ZyXEL Communications Internet Security Appliance ZyWALL5UTM 4.0 User Manual

Internet security appliance

Table of Contents

Quick Links

Download this manual

ZyWALL 5/35/70 Series

Internet Security Appliance

User's Guide

Version 4.00

10/2005

Table of Contents

Troubleshooting

Summary of Contents for ZyXEL Communications Internet Security Appliance ZyWALL5UTM 4.0

Page 1 ZyWALL 5/35/70 Series Internet Security Appliance User’s Guide Version 4.00 10/2005...
Page 3: Federal Communications Commission (Fcc) Interference Statement
ZyWALL 5/35/70 Series User’s Guide Federal Communications Commission (FCC) Interference This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations.
Page 4 ZyWALL 5/35/70 Series User’s Guide Federal Communications Commission (FCC) Interference Statement...
Page 5: Safety Warnings
ZyWALL 5/35/70 Series User’s Guide For your safety, be sure to read and follow all warning notices and instructions. • Do NOT open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks. ONLY qualified service personnel can service the device.
Page 6: Zyxel Limited Warranty
ZyWALL 5/35/70 Series User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever...
Page 7: Customer Support
+7-3272-590-689 1-800-255-4101 www.us.zyxel.com +1-714-632-0882 +1-714-632-0858 ftp.us.zyxel.com +47-22-80-61-80 www.zyxel.no +47-22-80-61-81 REGULAR MAIL ZyXEL Communications Corp. 6 Innovation Road II Science Park Hsinchu 300 Taiwan ZyXEL Communications Czech s.r.o. Modranská 621 143 01 Praha 4 - Modrany Ceská Republika ZyXEL Communications A/S...
Page 8 Poland ZyXEL Russia Ostrovityanova 37a Str. Moscow, 117279 Russia ZyXEL Communications Alejandro Villegas 33 1º, 28043 Madrid Spain ZyXEL Communications A/S Sjöporten 4, 41764 Göteborg Sweden ZyXEL Ukraine 13, Pimonenko Str. Kiev, 04050 Ukraine ZyXEL Communications UK Ltd.,11 The Courtyard,...
Page 9 ZyWALL 5/35/70 Series User’s Guide Customer Support...
Page 10: Table Of Contents
Copyright ... 2 Federal Communications Commission (FCC) Interference Statement ... 3 Safety Warnings ... 5 ZyXEL Limited Warranty... 6 Customer Support... 7 Table of Contents ... 10 List of Figures ... 28 List of Tables ... 40 Preface ... 48 Chapter 1 Getting to Know Your ZyWALL ...
Page 11 ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wizard Setup ... 80 3.1 Wizard Setup Overview ...80 3.2.1 ISP Parameters ...80 3.2.1.1 Ethernet ...80 3.2.1.2 PPPoE Encapsulation ...82 3.2.1.3 PPTP Encapsulation ...83 Chapter 4 Registration ... 100 4.1 myZyXEL.com overview ...100 4.1.1 Subscription Services Available on the ZyWALL ...100 Chapter 5 LAN Screens...
Page 12 7.4.2 Weighted Round Robin ...129 7.4.3 Spillover ...129 7.5 TCP/IP Priority (Metric) ...130 7.7 Configuring Load Balancing ...133 7.7.1 Least Load First ...134 7.7.2 Weighted Round Robin ...135 7.7.3 Spillover ...135 7.9 WAN IP Address Assignment ...138 7.10 DNS Server Address Assignment ...138 7.11 WAN MAC Address ...139 7.12.1 WAN Ethernet Encapsulation ...139 7.12.2 PPPoE Encapsulation ...142...
Page 13 ZyWALL 5/35/70 Series User’s Guide 9.11.2 Encryption ...183 9.12 WPA-PSK Application Example ...184 9.13 Introduction to RADIUS ...185 9.14 WPA with RADIUS Application Example ...185 9.15 Wireless Client WPA Supplicants ...186 9.16.1 Static WEP ...188 9.16.2 WPA-PSK ...189 9.16.3 WPA ...191 9.16.4 IEEE 802.1x + Dynamic WEP ...192 9.16.5 IEEE 802.1x + Static WEP ...193 9.16.6 IEEE 802.1x + No WEP ...194...
Page 14 Chapter 11 Firewall Screens... 210 11.1 Access Methods ...210 11.2 Firewall Policies Overview ...210 11.3 Rule Logic Overview ...212 11.3.1 Rule Checklist ...212 11.3.2 Security Ramifications ...212 11.3.3 Key Fields For Configuring Rules ...212 11.3.3.1 Action ...212 11.3.3.2 Service ...213 11.3.3.3 Source Address ...213 11.3.3.4 Destination Address ...213 11.4 Connection Direction Examples ...213...
Page 15 ZyWALL 5/35/70 Series User’s Guide 13.3.3 Signature Actions ...244 13.3.4 Configuring IDP Signatures ...245 13.3.5.1 Query Example 1 ...247 13.3.5.2 Query Example 2 ...249 13.4.1 mySecurity Zone ...250 13.4.2 Configuring IDP Update ...251 Chapter 14 Anti-Virus ... 254 14.1.1 Types of Computer Viruses ...254 14.1.2 Computer Virus Infection and Prevention ...254 14.1.3 Types of Anti-Virus Scanner ...255 14.2 Introduction to the ZyWALL Anti-Virus Scanner ...255...
Page 16 16.6.2 Full Path URL Checking ...286 16.6.3 File Name URL Checking ...286 Chapter 17 Content Filtering Reports ... 290 17.1 Checking Content Filtering Activation ...290 17.2 Viewing Content Filtering Reports ...290 17.3 Web Site Submission ...295 Chapter 18 Introduction to IPSec ... 298 18.1 VPN Overview ...298 18.1.1 IPSec ...298 18.1.2 Security Association ...298...
Page 17 ZyWALL 5/35/70 Series User’s Guide 19.7 ID Type and Content ...307 19.7.1 ID Type and Content Examples ...308 19.8 IKE Phases ...309 19.8.1 Negotiation Mode ...310 19.8.2 Pre-Shared Key ...310 19.8.3 Diffie-Hellman (DH) Key Groups ...311 19.8.4 Perfect Forward Secrecy (PFS) ...311 19.9 X-Auth (Extended Authentication) ...311 19.9.1 Authentication Server ...311 19.15.1 Security Parameter Index (SPI) ...327...
Page 18 22.5.1 Default Server IP Address ...380 22.5.2 Port Forwarding: Services and Port Numbers ...380 22.5.3 Configuring Servers Behind Port Forwarding (Example) ...380 22.5.4 NAT and Multiple WAN ...381 22.5.5 Port Translation ...381 Chapter 23 Static Route ... 388 23.2 IP Static Route ...388 Chapter 24 Policy Route ...
Page 19 ZyWALL 5/35/70 Series User’s Guide 26.5 Name Server Record ...415 26.5.1 Private DNS Server ...415 26.6 System Screen ...416 26.8 Configure DNS Cache ...421 26.10.1 DYNDNS Wildcard ...424 26.10.2 High Availability ...424 26.11 Configuring Dynamic DNS ...424 Chapter 27 Remote Management ... 428 27.1 Remote Management Overview ...428 27.1.1 Remote Management Limitations ...428 27.1.2 System Timeout ...429...
Page 20 28.5 Using UPnP in Windows XP Example ...457 28.5.1 Auto-discover Your UPnP-enabled Network Device ...458 28.5.2 Web Configurator Easy Access ...459 Chapter 29 ALG Screen... 462 29.1.1 ALG and NAT ...462 29.1.2 ALG and the Firewall ...462 29.1.3 ALG and Multiple WAN ...462 29.2 FTP ...463 29.3 H.323 ...463 29.4 RTP ...463...
Page 21 ZyWALL 5/35/70 Series User’s Guide Chapter 32 Introducing the SMT ... 496 32.1 Introduction to the SMT ...496 32.2 Accessing the SMT via the Console Port ...496 32.2.1 Initial Screen ...496 32.2.2 Entering the Password ...497 32.3 Navigating the SMT Interface ...497 32.3.1 Main Menu ...498 32.3.2 SMT Menus Overview ...500 32.4 Changing the System Password ...502...
Page 22 36.2 Ethernet Encapsulation ...528 36.3 Configuring the PPTP Client ...530 36.4 Configuring the PPPoE Client ...530 36.5 Basic Setup Complete ...531 Chapter 37 DMZ Setup ... 532 37.1 Configuring DMZ Setup ...532 37.2 DMZ Port Filter Setup ...532 37.3 TCP/IP Setup ...532 37.3.1 IP Address ...533 37.3.2 IP Alias Setup ...534 Chapter 38...
Page 23 ZyWALL 5/35/70 Series User’s Guide Chapter 41 IP Static Route Setup ... 556 41.1 IP Static Route Setup ...556 Chapter 42 Network Address Translation (NAT) ... 558 42.1 Using NAT ...558 42.1.1 SUA (Single User Account) Versus NAT ...558 42.1.2 Applying NAT ...558 42.2 NAT Setup ...560 42.2.1 Address Mapping Sets ...561 42.2.1.1 SUA Address Mapping Set ...561...
Page 24 Chapter 45 SNMP Configuration ... 594 45.1 SNMP Configuration ...594 45.2 SNMP Traps ...595 Chapter 46 System Information & Diagnosis ... 596 46.1 Introduction to System Status ...596 46.2 System Status ...596 46.3 System Information and Console Port Speed ...598 46.3.1 System Information ...598 46.3.2 Console Port Speed ...599 46.4 Log and Trace ...600...
Page 25 ZyWALL 5/35/70 Series User’s Guide 47.5.6 TFTP Upload Command Example ...620 47.5.7 Uploading Via Console Port ...620 47.5.8 Uploading Firmware File Via Console Port ...620 47.5.9 Example Xmodem Firmware Upload Using HyperTerminal ...621 47.5.10 Uploading Configuration File Via Console Port ...621 47.5.11 Example Xmodem Configuration Upload Using HyperTerminal ...622 Chapter 48 System Maintenance Menus 8 to 10 ...
Page 26 ZyWALL 5/35/70 Series User’s Guide 52.5.1.3 Java Permissions ...656 52.6 Packet Flow ...658 Appendix A Product Specifications ... 660 Appendix B Hardware Installation... 668 Appendix C Removing and Installing a Fuse ... 672 Appendix D Setting up Your Computer’s IP Address... 674 Appendix E IP Subnetting ...
Page 27 ZyWALL 5/35/70 Series User’s Guide Certificates Commands ... 762 Appendix Q Brute-Force Password Guessing Protection... 766 Appendix R Boot Commands ... 768 Appendix S Log Descriptions... 770 Index... 794 Table of Contents...
Page 28: List Of Figures
ZyWALL 5/35/70 Series User’s Guide List of Figures Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem ... 58 Figure 2 VPN Application ... 59 Figure 3 ZyWALL 70 Front Panel ... 59 Figure 4 ZyWALL 35 Front Panel ... 59 Figure 5 ZyWALL 5 Front Panel ...
Page 29 ZyWALL 5/35/70 Series User’s Guide Figure 39 WLAN Port Role Example ... 114 Figure 40 LAN Port Roles ... 115 Figure 41 Port Roles Change Complete ... 116 Figure 42 Bridge Loop: Bridge Connected to Wired LAN ... 118 Figure 43 Bridge ... 121 Figure 44 WLAN Port Role Example ...
Page 30 ZyWALL 5/35/70 Series User’s Guide Figure 82 Wireless Card: WPA-PSK ... 190 Figure 83 Wireless Card: WPA ... 191 Figure 84 Wireless Card: 802.1x + Dynamic WEP ... 192 Figure 85 Wireless Card: 802.1x + Static WEP ... 193 Figure 86 Wireless Card: 802.1x + No WEP ... 194 Figure 87 Wireless Card: No Access 802.1x + Static WEP ...
Page 31 ZyWALL 5/35/70 Series User’s Guide Figure 125 Anti-Spam: General ... 266 Figure 126 Anti-Spam: External DB ... 268 Figure 127 Anti-Spam: Lists ... 270 Figure 128 Anti-Spam Rule Edit ... 271 Figure 129 Content Filter : General ... 275 Figure 130 Content Filtering Lookup Procedure ... 277 Figure 131 Content Filter : Categories ...
Page 32 ZyWALL 5/35/70 Series User’s Guide Figure 168 Trusted Remote Hosts ... 356 Figure 169 Remote Host Certificates ... 357 Figure 170 Certificate Details ... 358 Figure 171 Trusted Remote Host Import ... 359 Figure 172 Trusted Remote Host Details ... 360 Figure 173 Directory Servers ...
Page 33 ZyWALL 5/35/70 Series User’s Guide Figure 211 Login Screen (Internet Explorer) ... 435 Figure 212 Login Screen (Netscape) ... 435 Figure 213 Replace Certificate ... 436 Figure 214 Device-specific Certificate ... 436 Figure 215 Common ZyWALL Certificate ... 437 Figure 216 SSH Communication Example ... 437 Figure 217 How SSH Works ...
Page 34 ZyWALL 5/35/70 Series User’s Guide Figure 254 Firmware Upload In Process ... 491 Figure 255 Network Temporarily Disconnected ... 492 Figure 256 Firmware Upload Error ... 492 Figure 257 Backup and Restore ... 493 Figure 258 Configuration Upload Successful ... 494 Figure 259 Network Temporarily Disconnected ...
Page 35 ZyWALL 5/35/70 Series User’s Guide Figure 297 Menu 6.3: Route Failover ... 538 Figure 298 Menu 7.1: Wireless Setup ... 540 Figure 299 Menu 7.1.1: WLAN MAC Address Filter ... 542 Figure 300 Menu 7: WLAN Setup ... 543 Figure 301 Menu 7.2: TCP/IP and DHCP Ethernet Setup ... 544 Figure 302 Menu 7.2.1: IP Alias Setup ...
Page 36 ZyWALL 5/35/70 Series User’s Guide Figure 339 Menu 21.2: Firewall Setup ... 579 Figure 340 Outgoing Packet Filtering Process ... 580 Figure 341 Filter Rule Process ... 582 Figure 342 Menu 21: Filter and Firewall Setup ... 583 Figure 343 Menu 21.1: Filter Set Configuration ... 583 Figure 344 Menu 21.1.1.1: TCP/IP Filter Rule ...
Page 37 ZyWALL 5/35/70 Series User’s Guide Figure 382 Example Xmodem Upload ... 621 Figure 383 Menu 24.7.2 As Seen Using the Console Port ... 622 Figure 384 Example Xmodem Upload ... 622 Figure 385 Command Mode in Menu 24 ... 624 Figure 386 Valid Commands ...
Page 38 ZyWALL 5/35/70 Series User’s Guide Figure 425 Windows XP: Advanced TCP/IP Properties ... 681 Figure 426 Windows XP: Internet Protocol (TCP/IP) Properties ... 682 Figure 427 Macintosh OS 8/9: Apple Menu ... 683 Figure 428 Macintosh OS 8/9: TCP/IP ... 683 Figure 429 Macintosh OS X: Apple Menu ...
Page 39 ZyWALL 5/35/70 Series User’s Guide Figure 468 Headquarters Network Policy Edit ... 731 Figure 469 Branch Office Network Policy Edit ... 732 Figure 470 VPN Rule Configured ... 733 Figure 471 VPN Dial ... 733 Figure 472 VPN Tunnel Established ... 733 Figure 473 VPN Log Example ...
Page 40: List Of Tables
ZyWALL 5/35/70 Series User’s Guide List of Tables Table 1 Model Specific Features ... 50 Table 2 Front Panel LEDs ... 60 Table 3 Web Configurator HOME Screen in Router Mode ... 66 Table 4 Web Configurator HOME Screen in Bridge Mode ... 68 Table 5 Bridge and Router Mode Features Comparison ...
Page 41 ZyWALL 5/35/70 Series User’s Guide Table 39 WAN: Ethernet Encapsulation ... 140 Table 40 WAN: PPPoE Encapsulation ... 144 Table 41 WAN: PPTP Encapsulation ... 147 Table 42 Traffic Redirect ... 150 Table 43 Dial Backup ... 153 Table 44 Advanced Setup ... 156 Table 45 DMZ ...
Page 42 ZyWALL 5/35/70 Series User’s Guide Table 82 Common Computer Virus Types ... 254 Table 83 Anti-Virus: General ... 258 Table 84 Anti-Virus: Update ... 260 Table 85 Anti-Spam: General ... 267 Table 86 Anti-Spam: External DB ... 268 Table 87 Anti-Spam: Lists ... 270 Table 88 Anti-Spam Rule Edit ...
Page 43 ZyWALL 5/35/70 Series User’s Guide Table 125 NAT Mapping Types ... 374 Table 126 NAT Overview ... 375 Table 127 NAT Address Mapping ... 377 Table 128 NAT Address Mapping Edit ... 379 Table 129 Services and Port Numbers ... 380 Table 130 Port Forwarding ...
Page 44 ZyWALL 5/35/70 Series User’s Guide Table 168 Web Site Hits Report ... 476 Table 169 Protocol/ Port Report ... 477 Table 170 Host IP Address Report ... 478 Table 171 Report Specifications ... 479 Table 172 General Setup ... 481 Table 173 Password Setup ...
Page 45 ZyWALL 5/35/70 Series User’s Guide Table 211 Remote Node Network Layer Options Menu Fields ... 552 Table 212 Menu 11.1.5: Traffic Redirect Setup ... 555 Table 213 Menu 12. 1: Edit IP Static Route ... 557 Table 214 Applying NAT in Menus 4 & 11.1.2 ... 560 Table 215 SUA Address Mapping Rules ...
Page 46 ZyWALL 5/35/70 Series User’s Guide Table 254 Classes of IP Addresses ... 690 Table 255 Allowed IP Address Range By Class ... 691 Table 256 “Natural” Masks ... 691 Table 257 Alternative Subnet Mask Notation ... 692 Table 258 Two Subnets Example ... 692 Table 259 Subnet 1 ...
Page 47 ZyWALL 5/35/70 Series User’s Guide Table 297 AS Logs ... 788 Table 298 Syslog Logs ... 790 Table 299 RFC-2408 ISAKMP Payload Types ... 791 List of Tables...
Page 48: Preface
Help us help you. E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan. Thank you! Preface www.zyxel.com...
Page 49: Syntax Conventions
ZyWALL 5/35/70 Series User’s Guide Syntax Conventions • “Enter” means for you to type one or more characters. “Select” or “Choose” means for you to use one predefined choices. • The SMT menu titles and labels are in Bold Times New Roman font. Predefined field choices are in Bold Arial font.
Page 50: Getting To Know Your Zywall
Getting to Know Your ZyWALL This chapter introduces the main features and applications of the ZyWALL. ZyWALL Internet Security Appliance Overview The ZyWALL is loaded with security features including VPN, firewall, content filtering, anti- spam, IDP (Intrusion Detection and Prevention), anti-virus and certificates. The ZyWALL’s De-Militarized Zone (DMZ) increases LAN security by providing separate ports for connecting publicly accessible servers.
Page 51: Physical Features
ZyWALL 5/35/70 Series User’s Guide Table Key: An O in a mode’s column shows that the device mode has the specified feature. The information in this table was correct at the time of writing, although it may be subject to change.
Page 52: Non-Physical Features
Time and Date The ZyWALL allows you to get the current time and date from an external server when you turn on your ZyWALL. You can also set the time manually. The Real Time Chip (RTC) keeps track of the time and date. Reset Button Use the reset button to restore the factory default password to 1234;...
Page 53: Ipsec Vpn Capability
ZyWALL 5/35/70 Series User’s Guide Bandwidth Management Bandwidth management allows you to allocate network resources according to defined policies. This policy-based bandwidth allocation helps your network to better handle real-time applications such as Voice-over-IP (VoIP). IPSec VPN Capability Establish a Virtual Private Network (VPN) to connect with business partners and branch offices using data encryption and the Internet to provide secure communications without the expense of leased site-to-site lines.
Page 54 Content Filtering The ZyWALL can block web features such as ActiveX controls, Java applets and cookies, as well as disable web proxies. The ZyWALL can block or allow access to web sites that you specify. The ZyWALL can also block access to web sites containing keywords that you specify.
Page 55: Wireless Lan Mac Address Filtering
ZyWALL 5/35/70 Series User’s Guide IEEE 802.1x for Network Security The ZyWALL supports the IEEE 802.1x standard that works with the IEEE 802.11 to enhance user authentication. With the local user profile, the ZyWALL allows you to configure up 32 user profiles without a network authentication server.
Page 56: Dynamic Dns Support
Dynamic DNS Support With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider. IP Multicast Deliver IP packets to a specific group of hosts using IP multicast.
Page 57: Traffic Redirect
ZyWALL 5/35/70 Series User’s Guide Traffic Redirect Traffic Redirect forwards WAN traffic to a backup gateway on the LAN when the ZyWALL cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails. Port Forwarding Use this feature to forward incoming service requests to a server on your local network.
Page 58: Applications For The Zywall
1.3 Applications for the ZyWALL Here are some examples of what you can do with your ZyWALL. 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem You can connect a cable modem, DSL or wireless modem to the ZyWALL for broadband Internet access via Ethernet or wireless port on the modem.
Page 59: Front Panel Leds
ZyWALL 5/35/70 Series User’s Guide Figure 2 VPN Application 1.3.3 Front Panel LEDs Figure 3 ZyWALL 70 Front Panel Figure 4 ZyWALL 35 Front Panel Figure 5 ZyWALL 5 Front Panel Chapter 1 Getting to Know Your ZyWALL...
Page 60: Table 2 Front Panel Leds
The following table describes the LEDs. Table 2 Front Panel LEDs COLOR Green Green Green CARD Green LAN 10/100 (ZyWALL 70 Green only) Orange WAN1/2 10/100 Green WAN 10/100 Orange DMZ 10/100 (ZyWALL 70 Green only) Orange LAN/DMZ 10/ Green (ZyWALL 35 and ZyWALL 5) Orange...
Page 61 ZyWALL 5/35/70 Series User’s Guide Chapter 1 Getting to Know Your ZyWALL...
Page 62: Introducing The Web Configurator
This chapter describes how to access the ZyWALL web configurator and provides an overview of its screens. 2.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy ZyWALL setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions.
Page 63: Resetting The Zywall
ZyWALL 5/35/70 Series User’s Guide Figure 6 Change Password Screen 6 Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Note: If you do not replace the default certificate here or in the CERTIFICATES screen, this screen displays every time you access the web configurator.
Page 64: Procedure To Use The Reset Button
2.3.1 Procedure To Use The Reset Button Make sure the SYS LED is on (not blinking) before you begin this procedure. 1 Press the RESET button for ten seconds, and then release it. If the SYS LED begins to blink, the defaults have been restored and the ZyWALL restarts. Otherwise, go to step 2. 2 Turn the ZyWALL off.
Page 65: Figure 9 Web Configurator Home Screen In Router Mode
ZyWALL 5/35/70 Series User’s Guide Note: Follow the instructions you see in the HOME screen or click the The screen varies according to the device mode you select in the MAINTENANCE Device Mode screen. 2.4.1 Router Mode The following screen displays when the ZyWALL is set to router mode. The ZyWALL is set to router mode by default.
Page 66: Table 3 Web Configurator Home Screen In Router Mode
The following table describes the labels in this screen. Table 3 Web Configurator HOME Screen in Router Mode LABEL DESCRIPTION Wizards for WAN 1 (WAN) and VPN Quick Setup Internet Access Click Internet Access to use the initial configuration wizard. This configures WAN1 on a ZyWALL with multiple WAN ports or the WAN port on a ZyWALL with a single WAN port.
Page 67: Bridge Mode
ZyWALL 5/35/70 Series User’s Guide Table 3 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Interface This is the port type. Port types for a ZyWALL with multiple WAN ports are: WAN1, WAN2, Dial Backup, LAN, WLAN and DMZ. Port types for a ZyWALL with a single WAN port are: WAN, Dial Backup, LAN, WLAN and DMZ.
Page 68: Figure 10 Web Configurator Home Screen In Bridge Mode
Figure 10 Web Configurator HOME Screen in Bridge Mode The following table describes the labels in this screen. Table 4 Web Configurator HOME Screen in Bridge Mode LABEL DESCRIPTION Wizards for VPN Quick Setup Click VPN to create VPN policies. Device Information System Name...
Page 69 ZyWALL 5/35/70 Series User’s Guide Table 4 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION Firmware Version This is the ZyNOS Firmware version and the date created. ZyNOS is ZyXEL's proprietary Network Operating System design. Device Mode This displays whether the ZyWALL is functioning as a router or a bridge. Firewall This displays whether or not the ZyWALL’s firewall is activated.
Page 70: Navigation Panel
Table 4 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION RSTP Path Cost This is the cost of transmitting a frame from the root bridge to the corresponding port. Show Statistics Click Show Statistics to see bridge performance statistics such as the number of packets sent and number of packets received for each port, including WAN (or WAN1, WAN2), Dial Backup, LAN, WLAN and DMZ.
Page 71: Table 6 Screens Summary
ZyWALL 5/35/70 Series User’s Guide Table 5 Bridge and Router Mode Features Comparison FEATURE Remote Management UPnP Logs Maintenance Table Key: An O in a mode’s column shows that the device mode has the specified feature. The information in this table was correct at the time of writing, although it may be subject to change.
Page 72 Table 6 Screens Summary (continued) LINK General Route (ZyWALL 5 only) WAN (ZyWALL 5 only) WAN1 (ZyWALL 35 and ZyWALL WAN2 (ZyWALL 35 and ZyWALL Traffic Redirect Use this screen to configure your traffic redirect properties and Dial Backup Static DHCP IP Alias Port Roles WLAN...
Page 73 ZyWALL 5/35/70 Series User’s Guide Table 6 Screens Summary (continued) LINK General Signature Update Backup & Restore ANTI-VIRUS General Update ANTI-SPAM General External DB Customization CONTENT General FILTER Categories Customization Cache VPN Rules (IKE) VPN Rules (Manual) SA Monitor Global Setting CERTIFICATES My Certificates Use this screen to view a summary list of certificates and manage Trusted CAs...
Page 74 Table 6 Screens Summary (continued) LINK NAT Overview Address Mapping Port Forwarding Port Triggering Use this screen to change your ZyWALL’s port triggering settings. STATIC ROUTE IP Static Route Use this screen to configure IP static routes. POLICY ROUTE Policy Rout Summary BW MGMT Summary...
Page 75: Figure 11 Home : Show Statistics
ZyWALL 5/35/70 Series User’s Guide Table 6 Screens Summary (continued) LINK MAINTENANCE General Password Time and Date Use this screen to change your ZyWALL’s time and date. Device Mode F/W Upload Backup & Restore Restart LOGOUT 2.4.4 System Statistics Click Show Statistics in the HOME screen. Read-only information here includes port status and packet specific statistics.
Page 76: Figure 12 Home : Show Statistics: Line Chart
Table 7 Home: Show Statistics (continued) LABEL DESCRIPTION Status For the LAN and DMZ ports, this displays the port speed and duplex setting. For the WAN and Dial Backup ports, this displays the port speed and duplex setting if you’re using Ethernet encapsulation and Down (line is down), Idle (line (ppp) idle), Dial (starting to trigger a call) or Drop (dropping a call) if you’re using PPPoE encapsulation.
Page 77: Figure 13 Home : Dhcp Table
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 8 Home: Show Statistics: Line Chart LABEL DESCRIPTION Click the icon to go back to the Show Statistics screen. Port Select the check box(es) to display the throughput statistics of the corresponding port(s).
Page 78: Table 9 Home: Dhcp Table
The following table describes the labels in this screen. Table 9 Home: DHCP Table LABEL DESCRIPTION Interface Select LAN, DMZ or WLAN to show the current DHCP client information for the specified interface. This is the index number of the host computer. IP Address This field displays the IP address relative to the # field listed above.
Page 79: Figure 14 Home : Vpn Status
ZyWALL 5/35/70 Series User’s Guide Figure 14 Home : VPN Status The following table describes the labels in this screen. Table 10 Home : VPN Status LABEL DESCRIPTION This is the security association index number. Name This field displays the identification name for this VPN policy. Local Network This field displays the IP address of the computer using the VPN IPSec feature of your ZyWALL.
Page 80: Chapter 3 Wizard Setup
This chapter provides information on the Wizard Setup screens in the web configurator. The Internet access wizard is only applicable when the ZyWALL is in router mode. 3.1 Wizard Setup Overview The web configurator's setup wizards help you configure WAN1 on a ZyWALL with multiple WAN ports or the WAN port on a ZyWALL with a single WAN port to access the Internet and edit VPN policies and configure IKE settings to establish a VPN tunnel.
Page 81: Figure 15 Isp Parameters : Ethernet Encapsulation
ZyWALL 5/35/70 Series User’s Guide Figure 15 ISP Parameters : Ethernet Encapsulation The following table describes the labels in this screen. Table 11 ISP Parameters : Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 82: Pppoe Encapsulation
3.2.1.2 PPPoE Encapsulation Point-to-Point Protocol over Ethernet (PPPoE) functions as a dial-up connection. PPPoE is an IETF (Internet Engineering Task Force) standard specifying how a host personal computer interacts with a broadband modem (for example xDSL, cable, wireless, etc.) to achieve access to high-speed data networks.
Page 83: Pptp Encapsulation
ZyWALL 5/35/70 Series User’s Guide Table 12 ISP Parameters: PPPoE Encapsulation (continued) LABEL DESCRIPTION IP Address Select Dynamic If your ISP did not assign you a fixed IP address. This is the Assignment default selection. Select Static If the ISP assigned a fixed IP address. The fields below are available only when you select Static.
Page 84: Figure 17 Isp Parameters: Pptp Encapsulation
Figure 17 ISP Parameters: PPTP Encapsulation The following table describes the labels in this screen. Table 13 ISP Parameters : PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down list box. To configure a PPTP client, you must configure the User Name and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 85: Figure 18 Internet Access Wizard: Second Screen
ZyWALL 5/35/70 Series User’s Guide Table 13 ISP Parameters : PPTP Encapsulation LABEL DESCRIPTION Connection ID/ Enter the connection ID or connection name in this field. It must follow the "c:id" Name and "n:name" format. For example, C:12 or N:My ISP. This field is optional and depends on the requirements of your xDSL modem.
Page 86: Figure 19 Internet Access Setup Complete
Figure 19 Internet Access Setup Complete 3.2.3 Internet Access Wizard: Registration If you clicked Next in the previous screen (see displays. Note: If you want to activate a standard service with your iCard’s PIN number (license key), use the REGISTRATION Service screen. Figure 20 Internet Access Wizard: Registration Chapter 3 Wizard Setup ZyWALL 5/35/70 Series User’s Guide...
Page 87: Figure 21 Internet Access Wizard: Registration In Progress
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 14 Internet Access Wizard: Registration LABEL Device Registration New myZyXEL.com account Existing myZyXEL.com account User Name Check Password Confirm Password E-Mail Address Country Back Next After you fill in the fields and click Next, the following screen shows indicating the registration is in progress.
Page 88: Figure 22 Internet Access Wizard: Status
ZyWALL 5/35/70 Series User’s Guide Figure 22 Internet Access Wizard: Status The following screen appears if the registration was not successful. Click Return to go back to the Device Registration screen and check your settings. Figure 23 Internet Access Wizard: Registration Failed If the ZyWALL has been registered, the Device Registration screen is read-only and the Service Activation screen appears indicating what trial applications are activated after you click Next.
Page 89: Figure 25 Internet Access Wizard: Activated Services
ZyWALL 5/35/70 Series User’s Guide Figure 25 Internet Access Wizard: Activated Services 3.3 VPN Wizard Gateway Setting Use the VPN wizard screens to configure a VPN rule that uses a pre-shared key. If you want to set the rule to use a certificate, please go to the VPN screens for configuration. Click VPN Wizard in the HOME screen to open the VPN configuration wizard.
Page 90: Table 15 Vpn Wizard: Gateway Setting
The following table describes the labels in this screen. Table 15 VPN Wizard: Gateway Setting LABEL DESCRIPTION Gateway Policy Property Name Type up to 32 characters to identify this VPN gateway policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces. My ZyWALL When the ZyWALL is in router mode, enter the WAN IP address or the domain name of your ZyWALL or leave the field set to 0.0.0.0.
Page 91: Figure 27 Vpn Wizard: Network Setting
ZyWALL 5/35/70 Series User’s Guide Figure 27 VPN Wizard: Network Setting The following table describes the labels in this screen. Table 16 VPN Wizard : Network Setting LABEL DESCRIPTION Network Policy Property Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 92: Figure 28 Vpn Wizard: Ike Tunnel Setting
Table 16 VPN Wizard : Network Setting LABEL DESCRIPTION Remote Remote IP addresses must be static and correspond to the remote IPSec router's Network configured local IP addresses. Select Single for a single IP address. Select Range IP for a specific range of IP addresses.
Page 93: Table 17 Vpn Wizard: Ike Tunnel Setting
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 17 VPN Wizard: IKE Tunnel Setting LABEL Negotiation Mode Encryption Algorithm When DES is used for data communications, both sender and receiver must Authentication Algorithm Key Group SA Life Time (Seconds)
Page 94: Figure 29 Vpn Wizard: Ipsec Setting
3.6 VPN Wizard IPSec Setting (IKE Phase 2) Figure 29 VPN Wizard: IPSec Setting The following table describes the labels in this screen. Table 18 VPN Wizard: IPSec Setting LABEL Encapsulation Mode IPSec Protocol Encryption Algorithm When DES is used for data communications, both sender and receiver must Authentication Algorithm Chapter 3 Wizard Setup...
Page 95: Vpn Wizard Status Summary
ZyWALL 5/35/70 Series User’s Guide Table 18 VPN Wizard: IPSec Setting (continued) LABEL SA Life Time (Seconds) Perfect Forward Secret (PFS) Back Next 3.7 VPN Wizard Status Summary This read-only screen shows the status of the current VPN setting. Use the summary table to check whether what you have configured is correct.
Page 96: Figure 30 Vpn Wizard: Vpn Status
Figure 30 VPN Wizard: VPN Status The following table describes the labels in this screen. Table 19 VPN Wizard: VPN Status LABEL Gateway Policy Property Name Gateway Policy Setting My ZyWALL Remote Gateway Address Network Policy Property Active Chapter 3 Wizard Setup DESCRIPTION This is the name of this VPN gateway policy.
Page 97 ZyWALL 5/35/70 Series User’s Guide Table 19 VPN Wizard: VPN Status (continued) LABEL Name Network Policy Setting Local Network Starting IP Address Ending IP Address/ Subnet Mask Remote Network Starting IP Address Ending IP Address/ Subnet Mask IKE Tunnel Setting (IKE Phase 1) Negotiation Mode Encryption Algorithm This is the method of data encryption.
Page 98: Figure 31 Vpn Wizard Setup Complete
3.8 VPN Wizard Setup Complete Congratulations! You have successfully set up the VPN rule after any existing rule(s) for your ZyWALL. Figure 31 VPN Wizard Setup Complete Chapter 3 Wizard Setup ZyWALL 5/35/70 Series User’s Guide...
Page 99 ZyWALL 5/35/70 Series User’s Guide Chapter 3 Wizard Setup...
Page 100: Chapter 4 Registration
4.1 myZyXEL.com overview myZyXEL.com is ZyXEL’s online services center where you can register your ZyWALL and manage subscription services available for the ZyWALL. Note: You need to create an account before you can register your device and activate the services at myZyXEL.com. You can directly create a myZyXEL.com account, register your ZyWALL and activate a service using the REGISTRATION screen.
Page 101: Figure 32 Registration
ZyWALL 5/35/70 Series User’s Guide You will get automatic e-mail notification of new signature releases from mySecurityZone after you activate the IDP/Anti-virus service. You can also check for new signature or virus updates at http://mysecurity.zyxel.com. See the chapters about content filtering, anti-virus, anti-spam and IDP for more information. Note: To update the signature file or use a subscription service, you have to register and activate the corresponding service at myZyXEL.com (through the ZyWALL).
