still need to configure a firewall rule to allow access.
Page 746: Figure 487 Menu 24.11 - Remote Management Control
Chapter 51 Remote Management Figure 487 Menu 24.11 – Remote Management Control TELNET Server: FTP Server: SSH Server: HTTPS Server: HTTP Server: SNMP Service: DNS Service: The following table describes the fields in this screen. Table 262 Menu 24.11 – Remote Management Control FIELD DESCRIPTION Telnet Server...
Page 747: Remote Management Limitations
Table 262 Menu 24.11 – Remote Management Control (continued) FIELD DESCRIPTION Authenticate Select Yes by pressing [SPACE BAR], then [ENTER] to require the SSL client to Client authenticate itself to the ZyWALL by sending the ZyWALL a certificate. To do that Certificates the SSL client must have a CA-signed certificate from a CA that has been imported as a trusted CA on the ZyWALL (see...
Page 748 Chapter 51 Remote Management ZyWALL 5/35/70 Series User’s Guide...
Page 749: Ip Policy Routing
H A P T E R This chapter covers setting and applying policies used for IP routing. 52.1 IP Routing Policy Summary Menu 25 shows the summary of a policy rule, including the criteria and the action of a single policy, and whether a policy is active or not.
Page 750: Ip Routing Policy Setup
Chapter 52 IP Policy Routing Table 263 Menu 25: Sample IP Routing Policy Summary (continued) FIELD Criteria/Action Select Command Select Rule When you have completed this menu, press [ENTER] at the prompt "Press ENTER to Confirm…" to save your configuration, or press [ESC] at any time to cancel. Table 264 IP Routing Policy Setup ABBREVIATION Criterion...
Page 751: Figure 489 Menu 25.1: Ip Routing Policy Setup
2 Select Edit in the Select Command field; type the index number of the rule you want to configure in the Select Rule field and press [ENTER] to open Menu 25.1 - IP Routing Policy Setup (see the next figure). Figure 489 Menu 25.1: IP Routing Policy Setup Menu 25.1 - IP Routing Policy Setup Rule Index= 1...
Page 752: Applying Policy To Packets
Chapter 52 IP Policy Routing Table 265 Menu 25.1: IP Routing Policy Setup FIELD addr start / end port start / end Action Gateway Type Gateway addr Remote Node Idx Redirect Packet Type of Service Precedence Edit policy to packets received from When you have completed this menu, press [ENTER] at the prompt "Press [ENTER] to confirm or [ESC] to cancel"...
Page 753: Ip Policy Routing Example
Figure 490 Menu 25.1.1: IP Routing Policy Setup Menu 25.1.1 - IP Routing Policy Setup Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this screen. Table 266 Menu 25.1.1: IP Routing Policy Setup FIELD DESCRIPTION LAN/DMZ/WLAN/...
Page 754: Figure 491 Example Of Ip Policy Routing
Chapter 52 IP Policy Routing Figure 491 Example of IP Policy Routing To force Web packets coming from clients with IP addresses of 192.168.1.33 to 192.168.1.64 to be routed to the Internet via the WAN port of the ZyWALL, follow the steps as shown next. 1 Create a rule in Menu 25.1 - IP Routing Policy Setup as shown next.
Page 755: Figure 493 Ip Routing Policy Example 2
2 Select Yes in the LAN field in menu 25.1.1 to apply the policy to packets received on the LAN port. 3 Check Menu 25 - IP Routing Policy Summary to see if the rule is added correctly. 4 Create another rule in menu 25.1 for this rule to route packets from any host (IP=0.0.0.0 means any host) with protocol TCP and port FTP access through another gateway (192.168.1.100).
Page 756 Chapter 52 IP Policy Routing ZyWALL 5/35/70 Series User’s Guide...
Page 757: Call Scheduling
H A P T E R Call scheduling allows you to dictate when a remote node should be called and for how long. 53.1 Introduction to Call Scheduling The call scheduling feature allows the ZyWALL to manage a remote node and dictate when a remote node should be called and for how long.
Page 758: Figure 495 Schedule Set Setup
Chapter 53 Call Scheduling To delete a schedule set, enter the set number and press [SPACE BAR] and then [ENTER] or [DEL] in the Edit Name field. To set up a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press [ENTER] to see Menu 26.1 - Schedule Set Setup as shown next.
Page 759: Figure 496 Applying Schedule Set(S) To A Remote Node (Pppoe)
