Page 1 ZyWALL USG 2000 Unified Security Gateway Default Login Details LAN Port IP Address http://192.168.1.1 User Name admin Password 1234 www.zyxel.com Firmware Version 2.11 Edition 1, 2/2009 www.zyxel.com Copyright © 2009 ZyXEL Communications Corporation...
Page 3: About This User's Guide
• To find specific information in this guide, use the Contents Overview, the Table of Contents, the Index, or search the PDF file. E-mail techwriters@zyxel.com.tw if you cannot find the information you require. Related Documentation • Quick Start Guide The Quick Start Guide is designed to show you how to make the ZyWALL hardware connections, rack mounting and access the web configurator wizards.
Page 4 In the event of problems that cannot be solved by using this manual, you should contact your vendor. If you cannot contact your vendor, then contact a ZyXEL office for the region in which you bought the device. See http://www.zyxel.com/ web/contact_us.php for contact information.
Page 5: Document Conventions
Syntax Conventions • The ZyWALL USG 2000 may be referred to as the “ZyWALL”, the “device”, the “system” or the “product” in this User’s Guide. • Product labels, screen names, field labels and field choices are all in bold font.
Page 6 Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The ZyWALL icon is not an exact representation of your device. ZyWALL Computer Notebook computer Server Firewall Telephone Switch Router ZyWALL USG 2000 User’s Guide...
Page 7: Safety Warnings
Your product is marked with this symbol, which is known as the WEEE mark. WEEE stands for Waste Electronics and Electrical Equipment. It means that used electrical and electronic products should not be mixed with general waste. Used electrical and electronic equipment should be treated separately. ZyWALL USG 2000 User’s Guide...
Page 8 Safety Warnings ZyWALL USG 2000 User’s Guide...
Page 9: Table Of Contents
SSL VPN ..........................379 SSL User Screens ........................391 SSL User Application Screens ....................399 SSL User File Sharing ......................401 L2TP VPN ..........................409 L2TP VPN Example ......................... 415 Application Patrol ........................ 443 Application Patrol ........................445 ZyWALL USG 2000 User’s Guide...
Page 10 System ........................... 697 Maintenance, Troubleshooting, & Specifications ............. 747 File Manager ........................... 749 Logs ............................761 Reports ........................... 775 Diagnostics ..........................793 Reboot ............................. 795 Troubleshooting ........................797 Product Specifications ......................803 Appendices and Index ......................809 ZyWALL USG 2000 User’s Guide...
Page 11: Table Of Contents
2.3 Applications ......................... 43 2.3.1 VPN Connectivity ....................... 43 2.3.2 SSL VPN Network Access ..................43 2.3.3 User-Aware Access Control ..................45 2.3.4 Multiple WAN Interfaces ..................... 45 2.3.5 Device HA ........................46 Chapter 3 Web Configurator........................47 ZyWALL USG 2000 User’s Guide...
Page 12 4.8.6 VPN Advanced Wizard - Phase 2 ................96 4.8.7 VPN Advanced Wizard - Summary ................98 4.8.8 VPN Advanced Wizard - Finish ................. 99 Chapter 5 Configuration Basics......................101 5.1 Object-based Configuration ....................101 5.2 Zones, Interfaces, and Physical Ports ................102 ZyWALL USG 2000 User’s Guide...
Page 13 6.1.1 Configure a WAN Ethernet Interface ................ 120 6.1.2 Configure Zones ....................... 120 6.1.3 Configure Port Grouping ..................121 6.2 How to Configure Load Balancing ..................122 6.2.1 Set Up Available Bandwidth on Ethernet Interfaces ..........123 ZyWALL USG 2000 User’s Guide...
Page 14 7.2.5 The DHCP Table Screen ..................159 7.2.6 The Port Statistics Screen ..................160 7.2.7 The Port Statistics Graph Screen ................161 7.2.8 The Current Users Screen ..................162 7.2.9 The SEM Status Detail Screen ................. 162 ZyWALL USG 2000 User’s Guide...
Page 15 10.6.4 PPP Interface Add/Edit ..................202 10.7 Cellular Configuration Screen (3G) ................. 205 10.7.1 Cellular Add/Edit Screen ..................208 10.8 Cellular Status Screen ..................... 212 10.9 VLAN Interfaces ......................214 10.9.1 VLAN Overview ...................... 214 ZyWALL USG 2000 User’s Guide...
Page 16 13.1.1 What You Can Do in the RIP and OSPF Screens ..........263 13.1.2 What You Need to Know About Routing Protocols ..........263 13.2 The RIP Screen ....................... 264 13.3 The OSPF Screen ......................265 13.3.1 Configuring the OSPF Screen ................269 ZyWALL USG 2000 User’s Guide...
Page 17 ALG ............................305 18.1 ALG Overview ......................... 305 18.1.1 What You Can Do in the ALG Screen ..............305 18.1.2 What You Need to Know About ALG ..............306 18.1.3 Before You Begin ....................308 ZyWALL USG 2000 User’s Guide...
Page 18 21.1.2 What You Need to Know About IPSec VPN ............340 21.1.3 Before You Begin ....................341 21.2 The VPN Connection Screen ..................341 21.2.1 The VPN Connection Add/Edit (IKE) Screen ............343 21.2.2 The VPN Connection Add/Edit Manual Key Screen ..........350 ZyWALL USG 2000 User’s Guide...
Page 19 25.3 Opening a File or Folder ....................402 25.3.1 Downloading a File ....................404 25.3.2 Saving a File ......................405 25.4 Creating a New Folder ..................... 405 25.5 Renaming a File or Folder ....................406 ZyWALL USG 2000 User’s Guide...
Page 20 28.4.1 The Other Applications Add/Edit Screen ..............464 28.5 Application Patrol Statistics ..................... 466 28.5.1 Application Patrol Statistics: General Setup ............467 28.5.2 Application Patrol Statistics: Bandwidth Statistics ..........468 28.5.3 Application Patrol Statistics: Protocol Statistics ............. 469 ZyWALL USG 2000 User’s Guide...
Page 21 30.8 Configuring Custom Signatures ..................508 30.8.1 Creating or Editing a Custom Signature ..............510 30.8.2 Custom Signature Example ................... 516 30.8.3 Applying Custom Signatures .................. 519 30.8.4 Verifying Custom Signatures .................. 519 30.9 IDP Technical Reference ....................520 ZyWALL USG 2000 User’s Guide...
Page 22 Chapter 34 Anti-Spam ..........................575 34.1 Overview .......................... 575 34.1.1 What You Can Do in the Anti-Spam Screens ............575 34.1.2 What You Need to Know About Anti-Spam ............575 34.2 Before You Begin ......................578 ZyWALL USG 2000 User’s Guide...
Page 23 36.2 User Summary Screen ....................616 36.2.1 User Add/Edit Screen ..................... 616 36.3 User Group Summary Screen ..................619 36.3.1 Group Add/Edit Screen ..................620 36.4 Setting Screen ........................ 620 36.4.1 Force User Authentication Policy Add/Edit Screen ..........624 ZyWALL USG 2000 User’s Guide...
Page 24 40.1.5 What You Need To Know About AAA Servers ............649 40.2 Active Directory or LDAP Default Server Screen ............649 40.2.1 Configuring Active Directory or LDAP Default Server Settings ......651 40.3 Active Directory or LDAP Group Summary Screen ............652 ZyWALL USG 2000 User’s Guide...
Page 25 44.1 Overview .......................... 689 44.1.1 What You Can Do in the SSL Application Screens ..........689 44.1.2 What You Need to Know About SSL Application Objects ........689 44.1.3 Example: Specifying a Web Site for Access ............690 ZyWALL USG 2000 User’s Guide...
Page 26 45.7.1 How SSH Works ....................729 45.7.2 SSH Implementation on the ZyWALL ..............730 45.7.3 Requirements for Using SSH ................. 730 45.7.4 Configuring SSH ....................730 45.7.5 Secure Telnet Using SSH Examples ..............732 45.8 Telnet ..........................734 ZyWALL USG 2000 User’s Guide...
Page 27 47.4.4 Active Log Summary Screen .................. 771 Chapter 48 Reports ..........................775 48.1 Overview .......................... 775 48.1.1 What You Can Do in the Report Screens ............... 775 48.2 The Traffic Statistics Screen .................... 775 48.3 The Session Monitor Screen ..................778 ZyWALL USG 2000 User’s Guide...
Page 28 Appendix A Log Descriptions ....................811 Appendix B Common Services..................... 871 Appendix C Displaying Anti-Virus Alert Messages in Windows..........875 Appendix D Importing Certificates..................881 Appendix E Open Software Announcements ............... 887 Appendix F Legal Information ....................933 Index............................937 ZyWALL USG 2000 User’s Guide...
Page 29: Getting Started
Getting Started Introducing the ZyWALL (31) Features and Applications (39) Web Configurator (47) Configuration Basics (101) Tutorials (119) Status (149) Registration (165) Signature Update (171)
Page 31: Introducing The Zywall
“1234” respectively. P7 and P8 are GbE dual personality interfaces. A dual personality interface includes one Gigabit port and one slot for a mini-GBIC transceiver (SFP module) with one port active at a time. ZyWALL USG 2000 User’s Guide...
Page 32: Front Panel
Chapter 1 Introducing the ZyWALL 1.2 Front Panel Figure 1 ZyWALL USG 2000 Front Panel 1.2.1 Dual Personality Interfaces The ZyWALL’s dual personality interfaces are 1000Base-T/mini-GBIC combo ports. For each interface you can connect either to the 1000Base-T port or the mini-GBIC port.
Page 33 Use the following steps to install a mini GBIC transceiver (SFP module). Insert the transceiver into the slot with the exposed section of PCB board facing down. Figure 2 Transceiver Installation Example Press the transceiver firmly until it clicks into place. Figure 3 Installed Transceiver ZyWALL USG 2000 User’s Guide...
Page 34 Press down on the top of the fiber-optic cable where it connects to the transceiver to release it. Then pull the fiber-optic cable out. Figure 5 Removing the Fiber-optic Cable Example Open the transceiver’s latch (latch styles vary). Figure 6 Opening the Transceiver’s Latch Example ZyWALL USG 2000 User’s Guide...
Page 35: Front Panel Leds
The AUX port is sending or receiving packets for the dial backup connection. CARD Green Reserved for future use. There is no card in the CARD SLOT. There is a card in the CARD SLOT. This LED is reserved for future use. ZyWALL USG 2000 User’s Guide...
Page 36: Management Overview
The CLI allows you to use text-based commands to configure the ZyWALL. You can access it using remote management (for example, SSH or Telnet) or via the console port. See the Command Reference Guide for more information about the CLI. ZyWALL USG 2000 User’s Guide...
Page 37: Starting And Stopping The Zywall
Note: It is recommended you use the shutdown command before turning off the ZyWALL. When you apply configuration files or running shell scripts, the ZyWALL does not stop or start the system processes. However, you might lose access to network ZyWALL USG 2000 User’s Guide...
Page 38 Chapter 1 Introducing the ZyWALL resources temporarily while the ZyWALL is applying configuration files or running shell scripts. ZyWALL USG 2000 User’s Guide...
Page 39: Features And Applications
Many security settings are made by zone, not by interface, port, or network. As a result, it is much simpler to set up and to change security settings in the ZyWALL. You can create or remove zones, and you can assign each network, VLAN, or interface to any zone. ZyWALL USG 2000 User’s Guide...
Page 40 ZyWALL to check web sites against an external database of dynamically-updated ratings of millions of web sites. You then simply select categories to block or monitor, such as pornography or racial intolerance, from a pre-defined list. ZyWALL USG 2000 User’s Guide...
Page 41: Packet Flow
The PPPoE or PPTP encapsulation used Application Layer Gateway DNAT Destination NAT Routing Routing includes policy routes, interface routing, static routes and load balancing for example. Firewall (Through ZyWALL) Firewall (To ZyWALL) Intrusion Detection and Protection ZyWALL USG 2000 User’s Guide...
Page 42: Interface To Interface (Through Zywall)
Ethernet -> VLAN -> Encap -> ALG -> DNAT-> Routing -> FW -> IDP -> AP -> CF -> AV -> AS -> SNAT -> IPSec E -> Routing -> BWM -> Encap -> VLAN -> Ethernet ZyWALL USG 2000 User’s Guide...
Page 43: Applications
In reverse proxy mode, the ZyWALL is a proxy that acts on behalf of the local network servers (such as your web and mail servers). As the final destination, the ZyWALL appears to be the server to remote users. This provides an added layer of protection for your internal servers. ZyWALL USG 2000 User’s Guide...
Page 44 IP addresses in the same subnet as the local network. This allows them to access network resources in the same way as if they were part of the internal network. Figure 11 Network Access Mode: Full Tunnel Mode ZyWALL USG 2000 User’s Guide...
Page 45: User-Aware Access Control
Set up multiple connections to the Internet on the same port, or set up multiple connections on different ports. In either case, you can balance the loads between them. Figure 13 Applications: Multiple WAN Interfaces ZyWALL USG 2000 User’s Guide...
Page 46: Device Ha
Chapter 2 Features and Applications 2.3.5 Device HA Set up an additional ZyWALL as a backup gateway to ensure the default gateway is always available for the network. Figure 14 Applications: Device HA ZyWALL USG 2000 User’s Guide...
Page 47: Web Configurator
• Enable Java permissions (enabled by default) • Enable cookies The recommended screen resolution is 1024 x 768 pixels. 3.2 Web Configurator Access Make sure your ZyWALL hardware is properly connected. See the Quick Start Guide. ZyWALL USG 2000 User’s Guide...
Page 48 Click Login. If you logged in using the default user name and password, the Update Admin Info screen (Figure 16 on page 48) appears. Otherwise, the main screen (Figure 17 on page 49) appears. Figure 16 Update Admin Info Screen ZyWALL USG 2000 User’s Guide...
Page 49: Web Configurator Main Screen
Figure 17 Main Screen 3.3 Web Configurator Main Screen As illustrated in Figure 17 on page 49, the main screen is divided into these parts: • A - title bar • B - navigation panel ZyWALL USG 2000 User’s Guide...
Page 50: Title Bar
IDP/AppPatrol Use this screen to schedule IDP signature updates and to update signature information immediately. System Protect Use this screen to schedule system-protect signature updates and to update signature information immediately. ZyWALL USG 2000 User’s Guide...
Page 51 Use this screen to configure IPSec tunnels. Connection VPN Gateway Use this screen to configure IKE tunnels. Concentrator Use this screen to configure VPN concentrators (hub-and-spoke VPN). SA Monitor Use this screen to monitor current IPSec VPN tunnels. ZyWALL USG 2000 User’s Guide...
Page 52 Use this screen to create and manage content filter policies. Filter Filter Profile Use this screen to create and manage the detailed filtering rules for content filtering policies. Cache Use this screen to manage the URL cache in the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 53 Use this screen to create and manage the ZyWALL’s certificates. Trusted Use this screen to import and manage certificates from trusted Certificates sources. ISP Account Use this screen to create and manage ISP account information for PPPoE/PPTP interfaces. ZyWALL USG 2000 User’s Guide...
Page 54 Use this screen to manage and run shell script files for the ZyWALL. View Log Use this screen to look at log entries. Log Setting Use this screen to configure the system log, e-mail logs, and remote syslog servers. ZyWALL USG 2000 User’s Guide...
Page 55: Main Window
Status screen. 3.3.4 Message Bar The message bar displays configuration status information. Check the message bar after you click Apply or OK to verify that the configuration has been updated. Figure 18 Message Bar ZyWALL USG 2000 User’s Guide...
Page 56 Figure 19 Warning Messages Click Refresh Now to update the screen. Close the popup window when you are done with it. Click Clear Warning Messages to remove the current warning messages from the window. ZyWALL USG 2000 User’s Guide...
Page 57 Close the popup window when you are done with it. See the Command Reference Guide for information about the commands. ZyWALL USG 2000 User’s Guide...
Page 58 Chapter 3 Web Configurator ZyWALL USG 2000 User’s Guide...
Page 59: Wizard Setup
(see Load Balancing Algorithms on page 241 for more on load balancing). This wizard creates matching ISP account settings in the ZyWALL if you use PPPoE or PPTP. This wizard also creates a WAN trunk. ZyWALL USG 2000 User’s Guide...
Page 60: Installation Setup, One Isp
The wizard screens vary depending on what encapsulation type you use. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you don’t have that information. ZyWALL USG 2000 User’s Guide...