Page 102: Table 20 Registration
The following table describes the labels in this screen. Table 20 Registration LABEL Device Registration New myZyXEL.com account Existing myZyXEL.com account User Name Check Password Confirm Password E-Mail Address Country Service Activation Content Filtering 1- month Trial Anti Spam 3-month Trial Select the check box to activate a trial. The trial period starts the day you IDP/AV 3-month Trial Apply Reset...
Page 103: Figure 33 Registration: Registered Device
ZyWALL 5/35/70 Series User’s Guide Figure 33 Registration: Registered Device 4.3 Service After you activate a trial, you can also use the Service screen to register and enter your iCard’s PIN number (license key). Click REGISTRATION, Service to open the screen as shown next.
Page 104: Table 21 Service
The following table describes the labels in this screen. Table 21 Service LABEL Service Management Service Status Registration Type Expiration Day License Upgrade License Key Service License Refresh Click this button to renew service license information (such as the license Chapter 4 Registration ZyWALL 5/35/70 Series User’s Guide DESCRIPTION...
Page 105 ZyWALL 5/35/70 Series User’s Guide Chapter 4 Registration...
Page 106: Chapter 5 Lan Screens
This chapter describes how to configure LAN settings. This chapter is only applicable when the ZyWALL is in router mode. The LAN Port Roles screen is available on the ZyWALL 5 and ZyWALL 35. 5.1 LAN Overview Local Area Network (LAN) is a shared communication system to which many computers are attached.
Page 107: Ip Address And Subnet Mask
ZyWALL 5/35/70 Series User’s Guide These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), read the embedded web configurator help regarding what fields need to be configured. 5.3.2 IP Address and Subnet Mask Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.
Page 108: Multicast
Both RIP-2B and RIP-2M send routing data in RIP-2 format; the difference being that RIP- 2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets.
Page 109: Figure 35 Lan
ZyWALL 5/35/70 Series User’s Guide Figure 35 LAN The following table describes the labels in this screen. Table 22 LAN LABEL DESCRIPTION LAN TCP/IP IP Address Type the IP address of your ZyWALL in dotted decimal notation. 192.168.1.1 is the factory default.
Page 110 Table 22 LAN (continued) LABEL DESCRIPTION Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use.
Page 111: Figure 36 Lan Static Dhcp
ZyWALL 5/35/70 Series User’s Guide 5.6 LAN Static DHCP This table allows you to assign IP addresses on the LAN to specific individual computers based on their MAC Addresses. Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02.
Page 112: Figure 37 Physical Network & Partitioned Logical Networks
Table 23 LAN Static DHCP LABEL DESCRIPTION IP Address Type the IP address that you want to assign to the computer on your LAN. Alternatively, click the right mouse button to copy and/or paste the IP address. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh.
Page 113: Figure 38 Lan Ip Alias
ZyWALL 5/35/70 Series User’s Guide Figure 38 LAN IP Alias The following table describes the labels in this screen. Table 24 LAN IP Alias LABEL DESCRIPTION Enable IP Alias 1, Select the check box to configure another LAN network for the ZyWALL. IP Address Enter the IP address of your ZyWALL in dotted decimal notation.
Page 114: Figure 39 Wlan Port Role Example
Table 24 LAN IP Alias LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 5.8 LAN Port Roles Use the Port Roles screen to set ports as LAN, DMZ or WLAN interfaces. The LAN port role is not available on all models.
Page 115: Figure 40 Lan Port Roles
ZyWALL 5/35/70 Series User’s Guide To change your ZyWALL’s port role settings, click NETWORK, LAN and then the Port Roles tab. The screen appears as shown. The radio buttons on the left correspond to Ethernet ports on the front panel of the ZyWALL. Ports 1 to 4 are all LAN ports by default.
Page 116: Figure 41 Port Roles Change Complete
Table 25 LAN Port Roles (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. After you change the LAN/DMZ/WLAN port roles and click Apply, please wait for few seconds until the following screen appears.
Page 117 ZyWALL 5/35/70 Series User’s Guide Chapter 5 LAN Screens...
Page 118: Chapter 6 Bridge Screens
This chapter describes how to configure bridge settings. This chapter is only applicable when the ZyWALL is in bridge mode. 6.1 Bridge Loop The ZyWALL can act as a bridge between a switch and a wired LAN or between two routers. Be careful to avoid bridge loops when you enable bridging in the ZyWALL.
Page 119: Rapid Stp
ZyWALL 5/35/70 Series User’s Guide 6.2.1 Rapid STP The ZyWALL uses IEEE 802.1w RSTP (Rapid Spanning Tree Protocol) that allow faster convergence of the spanning tree (while also being backwards compatible with STP-only aware bridges). Using RSTP topology change information does not have to propagate to the root bridge and unwanted learned addresses are flushed from the filtering database.
Page 120: Stp Port States
Once a stable network topology has been established, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) transmitted from the root bridge. If a bridge does not get a Hello BPDU after a predefined interval (Max Age), the bridge assumes that the link to the root bridge is down.
Page 121: Figure 43 Bridge
ZyWALL 5/35/70 Series User’s Guide Figure 43 Bridge The following table describes the labels in this screen. Table 28 Bridge LABEL Bridge IP Address Setup IP Address IP Subnet Mask Gateway IP Address First/Second/Third DNS Server DESCRIPTION Type the IP address of your ZyWALL in dotted decimal notation. The subnet mask specifies the network number portion of an IP address.
Page 122: Bridge Port Roles
Table 28 Bridge (continued) LABEL Rapid Spanning Tree Protocol Setup Enable Rapid Spanning Tree Protocol Bridge Priority Bridge Hello Time Bridge Max Age Forward Delay Bridge Port RSTP Active RSTP Priority 0(Highest)~240(Lowest) RSTP Path Cost 1(Lowest)~65535(Highes Apply Reset 6.4 Bridge Port Roles Use the Port Roles screen to set ports as LAN, DMZ or WLAN interfaces.
Page 123: Figure 44 Wlan Port Role Example
ZyWALL 5/35/70 Series User’s Guide Figure 44 WLAN Port Role Example To change your ZyWALL’s port role settings, click NETWORK, BRIDGE and then the Port Roles tab. The screen appears as shown. The radio buttons on the left correspond to Ethernet ports on the front panel of the ZyWALL. Ports 1 to 4 are all DMZ ports on the ZyWALL 70 and all LAN ports on the ZyWALL 5 or ZyWALL 35 by default.
Page 124: Figure 46 Port Roles Change Complete
Table 29 Bridge Port Roles (continued) LABEL DESCRIPTION WLAN When you have the wireless card set to WLAN, you can select a port’s WLAN radio button to use the port as part of the WLAN. The port will use the ZyWALL’s WLAN IP address and the MAC address of the WLAN card.
Page 125 ZyWALL 5/35/70 Series User’s Guide Chapter 6 Bridge Screens...
Page 126: Chapter 7 Wan Screens
This chapter describes how to configure WAN settings. Multiple WAN and load balancing are not available on the ZyWALL 5. 7.1 WAN Overview • Use the WAN General screen to configure load balancing, route priority and traffic redirect properties for the ZyWALL 70 and ZyWALL 35. •...
Page 127: Load Balancing Introduction
ZyWALL 5/35/70 Series User’s Guide You can select through which WAN port you want to send out traffic from UPnP-enabled applications (see Chapter 28 on page The ZyWALL's DDNS lets you select which WAN interface you want to use for each individual domain name.
Page 128: Example 1
7.4.1.1 Example 1 The following figure depicts an example where both the WAN ports on the ZyWALL are connected to the Internet. The configured available outbound bandwidths for WAN 1 and WAN 2 are 512K and 256K respectively. Figure 47 Least Load First Example If the outbound bandwidth utilization is used as the load balancing index and the measured outbound throughput of WAN 1 is 412K and WAN 2 is 198K, the ZyWALL calculates the load balancing index as shown in the table below.
Page 129: Weighted Round Robin
ZyWALL 5/35/70 Series User’s Guide 7.4.2 Weighted Round Robin Similar to the Round Robin (RR) algorithm, the Weighted Round Robin (WRR) algorithm sets the ZyWALL to send traffic through each WAN interface in turn. In addition, the WAN interfaces are assigned weights. An interface with a larger weight gets more of the traffic than an interface with a smaller weight.
Page 130: Tcp/Ip Priority (Metric)
Figure 49 Spillover Algorithm Example 7.5 TCP/IP Priority (Metric) The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the measurement of cost, with a minimum of "1" for directly connected networks. The number must be between "1"...
Page 131: Figure 50 Wan General
ZyWALL 5/35/70 Series User’s Guide Figure 50 WAN General Chapter 7 WAN Screens...
Page 132: Table 32 Wan General
The following table describes the labels in this screen. Table 32 WAN General LABEL DESCRIPTION Active/Passive Select the Active/Passive (fail over) operation mode to have the ZyWALL use the (Fail Over) Mode second highest priority WAN port as a back up. This means that the ZyWALL will normally use the highest priority (primary) WAN port (depending on the priorities you configure in the Route Priority fields).
Page 133: Configuring Load Balancing
ZyWALL 5/35/70 Series User’s Guide Table 32 WAN General (continued) LABEL DESCRIPTION Check WAN1/2 Select the check box to have the ZyWALL periodically test the respective WAN Connectivity port's connection. Select Ping Default Gateway to have the ZyWALL ping the WAN port's default gateway IP address.
Page 134: Least Load First
7.7.1 Least Load First To configure Least Load First, select Least Load First in the Load Balancing Algorithm field. Figure 51 Load Balancing: Least Load First The following table describes the related fields in this screen. Table 33 Load Balancing: Least Load First LABEL DESCRIPTION Active/Active...
Page 135: Weighted Round Robin
ZyWALL 5/35/70 Series User’s Guide 7.7.2 Weighted Round Robin To load balance using the weighted round robin method, select Weighted Round Robin in the Load Balancing Algorithm field. Figure 52 Load Balancing: Weighted Round Robin The following table describes the related fields in this screen. Table 34 Load Balancing: Weighted Round Robin LABEL DESCRIPTION...
Page 136: Figure 53 Load Balancing: Spillover
Figure 53 Load Balancing: Spillover The following table describes the related fields in this screen. Table 35 Load Balancing: Spillover LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on the Mode ZyWALL. Load Balancing Select a load balancing method to use from the drop-down list box.
Page 137: Figure 54 Wan Route
ZyWALL 5/35/70 Series User’s Guide Figure 54 WAN Route The following table describes the labels in this screen. Table 36 WAN Route LABEL DESCRIPTION Route Priority The default WAN connection is "1' as your broadband connection via the WAN port should always be your preferred method of accessing the WAN.
Page 138: Wan Ip Address Assignment
Table 36 WAN Route (continued) LABEL DESCRIPTION Allow between Select this check box to forward NetBIOS packets from the WLAN to the WAN and WAN and WLAN from the WAN to the WLAN. Clear this check box to block all NetBIOS packets going from the WLAN to the WAN and from the WAN to the WLAN.
Page 139: Wan Mac Address
ZyWALL 5/35/70 Series User’s Guide 1 The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server fields. 2 If your ISP dynamically assigns the DNS server IP addresses (along with the ZyWALL’s WAN IP address), set the DNS server fields to get the DNS server address from the ISP.
Page 140: Figure 55 Wan: Ethernet Encapsulation
Figure 55 WAN: Ethernet Encapsulation The following table describes the labels in this screen. Table 39 WAN: Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 141 ZyWALL 5/35/70 Series User’s Guide Table 39 WAN: Ethernet Encapsulation (continued) LABEL DESCRIPTION Retype to Confirm Type your password again to make sure that you have entered is correctly. Login Server IP Type the authentication server IP address here if your ISP gave you one. Address This field is not available for Telia Login.
Page 142: Pppoe Encapsulation
Table 39 WAN: Ethernet Encapsulation (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). Choose RIP-1, RIP-2B or RIP-2M. RIP-1 is universally supported;...
Page 143: Figure 56 Wan: Pppoe Encapsulation
ZyWALL 5/35/70 Series User’s Guide Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no specific configuration of the broadband modem at the customer site. By implementing PPPoE directly on the ZyWALL (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyWALL does that part of the task.
Page 144: Table 40 Wan: Pppoe Encapsulation
The following table describes the labels in this screen. Table 40 WAN: PPPoE Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation The PPPoE choice is for a dial-up connection using PPPoE. The router supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (i.e.
Page 145 ZyWALL 5/35/70 Series User’s Guide Table 40 WAN: PPPoE Encapsulation LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Choose Both, None, In Only or Out Only.
Page 146: Pptp Encapsulation
7.12.3 PPTP Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet.
Page 147: Table 41 Wan: Pptp Encapsulation
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 41 WAN: PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks.
Page 148 Table 41 WAN: PPTP Encapsulation LABEL DESCRIPTION Enable NAT Network Address Translation (NAT) allows the translation of an Internet protocol (Network Address address used within one network (for example a private IP address used in a local Translation) network) to a different IP address known within another network (for example a public IP address used on the Internet).
Page 149: Figure 58 Traffic Redirect Wan Setup
ZyWALL 5/35/70 Series User’s Guide 7.13 Traffic Redirect Traffic redirect forwards WAN traffic to a backup gateway when the ZyWALL cannot connect to the Internet through its normal gateway. Connect the backup gateway on the WAN so that the ZyWALL still provides firewall protection. Figure 58 Traffic Redirect WAN Setup The following network topology allows you to avoid triangle route security issues (see Appendix I on page...
Page 150: Configuring Traffic Redirect
Figure 59 Traffic Redirect LAN Setup 7.14 Configuring Traffic Redirect To change your ZyWALL’s traffic redirect settings, click NETWORK, WAN and then the Traffic Redirect tab. The screen appears as shown. Not all fields are available on all models. Figure 60 Traffic Redirect The following table describes the labels in this screen.
Page 151: Configuring Dial Backup
ZyWALL 5/35/70 Series User’s Guide Table 42 Traffic Redirect (continued) LABEL DESCRIPTION Fail Tolerance Type how many WAN connection checks can fail (1 to 10) before the connection is considered "down" (not connected). The ZyWALL still checks a "down" connection to detect if it reconnects.
Page 152: Figure 61 Dial Backup
ZyWALL 5/35/70 Series User’s Guide Figure 61 Dial Backup Chapter 7 WAN Screens...
Page 153: Table 43 Dial Backup
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 43 Dial Backup LABEL DESCRIPTION Dial Backup Setup Enable Dial Backup Select this check box to turn on dial backup. Basic Settings Login Name Type the login name assigned by your ISP. Password Type the password assigned by your ISP.
Page 154 Table 43 Dial Backup (continued) LABEL DESCRIPTION Enable RIP Select this check box to turn on RIP (Routing Information Protocol), which allows a router to exchange routing information with other routers. RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving).
Page 155: At Command Strings
ZyWALL 5/35/70 Series User’s Guide Table 43 Dial Backup (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 7.16 Advanced Modem Setup 7.16.1 AT Command Strings For regular telephone lines, the default Dial string tells the modem that the line uses tone dialing.
Page 156: Figure 62 Advanced Setup
Figure 62 Advanced Setup The following table describes the labels in this screen. Table 44 Advanced Setup LABEL DESCRIPTION AT Command Strings Dial Type the AT Command string to make a call. Drop Type the AT Command string to drop a call. "~" represents a one second wait, for example, "~~~+++~~ath"...
Page 157 ZyWALL 5/35/70 Series User’s Guide Table 44 Advanced Setup (continued) LABEL DESCRIPTION Dial Timeout (sec) Type a number of seconds for the ZyWALL to try to set up an outgoing call before timing out (stopping). Retry Count Type a number of times for the ZyWALL to retry a busy or no-answer phone number before blacklisting the number.
Page 158: Chapter 8 Dmz Screens
This chapter describes how to configure the ZyWALL’s DMZ. 8.1 DMZ The DeMilitarized Zone (DMZ) provides a way for public servers (Web, e-mail, FTP, etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death).
Page 159: Figure 63 Dmz
ZyWALL 5/35/70 Series User’s Guide Figure 63 DMZ The following table describes the labels in this screen. Table 45 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address Type the IP address of your ZyWALL’s DMZ port in dotted decimal notation. Note: Make sure the IP addresses of the LAN, WAN, WLAN and IP Subnet Mask The subnet mask specifies the network number portion of an IP address.
Page 160 Table 45 DMZ (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP- 1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Page 161: Dmz Static Dhcp
ZyWALL 5/35/70 Series User’s Guide Table 45 DMZ (continued) LABEL DESCRIPTION Allow between DMZ Select this check box to forward NetBIOS packets from the WLAN to the DMZ and WLAN and from the DMZ to the WLAN. Clear this check box to block all NetBIOS packets going from the WLAN to the DMZ and from the DMZ to the WLAN.
Page 162: Figure 64 Dmz Static Dhcp
Figure 64 DMZ Static DHCP The following table describes the labels in this screen. Table 46 DMZ Static DHCP LABEL DESCRIPTION This is the index number of the Static IP table entry (row). MAC Address Type the MAC address of a computer on your DMZ. IP Address Type the IP address that you want to assign to the computer on your DMZ.
Page 163: Figure 65 Dmz: Ip Alias
ZyWALL 5/35/70 Series User’s Guide 8.4 DMZ IP Alias IP alias allows you to partition a physical network into different logical networks over the same Ethernet interface. The ZyWALL supports three logical DMZ interfaces via its single physical Ethernet interface with the ZyWALL itself as the gateway for each DMZ network. The IP alias IP addresses can be either private or public regardless of whether the physical DMZ interface is set to use a private or public IP address.
Page 164: Dmz Public Ip Address Example
Table 47 DMZ: IP Alias (continued) LABEL DESCRIPTION IP Subnet Mask Your ZyWALL will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the ZyWALL. RIP Direction RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to exchange routing information with other routers.
Page 165: Dmz Private And Public Ip Address Example
ZyWALL 5/35/70 Series User’s Guide Figure 66 DMZ Public Address Example 8.6 DMZ Private and Public IP Address Example The following figure shows a network setup with both private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected computers (A through C) use private IP addresses that are in one subnet.
Page 166: Figure 67 Dmz Private And Public Address Example
Figure 67 DMZ Private and Public Address Example 8.7 DMZ Port Roles Use the Port Roles screen to set ports as LAN, DMZ or WLAN interfaces. The LAN port role is not available on all models. Connect wireless LAN Access Points (APs) to WLAN interfaces to extend the ZyWALL’s wireless LAN coverage.
Page 167: Figure 68 Wlan Port Role Example
ZyWALL 5/35/70 Series User’s Guide Figure 68 WLAN Port Role Example Note: Do the following if you are configuring from a computer connected to a LAN, DMZ or WLAN port and changing the port's role: 1. A port's IP address varies as its role changes, make sure your computer's IP address is in the same subnet as the ZyWALL's LAN, DMZ or WLAN IP address.
Page 168: Figure 69 Dmz: Port Roles
Figure 69 DMZ: Port Roles The following table describes the labels in this screen. Table 48 DMZ: Port Roles LABEL DESCRIPTION Select a port’s LAN radio button to use the port as part of the LAN. The port will use the LAN IP address and MAC address. Select a port’s DMZ radio button to use the port as part of the DMZ.
Page 169 ZyWALL 5/35/70 Series User’s Guide Chapter 8 DMZ Screens...
Page 170: Chapter 9 Wireless Lan
This chapter discusses how to configure wireless LAN on the ZyWALL. 9.1 Wireless LAN Introduction A wireless LAN can be as simple as two computers with wireless LAN adapters communicating in a peer-to-peer network or as complex as a number of computers with wireless LAN adapters communicating through access points which bridge network traffic to the wired LAN.
Page 171: Figure 70 Wlan
ZyWALL 5/35/70 Series User’s Guide Figure 70 WLAN The following table describes the labels in this screen. Table 49 WLAN LABEL DESCRIPTION WLAN TCP/IP IP Address Type the IP address of your ZyWALL’s WLAN interface in dotted decimal notation. Alternatively, click the right mouse button to copy and/or paste the IP address. Note: Make sure the IP addresses of the LAN, WAN, WLAN and IP Subnet Mask The subnet mask specifies the network number portion of an IP address.
Page 172 Table 49 WLAN (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Page 173: Wlan Static Dhcp
ZyWALL 5/35/70 Series User’s Guide Table 49 WLAN (continued) LABEL DESCRIPTION Allow between Select this check box to forward NetBIOS packets from the LAN to the DMZ and WLAN and DMZ from the DMZ to the WLAN. If your firewall is enabled with the default policy set to block DMZ to WLAN traffic, you also need to enable the default DMZ to WLAN firewall rule that forwards NetBIOS traffic.
Page 174: Figure 71 Wlan Static Dhcp
Figure 71 WLAN Static DHCP The following table describes the labels in this screen. Table 50 WLAN Static DHCP LABEL DESCRIPTION This is the index number of the Static IP table entry (row). MAC Address Type the MAC address of a computer on your WLAN. IP Address Type the IP address that you want to assign to the computer on your WLAN.
Page 175: Figure 72 Wlan Ip Alias
ZyWALL 5/35/70 Series User’s Guide When you use IP alias, you can also configure firewall rules to control access between the WLAN's logical networks (subnets). Note: Make sure that the subnets of the logical networks do not overlap. To change your ZyWALL’s IP alias settings, click NETWORK, WLAN and then the IP Alias tab.
Page 176: Figure 73 Wlan Port Role Example
Table 51 WLAN IP Alias LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Page 177: Figure 74 Wlan Port Roles
ZyWALL 5/35/70 Series User’s Guide Note: Do the following if you are configuring from a computer connected to a LAN, DMZ or WLAN port and changing the port's role: 1. A port's IP address varies as its role changes, make sure your computer's IP address is in the same subnet as the ZyWALL's LAN, DMZ or WLAN IP address.
Page 178: Wireless Security
Table 52 WLAN Port Roles (continued) LABEL DESCRIPTION Wireless Card Select LAN to use the wireless card as part of the LAN. Select DMZ to use the wireless card as part of the DMZ. Select WLAN to use the wireless card as part of the WLAN. The ZyWALL restarts after you change the wireless card setting.
Page 179: Encryption
ZyWALL 5/35/70 Series User’s Guide Figure 76 ZyWALL Wireless Security Levels If you do not enable any wireless security on your ZyWALL, your network is accessible to any wireless networking device that is within range. Use the ZyWALL web configurator to set up your wireless LAN security settings. Refer to the chapter on using the ZyWALL web configurator to see how to access the web configurator.
Page 180: Restricted Access
9.6.3 Restricted Access The MAC Filter screen allows you to configure the AP to give exclusive access to devices (Allow Association) or exclude them from accessing the AP (Deny Association). 9.6.4 Hide ZyWALL Identity If you hide the ESSID, then the ZyWALL cannot be seen when a wireless client scans for local APs.
Page 181: Overview
ZyWALL 5/35/70 Series User’s Guide 9.9 802.1x Overview The IEEE 802.1x standard outlines enhanced security methods for both the authentication of wireless stations and encryption key management. Authentication can be done using the local user database internal to the ZyWALL (authenticate up to 32 users) or an external RADIUS server for an unlimited number of users.
Page 182: Eap Authentication Overview
Sent by the RADIUS server to indicate that it has started or stopped accounting. In order to ensure network security, the access point and the RADIUS server use a shared secret key, which is a password, they both know. The key is not sent over the network. In addition to the shared key, password information exchanged is also encrypted to protect the network from unauthorized access.
Page 183: Introduction To Wpa
ZyWALL 5/35/70 Series User’s Guide If this feature is enabled, it is not necessary to configure a default encryption key in the Wireless Card screen (see keys here, but they will not be used while dynamic WEP is enabled. To use dynamic WEP, enable and configure dynamic WEP key exchange in the Wireless Card screen and configure RADIUS server settings in the AUTH SERVER RADIUS screen (see Section 21.3 on page...
Page 184: Wpa-Psk Application Example
TKIP regularly changes and rotates the encryption keys so that the same encryption key is never used twice. The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up a key hierarchy and management system, using the pair-wise key to dynamically generate unique data encryption keys to encrypt every data packet that is wirelessly communicated between the AP and the wireless clients.
Page 185: Introduction To Radius
ZyWALL 5/35/70 Series User’s Guide Figure 78 WPA-PSK Authentication 9.13 Introduction to RADIUS The ZyWALL can use an external RADIUS server to authenticate an unlimited number of users. RADIUS is based on a client-sever model that supports authentication and accounting, where access point is the client and the server is the RADIUS server.
Page 186: Wireless Client Wpa Supplicants
Figure 79 WPA with RADIUS Application Example 9.15 Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA. At the time of writing, the most widely available supplicants are the WPA patch for Windows XP, Funk Software's Odyssey client, and Meetinghouse Data Communications' AEGIS client.
Page 187: Figure 80 Wireless Card: No Security
ZyWALL 5/35/70 Series User’s Guide Figure 80 Wireless Card: No Security The following table describes the labels in this screen. Table 54 Wireless Card: No Security LABEL DESCRIPTION Enable The wireless LAN is turned off by default, before you enable the wireless LAN you Wireless Card should configure some security by setting MAC filters and/or 802.1x security;...
Page 188: Static Wep
Table 54 Wireless Card: No Security (continued) LABEL DESCRIPTION Fragmentation This is the threshold (number of bytes) for the fragmentation boundary for directed Threshold messages. It is the maximum data fragment size that can be sent. Select the check box to change the default value and enter a value between 256 and 2432.
Page 189: Wpa-Psk
ZyWALL 5/35/70 Series User’s Guide Figure 81 Wireless Card: Static WEP The following table describes the wireless LAN security labels in this screen. Table 55 Wireless Card: Static WEP LABEL DESCRIPTION Security Select Static WEP from the drop-down list. WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized Encryption wireless stations from accessing data transmitted over the wireless network.
Page 190: Figure 82 Wireless Card: Wpa-Psk
Figure 82 Wireless Card: WPA-PSK The following wireless LAN security fields become available when you select WPA-PSK in the Security drop down list-box. Table 56 Wireless Card: WPA-PSK LABEL DESCRIPTION Security Select WPA-PSK from the drop-down list. Pre-Shared Key The encryption mechanisms used for WPA and WPA-PSK are the same. The only difference between the two is that WPA-PSK uses a simple common password, instead of user-specific credentials.
Page 191: Wpa
ZyWALL 5/35/70 Series User’s Guide 9.16.3 WPA Click the NETWORK and WIRELESS CARD to display the Wireless Card screen. Select WPA from the Security list. Figure 83 Wireless Card: WPA The following wireless LAN security fields become available when you select WPA in the Security drop down list-box.
Page 192: Ieee 802.1X + Dynamic Wep
9.16.4 IEEE 802.1x + Dynamic WEP Click the NETWORK and WIRELESS CARD to display the Wireless Card screen. Select 802.1x + Dynamic WEP from the Security list. Figure 84 Wireless Card: 802.1x + Dynamic WEP The following wireless LAN security fields become available when you select 802.1x + Dynamic WEP in the Security drop down list-box.
Page 193: Ieee 802.1X + Static Wep
ZyWALL 5/35/70 Series User’s Guide 9.16.5 IEEE 802.1x + Static WEP Click the NETWORK and WIRELESS CARD to display the Wireless Card screen. Select 802.1x + Static WEP from the Security list. Figure 85 Wireless Card: 802.1x + Static WEP The following wireless LAN security fields become available when you select 802.1x + Static WEP in the Security drop down list-box.
Page 194: Ieee 802.1X + No Wep
Table 59 Wireless Card: 802.1x + Static WEP (continued) LABEL DESCRIPTION ReAuthentication Specify how often wireless stations have to resend user names and passwords in Timer (Seconds) order to stay connected. Enter a time interval between 10 and 65535 seconds. If wireless station authentication is done using a RADIUS server, the reauthentication timer on the RADIUS server has priority.
Page 195: No Access 802.1X + Static Wep
ZyWALL 5/35/70 Series User’s Guide The following wireless LAN security fields become available when you select 802.1x + No WEP in the Security drop down list-box. Table 60 Wireless Card: 802.1x + No WEP LABEL DESCRIPTION Security Select 802.1x + No WEP from the drop-down list. ReAuthentication Specify how often wireless stations have to resend user names and passwords in Timer (Seconds)
Page 196: No Access 802.1X + No Wep
The following wireless LAN security fields become available when you select No Access 802.1x + Static WEP in the Security drop down list-box. Table 61 Wireless Card: No Access 802.1x + Static WEP LABEL DESCRIPTION Security Select No Access 802.1x + Static WEP from the drop-down list. WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized Encryption wireless stations from accessing data transmitted over the wireless network.
Page 197: Figure 88 Wireless Card: Mac Address Filter
ZyWALL 5/35/70 Series User’s Guide Figure 88 Wireless Card: MAC Address Filter The following table describes the labels in this menu. Table 62 Wireless Card: MAC Address Filter LABEL DESCRIPTION Active Select or clear the check box to enable or disable MAC address filtering. Enable MAC address filtering to have the router allow or deny access to wireless stations based on MAC addresses.
Page 198: Chapter 10 Firewalls
This chapter gives some background information on firewalls and introduces the ZyWALL firewall. 10.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another. The networking term firewall is a system or group of systems that enforces an access-control policy between two networks.
Page 199: Stateful Inspection Firewalls
ZyWALL 5/35/70 Series User’s Guide 1 Information hiding prevents the names of internal systems from being made known via DNS to outside systems, since the application gateway is the only host whose name must be made known to outside systems. 2 Robust authentication and logging pre-authenticates application traffic before it reaches internal hosts and causes it to be logged more effectively than if it were logged with standard host logging.
Page 200: Denial Of Service
Figure 89 ZyWALL Firewall Application 10.4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources.
Page 201: Types Of Dos Attacks
ZyWALL 5/35/70 Series User’s Guide 10.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data. 4 IP Spoofing.
Page 202: Figure 91 Syn Flood
Figure 91 SYN Flood b In a LAND Attack, hackers flood SYN packets into the network with • A brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification known as directed or subnet broadcasting, to quickly flood the target network with useless data.
Page 203: Icmp Vulnerability
ZyWALL 5/35/70 Series User’s Guide Figure 92 Smurf Attack 10.4.2.1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 64 ICMP Commands That Trigger Alerts REDIRECT TIMESTAMP_REQUEST TIMESTAMP_REPLY ADDRESS_MASK_REQUEST ADDRESS_MASK_REPLY 10.4.2.2 Illegal Commands (NetBIOS and SMTP)
Page 204: Traceroute
All SMTP commands are illegal except for those displayed in the following tables. Table 66 Legal SMTP Commands AUTH DATA QUIT RCPT 10.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints. Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute the firewall gaining knowledge of the network topology inside the firewall.