Table 267 Schedule Set Setup (continued) FIELD DESCRIPTION If you selected Weekly in the How Often field above, then select the day(s) when the set should activate (and recur) by going to that day(s) and pressing [SPACE BAR] to select Yes, then press [ENTER]. Start Time Enter the start time when you wish the schedule set to take effect in hour-minute format.
Page 760: Figure 497 Applying Schedule Set(S) To A Remote Node (Pptp)
Chapter 53 Call Scheduling Figure 497 Applying Schedule Set(s) to a Remote Node (PPTP) Rem Node Name= ChangeMe Active= Yes Encapsulation= PPTP Service Type= Standard Outgoing= PPTP: Press ENTER to Confirm or ESC to Cancel: Menu 11.1 - Remote Node Profile My Login= My Password= ******** Retype to Confirm= ********...
Page 761: Troubleshooting And Product Specifications
Troubleshooting and Product Specifications Troubleshooting (763) Product Specifications (769)
Page 763: Troubleshooting
H A P T E R This chapter offers some suggestions to solve problems you might encounter. The potential problems are divided into the following categories. • Power, Hardware Connections, and LEDs • ZyWALL Access and Login • Internet Access •...
Page 764: Zywall Access And Login
Chapter 54 Troubleshooting 54.2 ZyWALL Access and Login I forgot the LAN IP address for the ZyWALL. 1 The default LAN IP address is 192.168.1.1. 2 Use the console port to log in to the ZyWALL. 3 If you changed the IP address and have forgotten it, you might get the IP address of the ZyWALL by looking up the IP address of the default gateway for your computer.
Page 765 • If there is a DHCP server on your network, make sure your computer is using a dynamic IP address. See by default. 6 Reset the device to its factory defaults, and try to access the ZyWALL with the default IP address.
Page 766: Internet Access
Chapter 54 Troubleshooting See the troubleshooting suggestions for configurator. Ignore the suggestions about your browser. I cannot use FTP to upload / download the configuration file. / I cannot use FTP to upload new firmware. See the troubleshooting suggestions for configurator.
Page 767: Wireless Router/Ap Troubleshooting
I cannot access the Internet anymore. I had access to the Internet (with the ZyWALL), but my Internet connection is not available anymore. 1 Check the hardware connections, and make sure the LEDs are behaving as expected. See the Quick Start Guide and 2 Check the schedule rules.
Page 768: Upnp
Chapter 54 Troubleshooting 5 Check that both the ZyWALL and your wireless station are using the same wireless and wireless security settings. 6 Make sure traffic between the WLAN and the LAN is not blocked by the firewall on the ZyWALL.
Page 769: Product Specifications
H A P T E R Product Specifications The following tables summarize the ZyWALL’s hardware and firmware features. Table 268 Hardware Specifications Dimensions Weight Power Specification Fuse Specifications Ethernet Interface Reset Button Console Dial Backup Extension Card Slot Operating Temperature Storage Temperature Operating Humidity Storage Humidity...
Page 770: Table 269 Firmware Specifications
Chapter 55 Product Specifications Table 269 Firmware Specifications FEATURE Default IP Address Default Subnet Mask Default Password Default DHCP Pool Device Management Wireless Functionality Firmware Upgrade Configuration Backup & Restoration Network Address Translation (NAT) Port Forwarding DHCP (Dynamic Host Configuration Protocol) Dynamic DNS Support IP Multicast IP Alias...
Page 771: Table 270 Feature And Performance Specifications
Table 269 Firmware Specifications FEATURE Firewall Content Filter IPSec VPN Bandwidth Management Remote Management Table 270 Feature and Performance Specifications FEATURE Local User Database Entries Static DHCP Table Entries Static Routes Policy Routes Port Forwarding Rules Concurrent Sessions (NAT sessions) Address Mapping Rules Configurable IPSec VPN Network Policies (including network policies in the recycle...
Page 772: Table 271 Compatible Zyxel Wlan Cards And Security Features