Page 61 Select the security zone to which you want this interface and Internet connection to belong. IP Address Select Auto If your ISP did not assign you a fixed IP address. Assignment Select Static If the ISP assigned a fixed IP address. Next Click Next to continue. ZyWALL USG 2000 User’s Guide...
Page 62: Step 1 Internet Access
Figure 23 Ethernet Encapsulation: Auto: Finish You have set up your ZyWALL to access the Internet. Note: If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. ZyWALL USG 2000 User’s Guide...
Page 63: Ethernet: Static Ip Address Assignment
WAN IP Address Assignments WAN Interface This displays the identity of the interface you configure to connect with your ISP. Zone This field displays to which security zone this interface and Internet connection will belong. ZyWALL USG 2000 User’s Guide...
Page 64: Step 2 Internet Access Ethernet
Gateway IP Address: Enter the IP address of the router through which this WAN connection will send traffic (the default gateway). DNS Server: The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The ZyWALL uses ZyWALL USG 2000 User’s Guide...
Page 65 You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 77). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 66: Pppoe: Auto Ip Address Assignment
Select Nailed-Up if you do not want the connection to time out. Idle Timeout Type the time in seconds that elapses before the router automatically disconnects from the PPPoE server. The default time is 100 seconds. ZyWALL USG 2000 User’s Guide...
Page 67 You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 77). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 68: Pppoe: Static Ip Address Assignment
Select Nailed-Up if you do not want the connection to time out. Idle Timeout Type the time in seconds that elapses before the router automatically disconnects from the PPPoE server. The default time is 100 seconds. ZyWALL USG 2000 User’s Guide...
Page 69: Step 2 Internet Access Pppoe
Assignment in the previous screen. WAN Interface: This is the number of the interface that will connect with your ISP. Zone: This is the security zone to which this interface and Internet connection will belong. ZyWALL USG 2000 User’s Guide...
Page 70 You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 77). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 71: Pptp: Auto Ip Address Assignment
Type your password again for confirmation. Confirm Nailed-Up Select Nailed-Up if you do not want the connection to time out. Idle Timeout Type the time in seconds that elapses before the router automatically disconnects from the PPTP server. PPTP Configuration ZyWALL USG 2000 User’s Guide...
Page 72 Leave the field as 0.0.0.0 if you do not want to configure DNS servers. Server If you do not configure a DNS server, you must know the IP address of a machine in order to access it. Next Click Next to continue. ZyWALL USG 2000 User’s Guide...
Page 73 You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 77). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 74: Pptp: Static Ip Address Assignment
Type the password associated with the user name above. Use up to 64 ASCII characters except the [] and ?. Retype to Type your password again for confirmation. Confirm Nailed-Up Select Nailed-Up if you do not want the connection to time out. ZyWALL USG 2000 User’s Guide...
Page 75: Step 2 Internet Access Pptp
Note: Enter the Internet access information exactly as given to you by your ISP. 4.3.9.1 ISP Parameters Type the User Name given to you by your ISP. Type the Password associated with the user name. ZyWALL USG 2000 User’s Guide...
Page 76 DNS Server: The Domain Name System (DNS) maps a domain name to an IP address and vice versa. Enter a DNS server's IP address(es). The ZyWALL uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. ZyWALL USG 2000 User’s Guide...
Page 77: Step 4 Internet Access - Finish
Note: You must be connected to the Internet to register. This screen displays a read-only user name and password if the ZyWALL is already registered. It also shows which trial services are activated (if any). You can still ZyWALL USG 2000 User’s Guide...
Page 78 Chapter 4 Wizard Setup select the unchecked trial service(s) to activate it after registration. Use the Registration > Service screen to update your service subscription status. Figure 34 Registration ZyWALL USG 2000 User’s Guide...
Page 79 Select the check box to activate a trial. The trial period starts the day you activate the trial. Anti-Virus Content Filter Close Click Close to exit the wizard. Next Click Next to save your changes back to the ZyWALL and activate the selected services. ZyWALL USG 2000 User’s Guide...
Page 80: Installation Setup, Two Internet Service Providers
Figure 35 Registration: Registered Device 4.5 Installation Setup, Two Internet Service Providers This wizard allows you to configure two interfaces for Internet access through either two different Internet Service Providers (ISPs) or two different accounts with the same ISP. ZyWALL USG 2000 User’s Guide...
Page 81 Chapter 4 Wizard Setup The configuration of the following screens is explained in Section 4.2 on page 60 section. Configure the First WAN Interface and click Next. Figure 36 Internet Access: Step 1: First WAN Interface ZyWALL USG 2000 User’s Guide...
Page 82 Chapter 4 Wizard Setup After you configure the First WAN Interface, you can configure the Second WAN Interface. Click Next to continue. Figure 37 Internet Access: Step 3: Second WAN Interface ZyWALL USG 2000 User’s Guide...
Page 83: Internet Access Wizard Setup Complete
ZyWALL and activate service trials (see Section 4.4 on page 77). Alternatively, click Close to exit the wizard. 4.5.1 Internet Access Wizard Setup Complete Well done! You have successfully set up your ZyWALL to access the Internet. ZyWALL USG 2000 User’s Guide...
Page 84: Vpn Setup
ZyWALL using a pre-shared key and default security settings. Advanced Use this wizard to configure detailed VPN security settings such as using certificates. The VPN connection can be to another ZLD-based ZyWALL or other IPSec device. Next Click Next to continue. ZyWALL USG 2000 User’s Guide...
Page 85: Vpn Wizards
The VPN connection can be to another ZLD-based ZyWALL or other IPSec devices. 4.7.1 VPN Express Wizard Click the Express radio button as shown in Figure 39 on page 84 to display the following screen. Figure 40 VPN Express Wizard: Step 2 ZyWALL USG 2000 User’s Guide...
Page 86: Vpn Express Wizard - Scenario
• Remote Access (Server Role) - Choose this to allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. ZyWALL USG 2000 User’s Guide...
Page 87 (IP/Mask) router's configured remote IP address (the remote IP address of the other ZyWALL). To specify IP addresses on a network by their subnet mask, type the subnet mask of the LAN behind your ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 88: Vpn Express Wizard - Policy Setting
Remote Policy (IP/Mask): Type the IP address of a computer behind the peer IPSec device. You can also specify a subnet. This must match the local IP address configured on the peer IPSec device. Figure 42 VPN Express Wizard: Step 4 ZyWALL USG 2000 User’s Guide...
Page 89: Vpn Express Wizard - Summary
Local Policy: IP address and subnet mask of the computers on the network behind your ZyWALL that can use the tunnel. Remote Policy: IP address and subnet mask of the computers on the network behind the peer IPSec device that can use the tunnel. ZyWALL USG 2000 User’s Guide...
Page 90: Vpn Express Wizard - Finish
You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 77). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 91: Vpn Advanced Wizard
Choose this to connect to an IPSec server. This ZyWALL is the client (dial- Access in user) and can initiate the VPN tunnel. (Client Role) Back Click Back to return to the previous screen. Next Click Next to continue. ZyWALL USG 2000 User’s Guide...
Page 92 Select Main for identity protection. Select Aggressive to allow more Mode incoming connections from dynamic IP addresses to use separate passwords. Note: Multiple SAs (security associations) connecting through a secure gateway must have the same negotiation mode. ZyWALL USG 2000 User’s Guide...
Page 93 ("0-9", "A-F") characters. Precede hexadecimal characters with “0x”. Both ends of the VPN tunnel must use the same pre-shared key. You will receive a PYLD_MALFORMED (payload malformed) packet if the same pre- shared key is not used on both ends. ZyWALL USG 2000 User’s Guide...
Page 94: Vpn Advanced Wizard - Advanced Settings
Use Dead Peer Detection (DPD) to have the ZyWALL make sure the remote IPSec router is there before transmitting data through the IKE SA. If the remote IPSec server does not respond, the ZyWALL shuts down the IKE SA. ZyWALL USG 2000 User’s Guide...
Page 95 In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP). ZyWALL USG 2000 User’s Guide...
Page 96: Vpn Advanced Wizard - Phase 2
IPSec SA when the SA life time expires. Next Click Next to continue. 4.8.6 VPN Advanced Wizard - Phase 2 Active Protocol: ESP is compatible with NAT, AH is not. Encapsulation: Tunnel is compatible with NAT, Transport is not. ZyWALL USG 2000 User’s Guide...
Page 97 SA life time expires. This read-only screen shows the status of the current VPN setting. Use the summary table to check whether what you have configured is correct. Figure 47 VPN Advanced Wizard: Step 5 ZyWALL USG 2000 User’s Guide...
Page 98: Vpn Advanced Wizard - Summary
Remote Policy: IP address and subnet mask of the computers on the network behind the peer IPSec device that can use the tunnel. Copy and paste the Remote Gateway CLI commands into another ZLD-based ZyWALL’s command line interface. Click Save to save the VPN rule. ZyWALL USG 2000 User’s Guide...
Page 99: Vpn Advanced Wizard - Finish
You can click Next and use the following screen to perform a basic registration (see Section 4.4 on page 77). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 100 Chapter 4 Wizard Setup ZyWALL USG 2000 User’s Guide...
Page 101: Configuration Basics
You can create address objects based on an interface’s IP address, subnet, or gateway. The ZyWALL automatically updates every rule or setting that uses these objects whenever the interface’s IP address settings change. For example, if you ZyWALL USG 2000 User’s Guide...
Page 102: Zones, Interfaces, And Physical Ports
(P1~P8) 5.2.1 Interface Types There are many types of interfaces in the ZyWALL. In addition to being used in various features, interfaces also describe the network that is directly connected to the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 103: Default Interface And Zone Configuration
5.2.2 Default Interface and Zone Configuration This section explains the ZyWALL’s factory default zone and interface configuration. The following figure uses letters to denote public IP addresses or part of a private IP address. Figure 50 Default Network Topology ZyWALL USG 2000 User’s Guide...
Page 104: Terminology In The Zywall
Network policy (IPSec SA) VPN connection Hub-and-spoke VPN (VPN) concentrator Table 25 ZyWALL Terminology That Might Be Different Than Other Products FEATURE / TERM ZYWALL FEATURE / TERM Destination NAT (DNAT) Virtual server Source NAT (SNAT) Policy route ZyWALL USG 2000 User’s Guide...
Page 105: Feature Configuration Overview
You may not have to configure everything in the list of prerequisites. For example, you do not have to create a schedule for a policy route unless time is one of the criterion. ZyWALL USG 2000 User’s Guide...
Page 106: Interface
Edit icon. 5.4.3 Trunks Use trunks to set up load balancing using two or more interfaces. Network > Interface > Trunk MENU ITEM(S) Interfaces PREREQUISITES Policy routes WHERE USED Example: See Chapter 6 on page 119. ZyWALL USG 2000 User’s Guide...
Page 107: Ipsec Vpn
NAT, IP pool for assigning to clients, DNS and WINS server addresses), to-ZyWALL firewall, firewall The IPSec VPN connection used for L2TP VPN can be used in policy WHERE USED routes and zones Example: See Chapter 27 on page 415. ZyWALL USG 2000 User’s Guide...
Page 108: Zones
Use policy routes to control the routing of packets through the ZyWALL’s interfaces, trunks, and send traffic through VPN connections. You also use policy routes for bandwidth management (out of the ZyWALL), port triggering, and ZyWALL USG 2000 User’s Guide...
Page 109 FTP traffic. Note: The ZyWALL checks the policy routes in the order that they are listed. So make sure that your custom policy route comes before any other routes that would also match the FTP traffic. ZyWALL USG 2000 User’s Guide...
Page 110: Static Routes
• In the Source field, select the address object of the VoIP server. • You don’t need to specify the destination address. • Leave the Access field set to Allow and the Log field set to No. ZyWALL USG 2000 User’s Guide...
Page 111: Application Patrol
Use anti-virus to detect and take action on viruses. You must subscribe to use anti-virus. You can subscribe using the Licensing > Registration screens or one of the wizards. Anti-X > AV MENU ITEM(S) Registration, zones PREREQUISITES ZyWALL USG 2000 User’s Guide...
Page 112: Idp
Click Anti-X > Content Filter > Filter Profile. Click the Add icon to go to the screen where you can configure a category-based profile. Name the profile and enable it. Enable the external web filter service. ZyWALL USG 2000 User’s Guide...
Page 113: Anti-Spam
Click Network > Virtual Server to configure the virtual server. Add an entry. Name the entry. Select the WAN interface that the FTP traffic is to come in through (in this example, ge2 or ge3.) ZyWALL USG 2000 User’s Guide...
Page 114: Http Redirect
Select the interface from which you want to redirect incoming HTTP requests (ge1). Specify the IP address of the HTTP proxy server. Specify the port number to use for the HTTP traffic that you forward to the proxy server. ZyWALL USG 2000 User’s Guide...
Page 115: Alg
Policy routes (criteria), firewall, application patrol, content filter, user settings (force user authentication) AAA server Authentication methods authentication VPN gateways (extended authentication), WWW (client methods authentication), L2TP VPN certificates VPN gateways, WWW, SSH, FTP SSL Application SSL VPN ZyWALL USG 2000 User’s Guide...
Page 116: User/Group
Use Dial-in Mgmt for a remote management connection through an external serial modem connected to the AUX port. System > DNS, WWW, SSH, TELNET, FTP, SNMP, Dial-in Mgmt, MENU ITEM(S) Vantage CNM, Language ZyWALL USG 2000 User’s Guide...
Page 117: File Manager
Use these screens to register your ZyWALL and subscribe to services like anti- virus, IDP and application patrol, more SSL VPN tunnels, and content filtering. You must have Internet access to myZyXEL.com. Licensing > Registration MENU ITEM(S) Internet access to myZyXEL.com PREREQUISITES ZyWALL USG 2000 User’s Guide...
Page 118: Licensing Update
Maintenance > Log, Report MENU ITEM(S) 5.6.6 Diagnostics The ZyWALL can generate a file containing the ZyWALL’s configuration and diagnostic information. Maintenance > Diagnostics MENU ITEM(S) ZyWALL USG 2000 User’s Guide...
Page 119: Tutorials
• This example uses a limited number of DMZ servers that need full wire speed communication with each other, so ports P4, P5, and P6 are combined into a ge4 interface port group. It uses IP address 192.168.2.1. Figure 51 Ethernet Interface, Port Grouping, and Zone Configuration Example ZyWALL USG 2000 User’s Guide...
Page 120: Configure A Wan Ethernet Interface
Click Network > Zone and then the WAN zone Edit icon. Select ge8 in the Available list and use the right arrow to move it to the Member list (as shown here). Click OK. Figure 53 Network > Zone > WAN Edit ZyWALL USG 2000 User’s Guide...
Page 121: Configure Port Grouping
Figure 54 Network > Interface > Port Grouping, Drag-and-Drop (P5 to ge4) Drag physical port 6 onto representative interface ge4, as shown next. Figure 55 Network > Interface > Port Grouping, Drag-and-Drop (P6 to ge4) Click Apply. ZyWALL USG 2000 User’s Guide...
Page 122: How To Configure Load Balancing
Figure 57 Trunk Example ge2: 1 Mbps ge3: 1 Mbps ge8: 100 Mbps You need to set up the outgoing bandwidth on each of the three interfaces and configure the WAN_TRUNK trunk’s load balancing settings. ZyWALL USG 2000 User’s Guide...
Page 123: Set Up Available Bandwidth On Ethernet Interfaces
Click Network > Interface > Trunk. Click WAN_TRUNK’s Edit icon. In the Load Balancing Algorithm field, select Spillover. After the screen refreshes, click the Add icon at the top of the right-hand column. Figure 59 Network > Interface > Trunk > WAN_TRUNK > Edit ZyWALL USG 2000 User’s Guide...
Page 124: How To Set Up An Ipsec Vpn Tunnel
Figure 62 VPN Example ge8: 1.2.3.4 2.2.2.2 192.168.1.0/24 172.16.1.0/24 In this example, the ZyWALL is router X (1.2.3.4), and the remote IPSec router is router Y (2.2.2.2). Create the VPN tunnel between ZyWALL X’s LAN subnet ZyWALL USG 2000 User’s Guide...
Page 125: Set Up The Vpn Gateway
The VPN connection manages the IPSec SA. You have to set up the address objects for the local network and remote network before you can set up the VPN connection. Click Object > Address. Click the Add icon. ZyWALL USG 2000 User’s Guide...