Page 205: Stateful Inspection Process
ZyWALL 5/35/70 Series User’s Guide Figure 93 Stateful Inspection The previous figure shows the ZyWALL’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated from the WAN is blocked.
Page 206: Stateful Inspection And The Zywall
temporary entries might be modified, in order to permit only packets that are valid for the current state of the connection. 8 Any additional inbound or outbound packets that belong to the connection are inspected to update the state table entry and to modify the temporary inbound access list entries as required, and are forwarded through the interface.
Page 207: Udp/Icmp Security
ZyWALL 5/35/70 Series User’s Guide If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the Internet. Assuming that this is an acceptable part of the security policy (as is the case with the default policy), the connection will be allowed. A cache entry is added which includes connection information such as IP addresses, TCP ports, sequence numbers, etc.
Page 208: Guidelines For Enhancing Security With Your Firewall
Any protocol that operates in this way must be supported on a case-by-case basis. You can use the web configurator’s Custom Services feature to do this. 10.6 Guidelines For Enhancing Security With Your Firewall 1 Change the default password via SMT or web configurator. 2 Think about access control before you connect a console port to the network in any way, including attaching a modem to the port.
Page 209: Firewall
ZyWALL 5/35/70 Series User’s Guide 10.7.2 Firewall • The firewall inspects packet contents as well as their source and destination addresses. Firewalls of this type employ an inspection module, applicable to all protocols, that understands data in the packet is intended for other layers, from the network layer (IP headers) up to the application layer.
Page 210: Chapter 11 Firewall Screens
This chapter shows you how to configure your ZyWALL firewall. 11.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your ZyWALL has to offer. For this reason, it is recommended that you configure your firewall using the web configurator.
Page 211 ZyWALL 5/35/70 Series User’s Guide • WLAN to WAN By default, the ZyWALL’s stateful packet inspection drops packets traveling in the following directions: • WAN to LAN • WAN to WAN/ZyWALL This prevents computers on the WAN from using the ZyWALL as a gateway to communicate with other computers on the WAN and/or managing the ZyWALL.
Page 212: Rule Logic Overview
11.3 Rule Logic Overview Note: Study these points carefully before configuring rules. 11.3.1 Rule Checklist 1 State the intent of the rule. For example, This restricts all IRC access from the LAN to the Internet. Or, This allows a remote Lotus Notes server to synchronize over the Internet to an inside Notes server.
Page 213: Service
ZyWALL 5/35/70 Series User’s Guide 11.3.3.2 Service Select the service from the Service scrolling list box. If the service is not listed, it is necessary to first define it. See 11.3.3.3 Source Address What is the connection’s source address; is it on the LAN, DMZ, WLAN or WAN? Is it a single IP, a range of IPs or a subnet? 11.3.3.4 Destination Address What is the connection’s destination address;...
Page 214: Wan To Lan Rules
Figure 94 LAN to WAN Traffic 11.4.2 WAN To LAN Rules The default rule for WAN to LAN traffic blocks all incoming connections (WAN to LAN). If you wish to allow certain WAN users to have access to your LAN, you will need to create custom rules to allow it.
Page 215: Figure 96 Default Rule (Router Mode)
ZyWALL 5/35/70 Series User’s Guide 11.6 Firewall Default Rule (Router Mode) Click SECURITY, FIREWALL to open the Default Rule screen. Enable (or activate) the firewall by selecting the Enable Firewall check box. Use this screen to configure general firewall settings when the ZyWALL is set to router mode. Figure 96 Default Rule (Router Mode) The following table describes the labels in this screen.
Page 216 Table 67 Default Rule (Router Mode) (continued) LABEL DESCRIPTION Packet Direction This is the direction of travel of packets (LAN to LAN/ZyWALL, LAN to WAN, LAN to DMZ, LAN to WLAN, WAN to LAN, WAN to WAN/ZyWALL, WAN to DMZ, WAN to WLAN, DMZ to LAN, DMZ to WAN, DMZ to DMZ/ZyWALL, DMZ to WLAN, WLAN to LAN, WLAN to WAN, WLAN to DMZ or WLAN to WLAN/ ZyWALL).
Page 217: Figure 97 Default Rule (Bridge Mode)
ZyWALL 5/35/70 Series User’s Guide Figure 97 Default Rule (Bridge Mode) The following table describes the labels in this screen. Table 68 Default Rule (Bridge Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Page 218: Figure 98 Rule Summary
Table 68 Default Rule (Bridge Mode) LABEL DESCRIPTION Log Broadcast Select the check box to create a log for any Layer 2 broadcast frames that are Frame traveling in the selected direction. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh.
Page 219: Firewall Edit Rule
ZyWALL 5/35/70 Series User’s Guide Table 69 Rule Summary LABEL DESCRIPTION The following read-only fields summarize the rules you have created that apply to traffic traveling in the selected packet direction. The firewall rules that you configure (summarized below) take priority over the general firewall action settings above.
Page 220: Figure 99 Firewall Edit Rule
ZyWALL 5/35/70 Series User’s Guide Figure 99 Firewall Edit Rule Chapter 11 Firewall Screens...
Page 221: Table 70 Firewall Edit Rule
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 70 Firewall Edit Rule LABEL DESCRIPTION Rule Name Enter a descriptive name of up to 31 printable ASCII characters (except Extended ASCII characters) for the firewall rule. Spaces are allowed. Edit Source/ Destination Address...
Page 222: Figure 100 Anti-Probing
11.9 Anti-Probing If an outside user attempts to probe an unsupported port on your ZyWALL, an ICMP response packet is automatically returned. This allows the outside user to know the ZyWALL exists. The ZyWALL supports anti-probing, which prevents the ICMP response packet from being sent.
Page 223: Threshold Values
ZyWALL 5/35/70 Series User’s Guide 11.10 Firewall Threshold In the Threshold screen, shown later, you may choose to generate an alert whenever an attack is detected. For DoS attacks, the ZyWALL uses thresholds to determine when to drop sessions that do not become fully established. These thresholds apply globally to all sessions. You can use the default threshold values, or you can change them to values more suitable to your security requirements.
Page 224: Tcp Maximum Incomplete And Blocking Time
When the rate of new connection attempts rises above a threshold (one-minute high), the ZyWALL starts deleting half-open sessions as required to accommodate new connection requests. The ZyWALL continues to delete half-open sessions as necessary, until the rate of new connection attempts drops below another threshold (one-minute low). The rate is the number of new attempts detected in the last one-minute sample period.
Page 225: Figure 101 Firewall Threshold
ZyWALL 5/35/70 Series User’s Guide Figure 101 Firewall Threshold The following table describes the labels in this screen. Table 72 Firewall Threshold LABEL DESCRIPTION Disable DoS Attack Select the check box of an interface to which the ZyWALL does not apply the Protection on thresholds.
Page 226 Table 72 Firewall Threshold (continued) LABEL DESCRIPTION Maximum This is the number of existing half-open sessions that causes the firewall to start Incomplete High deleting half-open sessions. When the number of existing half-open sessions rises above this number, the ZyWALL deletes half-open sessions as required to accommodate new connection requests.
Page 227: Figure 102 Firewall Service
ZyWALL 5/35/70 Series User’s Guide Figure 102 Firewall Service The following table describes the labels in this screen. Table 73 Firewall Service LABEL DESCRIPTION Custom Service This table shows all configured custom services. This is the index number of the custom service. Service Name This is the name of the service.
Page 228: Figure 103 Firewall Edit Custom Service
Table 73 Firewall Service LABEL DESCRIPTION Click this button to bring up the screen that you use to configure a new custom service that is not in the predefined list of services. Predefined This table shows all the services that are already configured for use in firewall Service rules.
Page 229: Predefined Services
ZyWALL 5/35/70 Series User’s Guide Table 74 Firewall Edit Custom Service LABEL DESCRIPTION Type/Code This field is available only when you select ICMP in the IP Protocol field. The ICMP messages are identified by their types and in some cases codes. Enter the type number in the Type field and select the Code radio button and enter the code number if any.
Page 230 Table 75 Predefined Services (continued) SERVICE IMAP(TCP/UDP:143) IMAPS(TCP/UDP:993) AX.25(AX.25:0) IPv6(IPv6:0) IPSEC_ TRANSPORT / TUNNEL(AH:0) IPSEC_TUNNEL(ESP:0) IRC(TCP/UDP:6667) MSN(TCP:1863) MULTICAST(IGMP:0) NetBIOS(TCP/UDP:137~139, 445) NEWS(TCP:144) NFS(UDP:2049) NNTP(TCP:119) POP3(TCP:110) POP3S(TCP/UDP:995) PPTP(TCP:1723) PPTP_TUNNEL(GRE:0) RCMD(TCP:512) REAL_AUDIO(TCP:7070) REXEC(TCP:514) RLOGIN(TCP:513) ROADRUNNER(TCP/ UDP:1026) RTELNET(TCP:107) RTSP(TCP/UDP:554) SFTP(TCP:115) Chapter 11 Firewall Screens ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Internet Message Access Protocol (IMAP) is used to access mail...
Page 231: Example Firewall Rule
ZyWALL 5/35/70 Series User’s Guide Table 75 Predefined Services (continued) SERVICE SIP-V2(UDP:5060) SMTP(TCP:25) SNMP(TCP/UDP:161) SNMP-TRAPS(TCP/UDP:162) SQL-NET(TCP:1521) SSDP(UDP:1900) SSH(TCP/UDP:22) STRMWORKS(UDP:1558) SYSLOG(UDP:514) TACACS(UDP:49) TELNET(TCP:23) TFTP(UDP:69) VDOLIVE(TCP:7000) Microsoft RDP(TCP:3389) VNC(TCP:5900) NTP(TCP/UDP:123) 11.12 Example Firewall Rule The following Internet firewall rule example allows a hypothetical My Service connection from the Internet.
Page 232: Figure 104 Service
Figure 104 Service 2 Configure it as follows and click Apply. Figure 105 Edit Custom Service Example 3 Click the Rule Summary tab. Select WAN to LAN from the Packet Direction drop- down list box. 4 In the Rule Summary screen, type the index number for where you want to put the rule. For example, if you type 6, your new rule becomes number 6 and the previous rule 6 (if there is one) becomes rule 7.
Page 233: Figure 106 Rule Summary
ZyWALL 5/35/70 Series User’s Guide Figure 106 Rule Summary 6 Enter the name of the firewall rule. 7 Select Any in the Destination Address(es) box and then click Delete. 8 Configure the destination address screen as follows and click Add. Figure 107 Rule Edit Example 9 In the Edit Rule screen, use the arrows between Available Services and Selected Service(s) to configure it as follows.
Page 234: Figure 108 My Service Rule Configuration
ZyWALL 5/35/70 Series User’s Guide Note: Custom services show up with an * before their names in the Services list box and the Rule Summary list box. Figure 108 My Service Rule Configuration Chapter 11 Firewall Screens...
Page 235: Figure 109 My Service Example Rule Summary
ZyWALL 5/35/70 Series User’s Guide Figure 109 My Service Example Rule Summary Rule 1: Allows a My Service connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN. Chapter 11 Firewall Screens...
Page 236: Intrusion Detection And Prevention (Idp)
Intrusion Detection and This chapter introduces some background information on IDP. Skip to the next chapter to see how to configure IDP on your ZyWALL. 12.1 Introduction to IDP An IDP system can detect malicious or suspicious packets and respond instantaneously. It can detect anomalies based on violations of protocol standards (RFCs –...
Page 237: Ids And Idp
ZyWALL 5/35/70 Series User’s Guide Firewalls are usually deployed at the network edge. However, many attacks (inadvertently) are launched from within an organization. Virtual private networks (VPN), removable storage devices and wireless networks may all provide access to the internal network without going through the firewall.
Page 238: Example Intrusions
12.1.5 Example Intrusions The following are some examples of intrusions. 12.1.5.1 SQL Slammer Worm W32.SQLExp.Worm is a worm that targets the systems running Microsoft SQL Server 2000, as well as Microsoft Desktop Engine (MSDE) 2000. The worm sends 376 bytes to UDP port 1434, the SQL Server Resolution Service Port.
Page 239: Mydoom
ZyWALL 5/35/70 Series User’s Guide 12.1.5.4 MyDoom MyDoom W32.Mydoom.A@mm (also known as W32.Novarg.A) is a mass-mailing worm that arrives as an attachment with an bat, cmd, exe, pif, scr, or zip file extension. When a computer is infected, the worm sets up a backdoor into the system by opening TCP ports 3127 through 3198, which can potentially allow an attacker to connect to the computer and use it as a proxy to gain access to its network resources.
Page 240: Chapter 13 Configuring Idp
This chapter shows you how to configure IDP on the ZyWALL. 13.1 Overview To use IDP on the ZyWALL, you need to insert the ZyWALL Turbo Card into the rear panel slot of the ZyWALL. See the ZyWALL Turbo Card guide for details. Note: The ZyWALL has no wireless capability when ZyWALL Turbo Card is in place.
Page 241: General Setup
ZyWALL 5/35/70 Series User’s Guide Figure 111 Applying IDP to Interfaces 13.2 General Setup Use this screen to enable IDP on the ZyWALL and choose what interface(s) you want to protect from intrusions. Click IDP from the navigation panel. General is the first screen as shown in the following figure.
Page 242: Attack Types
Figure 112 IDP: General The following table describes the labels in this screen. Table 76 IDP: General Setup LABEL General Setup Enable Intrusion Detection and Protection Turbo Card Protected Interface Apply Reset 13.3 IDP Signatures The rules that define how to identify and respond to intrusions are called “signatures”. Click IDP in the navigation panel and then click the Signatures tab to see the ZyWALL’s signatures.
Page 243: Figure 113 Attack Types
ZyWALL 5/35/70 Series User’s Guide To see signatures listed by intrusion type supported by the ZyWALL, select that type from the Attack Type list box. Figure 113 Attack Types The following table describes each attack type. Table 77 Attack Types TYPE DESCRIPTION DoS/DDoS...
Page 244: Intrusion Severity
Table 77 Attack Types (continued) TYPE DESCRIPTION Virus/Worm A computer virus is a small program designed to corrupt and/or alter the operation of other legitimate programs. A worm is a program that is designed to copy itself from one computer to another on a network. A worm’s uncontrolled replication consumes system resources thus slowing or stopping other tasks.
Page 245: Configuring Idp Signatures
ZyWALL 5/35/70 Series User’s Guide Figure 114 Signature Actions The following table describes signature actions. Table 79 Signature Actions ACTION No Action Drop Packet Drop Session Reset Sender Reset Receiver Reset Both 13.3.4 Configuring IDP Signatures Click IDP in the navigation panel and then click the Signatures tab to see the ZyWALL’s “group view”...
Page 246: Figure 115 Idp: Signatures
Figure 115 IDP: Signatures The following table describes the labels in this screen. Table 80 IDP Signatures: Group View LABEL DESCRIPTION Signature Groups Attack Type Select the type of signatures you want to view from the list box. See page 242 Switch to Click this hyperlink to go to a screen where you can search for signatures based on query view...
Page 247: Query Example 1
ZyWALL 5/35/70 Series User’s Guide Table 80 IDP Signatures: Group View (continued) LABEL DESCRIPTION Select this check box to have a log generated when a match is found for a signature. Select the check box in the heading row to automatically select all check boxes or clear it to clear all entries on the current page.
Page 248: Figure 116 Signature Query By Partial Name
Note: A partial name may be searched but a complete ID number must be entered before a match can be found. For example, a search by name for “w” (in the first example) finds all intrusions that contain this letter in the name field. However a search by ID for “1”...
Page 249: Query Example 2
ZyWALL 5/35/70 Series User’s Guide Figure 117 Signature Query by Complete ID 13.3.5.2 Query Example 2 1 From the “group view” signature screen, click the Switch to query view link. 1 Select Signature Search By Attributes. 2 Select the Severity, Type, Platform, Active, Log, Alert and/or Action items. In this example all severe DDoS type signatures that target the Windows operating system are displayed.
Page 250: Mysecurity Zone
Figure 118 Signature Query by Attribute. 13.4 Update The ZyWALL comes with built-in signatures created by the ZyXEL Security Response Team (ZSRT). These are regularly updated as new intrusions evolve. Use the Update screen to immediately download or schedule new signature downloads. Note: You should have already registered the ZyWALL at myZyXEL.com (http:// www.myzyxel.com/myzyxel/) and also have either activated the trial license or standard license (iCard).
Page 251: Configuring Idp Update
ZyWALL 5/35/70 Series User’s Guide 13.4.2 Configuring IDP Update When scheduling signature updates, you should choose a day and time when your network is least busy so as to minimize disruption to your network. Your custom signature configurations are not over-written when you download new signatures. File-based anti-virus signatures (see the anti-virus chapter) are included with IDP signatures.
Page 252: Table 81 Signatures Update
The following table describes the labels in this screen. Table 81 Signatures Update LABEL DESCRIPTION Signature Information Current Pattern This field displays the signatures version number currently used by the ZyWALL. Version This number is defined by the ZyXEL Security Response Team (ZSRT) who maintain and update them.
Page 253: Figure 120 Idp: Backup & Restore
ZyWALL 5/35/70 Series User’s Guide 13.5 Backup and Restore You can change the pre-defined signatures. Figure 120 IDP: Backup & Restore Use the Backup & Restore screen to: • Back up IDP signatures with your custom configured settings. Click Backup and then choose a location and filename for the IDP configuration set.
Page 254: Chapter 14 Anti-Virus
This chapter introduces and shows you how to configure the anti-virus scanner. 14.1 Anti-Virus Overview A computer virus is a small program designed to corrupt and/or alter the operation of other legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates itself.
Page 255: Types Of Anti-Virus Scanner
ZyWALL 5/35/70 Series User’s Guide 2 The virus spreads to other files and programs on the computer. 3 The infected files are unintentionally sent to another computer thus starting the spread of the virus. 4 Once the virus is spread through the network, the number of infected networked computers can grow exponentially.
Page 256: How The Zywall Anti-Virus Scanner Works
14.2.1 How the ZyWALL Anti-Virus Scanner Works The ZyWALL checks traffic going to the interface(s) you specify for signature matches. Figure 121 ZyWALL Anti-virus Example The following describes the virus scanning process on the ZyWALL. 1 The ZyWALL first identifies SMTP, POP3, HTTP and FTP packets through standard ports.
Page 257: General Anti-Virus Setup
ZyWALL 5/35/70 Series User’s Guide 1 The ZyWALL anti-virus scanner cannot detect polymorphic viruses. 2 The ZyWALL does not scan the following file/traffic types: • Simultaneous downloads of a file using multiple connections. For example, when you use FlashGet to download sections of a file simultaneously. •...
Page 258: Table 83 Anti-Virus: General
The following table describes the labels in this screen. Table 83 Anti-Virus: General LABEL DESCRIPTION General Setup Enable Anti-Virus Select Enable Anti-Virus to activate the anti-virus feature on the ZyWALL. Clear this check box to disable it. Note: Before you use the anti-virus feature, you must register for Enable ZIP File Select this check box to have the ZyWALL scan a ZIP file (with the “zip”...
Page 259: Mysecurity Zone
ZyWALL 5/35/70 Series User’s Guide Note: You should have already registered the ZyWALL at myZyXEL.com (http:// www.myzyxel.com/myzyxel/) and also have either activated the trial license or standard license (iCard). If your license has expired, you will have to renew it before updates are allowed.
Page 260: Figure 123 Anti-Virus: Update
Figure 123 Anti-Virus: Update The following table describes the labels in this screen. Table 84 Anti-Virus: Update LABEL DESCRIPTION Signature Information Current Pattern This field displays the signatures version number currently used by the ZyWALL. Version This number is defined by the ZyXEL Security Response Team (ZSRT) who maintain and update them.
Page 261 ZyWALL 5/35/70 Series User’s Guide Table 84 Anti-Virus: Update (continued) LABEL DESCRIPTION Update Now Click this button to begin downloading signatures from the Update Server immediately. Auto Update Select the check box to configure a schedule for automatic signature updates. The Hourly, Daily and Weekly fields display when the check box is selected.
Page 262: Chapter 15 Anti-Spam
This chapter covers how to use the ZyWALL’s anti-spam feature to deal with junk e-mail (spam). 15.1 Anti-Spam Overview The ZyWALL’s anti-spam feature identifies unsolicited commercial or junk e-mail (spam). You can set the ZyWALL to mark or discard spam. The ZyWALL can use an anti-spam external database to help identify spam.
Page 263: Spambulk Engine
ZyWALL 5/35/70 Series User’s Guide 15.1.1.1 SpamBulk Engine The e-mail fingerprint ID that the ZyWALL generates and sends to the anti-spam external database only includes the parts of the e-mail that are the most difficult for spammers (senders of spam) to change or fake. The anti-spam external database maintains a database of e-mail fingerprint IDs.
Page 264: Spamtricks Engine
15.1.1.4 SpamTricks Engine The SpamTricks engine checks for the tactics that spammers use to minimize the expense of sending lots of e-mail and tactics that they use to bypass spam filters. Use of relays, image-only e-mails, manipulation of mail formats and HTML obfuscation are common tricks for which the SpamTricks engine checks.
Page 265: Whitelist
ZyWALL 5/35/70 Series User’s Guide The anti-spam external database checks for spoofing of e-mail attributes (like the IP address) and uses statistical analysis to detect phishing. 15.1.4 Whitelist Configure whitelist entries to identify legitimate e-mail. The whitelist entries have the ZyWALL classify any e-mail that is from a specified sender or uses a specified MIME (Multipurpose Internet Mail Extensions) header or MIME header value as being legitimate (see...
Page 266: Mime Headers
15.1.7 MIME Headers MIME (Multipurpose Internet Mail Extensions) allows varied media types to be used in e- mail. MIME headers describe an e-mail’s content encoding and type. For example, it may show which program generated the e-mail and what type of text is used in the e-mail body. Here are some examples of MIME headers: •...
Page 267: Table 85 Anti-Spam: General
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 85 Anti-Spam: General LABEL General Setup Enable Anti-spam Action for Spam Mails Phishing Tag Spam Tag Forward SMTP & POP3 mail with tag in mail subject Discard SMTP mail.
Page 268: Figure 126 Anti-Spam: External Db
Figure 126 Anti-Spam: External DB The following table describes the labels in this screen. Table 86 Anti-Spam: External DB LABEL External Database Enable External Database Spam Threshold Chapter 15 Anti-Spam DESCRIPTION Enable the anti-spam external database feature to have the ZyWALL calculate a digest of an e-mail and send it to an anti-spam external database.
Page 269 ZyWALL 5/35/70 Series User’s Guide Table 86 Anti-Spam: External DB (continued) LABEL Action for No Spam Score Tag for No Spam Score Enter a message or label (up to 16 ASCII characters) to add to the mail Forward SMTP & POP3 mail with tag in mail subject Discard SMTP mail.
Page 270: Figure 127 Anti-Spam: Lists
Figure 127 Anti-Spam: Lists The following table describes the labels in this screen. Table 87 Anti-Spam: Lists LABEL Resource Usage Whitelist & Blacklist Storage Space in Whitelist Use Whitelist Active Type Content Modify Chapter 15 Anti-Spam DESCRIPTION This bar displays the percentage of the ZyWALL’s anti-spam whitelist and blacklist storage space that is currently in use.
Page 271: Figure 128 Anti-Spam Rule Edit
ZyWALL 5/35/70 Series User’s Guide Table 87 Anti-Spam: Lists (continued) LABEL Insert Blacklist Use Blacklist Active Type Content Modify Insert Apply Reset 15.5 Anti-Spam Rule Edit Screen Click SECURITY, ANTI-SPAM, Lists to display the Anti-Spam Lists screen. To create a new anti-spam whitelist or blacklist entry, type the index number where you want to put the entry.
Page 272: Table 88 Anti-Spam Rule Edit
The following table describes the labels in this screen. Table 88 Anti-Spam Rule Edit LABEL DESCRIPTION Rule Edit Active Turn this entry on to have the ZyWALL use it as part of the whitelist or blacklist. You must also turn on the use of the corresponding list (in the Anti-Spam Customization screen) and the anti-spam feature (in the Anti-Spam General screen).
Page 273 ZyWALL 5/35/70 Series User’s Guide Table 88 Anti-Spam Rule Edit LABEL DESCRIPTION Apply Click Apply to save your settings and exit this screen. Cancel Click Cancel to exit this screen without saving. Chapter 15 Anti-Spam...
Page 274: Content Filtering Screens
Content Filtering Screens This chapter provides an overview of content filtering. 16.1 Content Filtering Overview Content filtering allows you to block certain web features, such as Cookies, and/or restrict specific websites. With content filtering, you can do the following: 16.1.1 Restrict Web Features The ZyWALL can block web features such as ActiveX controls, Java applets, cookies and disable web proxies.
Page 275: Figure 129 Content Filter : General
ZyWALL 5/35/70 Series User’s Guide Figure 129 Content Filter : General The following table describes the labels in this screen. Table 89 Content Filter : General LABEL General Setup Enable Content Filter Restrict Web Features Block ActiveX Java Cookies DESCRIPTION Select this check box to enable the content filter.
Page 276: Content Filtering With An External Database
Table 89 Content Filter : General LABEL Web Proxy Schedule to Block Always Block Block From/To Message to display when a site is blocked Denied Access Message Exempt Computers Enforce content filter policies for all computers Include specified address ranges in the content filter enforcement Exclude specified...
Page 277: Figure 130 Content Filtering Lookup Procedure
ZyWALL 5/35/70 Series User’s Guide Figure 130 Content Filtering Lookup Procedure 1 A computer behind the ZyWALL tries to access a web site. 2 The ZyWALL looks up the web site in its cache. If an attempt to access the web site was made in the past, a record of that web site’s category will be in the ZyWALL’s cache.
Page 278: Figure 131 Content Filter : Categories
Figure 131 Content Filter : Categories The following table describes the labels in this screen. Table 90 Content Filter: Categories LABEL Auto Category Setup Enable External Database Content Filtering Matched Web Pages Chapter 16 Content Filtering Screens ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Enable external database content filtering to have the ZyWALL check an external database to find to which category a requested web page...
Page 279 ZyWALL 5/35/70 Series User’s Guide Table 90 Content Filter: Categories (continued) LABEL Unrated Web Pages When Content Filter Server Is Unavailable Content Filter Server Unavailable Timeout Select Categories Select All Categories Clear All Categories Adult/Mature Content Pornography Sex Education Intimate Apparel/Swimsuit Nudity DESCRIPTION Select Block to prevent users from accessing web pages that the external...
Page 280 Table 90 Content Filter: Categories (continued) LABEL Alcohol/Tobacco Illegal/Questionable Gambling Violence/Hate/Racism Weapons Abortion Arts/Entertainment Business/Economy Cult/Occult Illegal Drugs Chapter 16 Content Filtering Screens ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Selecting this category excludes pages that promote or offer the sale alcohol/tobacco products, or provide the means to create them.
Page 281 ZyWALL 5/35/70 Series User’s Guide Table 90 Content Filter: Categories (continued) LABEL Education Cultural Institutions Financial Services Brokerage/Trading Games Government/Legal Military Political/Activist Groups Health Computers/Internet Hacking/Proxy Avoidance Search Engines/Portals Web Communications Job Search/Careers DESCRIPTION Selecting this category excludes pages that offer educational information, distance learning and trade school information or programs.
Page 282 Table 90 Content Filter: Categories (continued) LABEL News/Media Personals/Dating Reference Chat/Instant Messaging Email Newsgroups Religion Shopping Auctions Real Estate Society/Lifestyle Gay/Lesbian Restaurants/Dining/Food Sports/Recreation/Hobbies Selecting this category excludes pages that promote or provide Travel Vehicles Chapter 16 Content Filtering Screens ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Selecting this category excludes pages that primarily report information or comments on current events or contemporary issues of the day.
Page 283 ZyWALL 5/35/70 Series User’s Guide Table 90 Content Filter: Categories (continued) LABEL Humor/Jokes Streaming Media/MP3 Software Downloads Pay to Surf For Kids Web Advertisements Web Hosting Advanced/Basic Test Web Site Attribute Test if Web site is blocked Test Against Local Cache Test Against Internet Server Content Filter Service...
Page 284: Figure 132 Content Filter: Customization
16.5 Content Filter Customization Click SECURITY, CONTENT FILTER, then the Customization tab to display the CONTENT FILTER Customization screen. You can create a list of good (allowed) web site addresses and a list of bad (blocked) web site addresses. You can also block web sites based on whether the web site’s address contains a keyword.
Page 285: Table 91 Content Filter: Customization
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 91 Content Filter: Customization LABEL Web Site List Customization Enable Web site customization Disable all Web traffic except for trusted Web sites Don't block Java/ActiveX/ Cookies/Web proxy to trusted Web sites Trusted Web Sites...
Page 286: Customizing Keyword Blocking Url Checking
Table 91 Content Filter: Customization (continued) LABEL Delete Apply Reset 16.6 Customizing Keyword Blocking URL Checking You can use commands to set how much of a website’s URL the content filter is to check for keyword blocking. See the appendices for information on how to access and use the command interpreter.
Page 287: Figure 133 Content Filter: Cache
ZyWALL 5/35/70 Series User’s Guide Use the ip urlfilter customize actionFlags 8 [disable | enable] to extend (or not extend) the keyword blocking search to include the URL's complete filename. 16.7 Content Filtering Cache Click SECURITY, CONTENT FILTER, then the Cache tab to display the CONTENT FILTER Cache screen.
Page 288: Table 92 Content Filter: Cache
The following table describes the labels in this screen. Table 92 Content Filter: Cache LABEL DESCRIPTION URL Cache Setup Maximum TTL Type the maximum time to live (TTL) (1 to 720 hours). This sets how long the ZyWALL is to allow an entry to remain in the URL cache before discarding it. Apply Click Apply to save your changes back to the ZyWALL.
Page 289 ZyWALL 5/35/70 Series User’s Guide Chapter 16 Content Filtering Screens...
Page 290: Content Filtering Reports
Content Filtering Reports This chapter describes how to view content filtering reports after you have activated the category-based content filtering subscription service. Chapter 4 on page 100 and activate the subscription services using the REGISTRATION screens. 17.1 Checking Content Filtering Activation After you activate content filtering, you need to wait up to five minutes for content filtering to be turned on.
Page 291: Figure 134 Myzyxel.com: Login
ZyWALL 5/35/70 Series User’s Guide Figure 134 myZyXEL.com: Login 3 A welcome screen displays. Click your ZyWALL’s model name and/or MAC address under Registered ZyXEL Products. You can change the descriptive name for your ZyWALL using the Rename button in the Service Management screen (see on page 292).
Page 292: Figure 136 Myzyxel.com: Service Management
Figure 136 myZyXEL.com: Service Management 5 Enter your ZyXEL device's MAC address (in lower case) in the Name field. You can find this MAC address in the Service Management screen your myZyXEL.com account password in the Password field. 6 Click Submit. Figure 137 Blue Coat: Login 7 In the Web Filter Home screen, click the Reports tab.
Page 293: Figure 138 Content Filtering Reports Main Screen