Chapter 55 Product Specifications Table 270 Feature and Performance Specifications (continued) FEATURE Anti-Spam Whitelist and Blacklist Entries Firewall Throughput (with NAT) VPN (3DES) Throughput User Licenses Compatible ZyXEL WLAN Cards The following table lists the ZyXEL WLAN cards that you can use in the ZyWALL at the time of writing.
Page 773: Compatible 3G Cards
55.1 Compatible 3G Cards At the time of writing, you can use the following 3G wireless cards in the ZyWALL 5. The table also shows you the 3G features supported by the compatible 3G cards. Table 272 3G Features Supported By Compatible 3G Cards 3G CARD FEATURES Radio Technology...
Page 774: Table 274 3G Features Supported By Additional Compatible 3G Cards
Chapter 55 Product Specifications Table 273 3G Features Supported By Additional Compatible 3G Cards 3G CARD FEATURES Manual or automatic service provider selection via the web configurator Signal strength update even when data is transmitting Network type update even when data is transmitting Roaming status update even when data is transmitting...
Page 775: Power Adaptor Specifications
Table 274 3G Features Supported By Additional Compatible 3G Cards 3G CARD FEATURES Budget Control Bandwidth Management 55.2 Power Adaptor Specifications Table 275 North American Plug Standards AC POWER ADAPTOR MODEL INPUT POWER OUTPUT POWER POWER CONSUMPTION SAFETY STANDARDS Table 276 European Plug Standards AC POWER ADAPTOR MODEL INPUT POWER OUTPUT POWER...
Page 776: Figure 498 Console/Dial Backup Port Pin Layout
Chapter 55 Product Specifications Table 279 Japan Plug Standards OUTPUT POWER POWER CONSUMPTION SAFETY STANDARDS Table 280 China Plug Standards AC POWER ADAPTOR MODEL INPUT POWER OUTPUT POWER POWER CONSUMPTION SAFETY STANDARDS Cable Pin Assignments In a serial communications connection, generally a computer is DTE (Data Terminal Equipment) and a modem is DCE (Data Circuit-terminating Equipment).
Page 777: Table 282 Ethernet Cable Pin Assignments
Table 282 Ethernet Cable Pin Assignments WAN / LAN ETHERNET CABLE PIN LAYOUT Straight-through (Switch) 1 IRD + 2 IRD - 3 OTD 6 OTD - ZyWALL 5/35/70 Series User’s Guide Chapter 55 Product Specifications Crossover (Adapter) (Switch) 1 OTD 1 IRD + 2 OTD - 2 IRD - 3 IRD +...
Page 778 Chapter 55 Product Specifications ZyWALL 5/35/70 Series User’s Guide...
Page 779: Appendices And Index
VIII Appendices and Index Removing and Installing a Fuse (781) Common Services (783) Wireless LANs (787) Windows 98 SE/Me Requirements for Anti-Virus Message Display (801) Legal Information (805) Customer Support (809) Index (815)
Page 781: Appendix A Removing And Installing A Fuse
P P E N D I X Removing and Installing a Fuse This appendix shows you how to remove and install fuses for the ZyWALL. If you need to install a new fuse, follow the procedure below. If you use a fuse other than the included fuses, make sure it matches the fuse specifications in the product specifications chapter.
Page 782: Appendix A Removing And Installing A Fuse
Appendix A Removing and Installing a Fuse ZyWALL 5/35/70 Series User’s Guide...
Page 783: Appendix B Common Services
P P E N D I X The following table lists some commonly-used services and their associated protocols and port numbers. For a comprehensive list of port numbers, ICMP type/code numbers and services, visit the IANA (Internet Assigned Number Authority) web site. •...
Page 784 Appendix B Common Services Table 283 Commonly Used Services (continued) NAME H.323 HTTP HTTPS ICMP IGMP (MULTICAST) User-Defined MSN Messenger NEW-ICQ NEWS NNTP PING POP3 PPTP PPTP_TUNNEL (GRE) RCMD REAL_AUDIO REXEC RLOGIN PROTOCOL PORT(S) DESCRIPTION File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail.
Page 785 Table 283 Commonly Used Services (continued) NAME PROTOCOL RTELNET RTSP TCP/UDP SFTP SMTP SNMP TCP/UDP SNMP-TRAPS TCP/UDP SQL-NET TCP/UDP STRM WORKS SYSLOG TACACS TELNET TFTP VDOLIVE ZyWALL 5/35/70 Series User’s Guide Appendix B Common Services PORT(S) DESCRIPTION Remote Telnet. The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet.
Page 786 Appendix B Common Services ZyWALL 5/35/70 Series User’s Guide...
Page 787: Appendix C Wireless Lans