Page 126: Set Up The Policy Route For The Vpn Tunnel
Figure 65 VPN > IPSec VPN > VPN Connection > Add 6.3.3 Set Up the Policy Route for the VPN Tunnel Do the following to create a policy route to have the ZyWALL send traffic through the VPN tunnel. ZyWALL USG 2000 User’s Guide...
Page 127 To trigger the VPN, either try to connect to a device on the peer IPSec router’s LAN or click VPN > IPSec VPN > VPN Connection and use the VPN connection screen’s Connect icon. ZyWALL USG 2000 User’s Guide...
Page 128: Configure Security Policies For The Vpn Tunnel
Set up one user account for each user account in the RADIUS server. If it is possible to export user names from the RADIUS server to a text file, then you might create a script to create the user accounts instead. This example uses the web configurator. ZyWALL USG 2000 User’s Guide...
Page 129: Set Up User Groups
Repeat this process to set up the remaining user groups. 6.4.3 Set Up User Authentication Using the RADIUS Server This step sets up user authentication using the RADIUS server. First, configure the settings for the RADIUS server. Then, set up the authentication method, and ZyWALL USG 2000 User’s Guide...
Page 130 Set up a default policy that forces every user to log in to the ZyWALL before the ZyWALL routes traffic for them. Select Enable. Then, select force in the Authentication field. Keep the rest of the default settings, and click OK. ZyWALL USG 2000 User’s Guide...
Page 131: Set Up Web Surfing Policies With Bandwidth Restrictions
You must have already subscribed for the application patrol service. You can subscribe using the Licensing > Registration screens or using one of the wizards. Click AppPatrol. If application patrol and bandwidth management are not enabled, enable them, and click Apply. Figure 74 AppPatrol > General ZyWALL USG 2000 User’s Guide...
Page 132 Figure 76 AppPatrol > Common > http Change the access to Drop because you do not want anyone except authorized user groups to browse the web. Click OK. Figure 77 AppPatrol > Common > http > Edit Default ZyWALL USG 2000 User’s Guide...
Page 133: Set Up Msn Policies
Give the schedule a descriptive name. Set up the days (Monday through Friday) and the times (8:30 - 18:00) when Sales is allowed to use MSN. Click OK. Figure 79 Object > Schedule > Add (Recurring) ZyWALL USG 2000 User’s Guide...
Page 134: Set Up Firewall Rules
Figure 81 Firewall > LAN to DMZ > Add Click the Add icon at the top of the rule list to create a rule for one of the user groups that is allowed to access the DMZ. ZyWALL USG 2000 User’s Guide...
Page 135: How To Configure Service Control
HTTPS access, make sure the firewall is not configured to block that access. 6.5.1 Allow HTTPS Administrator Access Only From the LAN This example configures service control to block administrator HTTPS access from all zones except the LAN. Click System > WWW. ZyWALL USG 2000 User’s Guide...
Page 136 Chapter 6 Tutorials In HTTPS Admin Service Control, click the Add icon. Figure 83 System > WWW In the Zone field select LAN and click OK. Figure 84 System > WWW > Service Control Rule Edit ZyWALL USG 2000 User’s Guide...
Page 137 Figure 85 System > WWW (First Example Admin Service Rule Configured) In the Zone field select ALL and set the Action to Deny. Click OK. Figure 86 System > WWW > Service Control Rule Edit ZyWALL USG 2000 User’s Guide...
Page 138: How To Allow Incoming H.323 Peer-To-Peer Calls
Suppose you have a H.323 device on the LAN for VoIP calls and you want it to be able to receive peer-to-peer calls from the WAN. Here is an example of how to configure virtual server (port forwarding) and firewall rules to have the ZyWALL ZyWALL USG 2000 User’s Guide...
Page 139: Turn On The Alg
6.6.2 Set Up a Virtual Server Policy For H.323 In this example, you need a virtual server policy to forward H.323 (TCP port 1720) traffic received on the ZyWALL’s 10.0.0.8 WAN IP address to LAN IP address 192.168.1.56. ZyWALL USG 2000 User’s Guide...
Page 140: Set Up A Firewall Rule For H.323
Here is how to configure a firewall rule to allow H.323 (TCP port 1720) traffic received on the WAN_IP-for-H323 IP address to go to LAN IP address 192.168.1.56. Click Firewall. In From Zone, select WAN; in To Zone, select LAN. ZyWALL USG 2000 User’s Guide...
Page 141: How To Use Active-Passive Device Ha
ZyWALL is functioning as the master uses the default gateway IP address of the LAN computers (192.168.1.1) for its ge1 interface and the static public IP address (1.1.1.1) for its ge2 interface. If ZyWALL A recovers (has both its ge1 and ge2 ZyWALL USG 2000 User’s Guide...
Page 142: Before You Start
144). To avoid an IP address conflict, do not connect ZyWALL B to the LAN subnet until after you configure its device HA settings and the instructions tell you to deploy it (in Section 6.7.4 on page 145). ZyWALL USG 2000 User’s Guide...
Page 143: Configure Device Ha On The Master Zywall
LAN (ge1) to the Internet through the ge2 interface, so turn on monitoring for the ge1 and ge2 interfaces. Enter a Synchronization Password (“mySyncPassword” in this example) and click Apply. Figure 97 Device HA > Active-Passive Mode: Master ZyWALL Example ZyWALL USG 2000 User’s Guide...
Page 144: Configure The Backup Zywall
In ZyWALL B click Device HA > Active-Passive Mode. Click ge1’s Edit icon. Configure 192.168.1.5 as the Management IP and 255.255.255.0 as the Subnet Mask. Click OK. Figure 99 Device HA > Active-Passive Mode > Edit: Backup ZyWALL Example ZyWALL USG 2000 User’s Guide...
Page 145: Deploy The Backup Zywall
Connect ZyWALL B’s ge1 interface to the LAN network. Connect ZyWALL B’s ge2 interface to the same router that ZyWALL A’s ge2 interface uses for Internet access. ZyWALL B copies A’s configuration (and re-synchronizes with A every ZyWALL USG 2000 User’s Guide...
Page 146: Check Your Device Ha Setup
HTTP server’s private IP address of 192.168.3.7. Figure 102 Public Server Example Network Topology 192.168.3.7 1.1.1.2 6.8.1 Create the Address Objects Use Object > Address > Add to create the address objects. ZyWALL USG 2000 User’s Guide...
Page 147: Configure A Virtual Server
HTTP server’s outgoing sessions through ge3 and use 1.1.1.2 as the source IP address (to match the IP address for accessing it). See NAT 1:1 Example on page 292 for details. ZyWALL USG 2000 User’s Guide...
Page 148 Now the public can go to IP address 1.1.1.2 to access the HTTP server. If a domain name is registered for IP address 1.1.1.2, users can just go to the domain name to access the web server. ZyWALL USG 2000 User’s Guide...
Page 149: Status
ZyWALL. • Use the SEM Status Detail screen (see Section 7.2.9 on page 162) to look at detailed status information for an installed SEM (Security Extension Module) card. ZyWALL USG 2000 User’s Guide...
Page 150: The Status Screen
Device Information System Name This field displays the name used to identify the ZyWALL on any network. Click the icon to open the screen where you can change it. See Section 45.2 on page 698. ZyWALL USG 2000 User’s Guide...
Page 151 This field displays the port speed and duplex setting (Full or Half). For the auxiliary interface: Inactive - The auxiliary interface is disabled. Connected - The auxiliary interface is enabled and connected. Disconnected - The auxiliary interface is not connected. ZyWALL USG 2000 User’s Guide...
Page 152 Current Login This field displays the user name used to log in to the current session, User the amount of reauthentication time remaining, and the amount of lease time remaining. See Chapter 36 on page 613. ZyWALL USG 2000 User’s Guide...
Page 153 If it displays 0 days, the license has expired. If the Remaining status is not Licensed, click this to open the screen where you can days activate or extend the license. See Section 8.2 on page 167. ZyWALL USG 2000 User’s Guide...
Page 154 Table 31 Status (continued) LABEL DESCRIPTION Anti-Virus This field displays whether the ZyWALL is set to use ZyXEL’s anti-virus Engine Type engine or the one powered by Kaspersky. Upgrading the ZyWALL to firmware version 2.11 and updating the anti- virus signatures automatically upgrades the ZyXEL anti-virus engine to v2.0.
Page 155: The Cpu Usage Screen
The x-axis shows the time period over which the CPU usage occurred Refresh Enter how often you want this window to be automatically updated. Interval Refresh Now Click this to update the information in the window right away. ZyWALL USG 2000 User’s Guide...
Page 156: The Memory Usage Screen
The x-axis shows the time period over which the RAM usage occurred Refresh Enter how often you want this window to be automatically updated. Interval Refresh Now Click this to update the information in the window right away. ZyWALL USG 2000 User’s Guide...
Page 157: The Session Usage Screen
The x-axis shows the time period over which the session usage occurred Refresh Enter how often you want this window to be automatically updated. Interval Refresh Now Click this to update the information in the window right away. ZyWALL USG 2000 User’s Guide...
Page 158: The Vpn Status Screen
Set Interval Click this to set the Poll Interval the screen uses. Stop Click this to stop the window from updating automatically. You can start it again by setting the Poll Interval and clicking Set Interval. ZyWALL USG 2000 User’s Guide...
Page 159: The Dhcp Table Screen
Apply. To remove a static DHCP entry, clear this field, and then click Apply. Apply Click this to save your settings to the ZyWALL. Refresh Click this to update the screen immediately. ZyWALL USG 2000 User’s Guide...
Page 160: The Port Statistics Screen
Set Interval Click this to set the Poll Interval the screen uses. Stop Click this to stop the window from updating automatically. You can start it again by setting the Poll Interval and clicking Set Interval. ZyWALL USG 2000 User’s Guide...
Page 161: The Port Statistics Graph Screen
This line represents the traffic received by the ZyWALL on the physical port since it was last connected. Last Update This field displays the date and time the information in the window was last updated. ZyWALL USG 2000 User’s Guide...
Page 162: The Current Users Screen
Click this icon to end a user’s session. 7.2.9 The SEM Status Detail Screen Use this screen to look at detailed status information for an installed SEM (Security Extension Module) card. An SEM enhances the ZyWALL’s VPN and/or ZyWALL USG 2000 User’s Guide...
Page 163 Driver load failed - An error occurred during the ZyWALL’s attempt to activate the SEM card. Make sure the SEM is installed properly and the thumbscrews are tightened. If this status still displays, contact your vendor. ZyWALL USG 2000 User’s Guide...
Page 164 Chapter 7 Status ZyWALL USG 2000 User’s Guide...
Page 165: Registration
This section introduces the topics covered in this chapter. myZyXEL.com myZyXEL.com is ZyXEL’s online services center where you can register your ZyWALL and manage subscription services available for the ZyWALL. To update signature files or use a subscription service, you have to register the ZyWALL and activate the corresponding service at myZyXEL.com (through the ZyWALL).
Page 166 • After the trial expires, you need to purchase an iCard for the anti-virus engine you want to use and enter the PIN number (license key) in the Registration > Service screen. You must use the ZyXEL anti-virus iCard for the ZyXEL anti- virus engine and the Kaspersky anti-virus iCard for the Kaspersky anti-virus engine.
Page 167: The Registration Screen
(and the underscore). Spaces are not allowed. Confirm Password Enter the password again for confirmation. E-Mail Address Enter your e-mail address. You can use up to 80 alphanumeric characters (periods and the underscore are also allowed) without spaces. ZyWALL USG 2000 User’s Guide...
Page 168 The ZyWALL’s anti-virus packet scanner uses the signature files on Service the ZyWALL to detect virus files. Select ZyXEL’s anti-virus engine or the Kaspersky anti-virus engine. During the trial you can use these fields to change from one anti-virus engine to the other.
Page 169: The Service Screen
To activate or extend a standard service subscription, purchase an iCard and enter the iCard’s PIN number (license key) in this screen. Click Licensing > Registration > Service to open the screen as shown next. Figure 118 Licensing > Registration > Service ZyWALL USG 2000 User’s Guide...
Page 170 (specific to your ZyWALL) and enter the new PIN number to extend the service. Service License Click this button to renew service license information (such as the Refresh registration status and expiration day). ZyWALL USG 2000 User’s Guide...
Page 171: Signature Update
• Schedule signature updates for a day and time when your network is least busy to minimize disruption to your network. • Your custom signature configurations are not over-written when you download new signatures. Note: The ZyWALL does not have to reboot when you upload new signatures. ZyWALL USG 2000 User’s Guide...
Page 172: The Antivirus Update Screen
The following fields display information on the current signature set that Information the ZyWALL is using. Anti-Virus This field displays whether the ZyWALL is set to use ZyXEL’s anti-virus Engine Type engine or the one powered by Kaspersky. Current This field displays the anti-virus signatures version number currently Version used by the ZyWALL.
Page 173: The Idp/Apppatrol Update Screen
IDP service in order to be able to download new packet inspection signatures from myZyXEL.com (see the Registration screens). Use the Update IDP /AppPatrol screen to schedule or immediately download IDP signatures. Figure 120 Licensing > Update > IDP/AppPatrol ZyWALL USG 2000 User’s Guide...
Page 174 Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. Figure 121 Downloading IDP Signatures ZyWALL USG 2000 User’s Guide...
Page 175: The System Protect Update Screen
The system-protection feature is enabled by default and can only be disabled via the commands. You do not need an IDP subscription to use the system-protection feature or to download updated system-protection signatures. Figure 123 Licensing > Update > System Protect ZyWALL USG 2000 User’s Guide...
Page 176 Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. Figure 124 Downloading System Protect Signatures ZyWALL USG 2000 User’s Guide...
Page 177 Chapter 9 Signature Update Figure 125 Successful System Protect Signature Download ZyWALL USG 2000 User’s Guide...
Page 178 Chapter 9 Signature Update ZyWALL USG 2000 User’s Guide...
Page 179: Network
Network Interface (181) Trunks (239) Policy and Static Routes (249) Routing Protocols (263) Zones (275) DDNS (279) Virtual Servers (287) HTTP Redirect (301) ALG (305) IP/MAC Binding (313)
Page 181: Interface
(Section 10.10 on page 222) to combine two or more network segments into a single network. • Use the Auxiliary screens (Section 10.11 on page 230) to configure the ZyWALL’s auxiliary interface to use an external modem. ZyWALL USG 2000 User’s Guide...
Page 182: What You Need To Know About Interfaces
• The auxiliary interface, along with an external modem, provides an interface the ZyWALL can use to dial out. This interface can be used as a backup WAN interface, for example. The auxiliary interface controls the AUX port. • Trunks manage load balancing between interfaces. ZyWALL USG 2000 User’s Guide...
Page 183: Relationships Between Interfaces
The relationships between interfaces are explained in the following table. Table 46 Relationships Between Different Types of Interfaces REQUIRED PORT / INTERFACE INTERFACE auxiliary interface auxiliary port port group physical port Ethernet interface physical port port group VLAN interface Ethernet interface ZyWALL USG 2000 User’s Guide...
Page 184 • See Section 6.1 on page 119 for an example of configuring Ethernet interfaces and port groups. • See Chapter 11 on page 239 to configure load balancing using trunks. ZyWALL USG 2000 User’s Guide...
Page 185: Interface Status Screen
Name This field displays the name of each interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the status of virtual interfaces on top of this interface. ZyWALL USG 2000 User’s Guide...
Page 186 Fault - This VRRP group is not functioning in the virtual router right now. For example, this might happen if the interface is down. n/a - Device HA is not active on the interface. Zone This field displays the zone to which the interface is currently assigned. ZyWALL USG 2000 User’s Guide...
Page 187 This field displays the transmission speed, in bytes per second, on the interface in the one-second interval before the screen updated. Rx B/s This field displays the reception speed, in bytes per second, on the interface in the one-second interval before the screen updated. ZyWALL USG 2000 User’s Guide...
Page 188: Port Grouping
• It can increase the bandwidth between the port group and other interfaces. In the example below, you might combine physical ports 3 and 4 into port group ge3. Figure 127 Port Grouping Example: Network ZyWALL USG 2000 User’s Guide...
Page 189: Port Grouping Screen
8 (the dual-personality Ethernet port and SFP slot pairs). The are always assigned to interfaces ge7 and ge8, respectively. To access this screen, click Network > Interface > Port Grouping. Figure 129 Network > Interface > Port Grouping ZyWALL USG 2000 User’s Guide...