ZyWALL 5/35/70 Series User’s Guide Figure 138 Content Filtering Reports Main Screen 8 Select items under Global Reports or Single User Reports to view the corresponding reports. Figure 139 Blue Coat: Report Home 9 Select a time period in the Date Range field, either Allowed or Blocked in the Action Taken field and a category (or enter the user name if you want to view single user reports) and click Run Report.The screens vary according to the report type you selected in the Report Home screen.
Page 294: Figure 140 Global Report Screen Example
ZyWALL 5/35/70 Series User’s Guide Figure 140 Global Report Screen Example 11You can click a category in the Categories report or click URLs in the Report Home screen to see the URLs that were requested. Chapter 17 Content Filtering Reports...
Page 295: Web Site Submission
ZyWALL 5/35/70 Series User’s Guide Figure 141 Requested URLs Example 17.3 Web Site Submission You may find that a web site has not been accurately categorized or that a web site’s contents have changed and the content filtering category needs to be updated. Use the following procedure to submit the web site for review.
Page 296: Figure 142 Web Page Review Process Screen
ZyWALL 5/35/70 Series User’s Guide Figure 142 Web Page Review Process Screen 3 Type the web site’s URL in the field and click Submit to have the web site reviewed. Chapter 17 Content Filtering Reports...
Page 297 ZyWALL 5/35/70 Series User’s Guide Chapter 17 Content Filtering Reports...
Page 298: Chapter 18 Introduction To Ipsec
This chapter introduces the basics of IPSec VPNs. 18.1 VPN Overview A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication.
Page 299: Data Confidentiality
ZyWALL 5/35/70 Series User’s Guide Figure 143 Encryption and Decryption 18.1.3.2 Data Confidentiality The IPSec sender can encrypt packets before transmitting them across a network. 18.1.3.3 Data Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.
Page 300: Ipsec Architecture
18.2 IPSec Architecture The overall IPSec architecture is shown as follows. Figure 144 IPSec Architecture 18.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure (including implementation algorithms).
Page 301: Transport Mode
ZyWALL 5/35/70 Series User’s Guide Figure 145 Transport and Tunnel Mode IPSec Encapsulation 18.3.1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP).
Page 302: Table 93 Vpn And Nat
NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet. When using AH protocol, packet contents (the data payload) are not encrypted.
Page 303 ZyWALL 5/35/70 Series User’s Guide Chapter 18 Introduction to IPSec...
Page 304: Chapter 19 Vpn Screens
This chapter introduces the VPN Web Configurator. See information on viewing logs and 19.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN connections. 19.2 IPSec Algorithms The ESP and AH protocols are necessary to create a Security Association (SA), the foundation of an IPSec VPN.
Page 305: My Zywall
ZyWALL 5/35/70 Series User’s Guide Table 94 ESP and AH Encryption DES (default) Data Encryption Standard (DES) is a widely used method of data encryption using a secret key. DES applies a 56-bit key to each 64-bit block of data. 3DES Triple DES (3DES) is a variant of DES, which iterates three times with three...
Page 306: Dynamic Remote Gateway Address
If the remote secure gateway has a static WAN IP address, enter it in the Remote Gateway Address field. You may alternatively enter the remote secure gateway’s domain name (if it has one). You can also enter a remote secure gateway’s domain name in the Remote Gateway Address field if the remote secure gateway has a dynamic WAN IP address and is using DDNS.
Page 307: Nat Traversal Configuration
ZyWALL 5/35/70 Series User’s Guide Figure 146 NAT Router Between IPSec Routers Normally you cannot set up a VPN connection with a NAT router between the two IPSec routers because the NAT router changes the header of the IPSec packet. In the previous figure, IPSec router A sends an IPSec packet in an attempt to initiate a VPN.
Page 308: Id Type And Content Examples
between three encryption algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN rule (see Section 19.12 on page incoming SAs. The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP address, domain name, or e-mail address.
Page 309: Ike Phases
ZyWALL 5/35/70 Series User’s Guide Table 97 Matching ID Type and Content Configuration Example ZYWALL A Peer ID type: IP Peer ID content: 1.1.1.2 The two ZyWALLs in this example cannot complete their negotiation because ZyWALL B’s Local ID type is IP, but ZyWALL A’s Peer ID type is set to E-mail. An ID mismatched message displays in the IPSec log.
Page 310: Negotiation Mode
• Choose an authentication algorithm. • Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2). • Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out. An IKE SA times out when the IKE SA lifetime period expires.
Page 311: Diffie-Hellman (Dh) Key Groups
ZyWALL 5/35/70 Series User’s Guide 19.8.3 Diffie-Hellman (DH) Key Groups Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 - DH1) and 1024-bit (Group 2 – DH2) Diffie-Hellman groups are supported.
Page 312: Figure 148 Vpn Rules (Ike)
19.10 VPN Rules (IKE) Click VPN to display the VPN Rules (IKE) screen. This is a read-only menu of your IPSec rule (tunnel). To add an IPSec rule (or gateway policy), click the add gateway policy ( icon. Edit an IPSec rule by clicking the edit ( Refer to Table 100 on page 313 Figure 148 VPN Rules (IKE)
Page 313: Figure 149 Gateway And Network Policies
ZyWALL 5/35/70 Series User’s Guide Figure 149 Gateway and Network Policies This figure helps explain the main fields in the VPN setup. Figure 150 IPSec Fields Summary Note: Local and remote network IP addresses must be static. The following table describes the icons used in the VPN screens. Table 100 VPN screen Icons Key ICON DESCRIPTION...
Page 314 Table 100 VPN screen Icons Key ICON DESCRIPTION Click this icon to establish a VPN connection to a remote network. This indicates that a gateway or network policy is not active. Note: The Recycle Bin gateway policy is a virtual placeholder for any network policy(ies) without an associated gateway policy.
Page 315: Figure 151 Vpn Rules (Ike): Gateway Policy: Edit
ZyWALL 5/35/70 Series User’s Guide Figure 151 VPN Rules (IKE): Gateway Policy: Edit Chapter 19 VPN Screens...
Page 316: Table 101 Vpn Rules (Ike): Gateway Policy: Edit
The following table describes the labels in this screen. Table 101 VPN Rules (IKE): Gateway Policy: Edit LABEL DESCRIPTION Property Name Type up to 32 characters to identify this VPN gateway policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces. NAT Traversal Select this check box to enable NAT traversal.
Page 317 ZyWALL 5/35/70 Series User’s Guide Table 101 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Remote Gateway Type the WAN IP address or the domain name (up to 31 characters) of the IPSec Address router with which you're making the VPN connection. Set this field to 0.0.0.0 if the remote IPSec router has a dynamic WAN IP address.
Page 318 Table 101 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Peer ID Type Select from the following when you set Authentication Key to Pre-shared Key. • • • Select from the following when you set Authentication Key to Certificate. •...
Page 319 ZyWALL 5/35/70 Series User’s Guide Table 101 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Server Mode Select Server Mode to have this ZyWALL authenticate extended authentication clients that request this VPN connection. You must also configure the extended authentication clients’ usernames and passwords in the authentication server’s local user database or a RADIUS server (see Click Local User to go to the Local User Database screen where you can view...
Page 320 Table 101 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Enable Multiple Select this check box to allow the ZyWALL to use any of its phase 1 or phase 2 Proposals encryption and authentication algorithms when negotiating an IPSec SA. When you enable multiple proposals, the ZyWALL allows the remote IPSec router to select which encryption and authentication algorithms to use for the VPN tunnel, even if they are less secure than the ones you configure for the VPN rule.
Page 321: Figure 152 Vpn Rules (Ike): Network Policy Edit
ZyWALL 5/35/70 Series User’s Guide Figure 152 VPN Rules (IKE): Network Policy Edit Chapter 19 VPN Screens...
Page 322: Table 102 Vpn Rules (Ike): Network Policy Edit
The following table describes the labels in this screen. Table 102 VPN Rules (IKE): Network Policy Edit LABEL Active Name Protocol Nailed-Up Allow NetBIOS Traffic Through IPSec Tunnel Check IPSec Tunnel Connectivity Ping this Address Gateway Policy Information Gateway Policy Local Network Address Type Chapter 19 VPN Screens...
Page 323 ZyWALL 5/35/70 Series User’s Guide Table 102 VPN Rules (IKE): Network Policy Edit (continued) LABEL Starting IP Address Ending IP Address/ Subnet Mask Local Port Remote Network Address Type Starting IP Address Ending IP Address/ Subnet Mask Remote Port IPSec Proposal Encapsulation Mode Active Protocol Encryption Algorithm When DES is used for data communications, both sender and receiver must...
Page 324 Table 102 VPN Rules (IKE): Network Policy Edit (continued) LABEL Authentication Algorithm SA Life Time (Seconds) Perfect Forward Secret (PFS) Enable Replay Detection Enable Multiple Proposals Apply Cancel 19.13 VPN Rules (IKE): Network Policy Move Click the move ( ) icon in the VPN Rules (IKE) screen to display the VPN Rules (IKE): Network Policy Move screen.
Page 325: Figure 153 Vpn Rules (Ike): Network Policy Move
ZyWALL 5/35/70 Series User’s Guide Figure 153 VPN Rules (IKE): Network Policy Move The following table describes the labels in this screen. Table 103 VPN Rules (IKE): Network Policy Move LABEL DESCRIPTION Network Policy The following fields display the general network settings of this VPN policy. Information Name This field displays the policy name.
Page 326: Figure 154 Vpn Rules (Manual)
You may want to configure a VPN rule that uses manual key management if you are having problems with IKE key management. Refer to Table 100 on page 313 Figure 154 VPN Rules (Manual) The following table describes the labels in this screen. Table 104 VPN Rules (Manual) LABEL DESCRIPTION...
Page 327: Security Parameter Index (Spi)
ZyWALL 5/35/70 Series User’s Guide Table 104 VPN Rules (Manual) (continued) LABEL DESCRIPTION IPSec Algorithm This field displays the security protocols used for an SA. Both AH and ESP increase ZyWALL processing requirements and communications latency (delay). Remote Gateway This is the static WAN IP address or domain name of the remote IPSec router. Address Modify Click the edit icon to edit the VPN policy.
Page 328: Figure 155 Vpn Rules (Manual): Edit
Figure 155 VPN Rules (Manual): Edit The following table describes the labels in this screen. Table 105 VPN Rules (Manual) Edit LABEL DESCRIPTION Property Active Select this check box to activate this VPN policy. Name Type up to 32 characters to identify this VPN policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 329 ZyWALL 5/35/70 Series User’s Guide Table 105 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION Local Network Local IP addresses must be static and correspond to the remote IPSec router's configured remote IP addresses. Two active SAs cannot have the local and remote IP address(es) both the same. Two active SAs can have the same local or remote IP address, but not both.
Page 330 Table 105 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION My ZyWALL When the ZyWALL is in router mode, enter the WAN IP address or the domain name of your ZyWALL or leave the field set to 0.0.0.0. For a ZyWALL with multiple WAN ports, the following applies if the My ZyWALL field is configured as 0.0.0.0: •...
Page 331: Figure 156 Vpn: Sa Monitor
ZyWALL 5/35/70 Series User’s Guide Table 105 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION Encryption Key This field is applicable when you select ESP in the Active Protocol field above. With DES, type a unique key 8 characters long. With 3DES, type a unique key 24 characters long.
Page 332: Figure 157 Vpn: Global Setting
Table 106 VPN: SA Monitor (continued) LABEL DESCRIPTION IPSec Algorithm This field displays the security protocols used for an SA. Both AH and ESP increase ZyWALL processing requirements and communications latency (delay). Refresh Click Refresh to display the current active VPN connection(s). Disconnect Select a security association index number that you want to disconnect and then click Disconnect.
Page 333: Telecommuter Vpn/Ipsec Examples
ZyWALL 5/35/70 Series User’s Guide Table 107 VPN: Global Setting (continued) LABEL Gateway Domain Name Update Timer Apply Reset 19.18 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyWALL at headquarters. The telecommuters use IPSec routers with dynamic WAN IP addresses.
Page 334: Telecommuters Using Unique Vpn Rules Example
Figure 158 Telecommuters Sharing One VPN Rule Example Table 108 Telecommuters Sharing One VPN Rule Example FIELDS My ZyWALL: Remote Gateway Address: Local Network - Single IP Address: Remote Network - Single IP Address: 19.18.2 Telecommuters Using Unique VPN Rules Example In this example the telecommuters (A, B and C in the figure) use IPSec routers with domain names that are mapped to their dynamic WAN IP addresses (use Dynamic DNS to do this).
Page 335: Figure 159 Telecommuters Using Unique Vpn Rules Example
ZyWALL 5/35/70 Series User’s Guide Figure 159 Telecommuters Using Unique VPN Rules Example Table 109 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS All Telecommuter Rules: My ZyWALL 0.0.0.0 Remote Gateway Address: bigcompanyhq.com Remote Network - Single IP Address: 192.168.1.10 Local ID Type: E-mail Peer ID Type: E-mail Peer ID Content: bob@bigcompanyhq.com Telecommuter A (telecommutera.dydns.org)
Page 336: Vpn And Remote Management
Table 109 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS Local IP Address: 192.168.4.15 19.19 VPN and Remote Management If a VPN tunnel uses Telnet, FTP, WWW, SNMP, DNS or ICMP, then you should configure remote management (REMOTE MGMT) to allow access for that service. Chapter 19 VPN Screens ZyWALL 5/35/70 Series User’s Guide HEADQUARTERS...
Page 337 ZyWALL 5/35/70 Series User’s Guide Chapter 19 VPN Screens...
Page 338: Chapter 20 Certificates
This chapter gives background information about public-key certificates and explains how to use them. 20.1 Certificates Overview The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. A certificate contains the certificate owner’s identity and public key.
Page 339: Advantages Of Certificates
ZyWALL 5/35/70 Series User’s Guide Certification authorities maintain directory servers with databases of valid and revoked certificates. A directory of certificates that have been revoked before the scheduled expiration is called a CRL (Certificate Revocation List). The ZyWALL can check a peer’s certificate against a directory server’s list of revoked certificates.
Page 340: Figure 161 My Certificates
20.4 My Certificates Click SECURITY, CERTIFICATES, My Certificates to open the My Certificates screen. This is the ZyWALL’s summary list of certificates and certification requests. Certificates display in black and certification requests display in gray. Figure 161 My Certificates The following table describes the labels in this screen. Table 110 My Certificates LABEL DESCRIPTION...
Page 341 ZyWALL 5/35/70 Series User’s Guide Table 110 My Certificates (continued) LABEL DESCRIPTION Type This field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request.
Page 342: Certificate File Formats
20.5 My Certificate Import Click SECURITY, CERTIFICATES, My Certificates and then Import to open the My Certificate Import screen. Follow the instructions in this screen to save an existing certificate to the ZyWALL. Note: You can only import a certificate that matches a corresponding certification request that was generated by the ZyWALL.
Page 343: Figure 162 My Certificate Import
ZyWALL 5/35/70 Series User’s Guide Figure 162 My Certificate Import The following table describes the labels in this screen. Table 111 My Certificate Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. Browse Click Browse to find the certificate file you want to upload.
Page 344: Figure 163 My Certificate Create
Figure 163 My Certificate Create The following table describes the labels in this screen. Table 112 My Certificate Create LABEL Certificate Name Subject Information Common Name Organizational Unit Organization Chapter 20 Certificates DESCRIPTION Type up to 31 ASCII characters (not including spaces) to identify this certificate.
Page 345 ZyWALL 5/35/70 Series User’s Guide Table 112 My Certificate Create (continued) LABEL Country Key Length Enrollment Options Create a self-signed certificate Create a certification request and save it locally for later manual enrollment Create a certification request and enroll for a certificate immediately online Enrollment Protocol...
Page 346: My Certificate Details
After you click Apply in the My Certificate Create screen, you see a screen that tells you the ZyWALL is generating the self-signed certificate or certification request. After the ZyWALL successfully enrolls a certificate or generates a certification request or a self-signed certificate, you see a screen with a Return button that takes you back to the My Certificates screen.
Page 347: Figure 164 My Certificate Details
ZyWALL 5/35/70 Series User’s Guide Figure 164 My Certificate Details Chapter 20 Certificates...
Page 348: Table 113 My Certificate Details
The following table describes the labels in this screen. Table 113 My Certificate Details LABEL Name Property Default self-signed certificate which signs the imported remote host certificates. Certification Path Refresh Certificate Information Type Version Serial Number Subject Issuer Signature Algorithm Valid From Valid To Key Algorithm...
Page 349: Trusted Cas
ZyWALL 5/35/70 Series User’s Guide Table 113 My Certificate Details (continued) LABEL Subject Alternative Name Key Usage Basic Constraint MD5 Fingerprint SHA1 Fingerprint Certificate in PEM (Base-64) Encoded Format Export Apply Cancel 20.8 Trusted CAs Click SECURITY, CERTIFICATES, Trusted CAs to open the Trusted CAs screen. This screen displays a summary list of certificates of the certification authorities that you have set the ZyWALL to accept as trusted.
Page 350: Figure 165 Trusted Cas
Figure 165 Trusted CAs The following table describes the labels in this screen. Table 114 Trusted CAs LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use. The bar turns from green to red when the maximum is being approached.
Page 351: Figure 166 Trusted Ca Import
ZyWALL 5/35/70 Series User’s Guide Table 114 Trusted CAs (continued) LABEL DESCRIPTION CRL Issuer This field displays Yes if the certification authority issues Certificate Revocation Lists for the certificates that it has issued and you have selected the Issues certificate revocation lists (CRL) check box in the certificate’s details screen to have the ZyWALL check the CRL before trusting any certificates issued by the certification authority.
Page 352: Table 115 Trusted Ca Import
The following table describes the labels in this screen. Table 115 Trusted CA Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. Browse Click Browse to find the certificate file you want to upload. Apply Click Apply to save the certificate on the ZyWALL.
Page 353: Figure 167 Trusted Ca Details
ZyWALL 5/35/70 Series User’s Guide Figure 167 Trusted CA Details The following table describes the labels in this screen. Table 116 Trusted CA Details LABEL Name Property Check incoming certificates issued by this CA against a DESCRIPTION This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 354 Table 116 Trusted CA Details (continued) LABEL Certification Path Refresh Certificate Information Type Version Serial Number Subject Issuer Signature Algorithm Valid From Valid To Key Algorithm Subject Alternative Name Key Usage Basic Constraint Chapter 20 Certificates DESCRIPTION Click the Refresh button to have this read-only text box display the end entity’s certificate and a list of certification authority certificates that shows the hierarchy of certification authorities that validate the end entity’s certificate.
Page 355: Trusted Remote Hosts
ZyWALL 5/35/70 Series User’s Guide Table 116 Trusted CA Details (continued) LABEL CRL Distribution Points MD5 Fingerprint SHA1 Fingerprint Certificate in PEM (Base-64) Encoded Format Export Apply Cancel 20.11 Trusted Remote Hosts Click SECURITY, CERTIFICATES, Trusted Remote Hosts to open the Trusted Remote Hosts screen.
Page 356: Figure 168 Trusted Remote Hosts
Figure 168 Trusted Remote Hosts The following table describes the labels in this screen. Table 117 Trusted Remote Hosts LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use. The bar turns from green to red when the maximum is being approached.
Page 357: Verifying A Trusted Remote Host's Certificate
ZyWALL 5/35/70 Series User’s Guide Table 117 Trusted Remote Hosts (continued) LABEL DESCRIPTION Import Click Import to open a screen where you can save the certificate of a remote host (which you trust) from your computer to the ZyWALL. Refresh Click this button to display the current validity status of the certificates.
Page 358: Figure 170 Certificate Details
Figure 170 Certificate Details Verify (over the phone for example) that the remote host has the same information in the Thumbprint Algorithm and Thumbprint fields. 20.13 Trusted Remote Hosts Import Click SECURITY, CERTIFICATES, Trusted Remote Hosts to open the Trusted Remote Hosts screen and then click Import to open the Trusted Remote Host Import screen.
Page 359: Figure 171 Trusted Remote Host Import
ZyWALL 5/35/70 Series User’s Guide Figure 171 Trusted Remote Host Import The following table describes the labels in this screen. Table 118 Trusted Remote Host Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. Browse Click Browse to find the certificate file you want to upload.
Page 360: Figure 172 Trusted Remote Host Details
Figure 172 Trusted Remote Host Details The following table describes the labels in this screen. Table 119 Trusted Remote Host Details LABEL Name Certification Path Refresh Chapter 20 Certificates DESCRIPTION This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 361 ZyWALL 5/35/70 Series User’s Guide Table 119 Trusted Remote Host Details (continued) LABEL Certificate Information These read-only fields display detailed information about the certificate. Type Version Serial Number Subject Issuer Signature Algorithm Valid From Valid To Key Algorithm Subject Alternative Name Key Usage Basic Constraint...
Page 362: Figure 173 Directory Servers
Table 119 Trusted Remote Host Details (continued) LABEL Certificate in PEM (Base-64) Encoded Format Export Apply Cancel 20.15 Directory Servers Click SECURITY, CERTIFICATES, Directory Servers to open the Directory Servers screen. This screen displays a summary list of directory servers (that contain lists of valid and revoked certificates) that have been saved into the ZyWALL.
Page 363: Figure 174 Directory Server Add
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 120 Directory Servers LABEL DESCRIPTION PKI Storage Space This bar displays the percentage of the ZyWALL’s PKI storage space that is in Use currently in use. The bar turns from green to red when the maximum is being approached.
Page 364: Table 121 Directory Server Add
The following table describes the labels in this screen. Table 121 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name Type up to 31 ASCII characters (spaces are not permitted) to identify this directory server. Access Protocol Use the drop-down list box to select the access protocol used by the directory server.
Page 365 ZyWALL 5/35/70 Series User’s Guide Chapter 20 Certificates...
Page 366: Authentication Server
This chapter discusses how to configure the ZyWALL’s authentication server feature. 21.1 Authentication Server Overview A ZyWALL set to be a VPN extended authentication server can use either the local user database internal to the ZyWALL or an external RADIUS server for an unlimited number of users.
Page 367: Figure 175 Local User Database
ZyWALL 5/35/70 Series User’s Guide Figure 175 Local User Database Chapter 21 Authentication Server...
Page 368: Figure 176 Radius
The following table describes the labels in this screen. Table 122 Local User Database LABEL DESCRIPTION Active Select this check box to enable the user profile. User Name Enter the user name of the user profile. Password Enter a password up to 31 characters long for this user profile. Apply Click Apply to save your changes back to the ZyWALL.
Page 369: Table 123 Radius
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 123 RADIUS LABEL Authentication Server Active Server IP Address Port Number Accounting Server Active Server IP Address Port Number Apply Reset DESCRIPTION Select the check box to enable user authentication through an external authentication server.
Page 370: Network Address Translation (Nat)
Network Address Translation This chapter discusses how to configure NAT on the ZyWALL. 22.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network.
Page 371: What Nat Does
ZyWALL 5/35/70 Series User’s Guide 22.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.
Page 372: Nat Application
Figure 177 How NAT Works 22.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyWALL can communicate with three distinct WAN networks. More examples follow at the end of this chapter. Figure 178 NAT Application With IP Alias Chapter 22 Network Address Translation (NAT) ZyWALL 5/35/70 Series User’s Guide...
Page 373: Port Restricted Cone Nat
ZyWALL 5/35/70 Series User’s Guide 22.1.5 Port Restricted Cone NAT At the time of writing ZyWALL ZyNOS version 4.00 uses port restricted cone NAT. Port restricted cone NAT maps all outgoing packets from an internal IP address and port to a single IP address and port on the external network.
Page 374: Using Nat
• Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world although, it is highly recommended that you use the DMZ port for these servers instead. Note: Port numbers do not change for One-to-One and Many-One-to-One NAT mapping types.
Page 375: Figure 180 Nat Overview
ZyWALL 5/35/70 Series User’s Guide 22.3 NAT Overview Click ADVANCED, NAT to open the NAT Overview screen. Not all fields are available on all models. Figure 180 NAT Overview The following table describes the labels in this screen. Table 126 NAT Overview LABEL DESCRIPTION Global Settings...
Page 376: Nat Address Mapping
Table 126 NAT Overview (continued) LABEL DESCRIPTION WAN 1, 2 Enable NAT Select this check box to turn on the NAT feature for the WAN port. Clear this check box to turn off the NAT feature for the WAN port. Address Select SUA to have the ZyWALL use its permanent, pre-defined NAT address Mapping Rules...
Page 377: Figure 181 Nat Address Mapping
ZyWALL 5/35/70 Series User’s Guide Figure 181 NAT Address Mapping The following table describes the labels in this screen. Table 127 NAT Address Mapping LABEL DESCRIPTION SUA Address This read-only table displays the default address mapping rules. Mapping Rules Full Feature Address Mapping Rules WAN Interface Select the WAN port for which you want to view or configure address mapping rules.
Page 378: Figure 182 Nat Address Mapping Edit
Table 127 NAT Address Mapping (continued) LABEL DESCRIPTION Global Start IP This refers to the Inside Global IP Address (IGA), that is the starting global IP address. 0.0.0.0 is for a dynamic IP address from your ISP with Many-to-One and Server mapping types.
Page 379: Port Forwarding
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 128 NAT Address Mapping Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. 1. One-to-One: One-to-One mode maps one local IP address to one global IP address.
Page 380: Default Server Ip Address
22.5.1 Default Server IP Address In addition to the servers for specified services, NAT supports a default server IP address. A default server receives packets from ports that are not specified in this screen. Note: If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup.
Page 381: Nat And Multiple Wan
ZyWALL 5/35/70 Series User’s Guide Figure 183 Multiple Servers Behind NAT Example 22.5.4 NAT and Multiple WAN The ZyWALL has two WAN ports. You can configure port forwarding and trigger port rule sets for the first WAN port and separate sets of rules for the second WAN port. 22.5.5 Port Translation The ZyWALL can translate the destination port number or a range of port numbers of packets coming from the WAN to another destination port number or range of port numbers on the...
Page 382: Figure 184 Port Translation Example
Figure 184 Port Translation Example 22.6 Port Forwarding Note: If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup. Click ADVANCED, NAT and Port Forwarding to open the Port Forwarding screen. Not all fields are available on all models.
Page 383: Figure 185 Port Forwarding
ZyWALL 5/35/70 Series User’s Guide Figure 185 Port Forwarding The following table describes the labels in this screen. Table 130 Port Forwarding LABEL DESCRIPTION WAN Interface Select the WAN port for which you want to view or configure address mapping rules. Default Server In addition to the servers for specified services, NAT supports a default server.
Page 384: Figure 186 Trigger Port Forwarding Process: Example
Table 130 Port Forwarding LABEL DESCRIPTION Server IP Enter the inside IP address of the server here. Address Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 22.7 Port Triggering Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side.
Page 385: Figure 187 Port Triggering
ZyWALL 5/35/70 Series User’s Guide 4 The ZyWALL forwards the traffic to Jane’s computer IP address. 5 Only Jane can connect to the Real Audio server until the connection is closed or times out. The ZyWALL times out in three minutes with UDP (User Datagram Protocol) or two hours with TCP/IP (Transfer Control Protocol/Internet Protocol).
Page 386 Table 131 Port Triggering LABEL DESCRIPTION Trigger The trigger port is a port (or a range of ports) that causes (or triggers) the ZyWALL to record the IP address of the LAN computer that sent the traffic to a server on the WAN. Start Port Type a port number or the starting port number in a range of port numbers.
Page 387 ZyWALL 5/35/70 Series User’s Guide Chapter 22 Network Address Translation (NAT)
Page 388: Chapter 23 Static Route
This chapter shows you how to configure static routes for your ZyWALL. 23.1 IP Static Route Each remote node specifies only the network to which the gateway is directly connected, and the ZyWALL has no knowledge of the networks beyond. For instance, the ZyWALL knows about network N2 in the following figure through remote node Router 1.
Page 389: Figure 189 Ip Static Route
ZyWALL 5/35/70 Series User’s Guide Note: The default route is disabled after you change the static WAN IP address to a dynamic WAN IP address. Figure 189 IP Static Route The following table describes the labels in this screen. Table 132 IP Static Route LABEL DESCRIPTION This is the number of an individual static route.
Page 390: Figure 190 Ip Static Route Edit
Table 132 IP Static Route LABEL DESCRIPTION Active This field shows whether this static route is active (Yes) or not (No). Destination This parameter specifies the IP network address of the final destination. Routing is always based on network number. Gateway This is the IP address of the gateway.
Page 391 ZyWALL 5/35/70 Series User’s Guide Table 133 IP Static Route Edit LABEL DESCRIPTION Gateway IP Enter the IP address of the gateway. The gateway is a router or switch on the same Address network segment as the device's LAN or WAN port. The gateway helps forward packets to their destinations.
Page 392: Chapter 24 Policy Route
This chapter covers setting and applying policies used for IP routing. This chapter applies to the ZyWALL 35 and ZyWALL 70. 24.1 Policy Route Traditionally, routing is based on the destination address only and the ZyWALL takes the shortest path to forward a packet. IP Policy Routing (IPPR) provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator.
Page 393: Ip Routing Policy Setup
ZyWALL 5/35/70 Series User’s Guide IPPR follows the existing packet filtering facility of RAS in style and in implementation. 24.4 IP Routing Policy Setup Click ADVANCED, POLICY ROUTE to open the Policy Route Summary screen (some of the screen’s blank rows are not shown). Figure 191 Policy Route Summary Chapter 24 Policy Route...
Page 394: Table 134 Policy Route Summary
The following table describes the labels in this screen. Table 134 Policy Route Summary LABEL DESCRIPTION This is the number of an individual policy route. Active This field shows whether the policy is active or inactive. Source Address/ This is the source IP address range and/or port number range. Port Destination This is the destination IP address range and/or port number range.
Page 395: Figure 192 Edit Ip Policy Route
ZyWALL 5/35/70 Series User’s Guide Figure 192 Edit IP Policy Route The following table describes the labels in this screen. Table 135 Edit IP Policy Route LABEL DESCRIPTION Criteria Active Select the check box to activate the policy. Rule Index This is the index number of the policy route.