P P E N D I X Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless adapters (A, B, C). Any time two or more wireless adapters are within range of each other, they can set up an independent network, which is commonly referred to as an ad-hoc network or Independent Basic Service Set (IBSS).
Page 788: Figure 500 Basic Service Set
Appendix C Wireless LANs Figure 500 Basic Service Set An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type of wireless LAN topology is called an Infrastructure WLAN.
Page 789: Figure 501 Infrastructure Wlan
Figure 501 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by wireless devices to transmit and receive data. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a channel different from an adjacent AP (access point) to reduce interference.
Page 790: Figure 502 Rts/Cts
Appendix C Wireless LANs Figure 502 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations.
Page 791: Table 284 Ieee 802.11G
If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size. Preamble Type Preamble is used to signal that data is coming to the receiver.
Page 792: Table 285 Wireless Security Levels
Appendix C Wireless LANs Wireless security methods available on the ZyWALL are data encryption, wireless client authentication, restricting access by device MAC address and hiding the ZyWALL identity. The following figure shows the relative effectiveness of these wireless security methods available on your ZyWALL.
Page 793: Types Of Eap Authentication
Determines the network services available to authenticated users once they are connected to the network. • Accounting Keeps track of the client’s network activity. RADIUS is a simple package exchange in which your AP acts as a message relay between the wireless client and the network RADIUS server.
Page 794 Appendix C Wireless LANs For EAP-TLS authentication type, you must first have a wired connection to the network and obtain the certificate(s) from a certificate authority (CA). A certificate (also called digital IDs) can be used to authenticate users and a CA issues certificates and guarantees the identity of each certificate owner.
Page 795: Table 286 Comparison Of Eap Authentication Types
Dynamic WEP Key Exchange The AP maps a unique key that is generated with the RADIUS server. This key expires when the wireless connection times out, disconnects or reauthentication times out. A new WEP key is generated each time reauthentication is performed. If this feature is enabled, it is not necessary to configure a default encryption key in the wireless security configuration screen.
Page 796 Appendix C Wireless LANs Encryption Both WPA and WPA2 improve data encryption by using Temporal Key Integrity Protocol (TKIP), Message Integrity Check (MIC) and IEEE 802.1x. WPA and WPA2 use Advanced Encryption Standard (AES) in the Counter mode with Cipher block chaining Message authentication code Protocol (CCMP) to offer stronger encryption than TKIP.
Page 797: Figure 503 Wpa(2) With Radius Application Example
Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA. At the time of writing, the most widely available supplicant is the WPA patch for Windows XP, Funk Software's Odyssey client. The Windows XP patch is a free download that adds WPA capability to Windows XP's built- in "Zero Configuration"...
Page 798: Figure 504 Wpa(2)-Psk Authentication
Appendix C Wireless LANs 3 The AP and wireless clients generate a common PMK (Pairwise Master Key). The key itself is not sent over the network, but is derived from the PSK and the SSID. 4 The AP and wireless clients use the TKIP or AES encryption process, the PMK and information exchanged in a handshake to create temporal encryption keys.
Page 799: Antenna Characteristics
Antenna Overview An antenna couples RF signals onto air. A transmitter within a wireless device sends an RF signal to the antenna, which propagates the signal through the air. The antenna also operates in reverse by capturing RF signals from the air. Positioning the antennas properly increases the range and coverage area of a wireless LAN.
Page 800: Positioning Antennas