Page 190: Ethernet Summary Screen
(last-saved values). 10.4 Ethernet Summary Screen This screen lists every Ethernet interface and virtual interface created on top of Ethernet interfaces. To access this screen, click Network > Interface. Figure 130 Network > Interface > Ethernet ZyWALL USG 2000 User’s Guide...
Page 191: Ethernet Edit
The Ethernet Edit screen lets you configure IP address assignment, interface parameters, RIP settings, OSPF settings, DHCP settings, and ping check settings. To access this screen, click an Edit icon in the Ethernet Summary screen. (See Section 10.4 on page 190.) ZyWALL USG 2000 User’s Guide...
Page 192 Chapter 10 Interface Figure 131 Network > Interface > Ethernet > Edit ZyWALL USG 2000 User’s Guide...
Page 193 ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first. Interface Parameters ZyWALL USG 2000 User’s Guide...
Page 194 Enter that domain name or IP address in the field next to it. Check Port This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. DHCP Setting ZyWALL USG 2000 User’s Guide...
Page 195 DHCP clients. The WINS server WINS Server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. ZyWALL USG 2000 User’s Guide...
Page 196 V2-Broadcast This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet broadcasting; otherwise, the ZyWALL uses multicasting. OSPF Setting Section 13.3 on page 265 for more information about OSPF. ZyWALL USG 2000 User’s Guide...
Page 197 It will not change unless you change the setting or upload a different configuration file. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 198: The Static Dhcp Screen
Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 10.6 The PPP Interfaces This section introduces PPPoE, PPTP, and PPPoE/PPTP interfaces and then explains the screens for PPPoE/PPTP interfaces. ZyWALL USG 2000 User’s Guide...
Page 199: Pppoe/Pptp Overview
IP address, subnet mask, and gateway used to make routing decisions; they restrict bandwidth and packet size; and they can verify the gateway is available. There are two main differences between PPPoE/PPTP interfaces and other interfaces. ZyWALL USG 2000 User’s Guide...
Page 200: Ppp Interface Summary
This field displays the name of the interface. Base Interface This field displays the interface on the top of which the PPPoE/PPTP interface is. Account Profile This field displays the ISP account used by this PPPoE/PPTP interface. ZyWALL USG 2000 User’s Guide...
Page 201 You might use this icon to test the interface or to manually establish the connection for a Dial-on-Demand PPPoE/PPTP interface. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 202: Ppp Interface Add/Edit
This screen lets you configure new or existing PPPoE/PPTP interfaces. To access this screen, click the Add icon or an Edit icon in the PPP Interface screen. Figure 135 Network > Interface > PPP > Edit ZyWALL USG 2000 User’s Guide...
Page 203 Use Fixed IP Select this if you want to specify the IP address manually. Address IP Address This field is enabled if you select Use Fixed IP Address. Enter the IP address for this interface. ZyWALL USG 2000 User’s Guide...
Page 204 Enter that domain name or IP address in the field next to it. Check Port This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Related Setting ZyWALL USG 2000 User’s Guide...
Page 205: Cellular Configuration Screen (3G)
Internet access to mobile devices. Note: The actual data rate you obtain varies depending the 3G card you use, the signal strength to the service provider’s base station, and so on. ZyWALL USG 2000 User’s Guide...
Page 206 Fast To change your 3G WAN settings, click Network > Interface > Cellular. Note: Install (or connect) a compatible 3G card to use a cellular connection. See Chapter 52 on page 803 for details. ZyWALL USG 2000 User’s Guide...
Page 207 You might use this icon to test the interface or to manually establish the connection. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 208: Cellular Add/Edit Screen
To change your 3G settings, click Network > Interface > Cellular > Add (or Edit). In the pop-up window that displays, select the slot that you want to configure. The following screen displays. Figure 137 Interface > Cellular > Add ZyWALL USG 2000 User’s Guide...
Page 209 Enter the dial string if your ISP provides a string, which would include the APN, to initialize the 3G card. You can enter up to 63 ASCII printable characters. Spaces are allowed. This field is available only when you insert a GSM 3G card. ZyWALL USG 2000 User’s Guide...
Page 210 Ingress This is reserved for future use. Bandwidth Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576. ZyWALL USG 2000 User’s Guide...
Page 211 This is the default selection. Use Fixed IP Select this option If the ISP assigned a fixed IP address. Address IP Address Enter the cellular interface’s WAN IP address in this field if you selected Use Fixed IP Address. ZyWALL USG 2000 User’s Guide...
Page 212: Cellular Status Screen
Click Cancel to exit this screen without saving. 10.8 Cellular Status Screen To check your 3G connection status, click Network > Interface > Cellular > Status. The following screen displays. Figure 138 Interface > Cellular > Status ZyWALL USG 2000 User’s Guide...
Page 213 Need auth-password - You need to enter the password for the 3G card in the cellular edit screen. Device ready - The ZyWALL successfully applied all of your configuration and you can use the 3G connection. ZyWALL USG 2000 User’s Guide...
Page 214: Vlan Interfaces
Figure 139 Example: Before VLAN In this example, there are two physical networks and three departments A, B, and C. The physical networks are connected to hubs, and the hubs are connected to the router. ZyWALL USG 2000 User’s Guide...
Page 215 VLAN. These rules are also independent of the physical network, so you can change the physical network without changing policies. In this example, the new switch handles the following types of traffic: • Inside VLAN 2. ZyWALL USG 2000 User’s Guide...
Page 216: Vlan Interfaces Overview
This field displays the name of the interface. Port/VID For VLAN interfaces, this field displays • the Ethernet interface on which the VLAN interface is created • the VLAN ID For virtual interfaces, this field is blank. ZyWALL USG 2000 User’s Guide...
Page 217: Vlan Add/Edit
DHCP settings, and ping check for each VLAN interface. To access this screen, click the Add icon at the top of the Add column or click an Edit icon next to a VLAN interface in the VLAN Summary screen. The following screen appears. ZyWALL USG 2000 User’s Guide...
Page 218 Each field is explained in the following table. Table 59 Network > Interface > VLAN > Edit LABEL DESCRIPTION General Settings Enable Select this to turn this interface on. Clear this to disable this interface. Interface Interface Properties ZyWALL USG 2000 User’s Guide...
Page 219 0 - 1048576. Ingress This is reserved for future use. Bandwidth Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576. ZyWALL USG 2000 User’s Guide...
Page 220 Relay Server 1 Enter the IP address of a DHCP server for the network. Relay Server 2 This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the ZyWALL is a DHCP Server. ZyWALL USG 2000 User’s Guide...
Page 221 MAC address. Violation Edit static Click this to configure static IP addresses for the ZyWALL to assign to DHCP table computers connected to this interface. See Section 10.5 on page 198. Related Setting ZyWALL USG 2000 User’s Guide...
Page 222: Bridge Interfaces
(except the one on which it was received). In the example above, computer A sends a packet to computer B. Bridge X records the source address 0A:0A:0A:0A:0A:0A and port 2 in the table. It also ZyWALL USG 2000 User’s Guide...
Page 223: Bridge Interface Overview
(250.250.250.0/23) between ge1 and vlan1. Table 62 Example: Routing Table Before and After Bridge Interface br0 Is Created IP ADDRESS(ES) DESTINATION IP ADDRESS(ES) DESTINATION 210.210.210.0/24 221.221.221.0/24 vlan0 210.211.1.0/24 ge1:1 230.230.230.192/26 221.221.221.0/24 vlan0 241.241.241.241/32 222.222.222.0/24 vlan1 242.242.242.242/32 230.230.230.192/26 250.250.250.0/23 ZyWALL USG 2000 User’s Guide...
Page 224: Bridge Summary
This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces. Member This field displays the Ethernet interfaces and VLAN interfaces in the bridge interface. It is blank for virtual interfaces. ZyWALL USG 2000 User’s Guide...
Page 225: Bridge Add/Edit
DHCP settings, and ping check for each bridge interface. To access this screen, click the Add icon at the top of the Add column in the Bridge Summary screen, or click an Edit icon in the Bridge Summary screen. The following screen appears. ZyWALL USG 2000 User’s Guide...
Page 226 Chapter 10 Interface Figure 144 Network > Interface > Bridge > Edit ZyWALL USG 2000 User’s Guide...
Page 227 Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. ZyWALL USG 2000 User’s Guide...
Page 228 Relay Server 1 Enter the IP address of a DHCP server for the network. Relay Server 2 This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the ZyWALL is a DHCP Server. ZyWALL USG 2000 User’s Guide...
Page 229 MAC address. Violation Edit static Click this to configure static IP addresses for the ZyWALL to assign to DHCP table computers connected to this interface. See Section 10.5 on page 198. ZyWALL USG 2000 User’s Guide...
Page 230: Auxiliary Interface
WAN interface. You have to connect an external modem to the ZyWALL’s auxiliary port to use the auxiliary interface. Note: You have to connect an external modem to the auxiliary port. ZyWALL USG 2000 User’s Guide...
Page 231: Auxiliary
General Settings Enable Select this to turn on the auxiliary dial up interface. The interface Interface does not dial out, however, unless it is part of a trunk and load- balancing conditions are satisfied. Interface Properties ZyWALL USG 2000 User’s Guide...
Page 232 Set this field to zero to disable the idle timeout. Allowed values are 0 - 360. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 233: Virtual Interfaces
This screen lets you configure IP address assignment and interface parameters for virtual interfaces. To access this screen, click an Add icon next to an Ethernet interface, VLAN interface, or bridge interface in the respective interface summary screen. Figure 146 Network > Interface > Add ZyWALL USG 2000 User’s Guide...
Page 234 Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can receive from the network through the interface. Allowed values are 0 - 1048576. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 235: Interface Technical Reference
5.5.5.5, it might not find any entries in the routing table. In this case, the packet is dropped. However, if there is a default router to which the ZyWALL should send this packet, you can specify it as a gateway in one of the interfaces. For example, ZyWALL USG 2000 User’s Guide...
Page 236 IP addresses, subnet masks, gateways, and some network information (such as the IP addresses of DNS servers) on At the time of writing, the ZyWALL does not support ingress bandwidth management. ZyWALL USG 2000 User’s Guide...
Page 237 • Subnet mask - The interface provides the same subnet mask you specify for the interface. See IP Address Assignment on page 235. • Gateway - The interface provides the same gateway you specify for the interface. See IP Address Assignment on page 235. ZyWALL USG 2000 User’s Guide...
Page 238 The first one runs on TCP port 1723. It is used to start and manage the second one. The second one uses Generic Routing Encapsulation (GRE, RFC 2890) to transfer information between the computers. PPTP is convenient and easy-to-use, but you have to make sure that firewalls support both PPTP sessions. ZyWALL USG 2000 User’s Guide...
Page 239: Trunks
• Use the Trunk Edit screen (Section 11.3 on page 245) to configure which interfaces belong to each trunk and the load balancing algorithm each trunk uses. ZyWALL USG 2000 User’s Guide...
Page 240: What You Need To Know About Trunks
WAN IP address, the file server would deny the request. Here is an example. Figure 148 Link Sticking LAN user A tries to download a file from server B on the Internet. The ZyWALL uses ge2 to send the request to server B. ZyWALL USG 2000 User’s Guide...
Page 241 WAN 1 and WAN 2 are 512K and 256K respectively. Figure 149 Least Load First Example In the load balancing section, a session may refer to normal connection-oriented, UDP and SNMP2 traffic. ZyWALL USG 2000 User’s Guide...
Page 242 This continues as long as there are more member interfaces and traffic to be sent through them. ZyWALL USG 2000 User’s Guide...
Page 243: The Trunk Summary Screen
Click Network > Interface > Trunk to open the Trunk screen. This screen lists the configured trunks and the load balancing algorithm that each is configured to use. Figure 152 Network > Interface > Trunk ZyWALL USG 2000 User’s Guide...
Page 244 To remove a trunk, click the Remove icon next to it. The ZyWALL confirms you want to remove it before doing so. Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 245: Configuring A Trunk
5 as part of the trunk. If you select interface ge5 as a member here, the ZyWALL will not send traffic through port 5 as part of the trunk. ZyWALL USG 2000 User’s Guide...
Page 246: Trunk Technical Reference
This queue then moves to the back of the list. The next queue is given an equal amount of bandwidth, and then moves to the end of the list; and so on, depending on the ZyWALL USG 2000 User’s Guide...
Page 247 Chapter 11 Trunks number of queues being used. This works in a looping fashion until a queue is empty. ZyWALL USG 2000 User’s Guide...
Page 248 Chapter 11 Trunks ZyWALL USG 2000 User’s Guide...
Page 249: Policy And Static Routes
Note: You can generally just use policy routes. You only need to use static routes if you have a large network with multiple routers where you use RIP or OSPF to propagate routing information to other routers. ZyWALL USG 2000 User’s Guide...
Page 250: What You Can Do In The Policy And Static Route Screens
• A NAT loopback policy route lets local users use a domain name to access a virtual server. When creating a virtual server that local users will use a domain name to access, you can select an option to configure a NAT loopback policy route. ZyWALL USG 2000 User’s Guide...
Page 251: Policy Route Screen
IP protocol (ICMP, UDP, TCP, etc.) and port. The actions that can be taken include: • Routing the packet to a different gateway, outgoing interface, VPN tunnel, or trunk. • Limiting the amount of bandwidth available and setting a priority for traffic. ZyWALL USG 2000 User’s Guide...
Page 252 This is the name of the source IP address (group) object. any means all IP addresses. Destination This is the name of the destination IP address (group) object. any means all IP addresses. Service This is the name of the service object. any means all services. ZyWALL USG 2000 User’s Guide...
Page 253: Policy Route Edit Screen
12.2.1 Policy Route Edit Screen Click Network > Routing to open the Policy Route screen. Then click the Add or Edit icon to open the Policy Route Edit screen. Use this screen to configure or edit a policy route. ZyWALL USG 2000 User’s Guide...
Page 254 If the next hop is a dynamic VPN tunnel and you enable Auto Destination Address, the ZyWALL uses the local network of the peer router that initiated an incoming dynamic IPSec tunnel as the destination address of the policy instead of your configuration here. ZyWALL USG 2000 User’s Guide...
Page 255 ZyWALL send traffic that matches the policy route through the specified interface. Address Use this section to configure NAT for the policy route. This section does Translation not apply to policy routes that use a VPN tunnel as the next hop. ZyWALL USG 2000 User’s Guide...
Page 256 This allows you to allocate bandwidth to a route and prioritize traffic that Shaping matches the routing policy. You must also enable bandwidth management in the main policy route screen (Network > Routing > Policy Route) in order to apply bandwidth shaping. ZyWALL USG 2000 User’s Guide...
Page 257: Ip Static Route Screen
Click Network > Routing > Static Route to open the Static Route screen. This screen displays the configured static routes. Configure static routes to be able to use RIP or OSPF to propagate the routing information to other routers. Figure 157 Network > Routing > Static Route ZyWALL USG 2000 User’s Guide...
Page 258: Static Route Add/Edit Screen
255.255.255.255 in the subnet mask field to force the network number to be identical to the host Subnet Mask Enter the IP subnet mask here. ZyWALL USG 2000 User’s Guide...
Page 259: Policy Routing Technical Reference
Whenever a client computer’s packets match the routing policy, it can use the pre-defined port triggering setting to connect to the remote server without manually configuring a port forwarding rule for each client computer. ZyWALL USG 2000 User’s Guide...
Page 260 When you enable maximize bandwidth usage, the ZyWALL first makes sure that each policy route gets up to its bandwidth allotment. Next, the ZyWALL divides up ZyWALL USG 2000 User’s Guide...
Page 261 The ZyWALL distributes the available bandwidth equally among policy routes with the same priority level. ZyWALL USG 2000 User’s Guide...
Page 262 Chapter 12 Policy and Static Routes ZyWALL USG 2000 User’s Guide...
Page 263: Routing Protocols
OSPF are compared here and discussed further in the rest of the chapter. Table 77 RIP vs. OSPF OSPF Network Size Small (with up to 15 Large routers) Metric Hop count Bandwidth, hop count, throughput, round trip time and reliability. Convergence Slow Fast ZyWALL USG 2000 User’s Guide...
Page 264: The Rip Screen
Use the RIP screen to specify the authentication method and maintain the policies for redistribution. To access this screen, login to the web configurator. When the main screen appears, click Network > Routing > RIP to open the following screen. Figure 160 Network > Routing > RIP ZyWALL USG 2000 User’s Guide...