Page 396 Table 135 Edit IP Policy Route (continued) LABEL DESCRIPTION Packet Length Type a length of packet (in bytes). The operators in the Len Compare field apply to incoming packets of this length. Length Choose from Equal, Not Equal, Less, Greater, Less or Equal or Greater or Comparison Equal.
Page 397 ZyWALL 5/35/70 Series User’s Guide Chapter 24 Policy Route...
Page 398: Chapter 25 Bandwidth Management
Bandwidth Management This chapter describes the functions and configuration of bandwidth management with multiple levels of sub-classes. 25.1 Bandwidth Management Overview Bandwidth management allows you to allocate an interface’s outgoing capacity to specific types of traffic. It can also help you make sure that the ZyWALL forwards certain types of traffic (especially real-time applications) with minimum delay.
Page 399: Proportional Bandwidth Allocation
ZyWALL 5/35/70 Series User’s Guide 25.3 Proportional Bandwidth Allocation Bandwidth management allows you to define how much bandwidth each class gets; however, the actual bandwidth allotted to each class decreases or increases in proportion to actual available bandwidth. 25.4 Application-based Bandwidth Management You can create bandwidth classes based on individual applications (like VoIP, Web, FTP, E- mail and Video for example).
Page 400: Application And Subnet-Based Bandwidth Management
25.6 Application and Subnet-based Bandwidth Management You could also create bandwidth classes based on a combination of a subnet and an application. The following example table shows bandwidth allocations for application specific traffic from separate LAN subnets. Table 136 Application and Subnet-based Bandwidth Management Example TRAFFIC TYPE VoIP E-mail...
Page 401: Reserving Bandwidth For Non-Bandwidth Class Traffic
ZyWALL 5/35/70 Series User’s Guide When you enable maximize bandwidth usage, the ZyWALL first makes sure that each bandwidth class gets up to its bandwidth allotment. Next, the ZyWALL divides up an interface’s available bandwidth (bandwidth that is unbudgeted or unused by the classes) depending on how many bandwidth classes require more bandwidth and on their priority levels.
Page 402: Priority-Based Allotment Of Unused And Unbudgeted Bandwidth
25.7.5.1 Priority-based Allotment of Unused and Unbudgeted Bandwidth The following table shows the priorities of the bandwidth classes and the amount of bandwidth that each class gets. Table 138 Priority-based Allotment of Unused and Unbudgeted Bandwidth Example BANDWIDTH CLASSES, PRIORITIES AND ALLOTMENTS Root Class: 10240 kbps Suppose that all of the classes except for the administration class need more bandwidth.
Page 403: Bandwidth Borrowing
ZyWALL 5/35/70 Series User’s Guide 25.8 Bandwidth Borrowing Bandwidth borrowing allows a sub-class to borrow unused bandwidth from its parent class, whereas maximize bandwidth usage allows bandwidth classes to borrow any unused or unbudgeted bandwidth on the whole interface. Enable bandwidth borrowing on a sub-class to allow the sub-class to use its parent class’s unused bandwidth.
Page 404: Maximize Bandwidth Usage With Bandwidth Borrowing
• The Bill class cannot borrow unused bandwidth from the Root class because the Sales class has bandwidth borrowing disabled. • The Amy class cannot borrow unused bandwidth from the Sales USA class because the Amy class has bandwidth borrowing disabled. •...
Page 405: Figure 194 Bandwidth Management: Summary
ZyWALL 5/35/70 Series User’s Guide Figure 194 Bandwidth Management: Summary The following table describes the labels in this screen. Table 141 Bandwidth Management: Summary LABEL DESCRIPTION Class These read-only labels represent the physical interfaces. Select an interface’s check box to enable bandwidth management on that interface. Bandwidth management applies to all traffic flowing out of the router through the interface, regardless of the traffic’s source.
Page 406: Figure 195 Bandwidth Management: Class Setup
25.11 Configuring Class Setup The Class Setup screen displays the configured bandwidth classes by individual interface. Select an interface and click the buttons to perform the actions described next. Click “+” to expand the class tree or click “-“ to collapse the class tree. Each interface has a permanent root class.
Page 407: Bandwidth Manager Class Configuration
ZyWALL 5/35/70 Series User’s Guide Table 142 Bandwidth Management: Class Setup (continued) LABEL DESCRIPTION Edit Click Edit to configure the selected class. You cannot edit the root class. Delete Click Delete to delete the class and all its sub-classes. You cannot delete the root class.
Page 408: Figure 196 Bandwidth Management: Edit Class
Figure 196 Bandwidth Management: Edit Class The following table describes the labels in this screen. Table 143 Bandwidth Management: Edit Class LABEL Class Configuration Class Name Bandwidth Budget (kbps) Priority Borrow bandwidth from parent class Filter Configuration Chapter 25 Bandwidth Management DESCRIPTION Use the auto-generated name or enter a descriptive name of up to 20 alphanumeric characters, including spaces.
Page 409 ZyWALL 5/35/70 Series User’s Guide Table 143 Bandwidth Management: Edit Class (continued) LABEL Enable Bandwidth Filter Service Destination IP Address Destination Subnet Mask Destination Port Source IP Address Source Subnet Mask Source Port Protocol ID DESCRIPTION Select Enable Bandwidth Filter to have the ZyWALL use this bandwidth filter when it performs bandwidth management.
Page 410: Table 144 Services And Port Numbers
Table 143 Bandwidth Management: Edit Class (continued) LABEL Apply Cancel Table 144 Services and Port Numbers SERVICES ECHO FTP (File Transfer Protocol) SMTP (Simple Mail Transfer Protocol) DNS (Domain Name System) Finger HTTP (Hyper Text Transfer protocol or WWW, Web) POP3 (Post Office Protocol) NNTP (Network News Transport Protocol) SNMP (Simple Network Management Protocol)
Page 411: Figure 197 Bandwidth Management: Statistics
ZyWALL 5/35/70 Series User’s Guide Figure 197 Bandwidth Management: Statistics The following table describes the labels in this screen. Table 145 Bandwidth Management: Statistics LABEL DESCRIPTION Class Name This field displays the name of the class the statistics page is showing. Budget (kbps) This field displays the amount of bandwidth allocated to the class.
Page 412: Figure 198 Bandwidth Management: Monitor
Figure 198 Bandwidth Management: Monitor The following table describes the labels in this screen. Table 146 Bandwidth Management: Monitor LABEL Interface Class Budget (kbps) Current Usage (kbps) Refresh a.If you allocate all the root class’s bandwidth to the bandwidth classes, the default class still displays a budget of 2 kbps (the minimum amount of bandwidth that can be assigned to a bandwidth class).
Page 413 ZyWALL 5/35/70 Series User’s Guide Chapter 25 Bandwidth Management...
Page 414: Chapter 26 Dns
This chapter shows you how to configure the DNS screens. 26.1 DNS Overview DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.
Page 415: Address Record
ZyWALL 5/35/70 Series User’s Guide 26.4 Address Record An address record contains the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the top-level domain. For example, www.zyxel.com.tw is a fully qualified domain name, where “www”...
Page 416: System Screen
Figure 199 Private DNS Server Example Note: If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote private network. 26.6 System Screen To configure your ZyWALL’s DNS address and name server records, click ADVANCED, DNS.
Page 417: Figure 200 System Dns
ZyWALL 5/35/70 Series User’s Guide Figure 200 System DNS The following table describes the labels in this screen. Table 147 System DNS LABEL Address Record FQDN Wildcard IP Address Modify DESCRIPTION An address record specifies the mapping of a fully qualified domain name (FQDN) to an IP address.
Page 418: Figure 201 System Dns: Add Address Record
Table 147 System DNS LABEL Name Server Record A name server record contains a DNS server’s IP address. The ZyWALL can Domain Zone From DNS Server Modify Insert 26.6.1 Adding an Address Record Click Add in the System screen to add an address record. Figure 201 System DNS: Add Address Record Chapter 26 DNS DESCRIPTION...
Page 419: Figure 202 System Dns: Insert Name Server Record
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 148 System DNS: Add Address Record LABEL DESCRIPTION FQDN Type a fully qualified domain name (FQDN) of a server. An FQDN starts with a host name and continues all the way up to the top-level domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where “www”...
Page 420: Table 149 System Dns: Insert Name Server Record
The following table describes the labels in this screen. Table 149 System DNS: Insert Name Server Record LABEL DESCRIPTION Domain Zone This field is optional. A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name.
Page 421: Configure Dns Cache
ZyWALL 5/35/70 Series User’s Guide 26.8 Configure DNS Cache To configure your ZyWALL’s DNS caching, click ADVANCED, DNS, then the Cache tab. The screen appears as shown. Figure 203 DNS Cache The following table describes the labels in this screen. Table 150 DNS Cache LABEL DNS Cache Setup...
Page 422: Configuring Dns Dhcp
Table 150 DNS Cache LABEL DNS Cache Entry Flush Refresh Cache Type Domain Name IP Address Remaining Time (sec) Modify 26.9 Configuring DNS DHCP Click ADVANCED, DNS and then the DHCP tab to open the DNS DHCP screen shown next. Use this screen to configure the DNS server information that the ZyWALL sends to its LAN, DMZ or WLAN DHCP clients.
Page 423: Figure 204 Dns Dhcp
ZyWALL 5/35/70 Series User’s Guide Figure 204 DNS DHCP The following table describes the labels in this screen. Table 151 DNS DHCP LABEL DNS Servers Assigned by DHCP Server Selected Interface Apply Reset DESCRIPTION The ZyWALL passes a DNS (Domain Name System) server IP address to the DHCP clients.
Page 424: Dyndns Wildcard
26.10 Dynamic DNS Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an IP address that changes each time you reconnect.
Page 425: Figure 205 Ddns
ZyWALL 5/35/70 Series User’s Guide Figure 205 DDNS The following table describes the labels in this screen. Table 152 DDNS LABEL Account Setup Active Service Provider Username Password My Domain Names Domain Name 1~5 DDNS Type Offline Wildcard DESCRIPTION Select this check box to use dynamic DNS. This is the name of your Dynamic DNS service provider.
Page 426 Table 152 DDNS LABEL WAN Interface IP Address Update Policy Apply Reset Chapter 26 DNS DESCRIPTION Select the WAN port to use for updating the IP address of the domain name. Select Use WAN IP Address to have the ZyWALL update the domain name with the WAN port's IP address.
Page 427 ZyWALL 5/35/70 Series User’s Guide Chapter 26 DNS...
Page 428: Chapter 27 Remote Management
This chapter provides information on the Remote Management screens. 27.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers. Note: When you configure remote management to allow management from the WAN, you still need to configure a firewall rule to allow access.
Page 429: System Timeout
ZyWALL 5/35/70 Series User’s Guide 1 A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. 2 You have disabled that service in one of the remote management screens. 3 The IP address in the Secure Client IP Address field does not match the client IP address.
Page 430: Figure 206 Https Implementation
Figure 206 HTTPS Implementation Note: If you disable HTTP Server Access (Disable) in the REMOTE MGMT WWW screen, then the ZyWALL blocks all HTTP connection attempts. 27.3 WWW Click ADVANCED, REMOTE MGMT to open the WWW screen. Use this screen to change your ZyWALL’s web settings.
Page 431: Figure 207 Www
ZyWALL 5/35/70 Series User’s Guide Figure 207 WWW The following table describes the labels in this screen. Table 153 WWW LABEL DESCRIPTION HTTPS Server Select the Server Certificate that the ZyWALL will use to identify itself. The Certificate ZyWALL is the SSL server and must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the ZyWALL).
Page 432: Https Example
Table 153 WWW (continued) LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Server Access Select the interface(s) through which a computer may access the ZyWALL using this service.
Page 433: Netscape Navigator Warning Messages
ZyWALL 5/35/70 Series User’s Guide 27.4.2 Netscape Navigator Warning Messages When you attempt to access the ZyWALL HTTPS server, a Website Certified by an Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that the certificate is from the ZyWALL. If Accept this certificate temporarily for this session is selected, then click OK to continue in Netscape.
Page 434: Avoiding The Browser Warning Messages
27.4.3 Avoiding the Browser Warning Messages The following describes the main reasons that your browser displays warnings about the ZyWALL’s HTTPS server certificate and what you can do to avoid seeing the warnings. • The issuing certificate authority of the ZyWALL’s HTTPS server certificate is not one of the browser’s trusted certificate authorities.
Page 435: Figure 211 Login Screen (Internet Explorer)
ZyWALL 5/35/70 Series User’s Guide Figure 211 Login Screen (Internet Explorer) Figure 212 Login Screen (Netscape) Click Login and you then see the next screen. The factory default certificate is a common default certificate for all ZyWALL models. Chapter 27 Remote Management...
Page 436: Figure 213 Replace Certificate
ZyWALL 5/35/70 Series User’s Guide Figure 213 Replace Certificate Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Click CERTIFICATES to open the My Certificates screen. You will see information similar to that shown in the following figure. Figure 214 Device-specific Certificate Click Ignore in the Replace Certificate screen to use the common ZyWALL certificate.
Page 437: How Ssh Works
ZyWALL 5/35/70 Series User’s Guide Figure 215 Common ZyWALL Certificate 27.5 SSH Unlike Telnet or FTP, which transmit data in clear text, SSH (Secure Shell) is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network. Figure 216 SSH Communication Example 27.6 How SSH works The following table summarizes how a secure connection is established between two remote...
Page 438: Ssh Implementation On The Zywall
Figure 217 How SSH Works 1 Host Identification The SSH client sends a connection request to the SSH server. The server identifies itself with a host key. The client encrypts a randomly generated session key with the host key and server key and sends the result back to the server. The client automatically saves any new server public keys.
Page 439: Requirements For Using Ssh
ZyWALL 5/35/70 Series User’s Guide 27.7.1 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the ZyWALL over SSH. 27.8 Configuring SSH Click ADVANCED, REMOTE MGMT and then the SSH tab to change your ZyWALL’s Secure Shell settings.
Page 440: Secure Telnet Using Ssh Examples
27.9 Secure Telnet Using SSH Examples This section shows two examples using a command interface and a graphical interface SSH client program to remotely access the ZyWALL. The configuration and connection steps are similar for most SSH client programs. Refer to your SSH client program user’s guide. 27.9.1 Example 1: Microsoft Windows This section describes how to access the ZyWALL using the Secure Shell Client program.
Page 441: Secure Ftp Using Ssh Example
ZyWALL 5/35/70 Series User’s Guide Figure 220 SSH Example 2: Test $ telnet 192.168.1.1 22 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5-1.0.0 2 Enter “ssh –1 192.168.1.1”. This command forces your computer to connect to the ZyWALL using SSH version 1. If this is the first time you are connecting to the ZyWALL using SSH, a message displays prompting you to save the host information of the ZyWALL.
Page 442: Configuring Telnet
Figure 222 Secure FTP: Firmware Upload Example $ sftp -1 192.168.1.1 Connecting to 192.168.1.1... The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established. RSA1 key fingerprint is 21:6c:07:25:7e:f4:75:80:ec:af:bd:d4:3d:80:53:d1. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.1' (RSA1) to the list of known hosts.
Page 443: Figure 224 Telnet
ZyWALL 5/35/70 Series User’s Guide Figure 224 Telnet The following table describes the labels in this screen. Table 155 Telnet LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Server Access Select the interface(s) through which a computer may access the ZyWALL using this service.
Page 444: Figure 225 Ftp
Figure 225 FTP The following table describes the labels in this screen. Table 156 FTP LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Server Access Select the interface(s) through which a computer may access the ZyWALL using this service.
Page 445: Figure 226 Snmp Management Model
ZyWALL 5/35/70 Series User’s Guide Figure 226 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyWALL). An agent translates the local management information from the managed device into a form compatible with SNMP.
Page 446: Supported Mibs
27.14.1 Supported MIBs The ZyWALL supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of the MIBs is to let administrators collect statistical data and monitor status and performance. 27.14.2 SNMP Traps The ZyWALL will send traps to the SNMP manager when any one of the following events occurs: Table 157 SNMP Traps TRAP #...
Page 447 ZyWALL 5/35/70 Series User’s Guide Figure 227 SNMP The following table describes the labels in this screen. Table 158 SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station.
Page 448: Figure 228 Dns
27.15 DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to Chapter 7 on page 126 Click ADVANCED, REMOTE MGMT and then the DNS tab to change your ZyWALL’s DNS settings.
Page 449: Configuring Cnm
ZyWALL 5/35/70 Series User’s Guide If you allow your ZyWALL to be managed by the Vantage CNM server, then you should not do any configurations directly to the ZyWALL (using either the web configurator, SMT menus or commands) without notifying the Vantage CNM administrator. 27.17 Configuring CNM Vantage CNM is disabled on the device by default.
Page 450 Table 160 CNM (continued) LABEL Last Registration Time This field displays the last date (year-month-date) and time (hours-minutes- Refresh Vantage CNM Setup Enable Vantage CNM Server Address Encryption Algorithm Encryption Key Apply Reset Chapter 27 Remote Management DESCRIPTION seconds) that the ZyWALL registered with the Vantage CNM server. It displays all zeroes if it has not yet registered with the Vantage CNM server.
Page 451 ZyWALL 5/35/70 Series User’s Guide Chapter 27 Remote Management...
Page 452: Chapter 28 Upnp
This chapter introduces the Universal Plug and Play feature. This chapter is only applicable when the ZyWALL is in router mode. 28.1 Universal Plug and Play Overview Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices.
Page 453: Upnp And Zyxel
ZyWALL 5/35/70 Series User’s Guide All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. 28.1.4 UPnP and ZyXEL ZyXEL has achieved UPnP certification from the Universal Plug and Play Forum Creates UPnP™...
Page 454: Figure 231 Upnp Ports
Table 161 UPnP LABEL Allow users to make configuration changes through UPnP Allow UPnP to pass through Firewall Outgoing WAN Interface Apply Reset 28.3 Displaying UPnP Port Mapping Click UPnP and then Ports to display the UPnP Ports screen. Use this screen to view the NAT port mapping rules that UPnP creates on the ZyWALL.
Page 455: Installing Upnp In Windows Example
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 162 UPnP Ports LABEL DESCRIPTION Reserve UPnP Select this check box to have the ZyWALL retain UPnP created NAT rules even NAT rules in flash after restarting.
Page 456: Installing Upnp In Windows Me
28.4.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windows Me. 1 Click Start, Settings and Control Panel. Double-click Add/Remove Programs. 2 Click on the Windows Setup tab and select Communication in the Components selection box. Click Details.
Page 457: Installing Upnp In Windows Xp
ZyWALL 5/35/70 Series User’s Guide 28.4.2 Installing UPnP in Windows XP Follow the steps below to install UPnP in Windows XP. 1 Click Start, Settings and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components ….
Page 458: Auto-Discover Your Upnp-Enabled Network Device
28.5.1 Auto-discover Your UPnP-enabled Network Device 1 Click Start and Control Panel. Double- click Network Connections. An icon displays under Internet Gateway. 2 Right-click the icon and select Properties. 3 In the Internet Connection Properties window, click Settings to see the port mappings that were automatically created.
Page 459: Web Configurator Easy Access
ZyWALL 5/35/70 Series User’s Guide Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 4 Select the Show icon in notification area when connected check box and click OK. An icon displays in the system tray.
Page 460 Follow the steps below to access the web configurator. 1 Click Start and then Control Panel. 2 Double-click Network Connections. 3 Select My Network Places under Other Places. 4 An icon with the description for each UPnP-enabled device displays under Local Network.
Page 461 ZyWALL 5/35/70 Series User’s Guide 6 Right-click the icon for your ZyXEL device and select Properties. A properties window displays with basic information about the ZyXEL device. Chapter 28 UPnP...
Page 462: Chapter 29 Alg Screen
This chapter covers how to use the ZyWALL’s ALG feature to allow certain applications to pass through the ZyWALL. 29.1 ALG Introduction The ZyWALL can function as an Application Layer Gateway (ALG) to allow certain NAT un- friendly applications (such as SIP) to operate properly through the ZyWALL. Some applications cannot operate through NAT (are NAT un-friendly) because they embed IP addresses and port numbers in their packets’...
Page 463: Ftp
ZyWALL 5/35/70 Series User’s Guide If the primary WAN connection fails, the client needs to re-initialize the connection through the secondary WAN port to have the connection go through the secondary WAN port. When the ZyWALL uses both of the WAN ports at the same time, you can configure routing policies to specify the WAN port that the connection’s traffic is to use.
Page 464: Figure 232 H.323 Alg Example
Figure 232 H.323 ALG Example • With multiple WAN IP addresses on the ZyWALL, you can configure different firewall and port forwarding rules to allow incoming calls from each WAN IP address to go to a specific IP address on the LAN (or DMZ). Use policy routing to have the H.323 calls from each of those LAN or DMZ IP addresses go out through the same WAN IP address that calls come in on.
Page 465: Sip
ZyWALL 5/35/70 Series User’s Guide Figure 234 H.323 Calls from the • The H.323 ALG operates on TCP packets with a port 1720 destination. • The ZyWALL allows H.323 audio connections. • The ZyWALL can also apply bandwidth management to traffic that goes through the H.323 ALG.
Page 466: Sip Signaling Session Timeout
The following example shows SIP signaling and audio sessions between SIP clients A and B and the SIP server (1). Figure 235 SIP ALG Example Signaling session over UDP port 5060 29.5.3 SIP Signaling Session Timeout Most SIP clients have an “expire” mechanism indicating the lifetime of signaling sessions. The SIP user agent sends registration packets to the SIP server periodically and keeps the session alive in the ZyWALL.
Page 467: Figure 236 Alg
ZyWALL 5/35/70 Series User’s Guide Figure 236 ALG The following table describes the labels in this screen. Table 163 ALG LABEL DESCRIPTION Enable FTP Select this check box to allow FTP sessions to pass through the ZyWALL. FTP (File Transfer Program) is a program that enables fast transfer of files, including large files that may not be possible by e-mail.
Page 468: Chapter 30 Logs Screens
This chapter contains information about configuring general log settings and viewing the ZyWALL’s logs. Refer to 30.1 Configuring View Log The web configurator allows you to look at all of the ZyWALL’s logs in one location. Click LOGS to open the View Log screen. Use the View Log screen to see the logs for the categories that you selected in the Log Settings screen (see Options include logs about system maintenance, system errors, access control, allowed or blocked web sites, blocked web features (such as ActiveX controls, java and cookies), attacks...
Page 469: Log Description Example
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 164 View Log LABEL DESCRIPTION Display The categories that you select in the Log Settings page (see 471) display in the drop-down list box. Select a category of logs to view; select All Logs to view logs from all of the log categories that you selected in the Log Settings page.
Page 470: Certificate Not Trusted Log Note
Table 165 Example Log Description LABEL DESCRIPTION notes The ZyWALL blocked the packet. message The ZyWALL blocked the packet in accordance with the firewall’s default policy of blocking sessions that are initiated from the WAN. “UDP” means that this was a User Datagram Protocol packet.
Page 471: Figure 239 Myzyxel.com: Certificate Download
ZyWALL 5/35/70 Series User’s Guide Figure 239 myZyXEL.com: Certificate Download 30.3 Configuring Log Settings To change your ZyWALL’s log settings, click LOGS, then the Log Settings tab. The screen appears as shown. Use the Log Settings screen to configure to where the ZyWALL is to send logs; the schedule for when the ZyWALL is to send the logs and which logs and/or immediate alerts the ZyWALL is to send.
Page 472: Figure 240 Log Settings
ZyWALL 5/35/70 Series User’s Guide Figure 240 Log Settings Chapter 30 Logs Screens...
Page 473: Table 166 Log Settings
ZyWALL 5/35/70 Series User’s Guide The following table describes the labels in this screen. Table 166 Log Settings LABEL E-mail Log Settings Mail Server Mail Subject Mail Sender Send Log To Send Alerts To Log Schedule Day for Sending Log Time for Sending Log SMTP Authentication User Name...
Page 474: Configuring Reports
Table 166 Log Settings (continued) LABEL Send Immediate Alert Select the categories of alerts for which you want the ZyWALL to instantly e- Log Consolidation Active Log Consolidation Period Apply Reset 30.4 Configuring Reports The Reports page displays which computers on the LAN send and receive the most traffic, what kinds of traffic are used the most and which web sites are visited the most often.
Page 475: Figure 241 Reports
ZyWALL 5/35/70 Series User’s Guide Figure 241 Reports Note: Enabling the ZyWALL’s reporting function decreases the overall throughput by about 1 Mbps. The following table describes the labels in this screen. Table 167 Reports LABEL DESCRIPTION Collect Statistics Select the check box and click Apply to have the ZyWALL record report data. Send Raw Select the check box and click Apply to have the ZyWALL send unprocessed traffic Traffic Statistics...
Page 476: Viewing Web Site Hits
30.4.1 Viewing Web Site Hits In the Reports screen, select Web Site Hits from the Report Type drop-down list box to have the ZyWALL record and display which web sites have been visited the most often and how many times they have been visited. Figure 242 Web Site Hits Report Example The following table describes the label in this screen.
Page 477: Figure 243 Protocol/Port Report Example
ZyWALL 5/35/70 Series User’s Guide Figure 243 Protocol/Port Report Example The following table describes the labels in this screen. Table 169 Protocol/ Port Report LABEL DESCRIPTION Protocol/Port This column lists the protocols or service ports for which the most traffic has gone through the ZyWALL.
Page 478: Viewing Host Ip Address
30.4.3 Viewing Host IP Address In the Reports screen, select Host IP Address from the Report Type drop-down list box to have the ZyWALL record and display the LAN, DMZ or WLAN IP addresses that the most traffic has been sent to and/or from and how much traffic has been sent to and/or from those IP addresses.
Page 479: Reports Specifications
ZyWALL 5/35/70 Series User’s Guide 30.4.4 Reports Specifications The following table lists detailed specifications on the reports feature. Table 171 Report Specifications LABEL DESCRIPTION Number of web sites/protocols or ports/IP addresses listed: Hit count limit: Up to 2 billion. Bytes count Up to 2 limit: over at 0 if it passes 2...
Page 480: Chapter 31 Maintenance
This chapter displays information on the maintenance screens. 31.1 Maintenance Overview The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your ZyWALL. 31.2 General Setup 31.2.1 General Setup and System Name General Setup contains administrative and system-related information. System Name is for identification purposes.
Page 481: Figure 245 General Setup
ZyWALL 5/35/70 Series User’s Guide Figure 245 General Setup The following table describes the labels in this screen. Table 172 General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name”...
Page 482: Figure 246 Password Setup
Figure 246 Password Setup The following table describes the labels in this screen. Table 173 Password Setup LABEL DESCRIPTION Old Password Type the default password or the existing password you use to access the system in this field. New Password Type your new system password (up to 30 characters).
Page 483: Figure 247 Time And Date
ZyWALL 5/35/70 Series User’s Guide Figure 247 Time and Date The following table describes the labels in this screen. Table 174 Time and Date LABEL DESCRIPTION Current Time and Date Current Time This field displays the ZyWALL’s present time. Current Date This field displays the ZyWALL’s present date.
Page 484 Table 174 Time and Date (continued) LABEL DESCRIPTION Get from Time Select this radio button to have the ZyWALL get the time and date from the time Server server you specified below. Time Protocol Select the time service protocol that your time server uses. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works.
Page 485: Pre-Defined Ntp Time Servers List
ZyWALL 5/35/70 Series User’s Guide 31.5 Pre-defined NTP Time Servers List When you turn on the ZyWALL for the first time, the date and time start at 2000-01-01 00:00:00. The ZyWALL then attempts to synchronize with one of the following pre-defined list of NTP time servers.
Page 486: Figure 248 Synchronization In Process
ZyWALL 5/35/70 Series User’s Guide When the System Time and Date Synchronization in Process screen appears, wait up to one minute. Figure 248 Synchronization in Process Click the Return button to go back to the Time and Date screen after the time and date is updated successfully.
Page 487: Introduction To Transparent Bridging
ZyWALL 5/35/70 Series User’s Guide 31.6 Introduction To Transparent Bridging A transparent bridge is invisible to the operation of a network in that it does not modify the frames it forwards. The bridge checks the source address of incoming frames on the port and learns MAC addresses to associate with that port.
Page 488: Figure 251 Device Mode (Router Mode)
3 As a transparent bridge does not modify the frames it forwards, it is effectively “stealth” as it is invisible to attackers. Bridging devices are most useful in complex environments that require a rapid or new firewall deployment. A transparent, bridging firewall can also be good for companies with several branch offices since the setups at these offices are often the same and it's likely that one design can be used for many of the networks.
Page 489: Figure 252 Device Mode (Bridge Mode)
ZyWALL 5/35/70 Series User’s Guide Table 177 Device Mode (Router Mode) (continued) LABEL DESCRIPTION Bridge Select this radio button and configure the following fields, then click Apply to set the ZyWALL to bridge mode. IP Address Enter the IP address of your ZyWALL in dotted decimal notation. IP Subnet Mask Enter the IP subnet mask of the ZyWALL.
Page 490 Table 178 Device Mode (Bridge Mode) (continued) LABEL DESCRIPTION Device Mode Setup Router Select this radio button and click Apply to set the ZyWALL to router mode. LAN Interface IP Enter the IP address of your ZyWALL’ s LAN port in dotted decimal notation. Address 192.168.1.1 is the factory default.
Page 491: Figure 253 Firmware Upload
ZyWALL 5/35/70 Series User’s Guide Figure 253 Firmware Upload The following table describes the labels in this screen. Table 179 Firmware Upload LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse ... to find it. Browse...
Page 492: Figure 255 Network Temporarily Disconnected
Figure 255 Network Temporarily Disconnected After two minutes, log in again and check your new firmware version in the HOME screen. If the upload was not successful, the following screen will appear. Click Return to go back to the F/W Upload screen. Figure 256 Firmware Upload Error 31.11 Backup and Restore Section 47.5 on page 617...
Page 493: Backup Configuration
ZyWALL 5/35/70 Series User’s Guide Figure 257 Backup and Restore 31.11.1 Backup Configuration Backup Configuration allows you to back up (save) the ZyWALL’s current configuration to a file on your computer. Once your ZyWALL is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes.
Page 494: Figure 258 Configuration Upload Successful