Appendix C Wireless LANs Positioning Antennas In general, antennas should be mounted as high as practically possible and free of obstructions. In point-to–point application, position both antennas at the same height and in a direct line of sight to each other to attain the best performance. For omni-directional antennas mounted on a table, desk, and so on, point the antenna up.
Page 801: Appendix D Windows 98 Se/Me Requirements For Anti-Virus Message Display
P P E N D I X Requirements for Anti-Virus With the anti-virus packet scan, when a virus is detected, an alert message is displayed on Miscrosoft Windows-based computers. For Windows 98 SE/Me, you must open the WinPopup window in order to view real-time alert messages.
Page 802: Figure 506 Windows 98 Se: Program Task Bar
Appendix D Windows 98 SE/Me Requirements for Anti-Virus Message Display Figure 506 WIndows 98 SE: Program Task Bar 2 Click the Start Menu Programs tab and click Advanced ... Figure 507 Windows 98 SE: Task Bar Properties 3 Double-click Programs and click StartUp. 4 Right-click in the StartUp pane and click New, Shortcut.
Page 803: Figure 508 Windows 98 Se: Startup
Appendix D Windows 98 SE/Me Requirements for Anti-Virus Message Display Figure 508 Windows 98 SE: StartUp 5 A Create Shortcut window displays. Enter “winpopup” in the Command line field and click Next. Figure 509 Windows 98 SE: Startup: Create Shortcut 6 Specify a name for the shortcut or accept the default and click Finish.
Page 804: Figure 510 Windows 98 Se: Startup: Select A Title For The Program
Appendix D Windows 98 SE/Me Requirements for Anti-Virus Message Display Figure 510 Windows 98 SE: Startup: Select a Title for the Program 7 A shortcut is created in the StartUp pane. Restart the computer when prompted. Figure 511 Windows 98 SE: Startup: Shortcut The WinPopup window displays after the computer finishes the startup process (see Figure 505 on page...
Page 806: Appendix E Legal Information
Appendix E Legal Information This device has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This device generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications.
Page 807: Zyxel Limited Warranty
Viewing Certifications 1 Go to http://www.zyxel.com. 2 Select your product on the ZyXEL home page to go to that product's page. 3 Select the certification you wish to view from this page. ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase.
Page 808 Appendix E Legal Information ZyWALL 5/35/70 Series User’s Guide...
Page 809: Appendix F Customer Support
• Sales E-mail: sales@zyxel.com.tw • Telephone: +886-3-578-3942 • Fax: +886-3-578-2439 • Web: www.zyxel.com • Regular Mail: ZyXEL Communications Corp., 6 Innovation Road II, Science Park, Hsinchu 300, Taiwan China - ZyXEL Communications (Beijing) Corp. • Support E-mail: cso.zycn@zyxel.cn • Sales E-mail: sales@zyxel.cn •...
Page 810: Appendix F Customer Support
Czech Republic • E-mail: info@cz.zyxel.com • Telephone: +420-241-091-350 • Fax: +420-241-091-359 • Web: www.zyxel.cz • Regular Mail: ZyXEL Communications, Czech s.r.o., Modranská 621, 143 01 Praha 4 - Modrany, Ceská Republika Denmark • Support E-mail: support@zyxel.dk • Sales E-mail: sales@zyxel.dk •...
Page 811 Germany • Support E-mail: support@zyxel.de • Sales E-mail: sales@zyxel.de • Telephone: +49-2405-6909-69 • Fax: +49-2405-6909-99 • Web: www.zyxel.de • Regular Mail: ZyXEL Deutschland GmbH., Adenauerstr. 20/A2 D-52146, Wuerselen, Germany Hungary • Support E-mail: support@zyxel.hu • Sales E-mail: info@zyxel.hu • Telephone: +36-1-3361649 •...
Page 812 • Support Telephone: +1-800-978-7222 • Sales E-mail: sales@zyxel.com • Sales Telephone: +1-714-632-0882 • Fax: +1-714-632-0858 • Web: www.zyxel.com • Regular Mail: ZyXEL Communications Inc., 1130 N. Miller St., Anaheim, CA 92806- 2001, U.S.A. Norway • Support E-mail: support@zyxel.no • Sales E-mail: sales@zyxel.no •...
Page 813 • Support E-mail: support@zyxel.es • Sales E-mail: sales@zyxel.es • Telephone: +34-902-195-420 • Fax: +34-913-005-345 • Web: www.zyxel.es • Regular Mail: ZyXEL Communications, Arte, 21 5ª planta, 28033 Madrid, Spain Sweden • Support E-mail: support@zyxel.se • Sales E-mail: sales@zyxel.se • Telephone: +46-31-744-7700 •...