Page 265: The Ospf Screen
Autonomous System (AS). OSPF offers some advantages over vector-space routing protocols like RIP. • OSPF supports variable-length subnet masks, which can be set up to use available IP addresses more efficiently. ZyWALL USG 2000 User’s Guide...
Page 266 • A Not So Stubby Area (NSSA, RFC 1587) has routing information about the OSPF AS and networks outside the OSPF AS to which the NSSA is directly connected. It does not have any routing information about other networks outside the OSPF AS. ZyWALL USG 2000 User’s Guide...
Page 267 • An Area Border Router (ABR) connects two or more areas. It is a member of all the areas to which it is connected, and it filters, summarizes, and exchanges routing information between them. ZyWALL USG 2000 User’s Guide...
Page 268 BDR in another group, and neither in a third group all at the same time. Virtual Links In some OSPF AS, it is not possible for an area to be directly connected to the backbone. In this case, you can create a virtual link through an intermediate area ZyWALL USG 2000 User’s Guide...
Page 269: Configuring The Ospf Screen
Use the first OSPF screen to specify the OSPF router the ZyWALL uses in the OSPF AS and maintain the policies for redistribution. In addition, it provides a summary of OSPF areas, allows you to remove them, and opens the OSPF Add/Edit screen to add or edit them. ZyWALL USG 2000 User’s Guide...
Page 270 “cost” of transmission for routing purposes. The way this is used depends on the Type field. This value is usually the average cost in the OSPF AS, and it can be between 1 and 16777214. ZyWALL USG 2000 User’s Guide...
Page 271: Ospf Area Add/Edit Screen
To access this screen, go to the OSPF summary screen (see Section 13.3 on page 265), and click either the Add icon or an Edit icon. Figure 165 Network > Routing > OSPF > Edit ZyWALL USG 2000 User’s Guide...
Page 272 ABR that is connected to the backbone. This field is a sequential value, and it is not associated with a specific area. Peer Router ID Type the 32-bit ID (in IP address format) of the other ABR in the virtual link. ZyWALL USG 2000 User’s Guide...
Page 273: Routing Protocol Technical Reference
If the received message is verified, then the receiving router accepts the updated routing information. The transmitting and receiving routers must have the same key. ZyWALL USG 2000 User’s Guide...
Page 274 Alternatively, you can override the default in any interface or virtual link by selecting a specific authentication method. Please see the respective interface sections for more information. ZyWALL USG 2000 User’s Guide...
Page 275: Zones
Figure 166 Example: Zones 14.1.1 What You Can Do in the Zones Screens Use the Zone screens (see Section 14.2 on page 277) to view, add, and edit the ZyWALL’s zones. ZyWALL USG 2000 User’s Guide...
Page 276: What You Need To Know About Zones
Any or All. See the specific feature for more information. Finding Out More Section 5.4.7 on page 108 for related information on these screens. ZyWALL USG 2000 User’s Guide...
Page 277: The Zone Screen
To edit a zone, click the Edit icon next to the zone. The Zone Add/Edit screen appears. To delete a zone, click the Remove icon next to the zone. The web configurator confirms that you want to delete the zone before doing so. ZyWALL USG 2000 User’s Guide...
Page 278: Zone Add/Edit
Member lists the interfaces that belong to the zone. Select any interfaces that you want to remove from the zone, and click the left arrow button to remove them. ZyWALL USG 2000 User’s Guide...
Page 279: Ddns
You must set up a dynamic DNS account with a supported DNS service provider before you can use Dynamic DNS services with the ZyWALL. When registration is complete, the DNS service provider gives you a password or key. At the time of ZyWALL USG 2000 User’s Guide...
Page 280: The Ddns Screen
To access this screen, login to the web configurator. When the main screen appears, click Network > DDNS. The following screen appears, providing a summary of the existing domain names. Figure 169 Network > DDNS ZyWALL USG 2000 User’s Guide...
Page 281 The web configurator confirms that you want to delete the account before doing so. Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 282: The Dynamic Dns Add/Edit Screen
Dynu website. Password Type the password provided by the DDNS provider. You can use up to 64 alphanumeric characters and the underscore. Spaces are not allowed. ZyWALL USG 2000 User’s Guide...
Page 283 Select the interface to use for updating the IP address mapped to the domain name. Select Any to let the domain name be used with any interface. Select None to not use a backup address. ZyWALL USG 2000 User’s Guide...
Page 284 Once your mail server is available again, the DynDNS server delivers the mail to you. See www.dyndns.org for more information about this service. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 285: The Ddns Status Screen
Click this to have the ZyWALL update the profile to the DDNS server. The ZyWALL attempts to resolve the IP address for the domain name. Refresh Click this to update the information displayed in the screen. ZyWALL USG 2000 User’s Guide...
Page 286 Chapter 15 DDNS ZyWALL USG 2000 User’s Guide...
Page 287: Virtual Servers
You can also create new virtual servers and edit or delete existing ones. 16.1.2 What You Need to Know About Virtual Servers Virtual server is also known as port forwarding or port translation. ZyWALL USG 2000 User’s Guide...
Page 288: The Virtual Server Screen
This field is a sequential value, and it is not associated with a specific virtual server. Name This field displays the name of the virtual server. Interface This field displays the interface on which packets for the virtual server were received. ZyWALL USG 2000 User’s Guide...
Page 289: The Virtual Server Add/Edit Screen
Click this button to return the screen to its last-saved settings. 16.2.1 The Virtual Server Add/Edit Screen The Virtual Server Add/Edit screen lets you create new virtual servers and edit existing ones. To open this window, open the Virtual Server summary screen. ZyWALL USG 2000 User’s Guide...
Page 290 Select Create Object to configure a new IP address object. User-Defined This field is available if Original IP is User Defined. Type the Original IP destination IP address that this virtual server supports. ZyWALL USG 2000 User’s Guide...
Page 291 This field is available if Mapping Type is Ports. Enter the end of the Port range of translated destination ports if this virtual server forwards the packet. The original port range and the mapped port range must be the same size. ZyWALL USG 2000 User’s Guide...
Page 292: Nat 1:1 And Nat Loopback Examples
In this example, there is an SMTP mail server in the LAN zone. It has a private IP address of 192.168.1.21. The public IP address for the server is 1.1.1.1 and is on the ge3 interface. ZyWALL USG 2000 User’s Guide...
Page 293 Figure 176 Create Address Objects NAT 1:1 Virtual Server This section sets up a virtual server rule that changes the destination of SMTP traffic coming to IP address 1.1.1.1 at the ZyWALL’s ge3 interface, to the LAN ZyWALL USG 2000 User’s Guide...
Page 294 NAT 1:1 mapping and loopback so the options to have the ZyWALL automatically create them are not selected here. Figure 178 Create a Virtual Server ZyWALL USG 2000 User’s Guide...
Page 295 Click Network > Routing > Policy Route > Add and configure the screen as shown next. Be careful of where you create the route as routes are ordered in descending priority. Figure 180 Create a Policy Route ZyWALL USG 2000 User’s Guide...
Page 296 Create a firewall rule to allow access from the WAN zone to the mail server in the LAN zone. Be careful of where you create the rule as firewall rules are ordered in descending priority. Figure 181 Create a Firewall Rule ZyWALL USG 2000 User’s Guide...
Page 297 ZyWALL through the LAN interface, thus it does not match the NAT 1:1 mapping’s virtual server rule for SMTP traffic coming to IP 1.1.1.1 from WAN2. So you must configure a similar virtual server rule for WAN2. ZyWALL USG 2000 User’s Guide...
Page 298 SMTP server with the LAN computer’s IP address as the source. The source address is in the same subnet, so the LAN SMTP server replies directly. The return traffic uses the SMTP server’s LAN IP address as the source address . This creates ZyWALL USG 2000 User’s Guide...
Page 299 Be careful of where you create the route as routes are ordered in descending priority. This policy route applies source NAT to traffic sent from LAN to the SMTP server. Even if the packets go through the ZyWALL, they only undergo layer 2 switching, not NAT. ZyWALL USG 2000 User’s Guide...
Page 300 The source in the return traffic matches the original destination address (1.1.1.1) and the LAN user can use the LAN SMTP server. Figure 188 NAT Loopback Successful Source 192.168.1.21 Source 1.1.1.1 SMTP SMTP 192.168.1.21 192.168.1.89 ZyWALL USG 2000 User’s Guide...
Page 301: Http Redirect
Figure 189 HTTP Redirect Example 17.1.1 What You Can Do in the HTTP Redirect Screens Use the HTTP Redirect screens (see Section 17.2 on page 303) to display and edit the HTTP redirect rules. ZyWALL USG 2000 User’s Guide...
Page 302: What You Need To Know About Http Redirect
• a HTTP redirect rule to forward HTTP traffic from ge1 to proxy server A. For HTTP traffic between ge4 and ge2: • a from DMZ to WAN through-ZyWALL rule (default) to allow HTTP request from ge4 to ge2. Responses to this request are allowed automatically. ZyWALL USG 2000 User’s Guide...
Page 303: The Http Redirect Screen
Click the Remove icon to delete an existing rule from the ZyWALL. A window displays asking you to confirm that you want to delete the rule. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 304: The Http Redirect Edit Screen
Enter the IP address of the proxy server. Port Enter the port number that the proxy server uses. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 305: Alg
The ZyWALL only needs to use the ALG feature for traffic that goes through the ZyWALL’s NAT. 18.1.1 What You Can Do in the ALG Screen Use the ALG screen (Section 18.2 on page 308) to set up SIP, H.323, and FTP ALG settings. ZyWALL USG 2000 User’s Guide...
Page 306: What You Need To Know About Alg
The following example shows H.323 signaling (1) and audio (2) sessions between H.323 devices A and B. Figure 193 H.323 ALG Example SIP ALG • SIP clients can be connected to the LAN or DMZ. A SIP server must be on the WAN. ZyWALL USG 2000 User’s Guide...
Page 307 B and C go out through WAN IP address 2. Even though only LAN IP address A can receive incoming calls from the Internet, LAN IP addresses B and C can still make calls out to the Internet. Figure 194 VoIP Calls from the WAN with Multiple Outgoing Calls ZyWALL USG 2000 User’s Guide...
Page 308: Before You Begin
18.2 The ALG Screen Click Network > ALG to open the ALG screen. Use this screen to turn ALGs off or on, configure the port numbers to which they apply, and configure SIP ALG time outs. ZyWALL USG 2000 User’s Guide...
Page 309 If the SIP client does not have this mechanism and makes no calls during the ZyWALL SIP timeout, the ZyWALL deletes the signaling session after the timeout period. Enter the SIP signaling session timeout value (1~86400). ZyWALL USG 2000 User’s Guide...
Page 310: Alg Technical Reference
Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 18.3 ALG Technical Reference Here is more detailed information about the Application Layer Gateway. ZyWALL USG 2000 User’s Guide...
Page 311 NetMeeting uses H.323. The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and ZyWALL USG 2000 User’s Guide...
Page 312 SIP handles telephone calls and can interface with traditional circuit- switched telephone networks. When you make a VoIP call using H.323 or SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer. See RFC 1889 for details on RTP. ZyWALL USG 2000 User’s Guide...
Page 313: Ip/Mac Binding
H A P T E R IP/MAC Binding 19.1 IP/MAC Binding Overview IP address to MAC address binding helps ensure that only the intended devices get to use privileged IP addresses. The ZyWALL uses DHCP to assign IP addresses and records to MAC address it assigned each IP address.
Page 314: What You Need To Know About Ip/Mac Binding
Chapter 19 IP/MAC Binding 19.1.2 What You Need to Know About IP/MAC Binding DHCP IP/MAC address bindings are based on the ZyWALL’s dynamic and static DHCP entries. Interfaces Used With IP/MAC Binding IP/MAC address bindings are grouped by interface. You can use IP/MAC binding with Ethernet, bridge, VLAN, and WLAN interfaces.
Page 315: Ip/Mac Binding Edit
Chapter 19 IP/MAC Binding Table 93 Network > IP/MAC Binding > Summary (continued) LABEL DESCRIPTION Modify The Active icon displays whether or not IP/MAC binding is enabled for an interface. Click it to activate or deactivate IP/MAC binding on an interface.
Page 316: Static Dhcp Edit
Chapter 19 IP/MAC Binding Table 94 Network > IP/MAC Binding > Edit (continued) LABEL DESCRIPTION This is the index number of the static DHCP entry. IP Address This is the IP address that the ZyWALL assigns to a device with the entry’s MAC address.
Page 317: Ip/Mac Binding Exempt List
Chapter 19 IP/MAC Binding Table 95 Network > IP/MAC Binding > Edit > Add (continued) LABEL DESCRIPTION Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 19.3 IP/MAC Binding Exempt List Click Network >...
Page 318 Chapter 19 IP/MAC Binding session with the ZyWALL. Devices that have never established a session with the ZyWALL do not display in the list. Figure 202 Network > IP/MAC Binding > Monitor The following table describes the labels in this screen. Table 97 Network >...
Page 319: Firewall
Firewall Firewall (321)
Page 321: Firewall
20.1.1 What You Can Do in the Firewall Screens • Use the Firewall screen (Section 20.2 on page 328) to enable or disable the firewall and asymmetrical routes, set a maximum number of sessions per host, and display the configured firewall rules. ZyWALL USG 2000 User’s Guide...
Page 322: What You Need To Know About The Firewall
• The firewall allows only LAN computers to access or manage the ZyWALL. • The ZyWALL drops most packets from the WAN zone to the ZyWALL itself, except for VRRP traffic for Device HA and ESP/AH/IKE/NATT/HTTPS services for VPN tunnels, and generates a log. ZyWALL USG 2000 User’s Guide...
Page 323 After you create a VPN tunnel and add it to a zone, you can set the firewall rules applied to VPN traffic. If you add a VPN tunnel to an existing zone (the LAN zone for example), you can configure a new LAN to LAN firewall rule or use intra-zone ZyWALL USG 2000 User’s Guide...
Page 324: Firewall Rule Example Applications
Figure 204 Blocking All LAN to WAN IRC Traffic Example Your firewall would have the following configuration. Table 99 Blocking All LAN to WAN IRC Traffic Example DESTINATIO USER SOURCE SCHEDULE SERVICE ACTION Deny Default Allow ZyWALL USG 2000 User’s Guide...
Page 325 You do not need to specify a schedule since you want the firewall rule to always be in effect. The following figure shows the results of your two custom rules. Figure 205 Limited LAN to WAN IRC Traffic Example ZyWALL USG 2000 User’s Guide...
Page 326: Firewall Rule Configuration Example
ZyWALL would drop it and not check any other firewall rules. 20.1.4 Firewall Rule Configuration Example The following Internet firewall rule example allows a hypothetical MyService from the WAN to IP addresses 192.168.1.10 through 192.168.1.15 (Dest_1) on the LAN. ZyWALL USG 2000 User’s Guide...
Page 327 Select Create Object in the Service drop-down list box. The screen for configuring a service object opens. Configure it as follows and click Figure 208 Firewall Example: Create a Service Object Select From WAN and To LAN. ZyWALL USG 2000 User’s Guide...
Page 328: The Firewall Screen
ZyWALL’s LAN IP address, return traffic may not go through the ZyWALL. This is called an asymmetrical or “triangle” route. This causes the ZyWALL to reset the connection, as the connection has not been acknowledged. ZyWALL USG 2000 User’s Guide...
Page 329: Configuring The Firewall Screen
Note the following. • If you enable intra-zone traffic blocking (see the chapter about zones), the firewall automatically creates (implicit) rules to deny packet passage between the interfaces in the specified zone. ZyWALL USG 2000 User’s Guide...
Page 330 Note: Allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the ZyWALL. A better solution is to use virtual interfaces to put the ZyWALL and the backup gateway on separate subnets. ZyWALL USG 2000 User’s Guide...
Page 331 VPN tunnels. ZyWALL means packets destined for the ZyWALL itself. Schedule This field tells you the schedule object that the rule uses. none means the rule is active at all times if enabled. ZyWALL USG 2000 User’s Guide...
Page 332 The ordering of your rules is important as they are applied in order of their numbering. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 333: The Firewall Edit Screen
IP address should be within the IP address range. Source Select a source address or address group for whom this rule applies. Select Create Object to configure a new one. Select any if the policy is effective for every source. ZyWALL USG 2000 User’s Guide...