ZyWALL 5/35/70 Series User’s Guide Note: Do not turn off the ZyWALL while configuration file upload is in progress. After you see a “restore configuration successful” screen, you must then wait one minute before logging into the ZyWALL again. Figure 258 Configuration Upload Successful The ZyWALL automatically restarts in this time causing a temporary network disconnect.
Page 495: Back To Factory Defaults
ZyWALL 5/35/70 Series User’s Guide 31.11.3 Back to Factory Defaults Pressing the Reset button in this section clears all user-entered configuration information and returns the ZyWALL to its factory defaults as shown on the screen. The following warning screen will appear. Figure 261 Reset Warning Message You can also press the RESET button on the rear panel to reset the factory defaults of your ZyWALL.
Page 496: Chapter 32 Introducing The Smt
This chapter explains how to access the System Management Terminal and gives an overview of its menus. 32.1 Introduction to the SMT The ZyWALL’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection. This chapter shows you how to access the SMT (System Management Terminal) menus via console port, how to navigate the SMT and how to configure SMT menus.
Page 497: Entering The Password
ZyWALL 5/35/70 Series User’s Guide Figure 263 Initial Screen Copyright (c) 1994 - 2004 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:A0:C5:01:23:45 initialize ch =1, ethernet address: 00:A0:C5:01:23:46 initialize ch =2, ethernet address: 00:A0:C5:01:23:47 initialize ch =3, ethernet address: 00:A0:C5:01:23:48 initialize ch =4, ethernet address: 00:00:00:00:00:00 AUX port init .
Page 498: Main Menu
Table 181 Main Menu Commands OPERATION KEYSTROKES Move to a Press [SPACE “hidden” BAR] to change No menu to Yes then press [ENTER]. Move the [ENTER] or [UP]/ cursor [DOWN] arrow keys Entering Fill in, or press information [SPACE BAR], then press [ENTER] to select from choices.
Page 499: Figure 265 Main Menu (Router Mode)
ZyWALL 5/35/70 Series User’s Guide Figure 265 Main Menu (Router Mode) Copyright (c) 1994 - 2005 ZyXEL Communications Corp. Getting Started 1. General Setup 2. WAN Setup 3. LAN Setup 4. Internet Access Setup 5. DMZ Setup 6. Route Setup 7.
Page 500: Smt Menus Overview
Table 182 Main Menu Summary NO. MENU TITLE LAN Setup Internet Access Setup DMZ Setup Route Setup Wireless Setup Remote Node Setup Static Routing Setup NAT Setup Filter and Firewall Setup SNMP Configuration System Password System Maintenance IP Routing Policy Setup This menu is not available on the ZyWALL 5. Schedule Setup Exit 32.3.2 SMT Menus Overview...
Page 501 ZyWALL 5/35/70 Series User’s Guide Table 183 SMT Menus Overview (continued) MENUS SUB MENUS 6 Route Setup (for the 6.1 Route Assessment ZyWALL 35 and the 6.2 Traffic Redirect ZyWALL 70) 6.3 Route Failover 7 Wireless Setup 7.1 Wireless Setup 7.2 TCP/IP and DHCP Ethernet Setup 11 Remote Node Setup...
Page 502: Changing The System Password
Table 183 SMT Menus Overview (continued) MENUS SUB MENUS 24 System Maintenance 24.1 System Status 24.2 System Information and Console Port Speed 24.3 Log and Trace 24.4 Diagnostic 24.5 Backup Configuration 24.6 Restore Configuration 24.7 Upload Firmware 24.8 Command Interpreter Mode 24.9 Call Control 24.10 Time and Date Setting...
Page 503: Resetting The Zywall
ZyWALL 5/35/70 Series User’s Guide Figure 267 Menu 23: System Password Old Password= ? New Password= ? Retype to confirm= ? 2 Type your existing password and press [ENTER]. 3 Type your new system password and press [ENTER]. 4 Re-type your new system password for confirmation and press [ENTER]. Note that as you type a password, the screen displays an “x”...
Page 504: Smt Menu 1 - General Setup
SMT Menu 1 - General Setup Menu 1 - General Setup contains administrative and system-related information. 33.1 Introduction to General Setup Menu 1 - General Setup contains administrative and system-related information. 33.2 Configuring General Setup 1 Enter 1 in the main menu to open Menu 1 - General Setup. 2 The Menu 1 - General Setup screen appears, as shown next.
Page 505: Figure 269 Menu 1: General Setup (Bridge Mode)
ZyWALL 5/35/70 Series User’s Guide Table 184 Menu 1: General Setup (Router Mode) (continued) FIELD DESCRIPTION Edit Dynamic Press [SPACE BAR] and then [ENTER] to select Yes or No (default). Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next. When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…”...
Page 506: Configuring Dynamic Dns
33.2.1 Configuring Dynamic DNS To configure Dynamic DNS, set the ZyWALL to router mode in menu 1 or in the MAINTENANCE Device Mode screen and go to Menu 1 - General Setup and press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1 - Configure Dynamic DNS (shown next).
Page 507: Figure 271 Menu 1.1.1: Ddns Host Summary
ZyWALL 5/35/70 Series User’s Guide Figure 271 Menu 1.1.1: --- - ------------------------------------------------------- Hostname=ZyWALL, Type=Dynamic,WC=Yes,Offline=No,Policy=DDNS Server Detect, WAN1, HA=Yes _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ _______________________________________________________ The following table describes the fields in this screen. Table 187 Menu 1.1.1: DDNS Host Summary FIELD DESCRIPTION This is the DDNS host index number.
Page 508: Figure 272 Menu 1.1.1: Ddns Edit Host
Figure 272 Menu 1.1.1: Hostname= ZyWALL DDNS Type= DynamicDNS Enable Wildcard Option= Yes Enable Off Line Option= N/A Bind WAN= 1 HA= Yes IP Address Update Policy: The following table describes the fields in this screen. Table 188 Menu 1.1.1: DDNS Edit Host FIELD DESCRIPTION Host Name...
Page 509 ZyWALL 5/35/70 Series User’s Guide Table 188 Menu 1.1.1: DDNS Edit Host (continued) FIELD DESCRIPTION IP Address You can select Yes in either the Let DDNS Server Auto Detect field (recommended) Update Policy: or the Use User-Defined field, but not both. With the Let DDNS Server Auto Detect and Use User-Defined fields both set to No, the DDNS server automatically updates the IP address of the host name(s) with the ZyWALL’s WAN IP address.
Page 510: Wan And Dial Backup Setup
WAN and Dial Backup Setup This chapter describes how to configure the WAN using menu 2 and dial-backup using menus 2.1 and 11.1. 34.1 Introduction to WAN and Dial Backup Setup This chapter explains how to configure settings for your WAN port and how to configure the ZyWALL for a dial backup connection.
Page 511: Dial Backup
ZyWALL 5/35/70 Series User’s Guide The following table describes the fields in this screen. Table 189 MAC Address Cloning in WAN Setup FIELD DESCRIPTION (WAN 1/2) MAC Address Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods to assign a MAC Address.
Page 512: Advanced Wan Setup
Figure 274 Menu 2: Dial Backup Setup WAN 1 MAC Address: WAN 2 MAC Address: Dial-Backup: Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu. Table 190 Menu 2: Dial Backup Setup FIELD DESCRIPTION Dial-Backup:...
Page 513: Figure 275 Menu 2.1: Advanced Wan Setup
ZyWALL 5/35/70 Series User’s Guide To edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in Menu 2 - WAN Setup, press the [SPACE BAR] to select Yes and then press [ENTER].
Page 514: Remote Node Profile (Backup Isp)
Table 192 Advanced WAN Port Setup: Call Control Parameters FIELD DESCRIPTION Call Control Dial Timeout (sec) Enter a number of seconds for the ZyWALL to keep trying to set up an outgoing call before timing out (stopping). The ZyWALL times out and stops if it cannot set up an outgoing call within the timeout value.
Page 515: Figure 276 Menu 11.3: Remote Node Profile (Backup Isp)
ZyWALL 5/35/70 Series User’s Guide Figure 276 Menu 11.3: Remote Node Profile (Backup ISP) Rem Node Name= Active= No Outgoing: My Login= ChangeMe My Password= ******** Retype to Confirm= ******** Authen= CHAP/PAP Pri Phone #= 0 Sec Phone #= The following table describes the fields in this menu. Table 193 Menu 11.3: Remote Node Profile (Backup ISP) FIELD DESCRIPTION...
Page 516: Editing Ppp Options
Table 193 Menu 11.3: Remote Node Profile (Backup ISP) (continued) FIELD DESCRIPTION Edit IP This field leads to a “hidden” menu. Press [SPACE BAR] to select Yes and press [ENTER] to go to Menu 11.3.2 - Remote Node Network Layer Options. See 34.8 on page 517 Edit Script Press [SPACE BAR] to select Yes and press [ENTER] to edit the AT script for the dial...
Page 517: Editing Tcp/Ip Options
ZyWALL 5/35/70 Series User’s Guide Figure 277 Menu 11.3.1: Remote Node PPP Options This table describes the Remote Node PPP Options Menu, and contains instructions on how to configure the PPP options fields. Table 194 Menu 11.3.1: Remote Node PPP Options FIELD DESCRIPTION Encapsulation...
Page 518: Figure 278 Menu 11.3.2: Remote Node Network Layer Options
Figure 278 Menu 11.3.2: Remote Node Network Layer Options Menu 11.3.2 - Remote Node Network Layer Options IP Address Assignment= Static Rem IP Addr= 0.0.0.0 Rem Subnet Mask= 0.0.0.0 My WAN Addr= 0.0.0.0 Network Address Translation= SUA Only NAT Lookup Set= 255 Metric= 15 Private= No RIP Direction= None...
Page 519: Editing Login Script
ZyWALL 5/35/70 Series User’s Guide Table 195 Menu 11.3.2: Remote Node Network Layer Options FIELD DESCRIPTION NAT Lookup If you select SUA Only in the Network Address Translation field, it displays 255 and indicates the SMT will use the pre-configured Set 255 (read only) in menu 15.1. If you select Full Feature or None in the Network Address Translation field, it displays 1, 2 or 3 and indicates the SMT will use the pre-configured Set 1 in menu 15.1 for the first WAN port, Set 2 in menu 15.1 for the second WAN port and Set 3 for the...
Page 520: Figure 279 Menu 11.3.3: Remote Node Script
You can use two variables, $USERNAME and $PASSWORD (all UPPER case), to represent the actual user name and password in the script, so they will not show in the clear. They are replaced with the outgoing login name and password in the remote node when the ZyWALL sees them in a ‘Send’...
Page 521: Remote Node Filter
ZyWALL 5/35/70 Series User’s Guide The following table describes the fields in this menu. Table 196 Menu 11.3.3: Remote Node Script FIELD DESCRIPTION Active Press [SPACE BAR] and then [ENTER] to select either Yes to enable the AT strings or No to disable them.
Page 522: Chapter 35 Lan Setup
This chapter describes how to configure the LAN using Menu 3 - LAN Setup. 35.1 Introduction to LAN Setup This chapter describes how to configure the ZyWALL for LAN and wireless LAN connections. 35.2 Accessing the LAN Menus From the main menu, enter 3 to open Menu 3 - LAN Setup. Figure 281 Menu 3: LAN Setup 35.3 LAN Port Filter Setup This menu allows you to specify the filter sets that you wish to apply to the LAN traffic.
Page 523: Tcp/Ip And Dhcp Ethernet Setup Menu
ZyWALL 5/35/70 Series User’s Guide Figure 282 Menu 3.1: LAN Port Filter Setup Menu 3.1 - LAN Port Filter Setup Input Filter Sets: protocol filters= Output Filter Sets: protocol filters= Press ENTER to Confirm or ESC to Cancel: 35.4 TCP/IP and DHCP Ethernet Setup Menu From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and DHCP Ethernet setup.
Page 524: Figure 284 Menu 3.2: Tcp/Ip And Dhcp Ethernet Setup
Figure 284 Menu 3.2: TCP/IP and DHCP Ethernet Setup Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server Client IP Pool: Starting Address= 192.168.1.33 Size of Client IP Pool= 128 DHCP Server Address= N/A Follow the instructions in the next table on how to configure the DHCP fields. Table 197 Menu 3.2: DHCP Ethernet Setup Fields FIELD DESCRIPTION...
Page 525: Table 198 Menu 3.2: Lan Tcp/Ip Setup Fields
ZyWALL 5/35/70 Series User’s Guide Table 197 Menu 3.2: DHCP Ethernet Setup Fields FIELD DESCRIPTION First DNS Server The ZyWALL passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients. Second DNS Server Select From ISP if your ISP dynamically assigns DNS server information (and the ZyWALL's WAN IP address).
Page 526: Ip Alias Setup
35.4.1 IP Alias Setup IP alias allows you to partition a physical network into different logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via its single physical Ethernet interface with the ZyWALL itself as the gateway for each LAN network. You must use menu 3.2 to configure the first network.
Page 527 ZyWALL 5/35/70 Series User’s Guide Table 199 Menu 3.2.1: IP Alias Setup (continued) FIELD DESCRIPTION Outgoing Enter the filter set(s) you wish to apply to the outgoing traffic between this node and Protocol Filters the ZyWALL. When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
Page 528: Chapter 36 Internet Access
This chapter shows you how to configure your ZyWALL for Internet access. 36.1 Introduction to Internet Access Setup Use information from your ISP along with the instructions in this chapter to set up your ZyWALL to access the Internet. There are three different menu 4 screens depending on whether you chose Ethernet, PPTP or PPPoE Encapsulation.
Page 529: Table 200 Menu 4: Internet Access Setup (Ethernet)
ZyWALL 5/35/70 Series User’s Guide The following table describes the fields in this menu. Table 200 Menu 4: Internet Access Setup (Ethernet) FIELD DESCRIPTION ISP’s Name This is the descriptive name of your ISP for identification purposes. Encapsulation Press [SPACE BAR] and then press [ENTER] to choose Ethernet. The encapsulation method influences your choices for the IP Address field.
Page 530: Configuring The Pptp Client
36.3 Configuring the PPTP Client Note: The ZyWALL supports only one PPTP server connection at any given time. To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and the PPTP parameters for a PPTP connection. After configuring My Login and Password for PPP connection, press [SPACE BAR] and then [ENTER] in the Encapsulation field in Menu 4 -Internet Access Setup to choose PPTP as your encapsulation option.
Page 531: Basic Setup Complete
ZyWALL 5/35/70 Series User’s Guide Figure 288 Internet Access Setup (PPPoE) The following table contains instructions about the new fields when you choose PPPoE in the Encapsulation field in menu 4. Table 202 New Fields in Menu 4 (PPPoE) screen FIELD DESCRIPTION Encapsulation...
Page 532: Chapter 37 Dmz Setup
This chapter describes how to configure the ZyWALL’s DMZ using Menu 5 - DMZ Setup. 37.1 Configuring DMZ Setup From the main menu, enter 5 to open Menu 5 – DMZ Setup. Figure 289 Menu 5: DMZ Setup Menu 5 - DMZ Setup 1.
Page 533: Ip Address
ZyWALL 5/35/70 Series User’s Guide 37.3.1 IP Address From the main menu, enter 5 to open Menu 5 - DMZ Setup to configure TCP/IP (RFC 1155). Figure 291 Menu 5: DMZ Setup Menu 5 - DMZ Setup 1. DMZ Port Filter Setup 2.
Page 534: Ip Alias Setup
37.3.2 IP Alias Setup You must use menu 5.2 to configure the first network. Move the cursor to the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second and third network. Pressing [ENTER] opens Menu 5.2.1 - IP Alias Setup, as shown next. Figure 293 Menu 5.2.1: IP Alias Setup Menu 5.2.1 - IP Alias Setup IP Alias 1= No...
Page 535 ZyWALL 5/35/70 Series User’s Guide Chapter 37 DMZ Setup...
Page 536: Chapter 38 Route Setup
This chapter describes how to configure the ZyWALL's traffic redirect. This chapter applies to the ZyWALL 35 and ZyWALL 70. 38.1 Configuring Route Setup From the main menu, enter 6 to open Menu 6 - Route Setup. Figure 294 Menu 6: Route Setup Menu 6 - Route Setup 1.
Page 537: Traffic Redirect
ZyWALL 5/35/70 Series User’s Guide The following table describes the fields in this menu. Table 203 Menu 6.1: Route Assessment FIELD DESCRIPTION Probing WAN 1/2 Press [SPACE BAR] and then press [ENTER] to choose Yes to test your Check Point ZyWALL's WAN accessibility.
Page 538: Route Failover
Table 204 Menu 6.2: Traffic Redirect FIELD Metric When you have completed this menu, press [ENTER] at the prompt "Press ENTER to Confirm…" to save your configuration, or press [ESC] at any time to cancel. 38.4 Route Failover This menu allows you to configure how the ZyWALL uses the route assessment ping check function.
Page 539 ZyWALL 5/35/70 Series User’s Guide Chapter 38 Route Setup...
Page 540: Chapter 39 Wireless Setup
Use menu 7 to set up your ZyWALL as the wireless access point. 39.1 Wireless LAN Setup Note: If you are configuring the ZyWALL from a computer connected to the wireless LAN and you change the ZyWALL’s ESSID or WEP settings, you will lose your wireless connection when you press [ENTER] to confirm.
Page 541: Table 206 Menu 7.1: Wireless Setup
ZyWALL 5/35/70 Series User’s Guide Follow the instructions in the next table on how to configure the wireless LAN parameters. Table 206 Menu 7.1: Wireless Setup FIELD DESCRIPTION Enable Press [SPACE BAR] to select Yes to turn on the wireless LAN. The wireless LAN is off Wireless LAN by default.
Page 542: Mac Address Filter Setup
39.1.1 MAC Address Filter Setup Your ZyWALL checks the MAC address of the wireless station device against a list of allowed or denied MAC addresses. However, intruders could fake allowed MAC addresses so MAC- based authentication is less secure than EAP authentication. Follow the steps below to create the MAC address table on your ZyWALL.
Page 543: Tcp/Ip Setup
ZyWALL 5/35/70 Series User’s Guide Table 207 Menu 7.1.1: WLAN MAC Address Filter FIELD DESCRIPTION Address 1..12 Enter the MAC addresses (in XX:XX:XX:XX:XX:XX format) of the client computers that are allowed or denied access to the ZyWALL in these address fields. When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
Page 544: Ip Alias Setup
Figure 301 Menu 7.2: TCP/IP and DHCP Ethernet Setup DHCP= None Client IP Pool: Starting Address= N/A Size of Client IP Pool= N/A DHCP Server Address= N/A The DHCP and TCP/IP setup fields are the same as the ones in Menu 3.2 - TCP/IP and DHCP Ethernet Setup.
Page 545: Figure 302 Menu 7.2.1: Ip Alias Setup
ZyWALL 5/35/70 Series User’s Guide Figure 302 Menu 7.2.1: IP Alias Setup Enter here to CONFIRM or ESC to CANCEL: Refer to Table 199 on page 526 Menu 7.2.1 - IP Alias Setup IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A...
Page 546: Chapter 40 Remote Node Setup
This chapter shows you how to configure a remote node. 40.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection. Note that when you use menu 4 to set up Internet access, you are actually configuring a remote node.
Page 547: Remote Node Profile Setup
ZyWALL 5/35/70 Series User’s Guide Figure 303 Menu 11: Remote Node Setup Menu 11 - Remote Node Setup 1. WAN_1 (ISP, SUA) 2. WAN_2 (ISP, NAT) 3. -Dial (BACKUP_ISP, SUA) Enter Node # to Edit: 40.3 Remote Node Profile Setup The following explains how to configure the remote node profile menu.
Page 548: Table 208 Menu 11.1: Remote Node Profile For Ethernet Encapsulation
The following table describes the fields in this menu. Table 208 Menu 11.1: Remote Node Profile for Ethernet Encapsulation FIELD DESCRIPTION Rem Node Name Enter a descriptive name for the remote node. This field can be up to eight characters. Active Press [SPACE BAR] and then [ENTER] to select Yes (activate remote node) or No (deactivate remote node).
Page 549: Pppoe Encapsulation
ZyWALL 5/35/70 Series User’s Guide 40.3.2 PPPoE Encapsulation The ZyWALL supports PPPoE (Point-to-Point Protocol over Ethernet). You can only use PPPoE encapsulation when you’re using the ZyWALL with a DSL modem as the WAN device. If you change the Encapsulation to PPPoE, then you will see the next screen. Please Appendix F on page 698 Figure 305 Menu 11.1: Remote Node Profile for PPPoE Encapsulation Rem Node Name= ChangeMe...
Page 550: Metric
40.3.2.3 Metric Section 7.5 on page 130 Table 209 Fields in Menu 11.1 (PPPoE Encapsulation Specific) FIELD DESCRIPTION Service Name If you are using PPPoE encapsulation, then type the name of your PPPoE service here. Only valid with PPPoE encapsulation. Authen This field sets the authentication protocol used for outgoing calls.
Page 551: Edit Ip
ZyWALL 5/35/70 Series User’s Guide Figure 306 Menu 11.1: Remote Node Profile for PPTP Encapsulation Rem Node Name= ChangeMe Active= Yes Encapsulation= PPTP Service Type= Standard Outgoing: My Login= My Password= ******** Retype to Confirm= ******** Authen= CHAP/PAP PPTP: My IP Addr= 10.0.0.140 My IP Mask= 255.255.255.0 Server IP Addr= 10.0.0.138 Connection ID/Name=...
Page 552: Figure 307 Menu 11.1.2: Remote Node Network Layer Options For Ethernet Encapsulation
Figure 307 Menu 11.1.2: Remote Node Network Layer Options for Ethernet Encapsulation Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic Rem IP Addr= N/A Rem Subnet Mask= N/A My WAN Addr= N/A Network Address Translation= SUA Only NAT Lookup Set= 255 Metric= 1 Private= No...
Page 553: Remote Node Filter
ZyWALL 5/35/70 Series User’s Guide Table 211 Remote Node Network Layer Options Menu Fields (continued) FIELD DESCRIPTION NAT Lookup If you select SUA Only in the Network Address Translation field, it displays 255 and indicates the SMT will use the pre-configured Set 255 (read only) in menu 15.1. If you select Full Feature or None in the Network Address Translation field, it displays 1, 2 or 3 and indicates the SMT will use the pre-configured Set 1 in menu 15.1 for the first WAN port, Set 2 in menu 15.1 for the second WAN port and Set 3 for the...
Page 554: Traffic Redirect
Figure 308 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters= Output Filter Sets: protocol filters= Enter here to CONFIRM or ESC to CANCEL: Figure 309 Menu 11.1.4: Remote Node Filter (PPPoE or PPTP Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters=...
Page 555: Figure 310 Menu 11.1.5: Traffic Redirect Setup
ZyWALL 5/35/70 Series User’s Guide Figure 310 Menu 11.1.5: Traffic Redirect Menu 11.1.5 - Traffic Redirect Setup Active= Yes Configuration: Backup Gateway IP Address= 0.0.0.0 Metric= 14 Check WAN IP Address= 0.0.0.0 Fail Tolerance= 10 Period(sec)= 300 Timeout(sec)= 8 Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu.
Page 556: Chapter 41 Ip Static Route Setup
This chapter shows you how to configure static routes with your ZyWALL. 41.1 IP Static Route Setup Enter 12 from the main menu. Select one of the IP static routes as shown next to configure IP static routes in menu 12.1. Note: The first two static route entries are for default WAN1 and WAN2 routes on a ZyWALL with multiple WAN ports;...
Page 557: Figure 312 Menu 12. 1: Edit Ip Static Route
ZyWALL 5/35/70 Series User’s Guide Figure 312 Menu 12. 1: Edit IP Static Route Menu 12.1 - Edit IP Static Route Route #: 3 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ? Metric= 2 Private= No Press ENTER to CONFIRM or ESC to CANCEL:...
Page 558: Network Address Translation (Nat)
Network Address Translation This chapter discusses how to configure NAT on the ZyWALL. 42.1 Using NAT Note: You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyWALL. 42.1.1 SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server.
Page 559: Figure 313 Menu 4: Applying Nat For Internet Access
ZyWALL 5/35/70 Series User’s Guide Figure 313 Menu 4: Applying NAT for Internet Access Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A Relogin Every (min)= IP Address Assignment= Dynamic IP Address= N/A...
Page 560: Nat Setup
The following table describes the fields in this menu. Table 214 Applying NAT in Menus 4 & 11.1.2 FIELD DESCRIPTION Network When you select this option the SMT will use Address Mapping Set 1 Address (menu 15.1 - see Translation can configure any of the mapping types described in 370.
Page 561: Address Mapping Sets
ZyWALL 5/35/70 Series User’s Guide 42.2.1 Address Mapping Sets Enter 1 to bring up Menu 15.1 - Address Mapping Sets. Figure 316 Menu 15.1: Address Mapping Sets Menu 15.1 - Address Mapping Sets Enter Menu Selection Number: 42.2.1.1 SUA Address Mapping Set Enter 255 to display the next screen (see also menu cannot be changed.
Page 562: User-Defined Address Mapping Sets
Note: Menu 15.1.255 is read-only. Table 215 SUA Address Mapping Rules FIELD DESCRIPTION Set Name This is the name of the set you selected in menu 15.1 or enter the name of a new set you want to create. This is the index or rule number. Local Start IP Local Start IP is the starting local IP address (ILA).
Page 563: Ordering Your Rules
ZyWALL 5/35/70 Series User’s Guide Figure 318 Menu 15.1.1: First Set Set Name= NAT_SET Local Start IP --------------- 0.0.0.0 Note: The Type, Local and Global Start/End IPs are configured in menu 15.1.1.1 (described later) and the values are displayed here. 42.2.1.3 Ordering Your Rules Ordering your rules is important because the ZyWALL applies the rules in the order that you specify.
Page 564: Figure 319 Menu 15.1.1.1: Editing/Configuring An Individual Rule In A Set
Note: You must press [ENTER] at the bottom of the screen to save the whole set. You must do this again if you make any changes to the set – including deleting a rule. No changes to the set take place until this action is taken. Selecting Edit in the Action field and then selecting a rule brings up the following menu, Menu 15.1.1.1 - Address Mapping Rule in which you can edit an individual rule and configure the Type, Local and Global Start/End IPs.
Page 565: Configuring A Server Behind Nat
ZyWALL 5/35/70 Series User’s Guide Table 217 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set FIELD DESCRIPTION Server This field is available only when you select Server in the Type field. Mapping Once you have finished configuring a rule in this menu, press [ENTER] at the message “Press ENTER to Confirm…”...
Page 566: Figure 321 Menu 15.2.1: Nat Server Sets
Figure 321 Menu 15.2.1: NAT Server Sets Rule ------------------------------------------------------ Select Command= None Press ENTER to Confirm or ESC to Cancel: 4 Select Edit Rule in the Select Command field; type the index number of the NAT server you want to configure in the Select Rule field and press [ENTER] to open Menu 15.2.1.2 - NAT Server Configuration (see the next figure).
Page 567: Figure 322 15.2.1.2: Nat Server Configuration
ZyWALL 5/35/70 Series User’s Guide Figure 322 15.2.1.2: NAT Server Configuration 15.2.1.2 - NAT Server Configuration ------------------------------------------------ Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this screen. Table 218 15.2.1.2: NAT Server Configuration FIELD DESCRIPTION On a ZyWALL with two WAN ports, you can configure port forwarding and trigger port...
Page 568: General Nat Examples
Figure 323 Menu 15.2.1: NAT Server Setup Rule ------------------------------------------------------ Select Command= None You assign the private network IP addresses. The NAT network appears as a single host on the Internet. A is the FTP/Telnet/SMTP server. Figure 324 Server Behind NAT Example 42.4 General NAT Examples The following are some examples of NAT configuration.
Page 569: Figure 325 Nat Example 1
ZyWALL 5/35/70 Series User’s Guide Figure 325 NAT Example 1 Figure 326 Menu 4: Internet Access & NAT Example Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A Relogin Every (min)= IP Address Assignment= Dynamic...
Page 570: Example 2: Internet Access With An Default Server
42.4.2 Example 2: Internet Access with an Default Server Figure 327 NAT Example 2 In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2.1 to specify the Default Server behind the NAT as shown in the next figure.
Page 571: Figure 329 Nat Example 3
ZyWALL 5/35/70 Series User’s Guide 1 Map the first IGA to the first inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses). 2 Map the second IGA to our second inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses).
Page 572: Figure 330 Example 3: Menu 11.1.2
Figure 330 Example 3: Menu 11.1.2 Menu 11.1.2 - Remote Node Network Layer Options Enter here to CONFIRM or ESC to CANCEL: The following figure shows how to configure the first rule. Figure 331 Example 3: Menu 15.1.1.1 Menu 15.1.1.1 Address Mapping Rule Press ENTER to Confirm or ESC to Cancel: Chapter 42 Network Address Translation (NAT) IP Address Assignment= Dynamic...
Page 573: Figure 332 Example 3: Final Menu 15.1.1
ZyWALL 5/35/70 Series User’s Guide Figure 332 Example 3: Final Menu 15.1.1 Set Name= Example3 Local Start IP --------------- 1. 192.168.1.10 192.168.1.11 3. 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: Now configure the IGA3 to map to our web server and mail server on the LAN. 1 Enter 15 from the main menu.
Page 574: Example 4: Nat Unfriendly Application Programs
42.4.4 Example 4: NAT Unfriendly Application Programs Some applications do not support NAT Mapping using TCP or UDP port address translation. In this case it is better to use Many-One-to-One mapping as port numbers do not change for Many-One-to-One (and One-to-One) NAT mapping types. The following figure illustrates this.
Page 575: Trigger Port Forwarding
ZyWALL 5/35/70 Series User’s Guide Figure 336 Example 4: Menu 15.1.1: Address Mapping Rules Set Name= Example4 Local Start IP --------------- 192.168.1.10 Action= Edit Press ENTER to Confirm or ESC to Cancel: 42.5 Trigger Port Forwarding Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side.
Page 576: Figure 337 Menu 15.3.1: Trigger Port Setup
Note: Only one LAN computer can use a trigger port (range) at a time. Enter 3 in menu 15 to display Menu 15.3 - Trigger Ports. For a ZyWALL with multiple WAN ports, enter 1 or 2 from menu 15.3 to go to Menu 15.3.1 or Menu 15.3.2 - Trigger Port Setup and configure trigger port rules for the first or second WAN port.
Page 577 ZyWALL 5/35/70 Series User’s Guide Chapter 42 Network Address Translation (NAT)
Page 578: Introducing The Zywall Firewall
Introducing the ZyWALL Firewall This chapter shows you how to get started with the ZyWALL firewall. 43.1 Using ZyWALL SMT Menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown next. Figure 338 Menu 21: Filter and Firewall Setup Menu 21 - Filter and Firewall Setup Enter Menu Selection Number:...
Page 579: Figure 339 Menu 21.2: Firewall Setup
ZyWALL 5/35/70 Series User’s Guide Figure 339 Menu 21.2: Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off. Refer to the User's Guide for details about the firewall default policies.
Page 580: Chapter 44 Filter Configuration
This chapter shows you how to create and apply filters. 44.1 Introduction to Filters Your ZyWALL uses filters to decide whether to allow passage of a data packet and/or to make a call. There are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and protocol filters, which are discussed later.
Page 581: The Filter Structure Of The Zywall
ZyWALL 5/35/70 Series User’s Guide 44.1.1 The Filter Structure of the ZyWALL A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descriptive name. The ZyWALL allows you to configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system.
Page 582: Figure 341 Filter Rule Process
ZyWALL 5/35/70 Series User’s Guide Figure 341 Filter Rule Process You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.
Page 583: Configuring A Filter Set
ZyWALL 5/35/70 Series User’s Guide 44.2 Configuring a Filter Set The ZyWALL includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below. 1 Enter 21 in the main menu to open menu 21. Figure 342 Menu 21: Filter and Firewall Setup Menu 21 - Filter and Firewall Setup Enter Menu Selection Number:...
Page 584: Configuring A Filter Rule
Table 220 Abbreviations Used in the Filter Rules Summary Menu FIELD DESCRIPTION Active: “Y” means the rule is active. “N” means the rule is inactive. Type The type of filter rule: “GEN” for Generic, “IP” for TCP/IP. Filter Rules These parameters are displayed here. More.
Page 585: Configuring A Tcp/Ip Filter Rule
ZyWALL 5/35/70 Series User’s Guide To speed up filtering, all rules in a filter set must be of the same class, i.e., protocol filters or generic filters. The class of a filter set is determined by the first rule that you create. When applying the filter sets to a port, separate menu fields are provided for protocol and device filter sets.
Page 586 Table 222 Menu 21.1.1.1: TCP/IP Filter Rule FIELD DESCRIPTION Destination IP Addr Enter the destination IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0. IP Mask Enter the IP mask to apply to the Destination: IP Addr. Port # Enter the destination port of the packets that you wish to filter.
Page 587: Configuring A Generic Filter Rule
ZyWALL 5/35/70 Series User’s Guide Figure 345 Executing an IP Filter 44.2.3 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. The purpose of generic rules is Chapter 44 Filter Configuration...
Page 588: Figure 346 Menu 21.1.1.1: Generic Filter Rule
to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly. For generic rules, the ZyWALL treats a packet as a byte stream as opposed to an IP or IPX packet. You specify the portion of the packet to check with the Offset (from 0) and the Length fields, both in bytes.
Page 589: Example Filter
ZyWALL 5/35/70 Series User’s Guide Table 223 Generic Filter Rule Menu Fields FIELD DESCRIPTION More If Yes, a matching packet is passed to the next filter rule before an action is taken; else the packet is disposed of according to the action fields. If More is Yes, then Action Matched and Action Not Matched will be No.
Page 590: Figure 348 Example Filter: Menu 21.1.3.1
Figure 348 Example Filter: Menu 21.1.3.1 Filter #: 3,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 Destination: IP Addr= 0.0.0.0 TCP Estab= No More= No Action Matched= Drop Action Not Matched= Forward Press Space Bar to Toggle. The port number for the telnet service (TCP protocol) is 23.
Page 591: Filter Types And Nat