Page 814 • Sales E-mail: sales@zyxel.co.uk • Telephone: +44-1344-303044, 0845 122 0301 (UK only) • Fax: +44-1344-303034 • Web: www.zyxel.co.uk • Regular Mail: ZyXEL Communications UK Ltd., 11 The Courtyard, Eastern Road, Bracknell, Berkshire RG12 2XB, United Kingdom (UK) ZyWALL 5/35/70 Series User’s Guide...
Page 815: Index
Numerics 9600 baud access control active protocol and encapsulation Address Assignment address assignment ADP (Anomaly, Detection and Prevention) Advanced Encryption Standard See AES. and transport mode STUN allocated budget 624, 663 antenna directional gain omni-directional anti-probing anti-spam action for no spam score action for spam mails concurrent e-mail sessions customization...
Page 816 Index Bridge Protocol Data Unit. See BPDU. broadcast budget budget management buffer overflow 399, 794 call back delay call control call history call scheduling max number of schedule sets PPPoE precedence setting up a schedule call-triggering packet certificate Certificate Authority See CA.
Page 817 diagnostic diagnostics dial timeout Diffie-Hellman key group Perfect Forward Secrecy (PFS) digest disclaimer IP alias setup port filter setup setup TCP/IP setup DNS Server For VPN Host DNS server address assignment domain name Domain Name System. See DNS. 251, 265 drop timeout DSL modem 202, 622...
Page 818 Index one minute high one minute low rules rules for VPN 122, 127 service type SMT menus stateful inspection TCP maximum incomplete three-way handshake when to use firmware file maintenance upload firmware upload flow control fragmentation threshold From VPN traffic 481, 509 commands file upload...
Page 819 IP address assignment 640, 665 pool 151, 154, 212, 222, 635 private IP alias IP alias setup IP policy routing 457, 749 IP protocol type IP routing policy IP static route active destination IP address name route number IPSec established in two phases local network NAT over remote IPSec router...
Page 820 Index nailed-up connection 662, 664 150, 435, 441, 442, 626, 641, 665, 666, 706 and VPN application configuring default server IP address examples in the SMT inside global address inside local address Many to Many No Overload Many to Many Overload Many to One mapping types NAT unfriendly applications...
Page 821 product registration protocol filter incoming outgoing Quality of Service. See QoS. query view (IDP) RADIUS 231, 244, 792 and IKE SA message types 244, 793 messages shared secret key 244, 793 Rapid Spanning Tree Protocol. See Rapid STP. Rapid STP Real time Transport Protocol.
Page 822 Index scanner types schedule 661, 664 duration searching for IDP signatures secure FTP using SSH secure Telnet using SSH security associations. See VPN. security settings for VPN traffic server set service set 230, 233 service type 266, 640, 660 services Session Initiation Protocol.
Page 823 time and date setting Daylight Saving Time resetting synchronization with server zone 589, 744 Time protocol time protocol Daytime Time time setting timeout system TKIP To VPN traffic trace trademarks traffic from VPN redirect to VPN transparent firewall 71, 161, 591, 593 triangle routes vs virtual interfaces trigger port forwarding...
Page 824 Index warranty note web attack web configurator web site hits WEP encryption 239, 242 whitelist 314, 321 Wi-Fi Protected Access Wi-Fi Protected Access. See WPA. Windows Internet Naming Service. See WINS. WinPopup window WINS 152, 154 WINS server wireless channel wireless client WPA supplicants wireless LAN wireless security...

This manual is also suitable for:

Zywall 35 - v4.04 Zywall 5 - v4.04 Zywall 70 - v4.04 Zywall 35 Zywall 70 Zywall 5 series ... Show all

ZyXEL Communications 5 Series User Manual

About this User's Guide

Document Conventions

Safety Warnings

Contents Overview

Table of Contents

List of Figures

List of Tables

Introduction

PART I Introduction

Chapter 1 Getting to Know Your Zywall

Chapter 2 Hardware Installation

Chapter 3 Introducing the Web Configurator

Chapter 4 Wizard Setup

Chapter 5 Tutorials

Chapter 6 Registration Screens

Network

Part II: Network

Chapter 7 LAN Screens

Chapter 8 Bridge Screens

Chapter 9 WAN Screens

Chapter 10 DMZ Screens

Quick Links

Troubleshooting

Related Manuals for ZyXEL Communications 5 Series

Summary of Contents for ZyXEL Communications 5 Series