Page 334: The Session Limit Screen
You can apply a default limit for all users and individual limits for specific users, addresses, or both. The individual limit takes priority if you apply both. Figure 214 Firewall > Session Limit ZyWALL USG 2000 User’s Guide...
Page 335 The ordering of your rules is important as they are applied in order of their numbering. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 336: The Session Limit Edit Screen
For this rule’s users and addresses, this setting overrides the Default Session per Host setting in the general Firewall Session Limit screen. Click OK to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 337: Vpn
IPSec VPN (339) SSL VPN (379) SSL User Screens (391) SSL User Application Screens (399) SSL User File Sharing (401) L2TP VPN (409) L2TP VPN Example (415)
Page 339: Ipsec Vpn
IPSec VPN tunnel. Figure 216 IPSec VPN Example The VPN tunnel connects the ZyWALL (X) and the remote (peer) IPSec router (Y). These routers then connect the local network (A) and remote network (B). ZyWALL USG 2000 User’s Guide...
Page 340: What You Can Do In The Ipsec Vpn Screens
Between routers X and Y, the data is protected by tunneling, encryption, authentication, and other security features of the IPSec SA. The IPSec SA is secure because routers X and Y established the IKE SA first. ZyWALL USG 2000 User’s Guide...
Page 341: Before You Begin
/ deactivate and connect / disconnect each VPN connection (each IPSec SA). To access this screen, click VPN > IPSec VPN. The following screen appears. Note: Except for dynamic IPSec VPN rules, each VPN connection requires a corresponding policy route. ZyWALL USG 2000 User’s Guide...
Page 342 Type a page number to go to or use the arrows to navigate the pages of entries. This field is a sequential value, and it is not associated with a specific connection. Name This field displays the name of the IPSec SA. ZyWALL USG 2000 User’s Guide...
Page 343: The Vpn Connection Add/Edit (Ike) Screen
341), and click either the Add icon or an Edit icon. If you click the Add icon, you have to select a specific VPN gateway in the VPN Gateway field before the following screen appears. ZyWALL USG 2000 User’s Guide...
Page 344 Chapter 21 IPSec VPN Figure 219 VPN > IPSec VPN > VPN Connection > Edit (IKE) ZyWALL USG 2000 User’s Guide...
Page 345 IPSec SA. Policy Click Advanced to display more settings. Click Basic to display fewer settings. Local Policy Select the address or address group corresponding to the local network. Select Create Object to configure a new one. ZyWALL USG 2000 User’s Guide...
Page 346 The ZyWALL and remote IPSec router must use the same encapsulation. Proposal This field is a sequential value, and it is not associated with a specific proposal. The sequence of proposals should not affect performance significantly. ZyWALL USG 2000 User’s Guide...
Page 347 DH key group. Connectivity The ZyWALL can regularly check the VPN connection to the gateway Check you specified to make sure it is still available. Enable Select this to turn on the VPN connection check. Connectivity Check ZyWALL USG 2000 User’s Guide...
Page 348 (SNAT). Destination Select the address object that represents the original destination address (or select Create Object to configure a new one). This is the address object for the remote network. ZyWALL USG 2000 User’s Guide...
Page 349 These fields are available if the protocol is TCP or UDP. Enter the translated destination port or range of translated destination ports. The size of the original port range must be the same size as the size of the mapped port range. ZyWALL USG 2000 User’s Guide...
Page 350: The Vpn Connection Add/Edit Manual Key Screen
Add icon or an existing manual key entry’s Edit icon. In the VPN Gateway section of the screen, select Manual Key. Note: Only use manual key as a temporary solution, because it is not as secure as a regular IPSec SA. ZyWALL USG 2000 User’s Guide...
Page 351 Type the IP address of the remote IPSec router in the IPSec SA. Gateway Address Type a unique SPI (Security Parameter Index) between 256 and 4095. The SPI is used to identify the ZyWALL during authentication. The ZyWALL and remote IPSec router must use the same SPI. ZyWALL USG 2000 User’s Guide...
Page 352 Select which hash algorithm to use to authenticate packet data in the Algorithm IPSec SA. Choices are SHA1 and MD5. SHA1 is generally considered stronger than MD5, but it is also slower. The ZyWALL and remote IPSec router must use the same algorithm. ZyWALL USG 2000 User’s Guide...
Page 353 MD5 authentication key, the ZyWALL 12345678901234567890 only uses . The ZyWALL still stores the longer 1234567890123456 key. Click OK to save your settings and exit this screen. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 354: The Vpn Gateway Screen
This field displays the interface or a domain name the ZyWALL uses for the VPN gateway. Secure Gateway This field displays the IP address(es) of the remote IPSec routers. VPN Connection This field displays VPN connections that use this VPN gateway. ZyWALL USG 2000 User’s Guide...
Page 355: The Vpn Gateway Add/Edit Screen
The VPN Gateway Add/Edit screen allows you to create a new VPN gateway policy or edit an existing one. To access this screen, go to the VPN Gateway summary screen (see Section 21.3 on page 354), and click either the Add icon or an Edit icon. ZyWALL USG 2000 User’s Guide...
Page 356 Type the name used to identify this VPN gateway. You may use 1-31 Name alphanumeric characters, underscores( ), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Gateway Settings ZyWALL USG 2000 User’s Guide...
Page 357 For example, "0x0123456789ABCDEF" is in hexadecimal format; in “0123456789ABCDEF” is in ASCII format. If you use hexadecimal, you must enter twice as many characters as listed above. The ZyWALL and remote IPSec router must use the same pre-shared key. ZyWALL USG 2000 User’s Guide...
Page 358 E-mail - the ZyWALL is identified by an e-mail address; you can use up to 31 ASCII characters including spaces, although trailing spaces are truncated. This value is only used for identification and can be any string. ZyWALL USG 2000 User’s Guide...
Page 359 Any - the ZyWALL does not check the identity of the remote IPSec router If the ZyWALL and remote IPSec router use certificates, there is one more choice. Subject Name - the remote IPSec router is identified by the subject name in the certificate ZyWALL USG 2000 User’s Guide...
Page 360 Type the maximum number of seconds the IKE SA can last. When this (Seconds) time has passed, the ZyWALL and remote IPSec router have to update the encryption and authentication keys and re-negotiate the IKE SA. This does not affect any existing IPSec SAs, however. ZyWALL USG 2000 User’s Guide...
Page 361 DH5 - use a 1536-bit random number The longer the key, the more secure the encryption, but also the longer it takes to encrypt and decrypt information. Both routers must use the same DH key group. ZyWALL USG 2000 User’s Guide...
Page 362 IPSec router. The password can be 1-31 ASCII characters. It is case- sensitive, but spaces are not allowed. Click OK to save your settings and exit this screen. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 363: The Vpn Concentrator Screen
Therefore, a VPN concentrator is more suitable when there is a minimum amount of traffic between spoke routers. ZyWALL USG 2000 User’s Guide...
Page 364: The Vpn Concentrator Add/Edit Screen
To access this screen, go to the VPN Concentrator summary screen (see Section 21.4 on page 363), and click either the Add icon or an Edit icon. Figure 225 VPN > IPSec VPN > Concentrator > Edit ZyWALL USG 2000 User’s Guide...
Page 365 To remove a member from the concentrator, click on the Remove icon next to the member. The web configurator confirms that you want to remove the member. Click OK to save your changes in the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 366: The Sa Monitor Screen
This field displays the encryption and authentication algorithms used in the SA. Up Time This field displays how many seconds the IPSec SA has been active. This field displays N/A if the IPSec SA uses manual keys. ZyWALL USG 2000 User’s Guide...
Page 367: Ipsec Vpn Background Information
You can also specify the IP address of the remote IPSec router as 0.0.0.0. This means that the remote IPSec router can have any IP address. In this case, only the remote IPSec router can initiate an IKE SA because the ZyWALL does not ZyWALL USG 2000 User’s Guide...
Page 368 AES applies a 128-bit key to 128-bit blocks of data. It is faster than 3DES. Some ZyWALLs also offer stronger forms of AES that apply 192-bit or 256-bit keys to 128-bit blocks of data. ZyWALL USG 2000 User’s Guide...
Page 369 This process is based on pre-shared keys and router identities. In main mode, the ZyWALL and remote IPSec router authenticate each other in steps 5 and 6, as illustrated below. The identities are also encrypted using the ZyWALL USG 2000 User’s Guide...
Page 370 IPSec router’s peer and local ID type and content, respectively. For example, in Table 114 on page 371, the ZyWALL and the remote IPSec router authenticate each other successfully. In contrast, in Table 115 on page 371, the ZyWALL USG 2000 User’s Guide...
Page 371 DH key group, to establish a shared secret. Steps 5 - 6: Finally, the ZyWALL and the remote IPSec router generate an encryption key (from the shared secret), encrypt their identities, and exchange their encrypted identity information for authentication. ZyWALL USG 2000 User’s Guide...
Page 372 • Configure the NAT router to forward packets with the extra header unchanged. (See the field description for detailed information about the extra header.) The extra header may be UDP port 500 or UDP port 4500, depending on the standard(s) the ZyWALL and remote IPSec router support. ZyWALL USG 2000 User’s Guide...
Page 373 There could be any number (of any type) of characters in front of the “abc” at the end and the VPN connection or policy name would still match. A VPN connection or policy name named “testacc” for example would not match. ZyWALL USG 2000 User’s Guide...
Page 374 ZyWALL and remote IPSec router (for example, for remote management), not between computers on the local and remote networks. Note: The ZyWALL and remote IPSec router must use the same encapsulation. ZyWALL USG 2000 User’s Guide...
Page 375 If you do not enable PFS, the ZyWALL and remote IPSec router use the same root key that was generated when the IKE SA was established to generate encryption keys. The DH key exchange is time-consuming and may be unnecessary for data that does not require such security. ZyWALL USG 2000 User’s Guide...
Page 376 • Destination address in inbound packets - this translation is used if you want to forward packets (for example, mail) from the remote network to a specific computer (like the mail server) in the local network. ZyWALL USG 2000 User’s Guide...
Page 377 To set up this NAT, you have to specify the following information: • Source - the original source address; the remote network (B). • Destination - the original destination address; the local network (A). ZyWALL USG 2000 User’s Guide...
Page 378 IP address of the mail server in the local network (A). • Mapped Port - the translated destination port or range of destination ports. The original port range and the mapped port range must be the same size. ZyWALL USG 2000 User’s Guide...
Page 379: Ssl Vpn
ZyWALL appears to be the server to remote users. This provides an added layer of protection for your internal servers. With reverse proxy mode, remote users can easily access any web-based applications on the local network by clicking on links or entering the provided URL. ZyWALL USG 2000 User’s Guide...
Page 380 • assign private IP addresses and provide DNS/WINS server information to remote users to access internal networks. SSL Access Policy Objects The SSL access policies reference the following objects. If you update this information, in response to changes, the ZyWALL automatically propagates the ZyWALL USG 2000 User’s Guide...
Page 381: The Ssl Access Privilege Screen
ZyWALL (after you have configured the SSL VPN settings on the ZyWALL). 22.2 The SSL Access Privilege Screen Click VPN > SSL VPN to open the Access Privilege screen. This screen lists the configured SSL access policies. Figure 236 VPN > SSL VPN > Access Privilege ZyWALL USG 2000 User’s Guide...
Page 382 To delete a policy, click the Remove icon next to the policy. To rearrange a policy in the list, click the Move to N icon next to the policy. Apply Click Apply to save the settings. Reset Click Reset to discard all changes. ZyWALL USG 2000 User’s Guide...
Page 383: The Ssl Access Policy Add/Edit Screen
Enter a descriptive name to identify this policy. You can enter up to 15 characters (“a-z”, A-Z”, “0-9”) with no spaces allowed. Description Enter additional information about this SSL access policy. You can enter up to 31 characters (“0-9”, “a-z”, “A-Z”, “-” and “_”). ZyWALL USG 2000 User’s Guide...
Page 384 To block access to a network, select the network name in the Selected Address Objects list and click <<. Create New Click this to create a new network object. Refer to Chapter 37 on page Address Object for more information. ZyWALL USG 2000 User’s Guide...
Page 385: The Ssl Vpn Connection Monitor Screen
This field displays the IP address the user used to establish this SSL VPN connection. Connected This field displays the time this connection was established. Time Inbound This field displays the number of bytes received by the ZyWALL on this (Bytes) connection. ZyWALL USG 2000 User’s Guide...
Page 386: The Ssl Global Setting Screen
Login Message Specify a message to display on the screen when a user logs in and an SSL VPN connection is established successfully. You can enter up to 31 characters (“a-z”, A-Z”, “0-9”) with spaces allowed. ZyWALL USG 2000 User’s Guide...
Page 387: How To Upload A Custom Logo
Upload Click Upload to transfer the specified graphic file from your computer to the ZyWALL. Reset Logo to Click Reset Logo to Default to display the ZyXEL company logo on the Default remote user’s web browser. Apply Click Apply to save the changes and/or start the logo file upload process.
Page 388: Establishing An Ssl Vpn Connection
After you have configured the SSL VPN settings on the ZyWALL, follow the steps below to establish an SSL VPN connection. Display the login screen and enter your user account information (the user name and password). Select Login to SSL VPN. Click Login. ZyWALL USG 2000 User’s Guide...
Page 389 Login screen. Clear the Login to SSL VPN check box and try logging in again. For more information on user portal screens, refer to Chapter 23 on page 391. ZyWALL USG 2000 User’s Guide...
Page 390 Chapter 22 SSL VPN ZyWALL USG 2000 User’s Guide...
Page 391: Ssl User Screens
The ZyWALL automatically loads a Java thin client program to your computer after a successful login. With the thin client, you can access servers, remote desktops and manage files as if you were on the local network. ZyWALL USG 2000 User’s Guide...
Page 392: Remote User Login
SSL VPN on the ZyWALL. 23.2 Remote User Login This section shows you how to access and log into the network through the ZyWALL. Example screens for Internet Explorer are shown. ZyWALL USG 2000 User’s Guide...
Page 393 If a token password is also required, enter it in the One-Time Password field. Select Log into SSL VPN and click Login to log in and establish an SSL VPN connection to the network to access network resources. Figure 245 Login Screen ZyWALL USG 2000 User’s Guide...
Page 394 Figure 247 SecuExtender Progress The Application screen displays showing the list of resources available to you. Figure 248 on page 395 for a screen example. Note: Available resource links vary depending on the configuration your network administrator made. ZyWALL USG 2000 User’s Guide...
Page 395: The Ssl Vpn User Screens
This part of the screen displays a list of the resources available to you. In the Application screen, click on a link to access or display the access method. In the File Sharing screen, click on a link to open a file or directory. ZyWALL USG 2000 User’s Guide...
Page 396: Bookmarking The Zywall
To properly terminate a connection, click on the Logout icon in any remote user screen. Click the Logout icon in any remote user screen. A prompt window displays. Click OK to continue. Figure 250 Logout: Prompt ZyWALL USG 2000 User’s Guide...
Page 397 Chapter 23 SSL User Screens An information screen displays to indicate that the SSL VPN connection is about to terminate. Figure 251 Logout: Connection Termination Progress ZyWALL USG 2000 User’s Guide...
Page 398 Chapter 23 SSL User Screens ZyWALL USG 2000 User’s Guide...
Page 399: Ssl User Application Screens
(Web Server) or web-based e-mail using Microsoft Outlook Web Access (OWA). To access a web-based application, simply click a link in the Application screen to display the web screen in a separate browser window. Figure 252 Application ZyWALL USG 2000 User’s Guide...
Page 400 Chapter 24 SSL User Application Screens ZyWALL USG 2000 User’s Guide...
Page 401: Ssl User File Sharing
• Rename a file or folder. • Delete a file or folder. • Upload a file. Note: Available actions you can perform in the File Sharing screen vary depending on the rights granted to you on the file server. ZyWALL USG 2000 User’s Guide...
Page 402: The Main File Sharing Screen
You can open a file if the file extension is recognized by the web browser and the associated application is installed on your computer. Log in as a remote user and click the File Sharing tab. Click on a file share icon. ZyWALL USG 2000 User’s Guide...
Page 403 If an access user name and password are required, a screen displays as shown in the following figure. Enter the account information and click Login to continue. Figure 254 File Sharing: Enter Access User Name and Password ZyWALL USG 2000 User’s Guide...