ZyWALL 5/35/70 Series User’s Guide M = N means an action can be taken immediately. The action is to drop the packet (m = D) if the action is matched and to forward the packet immediately (n = F) if the action is not matched no matter whether there are more rules to be checked (there aren’t in this example).
Page 592: Applying A Filter
44.6 Applying a Filter This section shows you where to apply the filter(s) after you design it (them). The ZyWALL already has filters to prevent NetBIOS traffic from triggering calls, and block incoming telnet, FTP and HTTP connections. Note: If you do not activate the firewall, it is advisable to apply filters. 44.6.1 Applying LAN Filters LAN traffic filter sets may be useful to block certain packets, reduce traffic and prevent security breaches.
Page 593: Applying Remote Node Filters
ZyWALL 5/35/70 Series User’s Guide Figure 352 Filtering DMZ Traffic Input Filter Sets: protocol filters= Output Filter Sets: protocol filters= Press ENTER to Confirm or ESC to Cancel: 44.6.3 Applying Remote Node Filters Go to menu 11.1.4 (shown below – note that call filter sets are only present for PPPoE encapsulation) and enter the number(s) of the filter set(s) as appropriate.
Page 594: Chapter 45 Snmp Configuration
This chapter explains SNMP configuration menu 22. 45.1 SNMP Configuration To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The “community” for Get, Set and Trap fields is SNMP terminology for password. Figure 354 Menu 22: SNMP Configuration Menu 22 - SNMP Configuration Press ENTER to Confirm or ESC to Cancel:...
Page 595: Snmp Traps
ZyWALL 5/35/70 Series User’s Guide Table 224 SNMP Configuration Menu Fields (continued) FIELD DESCRIPTION Destination Type the IP address of the station to send your SNMP traps to. When you have completed this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel”...
Page 596: System Information & Diagnosis
System Information & Diagnosis This chapter covers SMT menus 24.1 to 24.4. 46.1 Introduction to System Status This chapter covers the diagnostic tools that help you to maintain your ZyWALL. These tools include updates on system status, port status and log and trace capabilities. Select menu 24 in the main menu to open Menu 24 - System Maintenance, as shown below.
Page 597: Figure 356 Menu 24.1: System Maintenance: Status
ZyWALL 5/35/70 Series User’s Guide 3 There are three commands in Menu 24.1 - System Maintenance - Status. Entering 1 drops the WAN connection, 9 resets the counters and [ESC] takes you back to the previous screen. Figure 356 Menu 24.1: System Maintenance: Status Menu 24.1 - System Maintenance - Status Port Status...
Page 598: System Information And Console Port Speed
Table 226 System Maintenance: Status Menu Fields (continued) FIELD DESCRIPTION Rx B/s This field shows the reception speed in Bytes per second on this port. Up Time This is the total amount of time the line has been up. Ethernet Address This is the Ethernet address of the port listed on the left.
Page 599: Console Port Speed
ZyWALL 5/35/70 Series User’s Guide Figure 358 Menu 24.2.1: System Maintenance: Information The following table describes the fields in this screen. Table 227 Fields in System Maintenance: Information FIELD Name Routing ZyNOS F/W Version Country Code Ethernet Address IP Address IP Mask DHCP When finished viewing, press [ESC] or [ENTER] to exit.
Page 600: Log And Trace
Figure 359 Menu 24.2.2: System Maintenance: Change Console Port Speed Menu 24.2.2 - System Maintenance - Change Console Port Speed Space Bar to Toggle. 46.4 Log and Trace There are two logging facilities in the ZyWALL. The first is the error logs and trace records that are stored locally.
Page 601: Syslog Logging
ZyWALL 5/35/70 Series User’s Guide Figure 361 Examples of Error and Information Messages 52 Thu Jul 1 05:54:53 2004 PP05 53 Thu Jul 1 05:54:53 2004 PINI 54 Thu Jul 1 05:54:56 2004 PP05 -WARN 55 Thu Jul 1 05:54:56 2004 PP0d 57 Thu Jul 1 05:54:56 2004 PP0d 58 Thu Jul...
Page 602 Your ZyWALL sends five types of syslog messages. Some examples (not all ZyWALL specific) of these syslog messages with their message formats are shown next: 1 CDR CDR Message Format SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String ); String = board xx line xx channel xx, call xx, str board = the hardware board ID line = the WAN ID in a board Channel = channel ID within the WAN...
Page 603 ZyWALL 5/35/70 Series User’s Guide Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D). Src: Source Address Dst: Destination Address prot: Protocol ("TCP","UDP","ICMP")
Page 604: Call-Triggering Packet
46.4.3 Call-Triggering Packet Call-Triggering Packet displays information about the packet that triggered a dial-out call in an easy readable format. Equivalent information is available in menu 24.1 in hex format. An example is shown next. Figure 363 Call-Triggering Packet Example IP Frame: ENET0-RECV Size: Frame Type: IP Header:...
Page 605: Wan Dhcp
ZyWALL 5/35/70 Series User’s Guide 1 From the main menu, select option 24 to open Menu 24 - System Maintenance. 2 From this menu, select option 4. Diagnostic. This will open Menu 24.4 - System Maintenance - Diagnostic. Figure 364 Menu 24.4: System Maintenance: Diagnostic Menu 24.4 - System Maintenance - Diagnostic TCP/IP System...
Page 606: Table 229 System Maintenance Menu Diagnostic
Table 229 System Maintenance Menu Diagnostic FIELD Ping Host WAN DHCP Release WAN DHCP Renewal Internet Setup Test Reboot System Host IP Address Enter the number of the selection you would like to perform or press [ESC] to cancel. Chapter 46 System Information & Diagnosis ZyWALL 5/35/70 Series User’s Guide DESCRIPTION Enter 1 to ping any machine (with an IP address) on your LAN or WAN.
Page 607 ZyWALL 5/35/70 Series User’s Guide Chapter 46 System Information & Diagnosis...
Page 608: Chapter 47 Firmware And Configuration File Maintenance
Firmware and Configuration File This chapter tells you how to back up and restore your configuration file as well as upload new firmware and a new configuration file. 47.1 Introduction Use the instructions in this chapter to change the ZyWALL’s configuration file or upgrade its firmware.
Page 609: Backup Configuration
ZyWALL 5/35/70 Series User’s Guide The following table is a summary. Please note that the internal filename refers to the filename on the ZyWALL and the external filename refers to the filename not on the ZyWALL, that is, on your computer, local network or FTP site and so the name (but not the extension) may vary. After uploading new firmware, see the ZyNOS F/W Version field in Menu 24.2.1 - System Maintenance - Information to confirm that you have uploaded the correct firmware version.
Page 610: Using The Ftp Command From The Command Line
Figure 366 Telnet into Menu 24.5 To transfer the configuration file to your workstation, follow the procedure below: 2. Type "open" and the IP address of your router. Then type For details on FTP commands, please consult the documentation of your FTP client program. (note that you must remain in this menu to back up using TFTP), please see your router manual.
Page 611: Example Of Ftp Commands From The Command Line
ZyWALL 5/35/70 Series User’s Guide 47.3.3 Example of FTP Commands from the Command Line Figure 367 FTP Session Example 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay 150 Opening data connection for STOR ras 226 File received OK ftp: 16384 bytes sent in 1.10Seconds...
Page 612: Backup Configuration Using Tftp
4 The IP you entered in the Secured Client IP field in menu 24.11 does not match the client IP. If it does not match, the ZyWALL will disconnect the Telnet session immediately. 5 You have an SMT console session running. 47.3.6 Backup Configuration Using TFTP The ZyWALL supports the up/downloading of the firmware and the configuration file using TFTP (Trivial File Transfer Protocol) over LAN.
Page 613: Gui-Based Tftp Clients
ZyWALL 5/35/70 Series User’s Guide 47.3.8 GUI-based TFTP Clients The following table describes some of the fields that you may see in GUI-based TFTP clients. Table 232 General Commands for GUI-based TFTP Clients COMMAND DESCRIPTION Host Enter the IP address of the ZyWALL. 192.168.1.1 is the ZyWALL’s default IP address when shipped.
Page 614: Restore Configuration
Figure 370 Backup Configuration Example Type a location for storing the configuration file or click Browse to look for one. Choose the Xmodem protocol. Then click Receive. 4 After a successful backup you will see the following screen. Press any key to return to the SMT menu.
Page 615: Figure 372 Telnet Into Menu 24.6
ZyWALL 5/35/70 Series User’s Guide Figure 372 Telnet into Menu 24.6 Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2.
Page 616: Restore Using Ftp Session Example
47.4.2 Restore Using FTP Session Example Figure 373 Restore Using FTP Session Example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec. ftp>quit Refer to Section 47.3.5 on page 611...
Page 617: Uploading Firmware And Configuration Files
ZyWALL 5/35/70 Series User’s Guide 4 After a successful restoration you will see the following screen. Press any key to restart the ZyWALL and return to the SMT menu. Figure 377 Successful Restoration Confirmation Screen Save to ROM Hit any key to start system reboot. 47.5 Uploading Firmware and Configuration Files This section shows you how to upload firmware and configuration files.
Page 618: Configuration File Upload
Figure 378 Telnet Into Menu 24.7.1: Upload System Firmware Menu 24.7.1 - System Maintenance - Upload System Firmware To upload the system firmware, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your system. Then type "root" and SMT password as requested.
Page 619: Ftp File Upload Command From The Dos Prompt Example
ZyWALL 5/35/70 Series User’s Guide 47.5.3 FTP File Upload Command from the DOS Prompt Example 1 Launch the FTP client on your computer. 2 Enter “open”, followed by a space and the IP address of your ZyWALL. 3 Press [ENTER] when prompted for a username. 4 Enter your password as requested (the default is “1234”).
Page 620: Tftp Upload Command Example
1 Use telnet from your computer to connect to the ZyWALL and log in. Because TFTP does not have any security checks, the ZyWALL records the IP address of the telnet client and accepts TFTP requests only from this address. 2 Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 –...
Page 621: Example Xmodem Firmware Upload Using Hyperterminal
ZyWALL 5/35/70 Series User’s Guide Figure 381 Menu 24.7.1 As Seen Using the Console Port Menu 24.7.1 - System Maintenance - Upload System Firmware To upload system firmware: 1. Enter "y" at the prompt below to go into debug mode. 2.
Page 622: Example Xmodem Configuration Upload Using Hyperterminal
Figure 383 Menu 24.7.2 As Seen Using the Console Port Menu 24.7.2 - System Maintenance - Upload System Configuration File To upload system configuration file: 1. Enter "y" at the prompt below to go into debug mode. 2. Enter "atlc" after "Enter Debug Mode" message. 3.
Page 623 ZyWALL 5/35/70 Series User’s Guide Chapter 47 Firmware and Configuration File Maintenance...
Page 624: System Maintenance Menus 8 To 10
System Maintenance Menus 8 to This chapter leads you through SMT menus 24.8 to 24.10. 48.1 Command Interpreter Mode The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions.
Page 625: Command Usage
A list of commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished. Figure 386 Valid Commands Copyright (c) 1994 - 2005 ZyXEL Communications Corp. ras> ? Valid commands are:...
Page 626: Call Control Support
48.2 Call Control Support The ZyWALL provides two call control functions: budget management and call history. Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1. The budget management function allows you to set a limit on the total outgoing call time of the ZyWALL within certain times.
Page 627: Call History
ZyWALL 5/35/70 Series User’s Guide Figure 388 Budget Management Menu 24.9.1 - Budget Management Remote Node 1.WAN_1 2.WAN_2 3.Dial The total budget is the time limit on the accumulated time for outgoing calls to a remote node. When this limit is reached, the call will be dropped and further outgoing calls to that remote node will be blocked.
Page 628: Time And Date Setting
Figure 389 Call History Menu 24.9.2 - Call History Phone Number Enter Entry to Delete(0 to exit): The following table describes the fields in this screen. Table 235 Call History FIELD DESCRIPTION Phone Number The PPPoE service names are shown here. This shows whether the call was incoming or outgoing.
Page 629: Figure 390 Menu 24: System Maintenance
ZyWALL 5/35/70 Series User’s Guide Figure 390 Menu 24: System Maintenance 10. Time and Date Setting 11. Remote Management Setup Enter 10 to go to Menu 24.10 - System Maintenance - Time and Date Setting to update the time and date settings of your ZyWALL as shown in the following screen. Figure 391 Menu 24.10 System Maintenance: Time and Date Setting Menu 24.10 - System Maintenance - Time and Date Setting Time Protocol= NTP (RFC-1305)
Page 630: Table 236 Menu 24.10 System Maintenance: Time And Date Setting
Table 236 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION Time Protocol Enter the time service protocol that your timeserver uses. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works. The main differences between them are the format.
Page 631 ZyWALL 5/35/70 Series User’s Guide Table 236 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION End Date (mm- Configure the day and time when Daylight Saving Time ends if you selected Yes in nth-week-hr) the Daylight Saving field. The hr field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time ends in the United States on the last Sunday of October.
Page 632: Chapter 49 Remote Management
This chapter covers remote management found in SMT menu 24.11. 49.1 Remote Management Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers. You may manage your ZyWALL from a remote location via: •...
Page 633: Figure 392 Menu 24.11 - Remote Management Control
ZyWALL 5/35/70 Series User’s Guide Figure 392 Menu 24.11 – Remote Management Control Menu 24.11 - Remote Management Control TELNET Server: FTP Server: SSH Server: HTTPS Server: HTTP Server: SNMP Service: DNS Service: Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this screen.
Page 634: Remote Management Limitations
49.1.1 Remote Management Limitations Remote management over LAN or WAN will not work when: 1 A filter in menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. 2 You have disabled that service in menu 24.11. 3 The IP address in the Secure Client IP field (menu 24.11) does not match the client IP address.
Page 635 ZyWALL 5/35/70 Series User’s Guide Chapter 49 Remote Management...
Page 636: Chapter 50 Ip Policy Routing
This chapter covers setting and applying policies used for IP routing. This chapter applies to the ZyWALL 35 and ZyWALL 70. 50.1 IP Routing Policy Summary Menu 25 shows the summary of a policy rule, including the criteria and the action of a single policy, and whether a policy is active or not.
Page 637: Ip Routing Policy Setup
ZyWALL 5/35/70 Series User’s Guide Table 238 Menu 25: Sample IP Routing Policy Summary (continued) FIELD DESCRIPTION Criteria/Action This displays the details about to which packets the policy applies and how the policy has the ZyWALL handle those packets. Refer to detailed information.
Page 638: Figure 394 Menu 25.1: Ip Routing Policy Setup
1 Type 25 in the main menu to open Menu 25 - IP Routing Policy Summary. 2 Select Edit in the Select Command field; type the index number of the rule you want to configure in the Select Rule field and press [ENTER] to open Menu 25.1 - IP Routing Policy Setup (see the next figure).
Page 639: Applying Policy To Packets
ZyWALL 5/35/70 Series User’s Guide Table 240 Menu 25.1: IP Routing Policy Setup FIELD DESCRIPTION port start / end Source port number range from start to end; applicable only for TCP/UDP. Destination addr start / end Destination IP address range from start to end. port start / end Destination port number range from start to end;...
Page 640: Ip Policy Routing Example
Figure 395 Menu 25.1.1: IP Routing Policy Setup Menu 25.1.1 - IP Routing Policy Setup Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this screen. Table 241 Menu 25.1.1: IP Routing Policy Setup FIELD DESCRIPTION LAN/DMZ/WLAN/...
Page 641: Figure 396 Example Of Ip Policy Routing
ZyWALL 5/35/70 Series User’s Guide Figure 396 Example of IP Policy Routing To force Web packets coming from clients with IP addresses of 192.168.1.33 to 192.168.1.64 to be routed to the Internet via the WAN port of the ZyWALL, follow the steps as shown next. 1 Create a rule in Menu 25.1 - IP Routing Policy Setup as shown next.
Page 642: Figure 398 Ip Routing Policy Example 2
4 Create another rule in menu 25.1 for this rule to route packets from any host (IP=0.0.0.0 means any host) with protocol TCP and port FTP access through another gateway (192.168.1.100). Figure 398 IP Routing Policy Example 2 Menu 25.1 - IP Routing Policy Setup Rule Index= 2 Criteria: IP Protocol...
Page 643 ZyWALL 5/35/70 Series User’s Guide Chapter 50 IP Policy Routing...
Page 644: Chapter 51 Call Scheduling
Call scheduling allows you to dictate when a remote node should be called and for how long. 51.1 Introduction to Call Scheduling The call scheduling feature allows the ZyWALL to manage a remote node and dictate when a remote node should be called and for how long. This feature is similar to the scheduler in a videocassette recorder (you can specify a time period for the VCR to record).
Page 645: Figure 400 Schedule Set Setup
ZyWALL 5/35/70 Series User’s Guide Figure 400 Schedule Set Setup Menu 26.1 - Schedule Set Setup Active= Yes How Often= Once Start Date(yyyy-mm-dd) = N/A Once: Date(yyyy-mm-dd)= 2000 - 01 - 01 Weekdays: Sunday= N/A Monday= N/A Tuesday= N/A Wednesday= N/A Thursday= N/A Friday= N/A Saturday= N/A...
Page 646: Figure 401 Applying Schedule Set(S) To A Remote Node (Pppoe)
Table 242 Schedule Set Setup (continued) FIELD DESCRIPTION Action Forced On means that the connection is maintained whether or not there is a demand call on the line and will persist for the time period specified in the Duration field. Forced Down means that the connection is blocked whether or not there is a demand call on the line.
Page 647: Figure 402 Applying Schedule Set(S) To A Remote Node (Pptp)
ZyWALL 5/35/70 Series User’s Guide Figure 402 Applying Schedule Set(s) to a Remote Node (PPTP) Rem Node Name= ChangeMe Active= Yes Encapsulation= PPTP Service Type= Standard Outgoing= My Login= My Password= ******** Retype to Confirm= ******** Authen= CHAP/PAP PPTP: My IP Addr= My IP Mask= Server IP Addr= Connection ID/Name=...
Page 648: Chapter 52 Troubleshooting
This chapter covers potential problems and possible remedies. After each problem description, some instructions are provided to help you to diagnose and to solve the problem. Please see our included disk for further information. 52.1 Problems Starting Up the ZyWALL Table 243 Troubleshooting the Start-Up of Your ZyWALL PROBLEM CORRECTIVE ACTION...
Page 649: Problems With The Dmz Interface
ZyWALL 5/35/70 Series User’s Guide 52.3 Problems with the DMZ Interface Table 245 Troubleshooting the DMZ Interface PROBLEM Cannot access servers on the DMZ from the LAN. Cannot ping any computer on the DMZ. 52.4 Problems with the WAN Interface Table 246 Troubleshooting the WAN Interface PROBLEM Cannot get WAN IP...
Page 650: Problems Accessing The Zywall
52.5 Problems Accessing the ZyWALL Table 247 Troubleshooting Accessing the ZyWALL PROBLEM Cannot access the ZyWALL. Cannot access the ZyWALL via the console port. Cannot access the web configurator. 52.5.1 Pop-up Windows, JavaScripts and Java Permissions In order to use the web configurator you need to allow: Chapter 52 Troubleshooting CORRECTIVE ACTION The default password is “1234”.
Page 651: Internet Explorer Pop-Up Blockers
ZyWALL 5/35/70 Series User’s Guide • Web browser pop-up windows from your device. • JavaScripts (enabled by default). • Java permissions (enabled by default). Note: Internet Explorer 6 screens are used here. Screens for other Internet Explorer versions may vary. 52.5.1.1 Internet Explorer Pop-up Blockers You may have to disable pop-up blocking to log into your device.
Page 652: Figure 404 Internet Options: Privacy
Figure 404 Internet Options: Privacy 3 Click Apply to save this setting. 52.5.1.1.2 Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab. 2 Select Settings…to open the Pop-up Blocker Settings screen.
Page 653: Figure 405 Internet Options: Privacy
ZyWALL 5/35/70 Series User’s Guide Figure 405 Internet Options: Privacy 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites. Chapter 52 Troubleshooting...
Page 654: Javascripts
Figure 406 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. 52.5.1.2 JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed. 1 In Internet Explorer, click Tools, Internet Options and then the Security tab.
Page 655: Figure 407 Internet Options: Security
ZyWALL 5/35/70 Series User’s Guide Figure 407 Internet Options: Security 2 Click the Custom Level... button. 3 Scroll down to Scripting. 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is selected (the default). 6 Click OK to close the window.
Page 656: Java Permissions
Figure 408 Security Settings - Java Scripting 52.5.1.3 Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is selected. 5 Click OK to close the window.
Page 657: Figure 409 Security Settings - Java
ZyWALL 5/35/70 Series User’s Guide Figure 409 Security Settings - Java 52.5.1.3.1 JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 Make sure that Use Java 2 for <applet> under Java (Sun) is selected. 3 Click OK to close the window.
Page 658: Packet Flow
Figure 410 Java (Sun) 52.6 Packet Flow The following is the packet check flow on the ZyWALL. LAN/DMZ/WLAN to WAN: LAN/DMZ Data and Call Filtering (in SMT menu 21) -> Firewall -> IDP -> Anti-Virus -> Anti-Spam -> Remote Node Data Filtering (in SMT menu 21) ->...
Page 659 ZyWALL 5/35/70 Series User’s Guide Chapter 52 Troubleshooting...
Page 660: Product Specifications
See also the Introduction chapter for a general overview of the key features. Specification Tables Table 248 Device Specifications Default IP Address Default Subnet Mask Default Password DHCP Pool Dimensions Weight Power Specification Fuse Specifications Ethernet Interface Reset Button Console Dial Backup Extension Card Slot Operation Temperature...
Page 661: Table 249 Performance
ZyWALL 5/35/70 Series User’s Guide Table 248 Device Specifications (continued) Operation Humidity Storage Humidity Certifications MTBF (Mean Time Between Failures) (Bellcore model) Table 249 Performance Firewall Throughput VPN 3DES/AES Throughput User Licenses Concurrent Sessions Simultaneous IPSec VPN Connections Table 250 Firmware Features Modes of Operation Firewall (ICSA Certified) IP Protocol/Packet Filter VPN (ICSA Certified)
Page 662 Table 250 Firmware Features (continued) Anti-Spam Content Filtering Traffic Management High Availability (HA) System Management Wireless Logging/Monitoring Appendix A Product Specifications ZyWALL 5/35/70 Series User’s Guide Spam, Phishing detection Configurable white and black lists SMTP, POP3 support External Spam database Web page blocking by URL keyword IKE + PKI support External database content filtering...
Page 663: Table 251 Feature Specifications
ZyWALL 5/35/70 Series User’s Guide Table 250 Firmware Features (continued) Other Protocol Support Other Features Table 251 Feature Specifications FEATURE Number of Static DHCP Table Entries Number of Static Routes Number of Policy Routes Number of Port Forwarding Rules Number of NAT Sessions Number of Address Mapping Rules Number of IPSec VPN Tunnels/Security Associations...
Page 664: Table 252 Compatible Zyxel Wlan Cards And Security Features
Compatible ZyXEL WLAN Cards The following table lists the ZyXEL WLAN cards that you can use in the ZyWALL at the time of writing. It also shows the security features that each card supports. Note: Check the product page on the www.zyxel.com website for updates on ZyXEL WLAN cards that you can use in the ZyWALL.
Page 665: Figure 411 Wlan Card Installation
ZyWALL 5/35/70 Series User’s Guide Figure 411 WLAN Card Installation Cable Pin Assignments In a serial communications connection, generally a computer is DTE (Data Terminal Equipment) and a modem is DCE (Data Circuit-terminating Equipment). The ZyWALL is DCE when you connect a computer to the console port. The ZyWALL is DTE when you connect a modem to the dial backup port.
Page 666: Figure 413 Ethernet Cable Pin Assignments
Table 253 Console/Dial Backup Port Pin Assignments CONSOLE Port RS – 232 (Female) DB-9F Pin 1 = NON Pin 2 = DCE-TXD Pin 3 = DCE –RXD Pin 4 = DCE –DSR Pin 5 = GND Pin 6 = DCE –DTR Pin 7 = DCE –CTS Pin 8 = DCE –RTS PIN 9 = NON...
Page 667 ZyWALL 5/35/70 Series User’s Guide Appendix A Product Specifications...
Page 668: Hardware Installation
The ZyWALL can be placed on a desktop or rack-mounted on a standard EIA rack. Use the brackets in a rack-mounted installation. General Installation Instructions Read all the safety warnings in the beginning of this User's Guide before you begin and make sure you follow them.
Page 669: Figure 414 Attaching Rubber Feet
ZyWALL 5/35/70 Series User’s Guide Figure 414 Attaching Rubber Feet Note: Do not block the ventilation holes. Leave space between ZyWALLs when stacking. Rack-mounted Installation Requirements The ZyWALL can be mounted on an EIA standard size, 19-inch rack or in a wiring closet with other equipment.
Page 670: Figure 415 Attaching Mounting Brackets And Screws
Figure 415 Attaching Mounting Brackets and Screws 3 After attaching both mounting brackets, position the ZyWALL in the rack by lining up the holes in the brackets with the appropriate holes on the rack. Secure the ZyWALL to the rack with the rack-mounting screws. Figure 416 Rack Mounting Appendix B Hardware Installation ZyWALL 5/35/70 Series User’s Guide...
Page 671 ZyWALL 5/35/70 Series User’s Guide Appendix B Hardware Installation...
Page 672: Removing And Installing A Fuse
Removing and Installing a Fuse This appendix shows you how to remove and install fuses for the ZyWALL. If you need to install a new fuse, follow the procedure below. Note: If you use a fuse other than the included fuses, make sure it matches the fuse specifications in the appendix on product specifications.
Page 673 ZyWALL 5/35/70 Series User’s Guide Appendix C Removing and Installing a Fuse...
Page 674: Setting Up Your Computer's Ip Address
Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/ IP on your computer.
Page 675: Figure 417 Windows 95/98/Me: Network: Configuration
ZyWALL 5/35/70 Series User’s Guide Figure 417 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add.
Page 676: Figure 418 Windows 95/98/Me: Tcp/Ip Properties: Ip Address
3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click 5 Restart your computer so the changes you made take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab.
Page 677: Figure 419 Windows 95/98/Me: Tcp/Ip Properties: Dns Configuration
ZyWALL 5/35/70 Series User’s Guide Figure 419 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab. • • 5 Click OK to save and close the TCP/IP Properties window. 6 Click OK to close the Network window. Insert the Windows CD if prompted. 7 Turn on your Prestige and restart your computer when prompted.
Page 678: Figure 420 Windows Xp: Start Menu
Figure 420 Windows XP: Start Menu 2 In the Control Panel, double-click Network Connections (Network and Dial-up Connections in Windows 2000/NT). Figure 421 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties. Appendix D Setting up Your Computer’s IP Address ZyWALL 5/35/70 Series User’s Guide...
Page 679: Figure 422 Windows Xp: Control Panel: Network Connections: Properties
ZyWALL 5/35/70 Series User’s Guide Figure 422 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties. Figure 423 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP).
Page 680: Figure 424 Windows Xp: Internet Protocol (Tcp/Ip) Properties
• • Figure 424 Windows XP: Internet Protocol (TCP/IP) Properties 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK. Do one or more of the following if you want to configure additional IP addresses: •...
Page 681: Figure 425 Windows Xp: Advanced Tcp/Ip Properties
ZyWALL 5/35/70 Series User’s Guide Figure 425 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). If you know your DNS server IP address(es), click Use the following DNS server addresses, and type them in the Preferred DNS server and Alternate DNS server fields.
Page 682: Figure 426 Windows Xp: Internet Protocol (Tcp/Ip) Properties
Figure 426 Windows XP: Internet Protocol (TCP/IP) Properties 8 Click OK to close the Internet Protocol (TCP/IP) Properties window. 9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 10 Close the Network Connections window (Network and Dial-up Connections in Windows 2000/NT).
Page 683: Figure 427 Macintosh Os 8/9: Apple Menu
ZyWALL 5/35/70 Series User’s Guide Figure 427 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 428 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. Appendix D Setting up Your Computer’s IP Address...
Page 684: Figure 429 Macintosh Os X: Apple Menu
4 For statically assigned settings, do the following: • • • • 5 Close the TCP/IP Control Panel. 6 Click Save if prompted, to save changes to your configuration. 7 Turn on your Prestige and restart your computer (if prompted). Verifying Settings Check your TCP/IP properties in the TCP/IP Control Panel window.
Page 685: Figure 430 Macintosh Os X: Network
ZyWALL 5/35/70 Series User’s Guide Figure 430 Macintosh OS X: Network 4 For statically assigned settings, do the following: • • • • 5 Click Apply Now and close the window. 6 Turn on your Prestige and restart your computer (if prompted). Verifying Settings Check your TCP/IP properties in the Network window.
Page 686: Figure 431 Red Hat 9.0: Kde: Network Configuration: Devices
Note: Make sure you are logged in as the root administrator. Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setting and click Network.
Page 687: Figure 433 Red Hat 9.0: Kde: Network Configuration: Dns
ZyWALL 5/35/70 Series User’s Guide • • 3 Click OK to save the changes and close the Ethernet Device General screen. 4 If you know your DNS server IP address(es), click the DNS tab in the Network Configuration screen. Enter the DNS server information in the fields provided. Figure 433 Red Hat 9.0: KDE: Network Configuration: DNS 5 Click the Devices tab.
Page 688: Figure 435 Red Hat 9.0: Dynamic Ip Address Setting In Ifconfig-Eth0
1 Assuming that you have only one network card on the computer, locate the configuration file (where eth0 configuration file with any plain text editor. • Figure 435 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0 DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp USERCTL=no PEERDNS=yes TYPE=Ethernet...
Page 689: Figure 438 Red Hat 9.0: Restart Ethernet Card
ZyWALL 5/35/70 Series User’s Guide Figure 438 Red Hat 9.0: Restart Ethernet Card [root@localhost init.d]# network restart Shutting down interface eth0: Shutting down loopback interface: Setting network parameters: Bringing up loopback interface: Bringing up interface eth0: Verifying Settings Enter in a terminal screen to check your TCP/IP properties. ifconfig Figure 439 Red Hat 9.0: Checking TCP/IP Properties [root@localhost]# ifconfig...
Page 690: Appendix Eip Subnetting
IP Addressing Routers “route” based on the network number. The router that delivers the data packet to the correct destination host uses the host ID. IP Classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1.
Page 691: Table 255 Allowed Ip Address Range By Class
ZyWALL 5/35/70 Series User’s Guide Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127. Similarly the first octet of a class “B” must begin with “10”, therefore the first octet of a class “B”...
Page 692: Table 257 Alternative Subnet Mask Notation
Since the mask is always a continuous number of ones beginning from the left, followed by a continuous number of zeros for the remainder of the 32 bit mask, you can simply specify the number of ones instead of writing the value of each octet. This is usually specified by writing a “/”...
Page 693: Table 259 Subnet 1
ZyWALL 5/35/70 Series User’s Guide Note: In the following charts, shaded/bolded last octet bit values indicate host ID bits “borrowed” to form network ID bits. The number of “borrowed” host ID bits determines the number of subnets you can have. The remaining number of host ID bits (after “borrowing”) determines the number of hosts you can have on each subnet.
Page 694: Table 261 Subnet 1
Example: Four Subnets The above example illustrated using a 25-bit subnet mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits (11111111.11111111.11111111.11000000) or 255.255.255.192.
Page 695: Table 264 Subnet 4
ZyWALL 5/35/70 Series User’s Guide Table 264 Subnet 4 IP Address IP Address (Binary) Subnet Mask (Binary) Subnet Address: 192.168.1.192 Broadcast Address: 192.168.1.255 Example Eight Subnets Similarly use a 27-bit mask to create 8 subnets (001, 010, 011, 100, 101, 110). The following table shows class C IP address last octet values for each subnet.
Page 696: Table 267 Class B Subnet Planning
Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID. A class “B” address has two host ID octets available for subnetting and a class “A” address has three host ID octets (see The following table is a summary for class “B”...
Page 697 ZyWALL 5/35/70 Series User’s Guide Appendix E IP Subnetting...
Page 698: Appendix Fpppoe
PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your computer to an ATM PVC (Permanent Virtual Circuit) which connects to a DSL Access Concentrator where the PPP session terminates (see support any number of PPP sessions from your LAN.
Page 699: Figure 440 Single-Computer Per Router Hardware Configuration
ZyWALL 5/35/70 Series User’s Guide Figure 440 Single-Computer per Router Hardware Configuration How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the computer and the computer runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC).
Page 700: Appendix Gpptp
What is PPTP? PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames. How can we transport PPP frames from a computer to a broadband modem over Ethernet? A solution is to build PPTP into the ANT (ADSL Network Termination) where PPTP is used only over the short haul between the computer and the modem over Ethernet.
Page 701: Figure 443 Pptp Protocol Overview
ZyWALL 5/35/70 Series User’s Guide PPTP Protocol Overview PPTP is very similar to L2TP, since L2TP is based on both PPTP and L2F (Cisco’s Layer 2 Forwarding). Conceptually, there are three parties in PPTP, namely the PNS (PPTP Network Server), the PAC (PPTP Access Concentrator) and the PPTP user. The PNS is the box that hosts both the PPP and the PPTP stacks and forms one end of the PPTP tunnel.
Page 702: Figure 444 Example Message Exchange Between Computer And An Ant
Figure 444 Example Message Exchange between Computer and an ANT PPP Data Connection The PPP frames are tunneled between the PNS and PAC over GRE (General Routing Encapsulation, RFC 1701, 1702). The individual calls within a tunnel are distinguished using the Call ID field in the GRE header.
Page 703 ZyWALL 5/35/70 Series User’s Guide Appendix G PPTP...
Page 704: Appendix H Wireless Lans
Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless stations (A, B, C). Any time two or more wireless adapters are within range of each other, they can set up an independent network, which is commonly referred to as an Ad-hoc network or Independent Basic Service Set (IBSS).
Page 705: Figure 446 Basic Service Set
ZyWALL 5/35/70 Series User’s Guide Figure 446 Basic Service Set An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type of wireless LAN topology is called an Infrastructure WLAN.
Page 706: Figure 447 Infrastructure Wlan
Figure 447 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.11a/b/g wireless devices. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a different channel than an adjacent AP (access point) to reduce interference.
Page 707: Figure 448 Rts/Cts
ZyWALL 5/35/70 Series User’s Guide Figure 448 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations.
Page 708: Table 268 Ieee802.11G
A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size.
Page 709 ZyWALL 5/35/70 Series User’s Guide IEEE 802.1x In June 2001, the IEEE 802.1x standard was designed to extend the features of IEEE 802.11 to support extended authentication as well as providing additional accounting and control features. It is supported by Windows XP and a number of network devices. Some advantages of IEEE 802.1x are: •...
Page 710: Figure 449 Eap Authentication
• Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: •...
Page 711: Types Of Authentication
ZyWALL 5/35/70 Series User’s Guide 3 The wireless station replies with identity information, including username and password. 4 The RADIUS server checks the user information against its user profile database and determines whether or not to authenticate the wireless station. Types of Authentication This section discusses some popular authentication types: EAP-MD5, EAP-TLS, EAP- TTLS, PEAP and LEAP.
Page 712: Wep Authentication Steps
PEAP (Protected EAP) Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use simple username and password methods through the secured connection to authenticate the clients, thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication.
Page 713: Figure 450 Wep Authentication Steps
ZyWALL 5/35/70 Series User’s Guide Figure 450 WEP Authentication Steps Open system authentication involves an unencrypted two-message procedure. A wireless station sends an open system authentication request to the AP, which will then automatically accept and connect the wireless station to the network. In effect, open system is not authentication at all as any station can gain access to the network.
Page 714: Table 269 Comparison Of Eap Authentication Types
Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are often deployed in corporate environments, but for public deployment, a simple user name and password pair is more practical. The following table is a comparison of the features of authentication types.
Page 715: Table 270 Wireless Security Relational Matrix
ZyWALL 5/35/70 Series User’s Guide The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data packets, altering them and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match, it is assumed that the data has been tampered with and the packet is dropped.
Page 716: Figure 451 Roaming Example
In a network environment with multiple access points, wireless stations are able to switch from one access point to another as they move between the coverage areas. This is roaming. As the wireless station moves from place to place, it is responsible for choosing the most appropriate access point depending on the signal strength, network utilization or other factors.
Page 717: Requirements For Roaming
ZyWALL 5/35/70 Series User’s Guide Requirements for Roaming The following requirements must be met in order for wireless stations to roam between the coverage areas. 1 All the access points must be on the same subnet and configured with the same ESSID. 2 If IEEE 802.1x user authentication is enabled and to be done locally on the access point, the new access point must have the user profile for the wireless station.
Page 718: Appendix I Triangle Route
The Ideal Setup When the firewall is on, your ZyWALL acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the ZyWALL to protect your LAN against attacks. Figure 452 Ideal Setup The “Triangle Route”...
Page 719: Figure 453 "Triangle Route" Problem
ZyWALL 5/35/70 Series User’s Guide Figure 453 “Triangle Route” Problem The “Triangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface.
Page 720: Figure 454 Ip Alias
Figure 454 IP Alias Gateways on the WAN Side A second solution to the “triangle route” problem is to put all of your network gateways on the WAN side as the following figure shows. This ensures that all incoming network traffic passes through your ZyWALL to your LAN.
Page 721 ZyWALL 5/35/70 Series User’s Guide Appendix I Triangle Route...
Page 722: Windows 98 Se/Me Requirements For Anti-Virus Message Display
ZyWALL 5/35/70 Series User’s Guide P P E N D I X Windows 98 SE/Me Requirements for Anti-Virus Message Display With the anti-virus packet scan, when a virus is detected, an alert message is displayed on Miscrosoft Windows-based computers. For Windows 98 SE/Me, you must open the WinPopup window in order to view real-time alert messages.
Page 723: Figure 457 Windows 98 Se: Program Task Bar
ZyWALL 5/35/70 Series User’s Guide Figure 457 WIndows 98 SE: Program Task Bar 2 Click the Start Menu Programs tab and click Advanced ... Figure 458 Windows 98 SE: Task Bar Properties 3 Double-click Programs and click StartUp. 4 Right-click in the StartUp pane and click New, Shortcut. Appendix J Windows 98 SE/Me Requirements for Anti-Virus Message Display...
Page 724: Figure 459 Windows 98 Se: Startup
Figure 459 Windows 98 SE: StartUp 5 A Create Shortcut window displays. Enter “winpopup” in the Command line field and click Next. Figure 460 Windows 98 SE: Startup: Create Shortcut 6 Specify a name for the shortcut or accept the default and click Finish. Appendix J Windows 98 SE/Me Requirements for Anti-Virus Message Display ZyWALL 5/35/70 Series User’s Guide...
Page 725: Figure 461 Windows 98 Se: Startup: Select A Title For The Program
ZyWALL 5/35/70 Series User’s Guide Figure 461 Windows 98 SE: Startup: Select a Title for the Program 7 A shortcut is created in the StartUp pane. Restart the computer when prompted. Figure 462 Windows 98 SE: Startup: Shortcut Note: The WinPopup window displays after the computer finishes the startup process (see Figure 456 on page Appendix J Windows 98 SE/Me Requirements for Anti-Virus Message Display...
Page 726: Appendix Kvpn Setup
This appendix will help you to quickly create a IPSec/VPN connection between two ZyXEL IPSec routers. It should be considered a quick reference for experienced users. General Notes • The private networks behind the IPSec routers must be on different subnets. For example, 192.168.10.0/24 and 192.168.20.0/24.
Page 727: Figure 463 Vpn Rules
ZyWALL 5/35/70 Series User’s Guide The following pages show a typical configuration that builds a tunnel between two private networks. One network is the headquarters (HQ) and the other is a branch office. Both sites have static (fixed) public addresses. Replace the Remote Gateway Address and Local/ Remote Starting IP Address settings with your own values.
Page 728: Figure 464 Headquarters Gateway Policy Edit
ZyWALL 5/35/70 Series User’s Guide Figure 464 Headquarters Gateway Policy Edit The IP address of the branch office IPSec router. Appendix K VPN Setup...
Page 729: Figure 465 Branch Office Gateway Policy Edit
ZyWALL 5/35/70 Series User’s Guide Figure 465 Branch Office Gateway Policy Edit 3 Click the add network policy ( configure a VPN policy. ) icon next to the BRANCH gateway policy to Appendix K VPN Setup The IP address of the headquarters IPSec router.
Page 730: Figure 466 Headquarters Vpn Rule
ZyWALL 5/35/70 Series User’s Guide Figure 466 Headquarters VPN Rule Figure 467 Branch Office VPN Rule 4 Configure the screens in the headquarters and the branch office as follows and click Apply. Appendix K VPN Setup...
Page 731: Figure 468 Headquarters Network Policy Edit
ZyWALL 5/35/70 Series User’s Guide Figure 468 Headquarters Network Policy Edit Activate the network policy. IP addresses on different subnets. Appendix K VPN Setup...
Page 732: Figure 469 Branch Office Network Policy Edit
Figure 469 Branch Office Network Policy Edit Dialing the VPN Tunnel via Web Configurator To test whether the IPSec routers can build the VPN tunnel, click the dial ( VPN Rules (IKE) screen to have the IPSec routers set up the tunnel. Appendix K VPN Setup ZyWALL 5/35/70 Series User’s Guide Activate the...
Page 733: Figure 470 Vpn Rule Configured
ZyWALL 5/35/70 Series User’s Guide Figure 470 VPN Rule Configured The following screen displays. Figure 471 VPN Dial This screen displays later if the IPSec routers can build the VPN tunnel. Figure 472 VPN Tunnel Established Appendix K VPN Setup...
Page 734: Vpn Troubleshooting
VPN Troubleshooting If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into the web configurators of both ZyXEL IPSec routers. Check the settings in each field methodically and slowly. VPN Log The system log can often help to identify a configuration problem.
Page 735: Figure 473 Vpn Log Example
ZyWALL 5/35/70 Series User’s Guide Figure 473 VPN Log Example ras> sys log disp ike ipsec .time message 0|01/11/2001 18:47:22 |5.6.7.8 Rule [ex-1] Tunnel built successfully 1|01/11/2001 18:47:22 |5.6.7.8 The cookie pair is : 0xDAC0B43FBDE154F5 / 0xC5156C099C3F7DCA 2|01/11/2001 18:47:22 |5.6.7.8 Send:[HASH] 3|01/11/2001 18:47:22 |5.6.7.8 The cookie pair is : 0xDAC0B43FBDE154F5 / 0xC5156C099C3F7DCA...
Page 736: Figure 474 Ike/Ipsec Debug Example
IPSec Debug If you are having difficulty building an IPSec tunnel to a non-ZyXEL IPSec router, advanced users may wish to examine the IPSec debug feature (Menu 24.8). Note: If any of your VPN rules have an active network policy set to nailed-up, using the IPSec debug feature may cause the ZyWALL to continuously display new information.
Page 737: Use A Vpn Tunnel
ZyWALL 5/35/70 Series User’s Guide Use a VPN Tunnel A VPN tunnel gives you a secure connection to another computer or network. The VPN Status screen displays whether or not your VPN tunnel is connected. Example VPN tunnel uses are securely sending and retrieving files, and accessing corporate network drives, web servers and email.
Page 738: Importing Certificates
This appendix shows importing certificates examples using Internet Explorer 5. Import ZyWALL Certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the ZyWALL’s server certificate by importing it into your operating system as a trusted certification authority. Select Accept This Certificate Permanently in the following screen to do this. Figure 475 Security Certificate Importing the ZyWALL’s Certificate into Internet Explorer For Internet Explorer to trust a self-signed certificate from the ZyWALL, simply import the...
Page 739: Figure 476 Login Screen
ZyWALL 5/35/70 Series User’s Guide Figure 476 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 477 Certificate General Information before Import 3 Click Next to begin the Install Certificate wizard. Appendix L Importing Certificates...
Page 740: Figure 478 Certificate Import Wizard 1
Figure 478 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next. Figure 479 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard. Appendix L Importing Certificates ZyWALL 5/35/70 Series User’s Guide...
Page 741: Figure 480 Certificate Import Wizard 3
ZyWALL 5/35/70 Series User’s Guide Figure 480 Certificate Import Wizard 3 6 Click Yes to add the ZyWALL certificate to the root store. Figure 481 Root Certificate Store Appendix L Importing Certificates...
Page 742: Figure 482 Certificate General Information After Import
Figure 482 Certificate General Information after Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyWALL. You must have imported at least one trusted CA to the ZyWALL in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details).
Page 743: Figure 483 Zywall Trusted Ca Screen
ZyWALL 5/35/70 Series User’s Guide Figure 483 ZyWALL Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). Installing the CA’s Certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown next.
Page 744: Figure 484 Ca Certificate Example
Figure 484 CA Certificate Example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment.
Page 745: Figure 485 Personal Certificate Import Wizard 1
ZyWALL 5/35/70 Series User’s Guide Figure 485 Personal Certificate Import Wizard 1 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. Figure 486 Personal Certificate Import Wizard 2 3 Enter the password given to you by the CA.
Page 746: Figure 487 Personal Certificate Import Wizard 3
Figure 487 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 488 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process.
Page 747: Figure 489 Personal Certificate Import Wizard 5
ZyWALL 5/35/70 Series User’s Guide Figure 489 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 490 Personal Certificate Import Wizard 6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS.
Page 748: Figure 492 Ssl Client Authentication
ZyWALL 5/35/70 Series User’s Guide Figure 492 SSL Client Authentication 3 You next see the ZyWALL login screen. Figure 493 ZyWALL Secure Login Screen Appendix L Importing Certificates...
Page 749 ZyWALL 5/35/70 Series User’s Guide Appendix L Importing Certificates...
Page 750: Appendix M Command Interpreter
The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 - Command Interpreter Mode. See the included disk or zyxel.com for more detailed information on these commands. Note: Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable.
Page 751 ZyWALL 5/35/70 Series User’s Guide Appendix M Command Interpreter...
Page 752: Appendix N Firewall Commands
The following describes the firewall commands. See on the command structure. Table 271 Firewall Commands FUNCTION COMMAND Firewall Set-Up config edit firewall active <yes | no> config retrieve firewall config save firewall Display config display firewall config display firewall set <set #>...
Page 753 ZyWALL 5/35/70 Series User’s Guide Table 271 Firewall Commands (continued) FUNCTION COMMAND E-mail config edit firewall e-mail mail-server <ip address of mail server> config edit firewall e-mail return-addr <e-mail address> config edit firewall e-mail email-to <e-mail address> config edit firewall e-mail policy <full | hourly | daily | weekly>...
Page 754 Table 271 Firewall Commands (continued) FUNCTION COMMAND config edit firewall attack minute-high <0-255> config edit firewall attack minute-low <0-255> config edit firewall attack max-incomplete-high <0-255> config edit firewall attack max-incomplete-low <0-255> config edit firewall attack tcp-max-incomplete <0-255> Sets config edit firewall set <set #>...
Page 755 ZyWALL 5/35/70 Series User’s Guide Table 271 Firewall Commands (continued) FUNCTION COMMAND Config edit firewall set <set #> tcp-idle-timeout <seconds> Config edit firewall set <set #> log <yes | no> Rules Config edit firewall set <set #> rule <rule #> permit <forward | block>...
Page 756 Table 271 Firewall Commands (continued) FUNCTION COMMAND config edit firewall set <set #> rule <rule #> destaddr- subnet <ip address> <subnet mask> config edit firewall set <set #> rule <rule #> destaddr- range <start ip address> <end ip address> config edit firewall set <set #>...
Page 757 ZyWALL 5/35/70 Series User’s Guide Appendix N Firewall Commands...
Page 758: Netbios Filter Commands
The following describes the NetBIOS packet filter commands. See for information on the command structure. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls. You can configure NetBIOS filters to do the following: •...
Page 759: Table 272 Netbios Filter Default Settings
ZyWALL 5/35/70 Series User’s Guide The filter types and their default settings are as follows. Table 272 NetBIOS Filter Default Settings NAME DESCRIPTION Between LAN This field displays whether NetBIOS packets are blocked or forwarded and WAN between the LAN and the WAN. Between LAN This field displays whether NetBIOS packets are blocked or forwarded and DMZ...
Page 760 sys filter netbios config 3 on sys filter netbios config 4 off Appendix O NetBIOS Filter Commands ZyWALL 5/35/70 Series User’s Guide This command blocks IPSec NetBIOS packets. This command stops NetBIOS commands from initiating calls.
Page 761 ZyWALL 5/35/70 Series User’s Guide Appendix O NetBIOS Filter Commands...
Page 762: Certificates Commands
The following describes the certificate commands. See information on the command structure. All of these commands start with certificates. Table 273 Certificates Commands COMMAND DESCRIPTION my_cert create create create create Appendix P Certificates Commands ZyWALL 5/35/70 Series User’s Guide P P E N D I X Certificates Commands Appendix M on page 750 Create a self-signed local host certificate.
Page 763 ZyWALL 5/35/70 Series User’s Guide Table 273 Certificates Commands (continued) COMMAND DESCRIPTION create import export view verify delete list rename def_self_sig Create a certificate request and enroll for a cmp_enroll certificate immediately online using CMP <name> <CA protocol. <name> specifies a descriptive name addr>...
Page 764 Table 273 Certificates Commands (continued) COMMAND DESCRIPTION replace_fact ca_trusted import export view verify delete list rename crl_issuer remote_trusted import export view verify Appendix P Certificates Commands ZyWALL 5/35/70 Series User’s Guide Create a certificate using your device MAC address that will be specific to this device. The factory default certificate is a common default certificate for all ZyWALL models.
Page 765 ZyWALL 5/35/70 Series User’s Guide Table 273 Certificates Commands (continued) COMMAND DESCRIPTION delete list rename dir_server delete view edit list rename cert_manager reinit Delete the specified trusted remote host <name> certificate. <name> specifies the name of the certificate to be deleted. List all trusted remote host certificate names and basic information.
Page 766: Brute-Force Password Guessing Protection
Brute-Force Password Guessing Brute-force password guessing protection allows you to specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered. The following describes the commands for enabling, disabling and configuring the brute-force password guessing protection mechanism for the password.
Page 767 ZyWALL 5/35/70 Series User’s Guide Appendix Q Brute-Force Password Guessing Protection...
Page 768: Appendix R Boot Commands
The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your ZyWALL, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen.
Page 769: Figure 495 Boot Module Commands
ZyWALL 5/35/70 Series User’s Guide Figure 495 Boot Module Commands just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time ATDA(y,m,d) change system date to year/month/day or show...
Page 770: Appendix S Log Descriptions
This appendix provides descriptions of example log messages. Table 275 System Maintenance Logs LOG MESSAGE Time calibration is successful Time calibration failed WAN interface gets IP: %s DHCP client IP expired DHCP server assigns %s Successful SMT login SMT login failed Successful WEB login WEB login failed Successful TELNET login...
Page 771: Table 276 System Error Logs
ZyWALL 5/35/70 Series User’s Guide Table 275 System Maintenance Logs (continued) LOG MESSAGE Configuration Change: PC = 0x%x, Task ID = 0x%x Successful SSH login SSH login failed Successful HTTPS login HTTPS login failed DNS server %s was not responding to last 32 consecutive queries…...
Page 772: Table 277 Access Control Logs
Table 276 System Error Logs (continued) LOG MESSAGE WAN connection is down. Dial Backup starts Dial Backup ends DHCP Server cannot assign the static IP %S (out of range). The DHCP static IP %s is conflict. SMTP fail (%s) SMTP authentication fail (%s) Table 277 Access Control Logs LOG MESSAGE...
Page 773: Table 278 Tcp Reset Logs
ZyWALL 5/35/70 Series User’s Guide Table 278 TCP Reset Logs LOG MESSAGE Under SYN flood attack, sent TCP RST Exceed TCP MAX incomplete, sent TCP RST Peer TCP state out of order, sent TCP RST Firewall session time out, sent TCP RST Exceed MAX incomplete, sent TCP RST Access block, sent TCP...
Page 774: Table 280 Icmp Logs
or type and code details, see Table 280 ICMP Logs LOG MESSAGE Firewall default policy: ICMP <Packet Direction>, <type:%d>, <code:%d> Firewall rule [NOT] match: ICMP <Packet Direction>, <rule:%d>, <type:%d>, <code:%d> Triangle route packet forwarded: ICMP Packet without a NAT table entry blocked: ICMP Unsupported/out-of-order ICMP: ICMP...
Page 775: Table 283 Upnp Logs
ZyWALL 5/35/70 Series User’s Guide Table 282 PPP Logs (continued) LOG MESSAGE ppp:LCP Closing ppp:IPCP Closing Table 283 UPnP Logs LOG MESSAGE UPnP pass through Firewall Table 284 Content Filtering Logs LOG MESSAGE %s: Keyword blocking %s: Not in trusted web list %s: Forbidden Web site The web site is in the forbidden web site list.
Page 776: Table 285 Attack Logs
Table 284 Content Filtering Logs (continued) LOG MESSAGE Connecting to content filter server fail License key is invalid The external content filtering license key is invalid. For type and code details, see Table 285 Attack Logs LOG MESSAGE attack [ TCP | UDP | IGMP | ESP | GRE | OSPF ] attack ICMP (type:%d, code:%d)
Page 777: Table 286 Remote Management Logs
ZyWALL 5/35/70 Series User’s Guide Table 285 Attack Logs (continued) LOG MESSAGE Firewall sent TCP packet in response to DoS attack ICMP Source Quench ICMP ICMP Time Exceed ICMP ICMP Destination Unreachable ICMP ping of death. ICMP smurf ICMP IP address in FTP port command is different from the client IP address.
Page 778: Table 287 Wireless Logs
Table 287 Wireless Logs LOG MESSAGE WLAN MAC Filter Fail WLAN MAC Filter Success WLAN STA Association WLAN STA Association List Full WLAN STA Association Again The SSID and time of association were updated for an wireless Table 288 IPSec Logs LOG MESSAGE Discard REPLAY packet Inbound packet...
Page 779: Table 289 Ike Logs
ZyWALL 5/35/70 Series User’s Guide Table 289 IKE Logs LOG MESSAGE Active connection allowed exceeded Start Phase 2: Quick Mode Verifying Remote ID failed: Verifying Local ID failed: IKE Packet Retransmit Failed to send IKE Packet Too many errors! Deleting SA Phase 1 IKE SA process done Duplicate requests with the same cookie...
Page 780 Table 289 IKE Logs (continued) LOG MESSAGE Remote IP <Remote IP> / <Remote IP> conflicts Phase 1 ID type mismatch Phase 1 ID content mismatch No known phase 1 ID type found ID type mismatch. Local / Peer: <Local ID type/Peer ID type>...
Page 781 ZyWALL 5/35/70 Series User’s Guide Table 289 IKE Logs (continued) LOG MESSAGE Rule [%d] Phase 2 authentication algorithm mismatch Rule [%d] Phase 2 encapsulation mismatch Rule [%d]> Phase 2 pfs mismatch Rule [%d] Phase 1 ID mismatch The listed rule’s IKE phase 1 ID did not match between the Rule [%d] Phase 1 hash mismatch Rule [%d] Phase 1 preshared...
Page 782: Table 290 Pki Logs
Table 290 PKI Logs LOG MESSAGE Enrollment successful Enrollment failed Failed to resolve <SCEP CA server url> Enrollment successful Enrollment failed Failed to resolve <CMP CA server url> Rcvd ca cert: <subject name> Rcvd user cert: <subject name> Rcvd CRL <size>: <issuer name>...
Page 783: Table 291 Certificate Path Verification Failure Reason Codes
ZyWALL 5/35/70 Series User’s Guide Table 291 Certificate Path Verification Failure Reason Codes CODE DESCRIPTION Algorithm mismatch between the certificate and the search constraints. Key usage mismatch between the certificate and the search constraints. Certificate was not valid in the time interval. (Not used) Certificate is not valid.
Page 784: Table 293 Acl Setting Notes
Table 292 802.1X Logs (continued) LOG MESSAGE Local User Database does not find user`s credential. RADIUS accepts user. RADIUS rejects user. Pls check RADIUS Server. Local User Database does not support authentication method. User logout because of session timeout expired. User logout because of user deassociation.
Page 785: Table 294 Icmp Notes
ZyWALL 5/35/70 Series User’s Guide Table 293 ACL Setting Notes (continued) PACKET DIRECTION (L to L/ZW) (W to W/ZW) (D to D/ZW) (L to WL) (WL to L) (W to WL) (WL to W) (D to WL) (WL to D) (WL to WL) Table 294 ICMP Notes TYPE...
Page 786: Table 295 Idp Logs
Table 294 ICMP Notes (continued) TYPE CODE Table 295 IDP Logs LOG MESSAGE The buffer size is too small! The format of the user config file is incorrect! The system is doing signature update now , please wait! No data! IDP %s! Can not find the signature , please...
Page 787: Table 296 Av Logs
ZyWALL 5/35/70 Series User’s Guide Table 295 IDP Logs (continued) LOG MESSAGE Signature update OK - New signature version: <Signature version> Release Date: <Release date>! The turbo card is not ready , please insert the card and reboot! Table 296 AV Logs LOG MESSAGE HTTP Virus infected - %s!
Page 788: Table 297 As Logs
Table 296 AV Logs (continued) LOG MESSAGE The turbo card is not ready , please insert the card and reboot! The system is doing signature update now , please wait! Table 297 AS Logs LOG MESSAGE Mail is in the Black List - Mail From:%EMAIL_ADDRESS% Subject:%MAIL_SUBJECT%!
Page 789 ZyWALL 5/35/70 Series User’s Guide Table 297 AS Logs (continued) LOG MESSAGE Remove rating server [%Rating Server IP Address%] from server list! "This is a phishing mail - Spam Score:%d Mail From:%EMAIL_ADDRESS% Subject:%MAIL_SUBJECT%!" Invalid parameter for AsEngine! Mail Parser buffer is overflow! There is no available HTTP session for...
Page 790: Table 298 Syslog Logs
Syslog Logs There are two types of syslog: event logs and traffic logs. The device generates an event log when a system event occurs, for example, when a user logs in or the device is under attack. The device generates a traffic log when a "session" is terminated. A traffic log summarizes the session's type, when it started and stopped the amount of traffic that was sent and received and so on.
Page 791: Table 299 Rfc-2408 Isakmp Payload Types
ZyWALL 5/35/70 Series User’s Guide Table 298 Syslog Logs (continued) LOG MESSAGE Event Log: <Facility*8 + Severity>Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP:dstPort>" ob="<0|1>" ob_mac="<mac address>" msg="<msg>" note="<note>" devID="<mac address>" cat="IDP" class="<idp class>" sid="<idp sid> act="<idp action>" count="1" Event Log: <Facility*8 + Severity>Mon dd hr:mm:ss hostname src="<srcIP:srcPort>"...
Page 792: Figure 496 Displaying Log Categories Example
Log Commands Go to the command interpreter interface. use the commands. Configuring What You Want the ZyWALL to Log 1 Use the sys logs load configure which logs the ZyWALL is to record. 2 Use sys logs category Figure 496 Displaying Log Categories Example ras>...
Page 793: Log Command Example
ZyWALL 5/35/70 Series User’s Guide • Use the sys logs clear Log Command Example This example shows how to set the ZyWALL to record the access logs and alerts and then view the results. ras> sys logs load ras> sys logs category access 3 ras>...
Page 794: Index
Numerics 10/100 Mbps Ethernet WAN 110V AC 230V AC Abnormal Working Conditions Access control Access Point Accessories Action for Matched Packets Action for No Spam Score Action for Spam Mails Active 515, 517, 548 Acts of God Address Assignment 138, 414 Advanced Encryption Standard (AES) 300, 304 Airflow...
Page 795 ZyWALL 5/35/70 Series User’s Guide Cable Modem Cables, Connecting Call Back Delay Call Control Call History 627, 628 Call Scheduling 55, 644 Max Number of Schedule Sets PPPoE Precedence Call-Triggering Packet CardBus slot Central Network Management certificate Certificate Authority Certifications Changes or Modifications Changing the Password Channel...
Page 796 DNS Server For VPN Host Domain Name 138, 272, 380, 480, 599 Basics Types DoS (Denial of Service) Drop Timeout DSL Modem 58, 549 155, 513 Dust Dynamic DNS Dynamic DNS Support Dynamic WEP Key Exchange DYNDNS Wildcard 415, 424 178, 179, 183 EAP Authentication 710, 711...
Page 797 ZyWALL 5/35/70 Series User’s Guide Firmware File Maintenance Fitness Flow Control Fragmentation Threshold Fragmentation threshold France, Contact Information Fraudsters 380, 424, 428, 443, 610, 634 File Upload GUI-based Clients Restoring Files FTP File Transfer FTP Restrictions 428, 611, 634 FTP Server 57, 571 Full Network Management Functionally Equivalent...
Page 798 IP Addressing IP Alias 56, 526 IP Alias Setup IP Classes IP Multicast Internet Group Management Protocol (IGMP) IP Policy Routing IP Pool 110, 160, 172, 524 IP Pool Setup IP Ports IP Routing Policy (IPPR) Benefits Cost Savings Criteria Load Sharing IP Spoofing 201, 204...
Page 799 ZyWALL 5/35/70 Series User’s Guide MIME MIME Header MIME Headers MIME Value Modifications MSDU Multicast 108, 110, 172, 519, 525, 553 Multimedia 231, 465 Multipurpose Internet Mail Extensions Mutation virus My IP Addr My Login 515, 548 My Login Name My Password 515, 529, 548 My Server IP Addr...
Page 800 Levels Policy-based Routing Polyphormic virus Pool POP2 POP3 200, 265, 267, 269, 380 Port Forwarding Port Restricted Cone NAT port scans Post Office Protocol Postage Prepaid. Power Cord PPPoE 55, 80, 82, 698 PPPoE Encapsulation 528, 531, 547, 549, 550, 554 PPTP 80, 83, 143, 146, 380 Client...
Page 801 ZyWALL 5/35/70 Series User’s Guide Return Material Authorization (RMA) Number Returned Products Returns RFC 1889 RFC 3489 Rights Rights, Legal 107, 108, 519, 525, 526, 553 Direction Version 526, 553 Risk Risks RoadRunner Support Roaming Example Requirements Root bridge Root Class Route Routing Policy 482, 628...
Page 802 53, 437 SSH Implementation startup Stateful Inspection 53, 198, 199, 204, 205 Process ZyWALL Static Route Storage Space STP (Spanning Tree Protocol) STP Port States STP See Spanning Tree Protocol STP Terminology SUA (Single User Account) 374, 558 Sub-class Layers Subnet Mask 107, 109, 121, 171, 221, 272, 518, 525, 529, 552, 557...
Page 803 Blaster SQL Slammer worm WPA-PSK Written Permission www.dyndns.org Xmodem File Upload XMODEM Protocol ZyNOS 2, 599, 609 ZyNOS F/W Version 599, 609 ZyXEL Communications Corporation ZyXEL Home Page ZyXEL Limited Warranty Note ZyXEL Network Operating System ZyXEL’s Firewall Introduction Index...

This manual is also suitable for:

Zywall 5 series Zywall 35 series Zywall 70 series

ZyXEL Communications Internet Security Appliance ZyWALL5UTM 4.0 User Manual

Chapter 1 Getting to Know Your Zywall

Chapter 2 Introducing the Web Configurator

Chapter 3 Wizard Setup

Chapter 4 Registration

Chapter 5 LAN Screens

Chapter 6 Bridge Screens

Chapter 7 WAN Screens

Chapter 8 DMZ Screens

Chapter 9 Wireless LAN

Chapter 10 Firewalls

Quick Links

Troubleshooting

Related Manuals for ZyXEL Communications Internet Security Appliance ZyWALL5UTM 4.0

Summary of Contents for ZyXEL Communications Internet Security Appliance ZyWALL5UTM 4.0