Page 404: Downloading A File
You are prompted to download a file which cannot be opened using a web browser. Follow the on-screen instructions to download and save the file to your computer. Then launch the associated application to open the file. ZyWALL USG 2000 User’s Guide...
Page 405: Saving A File
Specify a descriptive name for the folder. You can enter up to 356 characters. Then click Add. Note: Make sure the length of the folder name does not exceed the maximum allowed on the file server. Figure 257 File Sharing: Save a Word File ZyWALL USG 2000 User’s Guide...
Page 406: Renaming A File Or Folder
Click the Delete icon next to a file or folder to remove it. There is no confirmation screen - the file or folder is just deleted - so be sure you really do not want the item before you click. ZyWALL USG 2000 User’s Guide...
Page 407: Uploading A File
After the file is uploaded successfully, you should see the name of the file and a message in the screen. Figure 260 File Sharing: File Upload Note: Uploading a file with the same name and file extension replaces the existing file on the file server. No warning message is displayed. ZyWALL USG 2000 User’s Guide...
Page 408 Chapter 25 SSL User File Sharing ZyWALL USG 2000 User’s Guide...
Page 409: L2Tp Vpn
IPSec VPN. IPSec Configuration Required for L2TP VPN You must configure an IPSec VPN connection for L2TP VPN to use (see Chapter 21 on page 339 for details). The IPSec VPN connection must: ZyWALL USG 2000 User’s Guide...
Page 410 • Set the Destination Address to the IP address pool that the ZyWALL assigns to the remote users (L2TP_POOL in the following figure). • Set the next hop to be the VPN tunnel that you are using for L2TP. Figure 262 Policy Route for L2TP VPN L2TP_POOL LAN_SUBNET ZyWALL USG 2000 User’s Guide...
Page 411: L2Tp Vpn Screen
L2TP VPN sessions. IP Address Pool Select the pool of IP addresses that the ZyWALL uses to assign to the L2TP VPN clients. Select Create Object to configure a new pool of IP addresses. ZyWALL USG 2000 User’s Guide...
Page 412: L2Tp Vpn Session Monitor Screen
Click VPN > L2TP VPN > Session Monitor to open the following screen. Use this screen to display and manage the ZyWALL’s connected L2TP VPN sessions. Figure 264 VPN > L2TP VPN > Session Monitor ZyWALL USG 2000 User’s Guide...
Page 413 This field displays the public IP address that the remote user is using to connect to the Internet. Action Click the Disconnect icon next to an L2TP VPN connection to disconnect it. Refresh Click Refresh to update the information in the display. ZyWALL USG 2000 User’s Guide...
Page 414 Chapter 26 L2TP VPN ZyWALL USG 2000 User’s Guide...
Page 415: L2Tp Vpn Example
• You configure an IP address pool object named L2TP_POOL to assign the remote users IP addresses from 192.168.10.10 to 192.168.10.20 for use in the L2TP VPN tunnel. • The VPN rule allows the remote user to access the LAN_SUBNET which covers the 192.168.1.x subnet. ZyWALL USG 2000 User’s Guide...
Page 416: Configuring The Default L2Tp Vpn Gateway Example
• Select Pre-Shared Key and configure a password. This example uses top- secret. Click OK. Click the Default_L2TP_VPN_GW entry’s Enable icon and click Apply to turn on the entry. Figure 267 VPN > IPSec VPN > VPN Gateway (Enable) ZyWALL USG 2000 User’s Guide...
Page 417: Configuring The Default L2Tp Vpn Connection Example
IP address of 0.0.0.0. It is named L2TP_HOST in this example. Click the Default_L2TP_VPN_Connection entry’s Enable icon and click Apply to turn on the entry. Figure 269 VPN > IPSec VPN > VPN Connection (Enable) ZyWALL USG 2000 User’s Guide...
Page 418: Configuring The L2Tp Vpn Settings Example
• Select a user or group of users that can use the tunnel. Here a user account named L2TP-test has been created. • The other fields are left to the defaults in this example, click Apply. ZyWALL USG 2000 User’s Guide...
Page 419: Configuring The Policy Route For L2Tp Example
• Set the Destination Address to the IP address pool that the ZyWALL assigns to the remote users (L2TP_POOL in this example). • Set the next hop to be the Default_L2TP_VPN_Connection VPN tunnel. • Click OK. ZyWALL USG 2000 User’s Guide...
Page 420: Configuring L2Tp Vpn In Windows Xp And 2000
Click Start > Control Panel > Network Connections > New Connection Wizard. Click Next in the Welcome screen. Select Connect to the network at my workplace and click Next. Figure 272 New Connection Wizard: Network Connection Type ZyWALL USG 2000 User’s Guide...
Page 421 Chapter 27 L2TP VPN Example Select Virtual Private Network connection and click Next. Figure 273 New Connection Wizard: Network Connection Type L2TP to ZyWALL as the Company Name. Figure 274 New Connection Wizard: Connection Name ZyWALL USG 2000 User’s Guide...
Page 422 Enter the domain name or WAN IP address configured as the My Address in the VPN gateway configuration that the ZyWALL is using for L2TP VPN (172.16.1.2 in this example). Figure 276 New Connection Wizard: VPN Server Selection 172.16.1.2 Click Finish. ZyWALL USG 2000 User’s Guide...
Page 423 Chapter 27 L2TP VPN Example The Connect L2TP to ZyWALL screen appears. Click Properties > Security. Figure 277 Connect L2TP to ZyWALL 10 Click Security, select Advanced (custom settings) and click Settings. Figure 278 Connect L2TP to ZyWALL: Security ZyWALL USG 2000 User’s Guide...
Page 424 Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Figure 279 Connect ZyWALL L2TP: Security > Advanced 12 Click IPSec Settings. Figure 280 L2TP to ZyWALL Properties > Security ZyWALL USG 2000 User’s Guide...
Page 425 Figure 282 L2TP to ZyWALL Properties: Networking 15 Enter the user name and password of your ZyWALL account. Click Connect. Figure 283 Connect L2TP to ZyWALL 16 A window appears while the user name and password are verified. ZyWALL USG 2000 User’s Guide...
Page 426: Configuring L2Tp In Windows 2000
L2TP client. 27.6.2.1 Editing the Windows 2000 Registry In Windows 2000, you need to create a registry entry and restart the computer to have it use pre-shared keys. ZyWALL USG 2000 User’s Guide...
Page 427 Click Registry > Export Registry File and save a backup copy of your registry. You can go back to using this backup if you misconfigure the registry settings. Select HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\P arameters. Figure 287 Registry Key Right-click Parameters and select New > DWORD Value. Figure 288 New DWORD Value ZyWALL USG 2000 User’s Guide...
Page 428 IPSec policy for the computer to use. Click Start > Run. Type mmc and click OK. Figure 290 Run mmc Click Console > Add/Remove Snap-in. Figure 291 Console > Add/Remove Snap-in ZyWALL USG 2000 User’s Guide...
Page 429 Figure 292 Add > IP Security Policy Management > Finish Right-click IP Security Policies on Local Machine and click Create IP Security Policy. Click Next in the welcome screen. Figure 293 Create IP Security Policy ZyWALL USG 2000 User’s Guide...
Page 430 Name the IP security policy L2TP to ZyWALL, and click Next. Figure 294 IP Security Policy: Name Clear the Activate the default response rule check box and click Next. Figure 295 IP Security Policy: Request for Secure Communication ZyWALL USG 2000 User’s Guide...
Page 431 Leave the Edit Properties check box selected and click Finish. Figure 296 IP Security Policy: Completing the IP Security Policy Wizard In the properties dialog box, click Add > Next. Figure 297 IP Security Policy Properties > Add ZyWALL USG 2000 User’s Guide...
Page 432 Select This rule does not specify a tunnel and click Next. Figure 298 IP Security Policy Properties: Tunnel Endpoint 10 Select All network connections and click Next. Figure 299 IP Security Policy Properties: Network Type ZyWALL USG 2000 User’s Guide...
Page 433 11 Select Use this string to protect the key exchange (preshared key), type password in the text box, and click Next. Figure 300 IP Security Policy Properties: Authentication Method 12 Click Add. Figure 301 IP Security Policy Properties: IP Filter List ZyWALL USG 2000 User’s Guide...
Page 434 (172.16.1.2 in this example) in the IP Address field. Make certain the Mirrored. Also match packets with the exact opposite source and destination addresses check box is selected and click Apply. Figure 303 Filter Properties: Addressing . 16 ZyWALL USG 2000 User’s Guide...
Page 435 UDP from port 1701. Select To any port. Click Apply, OK, and then Close. Figure 304 Filter Properties: Protocol 16 Select ZyWALL WAN_IP and click Next. Figure 305 IP Security Policy Properties: IP Filter List ZyWALL USG 2000 User’s Guide...
Page 436 18 In the Console window, right-click L2TP to ZyWALL and select Assign. Figure 307 Console: L2TP to ZyWALL Assign 27.6.2.3 Configure the Windows 2000 Network Connection After you have configured the IPSec policy, use these directions to create a network connection. ZyWALL USG 2000 User’s Guide...
Page 437 Enter the domain name or WAN IP address configured as the My Address in the VPN gateway configuration that the ZyWALL is using for L2TP VPN. Click Next. Figure 310 New Connection Wizard: Destination Address 172.16.1.2 ZyWALL USG 2000 User’s Guide...
Page 438 Select For all users and click Next. Figure 311 New Connection Wizard: Connection Availability Name the connection L2TP to ZyWALL and click Finish. Figure 312 New Connection Wizard: Naming the Connection Click Properties. Figure 313 Connect L2TP to ZyWALL ZyWALL USG 2000 User’s Guide...
Page 439 Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Click Yes if a screen pops up. Figure 315 Connect L2TP to ZyWALL: Security > Advanced ZyWALL USG 2000 User’s Guide...
Page 440 Figure 317 Connect L2TP to ZyWALL 11 A ZyWALL-L2TP icon displays in your system tray. Double-click it to open a status screen. Figure 318 ZyWALL-L2TP System Tray Icon ZyWALL USG 2000 User’s Guide...
Page 441 12 Click Details and scroll down to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20). Figure 319 L2TP to ZyWALL Status: Details 13 Access a server or other network resource behind the ZyWALL to make sure your access works. ZyWALL USG 2000 User’s Guide...
Page 442 Chapter 27 L2TP VPN Example ZyWALL USG 2000 User’s Guide...
Page 443: Application Patrol
Application Patrol Application Patrol (445)
Page 445: Application Patrol
It also lets you open the Other Configuration Add/ Edit screen to create new conditions or edit existing ones. • Use the Statistics screen (see Section 28.5 on page 466) to see a bandwidth usage graph and statistics for each protocol. ZyWALL USG 2000 User’s Guide...
Page 446: What You Need To Know About Application Patrol
This approach is available in case the ZyWALL identifies a lot of “false positives” for a particular application. Bandwidth Management When you allow an application, you can restrict the bandwidth it uses or even the bandwidth that particular features in the application (like voice, video, or file ZyWALL USG 2000 User’s Guide...
Page 447 • Inbound traffic comes back from the WAN zone device to the LAN zone device. Bandwidth management is applied before sending the traffic out a LAN zone interface. Figure 320 LAN to WAN Connection and Packet Directions Connection Outbound Inbound ZyWALL USG 2000 User’s Guide...
Page 448 Unused bandwidth is divided equally. Higher priority traffic does not get a larger portion of the unused bandwidth. ZyWALL USG 2000 User’s Guide...
Page 449 With maximize bandwidth usage enabled, after each server gets its configured rate, the rest of the available bandwidth is divided equally between the two. So server A gets its configured rate of 300 kbps and server B gets its configured rate ZyWALL USG 2000 User’s Guide...
Page 450: Application Patrol Bandwidth Management Examples
The following sections give some simplified examples of using application patrol policies to manage applications competing for that 1 Mbps of upstream bandwidth. Here is an overview of what the rules need to accomplish. See the following sections for more details. ZyWALL USG 2000 User’s Guide...
Page 451 • Inbound traffic (to the LAN and DMZ from the WAN) is also limited to 200 kbps. The ZyWALL applies this limit before sending the traffic to LAN or DMZ. • Highest priority (1). Set policies for other applications to lower priorities so the SIP traffic always gets the best treatment. ZyWALL USG 2000 User’s Guide...
Page 452 HTTP traffic gets sent before non-SIP traffic. • Enable maximize bandwidth usage so the HTTP traffic can borrow unused bandwidth. Figure 325 HTTP Any to WAN Bandwidth Management Example Outbound: 200 kbps Inbound: 500 kbps ZyWALL USG 2000 User’s Guide...
Page 453 • Fourth highest priority (4). • Disable maximize bandwidth usage since you do not want to give FTP more bandwidth. Figure 327 FTP LAN to DMZ Bandwidth Management Example Inbound: 50 Mbps Outbound: 50 Mbps ZyWALL USG 2000 User’s Guide...
Page 454: Application Patrol General Screen
This same setting also appears in the Network > Routing > Policy Route screen. Enabling or disabling it in one screen also enables or disables it in the other screen. ZyWALL USG 2000 User’s Guide...
Page 455: Application Patrol Applications
Use the application patrol Common, Instant Messenger, Peer to Peer, VoIP, or Streaming screen to manage traffic of individual applications. Use the Common screen (shown here as an example) to manage traffic of the most commonly used web, file transfer and e-mail protocols. ZyWALL USG 2000 User’s Guide...
Page 456: The Application Patrol Edit Screen
Click Reset to begin configuring this screen afresh. 28.3.1 The Application Patrol Edit Screen Use this screen to edit the settings for an application. To access this screen, go to the application patrol Common, Instant Messenger, Peer to Peer, VoIP, or ZyWALL USG 2000 User’s Guide...
Page 457 Service Port field. Click Remove to delete a port number. The web configurator confirms that you want to delete the port number before doing so. Policy This table lists the policies configured for this application. ZyWALL USG 2000 User’s Guide...
Page 458 The ZyWALL ignores this number if the incoming and outgoing limits are both set to 0. In this case the traffic is automatically treated as being set to the lowest priority (7) regardless of this field’s configuration. ZyWALL USG 2000 User’s Guide...
Page 459: The Application Patrol Policy Edit Screen
Messenger, Peer to Peer, VoIP, or Streaming screen and click an application’s Edit icon. Then click the Add icon or an Edit icon in the Policy table. The screen displayed here is for the MSN instant messenger service. Figure 331 Application Policy Edit ZyWALL USG 2000 User’s Guide...
Page 460 Configure these fields to set the amount of bandwidth the application Management can use. These fields only apply when Access is set to forward. You must also enable bandwidth management in the main application patrol screen (AppPatrol > General) in order to apply bandwidth shaping. ZyWALL USG 2000 User’s Guide...
Page 461 (log alert) or neither (no) when the application’s traffic matches this policy. See Chapter 47 on page 761 for more on logs. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 462: The Other Applications Screen
This is the user name or user group to which the policy applies. If any displays, the policy applies to all users. From This is the source zone of the traffic to which this policy applies. This is the destination zone of the traffic to which this policy applies. ZyWALL USG 2000 User’s Guide...
Page 463 (# field) of where you want to move the entry. The # field is updated accordingly. The ordering of the entries is important as they are applied in order of their numbering. ZyWALL USG 2000 User’s Guide...
Page 464: The Other Applications Add/Edit Screen
Select any to apply the policy for every user. From Select the source zone of the traffic to which this policy applies. Select the destination zone of the traffic to which this policy applies. ZyWALL USG 2000 User’s Guide...
Page 465 If the sum of the bandwidths for routes using the same next hop is higher than the actual transmission speed, lower priority traffic may not be sent if higher priority traffic uses all of the actual bandwidth. ZyWALL USG 2000 User’s Guide...
Page 466: Application Patrol Statistics
Click Cancel to exit this screen without saving your changes. 28.5 Application Patrol Statistics This screen displays a bandwidth usage graph and statistics for selected protocols. Click AppPatrol > Statistics to open the following screen. ZyWALL USG 2000 User’s Guide...
Page 467: Application Patrol Statistics: General Setup
Select the protocols for which to display statistics. Protocols Select All selects all of the protocols. Clear All clears all of the protocols. Click Expand to display individual protocols. Collapse hides them. Statistics for the selected protocols display after you click Apply. ZyWALL USG 2000 User’s Guide...
Page 468: Application Patrol Statistics: Bandwidth Statistics
ZyWALL sends to the initiator of the connection. • A dotted line represents a protocol’s outgoing bandwidth usage. This is the protocol’s traffic that the ZyWALL sends out from the initiator of the connection. • Different colors represent different protocols. ZyWALL USG 2000 User’s Guide...
Page 469: Application Patrol Statistics: Protocol Statistics
IP payload. Matched This is how much of the application’s traffic the ZyWALL identified by Service Ports examining OSI level-3 information such as IP addresses and port Connection numbers. Rule This is a protocol’s rule. ZyWALL USG 2000 User’s Guide...
Page 470 This is how much of the application’s traffic the ZyWALL has discarded Data (KB) and notified the client that the traffic was rejected (in kilobytes). This traffic was rejected because it matched a policy set to “reject”. ZyWALL USG 2000 User’s Guide...
Page 471: Anti-X
Anti-X Anti-Virus (473) IDP (489) ADP (523) Content Filtering (543) Content Filter Reports (567) Anti-Spam (575)
Page 473: Anti-Virus
481) to set up anti- virus black (blocked) and white (allowed) lists of virus file patterns. • Use the Signature screen (Section 29.6 on page 485) to search signatures to get more information about signatures. ZyWALL USG 2000 User’s Guide...
Page 474: What You Need To Know About Anti-Virus
Registration screen. After the trial expires, you need to purchase an iCard for the anti-virus engine you want to use and register it in the Registration > Service screen. You must use the ZyXEL anti-virus iCard for the ZyXEL anti-virus engine and the Kaspersky anti-virus iCard for the Kaspersky anti-virus engine. See Chapter 8 on page 165 for details.
Page 475 • ZIP file(s) within a ZIP file. Finding Out More • See Section 5.4.14 on page 111 for related information on these screens. • See Section 29.7 on page 487 for anti-virus background information. ZyWALL USG 2000 User’s Guide...
Page 476: Before You Begin
Select this check box to check traffic for viruses and spyware. The Virus and Anti- following table lists policies that define which traffic the ZyWALL scans Spyware and the action it takes upon finding a virus. ZyWALL USG 2000 User’s Guide...
Page 477 6, the policy you are moving becomes number 6 and the previous policy 6 (if there is one) gets pushed up (or down) one. The ordering of your policies is important as they are applied in order of their numbering. ZyWALL USG 2000 User’s Guide...
Page 478 The following fields display information on the current signature set that Information the ZyWALL is using. Anti-Virus This field displays whether the ZyWALL is set to use ZyXEL’s anti-virus Engine Type engine or the one powered by Kaspersky. Current This field displays the anti-virus signature set version number. This Version number gets larger as the set is enhanced.
Page 479: Anti-Virus Policy Add Or Edit Screen
FTP applies to traffic using the TCP port number specified for FTP in the ALG screen. SMTP applies to traffic using TCP port 25. POP3 applies to traffic using TCP port 110. IMAP4 applies to traffic using TCP port 143. ZyWALL USG 2000 User’s Guide...
Page 480 (ZIP and RAR) first decompresses the ZIP file and then scans the contents for viruses. Note: The ZyWALL decompresses a ZIP file once. The ZyWALL does NOT decompress any ZIP file(s) within a ZIP file. ZyWALL USG 2000 User’s Guide...
Page 481: Anti-Virus Black List
Click Anti-X > Anti-Virus > Black/White List to display the screen shown next. Use the Black List screen to set up the Anti-Virus black (blocked) list of virus file patterns. Figure 340 Anti-X > Anti-Virus > Black/White List > Black List ZyWALL USG 2000 User’s Guide...
Page 482: Anti-Virus Black List Or White List Add/Edit
Add icon or an Edit icon to display the following screen. • For a black list entry, enter a file pattern that should cause the ZyWALL to log and delete a file. ZyWALL USG 2000 User’s Guide...
Page 483 If you do not use a wildcard, the ZyWALL checks up to the first 80 characters of a file name. Click OK to save your changes. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 484: Anti-Virus White List
This is the entry’s index number in the list. File Pattern This is the file name pattern. If a file’s name matches this pattern, the ZyWALL does not check the file for viruses. ZyWALL USG 2000 User’s Guide...
Page 485: Signature Searching
If Internet Explorer opens a warning screen about a script making Internet Explorer run slowly and the computer maybe becoming unresponsive, just click No to continue. Figure 343 Anti-X > Anti-Virus > Signature: Search by Severity ZyWALL USG 2000 User’s Guide...
Page 486 Category This column displays whether the signature is for identifying a virus or spyware. Click the column heading to sort your search results by category. ZyWALL USG 2000 User’s Guide...
Page 487: Anti-Virus Technical Reference
Once the virus is spread through the network, the number of infected networked computers can grow exponentially. Types of Anti-Virus Scanner The section describes two types of anti-virus scanner: host-based and network- based. ZyWALL USG 2000 User’s Guide...
Page 488 • NAV scanners stops virus threats at the network edge before they enter or exit a network. • NAV scanners reduce computing loading on computers as the read-time data traffic inspection is done on a dedicated security device. ZyWALL USG 2000 User’s Guide...
Page 489: Idp
Chapter 31 on page 523). Zone A zone is a combination of ZyWALL interfaces and VPN connections used for configuring security. See the zone chapter for details on zones and the interfaces chapter for details on interfaces. ZyWALL USG 2000 User’s Guide...
Page 490: Before You Begin
When the trial subscription expires, purchase and enter a license key using the same screens to continue the subscription. • Configure zones on the ZyWALL - see Chapter 14 on page 275 for more information. ZyWALL USG 2000 User’s Guide...
Page 491: The Idp General Screen
If you don’t have a standard license, you can register for Detection a once-off trial one. Policies Use this list to specify which IDP profile the ZyWALL uses for traffic flowing in a specific direction. Priority IDP policies are applied in order of priority. ZyWALL USG 2000 User’s Guide...
Page 492 Apply New This link appears if you have not registered for the service or only Registration have the trial registration. Click this link to go to the screen where you can register for the service. ZyWALL USG 2000 User’s Guide...
Page 493: Configuring Idp Policies
From Traffic direction is defined by the zone the traffic is coming from and the zone the traffic is going to. Use the From field to specify the zone from which the traffic is coming. ZyWALL USG 2000 User’s Guide...
Page 494: Introducing Idp Profiles
The ZyWALL comes with several base profiles. You use base profiles to create new profiles. In the Anti-X > IDP > Profile screen, click the Add icon to display the following screen. Figure 346 Base Profiles ZyWALL USG 2000 User’s Guide...
Page 495: The Profile Summary Screen
Click Cancel to exit this screen without saving your changes. 30.4 The Profile Summary Screen Select Anti-X > IDP > Profile. Use this screen to: • Add a new profile • Edit an existing profile ZyWALL USG 2000 User’s Guide...
Page 496: Creating New Profiles
When you’re satisfied that they have been reduced to an acceptable level, you could then create an ‘inline profile’ whereby you configure appropriate actions to be taken when a packet matches a signature. 30.5.1 Procedure To Create a New Profile To create a new profile: ZyWALL USG 2000 User’s Guide...
Page 497 Note: If Internet Explorer opens a warning screen about a script making Internet Explorer run slowly and the computer maybe becoming unresponsive, just click No to continue. Type a new profile name Enable or disable individual signatures. Edit the default log options and actions. ZyWALL USG 2000 User’s Guide...
Page 498: Profiles: Packet Inspection
Select Anti-X > IDP > Profile and then add a new or edit an existing profile select. Packet inspection signatures examine the contents of a packet for malicious data. It operates at layer-4 to layer-7. Figure 348 Anti-X > IDP > Profile > Edit : Group View ZyWALL USG 2000 User’s Guide...
Page 499 This is the attack type as defined on the ZyWALL. See Table 148 on page Type for a description of each type. Activation Click the icon to enable or disable a signature or group of signatures. ZyWALL USG 2000 User’s Guide...
Page 500 A profile consists of three separate screens. If you want to configure just one screen for an IDP profile, click OK to save your settings to the ZyWALL, complete the profile and return to the profile summary page. ZyWALL USG 2000 User’s Guide...
Page 501: Policy Types
80 on a server, he determines that it is a HTTP service run by some web server application. He then uses a web vulnerability scanner (for example, Nikto) to look for documented vulnerabilities. ZyWALL USG 2000 User’s Guide...
Page 502: Idp Service Groups
The following figure shows the WEB_PHP service group that contains signatures related to attacks on web servers using PHP exploits. PHP (PHP: Hypertext Preprocessor) is a server-side HTML embedded scripting language that allows web developers to build dynamic websites. ZyWALL USG 2000 User’s Guide...
Page 503 If you select original setting for service group logs and/or actions, all signatures within that group are returned to their last-saved settings. Figure 349 Anti-X > IDP > Profile > Edit > IDP Service Group ZyWALL USG 2000 User’s Guide...
Page 504: Profile > Query View Screen
Type the ID or part of the ID of the signature(s) you want to find. Severity Search for signatures by severity level(s) (see Table 147 on page 499). Hold down the [Ctrl] key if you want to make multiple selections. ZyWALL USG 2000 User’s Guide...
Page 505: Query Example
Click OK in the final profile screen to complete the profile. 30.6.4 Query Example This example shows a search with these criteria: • Severity: severe and high • Attack Type: DDoS • Platform: Windows 2000 and Windows XP computers • Service: Any ZyWALL USG 2000 User’s Guide...
Page 506: Introducing Idp Custom Signatures
Figure 352 Query Example Search Results 30.7 Introducing IDP Custom Signatures Create custom signatures for new attacks or attacks peculiar to your network. Custom signatures can also be saved to/from your computer so as to share with others. ZyWALL USG 2000 User’s Guide...
Page 507: Ip Packet Header
When it reaches zero, the datagram is discarded. It is used to prevent accidental routing loops. Protocol The protocol indicates the type of transport packet being carried, for example, 1 = ICMP; 2= IGMP; 6 = TCP; 17= UDP. ZyWALL USG 2000 User’s Guide...
Page 508: Configuring Custom Signatures
Click the SID or Name heading to sort. Click the Add icon to create a new signature or click the Edit icon to edit an existing signature. You can also delete custom signatures here or save them to your computer. ZyWALL USG 2000 User’s Guide...
Page 509 Export. Click Save in the file download dialog box and then select a location and name for the file. Custom signatures must end with the ‘rules’ file name extension, for example, MySig.rules. ZyWALL USG 2000 User’s Guide...
Page 510: Creating Or Editing A Custom Signature
Figure 354 on page 509. A packet must match all items you configure in this screen before it matches the signature. The more specific your signature (including packet contents), then the fewer false positives the signature will trigger. ZyWALL USG 2000 User’s Guide...
Page 511 Chapter 30 IDP Try to write signatures that target a vulnerability, for example a certain type of traffic on certain operating systems, instead of a specific exploit. Figure 355 Anti-X > IDP > Custom Signatures > Add/Edit ZyWALL USG 2000 User’s Guide...
Page 512 If a datagram is fragmented, it contains a value that identifies the datagram to which the fragment belongs. Some intrusions use an invalid Identification number. Select the check box and then type in the invalid number that the intrusion uses. ZyWALL USG 2000 User’s Guide...
Page 513 The following fields vary depending on whether you choose TCP, UDP Protocol or ICMP. Transport Protocol: TCP Port Select the check box and then enter the source and destination TCP port numbers that will trigger this signature. ZyWALL USG 2000 User’s Guide...
Page 514 Payload Options The longer a payload option is, the more exact the match, the faster the signature processing. Therefore, if possible, it is recommended to have at least one payload option in your signature. ZyWALL USG 2000 User’s Guide...
Page 515 /winnt/system32/cmd.exe?/c+ver Click this button to save your changes to the ZyWALL and return to the summary screen. Cancel Click this button to return to the summary screen without saving any changes. ZyWALL USG 2000 User’s Guide...
Page 516: Custom Signature Example
From the NetBIOS header you see that the first byte ‘00’ defines the message type. The next three bytes represent the length of data, so you can ignore it. Therefore enter |00| as the first pattern. Figure 356 Custom Signature Example Pattern 1 ZyWALL USG 2000 User’s Guide...
Page 517 Figure 358 Custom Signature Example Patterns 3 and 4 The final custom signature should look like as shown in the following figure. If the attack occurs, check the logs for a log of your custom signature. This indicates the signature works correctly. ZyWALL USG 2000 User’s Guide...
Page 518 Chapter 30 IDP Figure 359 Example Custom Signature ZyWALL USG 2000 User’s Guide...
Page 519: Applying Custom Signatures
The Note column displays ACCESS FORWARD when no action is configured for the signature. It displays ACCESS ZyWALL USG 2000 User’s Guide...
Page 520: Idp Technical Reference
Typical “network-based intrusions” are SQL slammer, Blaster, Nimda MyDoom etc. ZyWALL USG 2000 User’s Guide...
Page 521 Time to Live IP Options ipopts Same IP sameip Transport Protocol Transport Protocol: TCP Port (In Snort rule header) Flow flow Flags flags Sequence Number Ack Number Window Size window Transport Protocol: UDP (In Snort rule header) ZyWALL USG 2000 User’s Guide...
Page 522 Payload Size dsize Offset (relative to start of offset payload) Relative to end of last match distance Content content Case-insensitive nocase Decode as URI uricontent Note: Not all Snort functionality is supported in the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 523: Adp
Traffic anomaly rules look for abnormal behavior or events such as port scanning, sweeping or network flooding. It operates at OSI layer-2 and layer-3. Traffic anomaly rules may be updated when you upload new firmware. ZyWALL USG 2000 User’s Guide...
Page 524: Before You Begin
IDP-related term definitions. • See Section 31.4 on page 534 for background information on these screens. 31.1.4 Before You Begin Configure the ZyWALL’s zones - see Chapter 14 on page 275 for more information. ZyWALL USG 2000 User’s Guide...
Page 525: The Adp General Screen
ZyWALL’s performance. Anomaly Profile An anomaly profile is a set of anomaly rules with configured activation, log and action settings. This field shows which anomaly profile is bound to which traffic direction. ZyWALL USG 2000 User’s Guide...
Page 526: Configuring Adp Policies
Click Anti-X > ADP > General and then an Add or Edit icon to display the following screen. Use this screen to apply an ADP profile to a traffic direction. Figure 363 Anti-X > ADP > General > Add ZyWALL USG 2000 User’s Guide...
Page 527: The Profile Summary Screen
Click Cancel to exit this screen without saving your changes. 31.3 The Profile Summary Screen Use this screen to: • Create a new profile using an existing base profile • Edit an existing profile • Delete an existing profile ZyWALL USG 2000 User’s Guide...
Page 528: Base Profiles
Click OK to save your changes. Cancel Click Cancel to exit this screen without saving your changes. 31.3.2 Configuring The ADP Profile Summary Screen Select Anti-X > ADP > Profile. Figure 365 Anti-X > ADP > Profile ZyWALL USG 2000 User’s Guide...
Page 529: Creating New Adp Profiles
In the Anti-X > ADP > Profile screen, click the Edit icon or click the Add icon and choose a base profile. If you made changes to other screens belonging to this ZyWALL USG 2000 User’s Guide...
Page 530 Chapter 31 ADP profile, make sure you have clicked OK or Save to save the changes before selecting the Traffic Anomaly tab. Figure 366 Profiles: Traffic Anomaly ZyWALL USG 2000 User’s Guide...
Page 531 For flood detection you can set the number of detected flood packets per second that causes the ZyWALL to take the configured action. Click OK to save your settings to the ZyWALL, complete the profile and return to the profile summary page. ZyWALL USG 2000 User’s Guide...
Page 532: Protocol Anomaly Profiles
Protocol Anomaly tab. If you made changes to other screens belonging to this profile, make sure you have clicked OK or Save to save the changes before selecting the Protocol Anomaly tab. ZyWALL USG 2000 User’s Guide...
Page 533 Chapter 31 ADP Figure 367 Profiles: Protocol Anomaly ZyWALL USG 2000 User’s Guide...
Page 534: Technical Reference
You may then go to the another profile screen (tab) in order to complete the profile. Click OK in the final profile screen to complete the profile. 31.4 Technical Reference This section is divided into traffic anomaly background information and protocol anomaly background information. ZyWALL USG 2000 User’s Guide...
Page 535 This may be used to evade intrusion detection. These are distributed port scan types: • TCP Distributed Portscan • UDP Distributed Portscan • IP Distributed Portscan ZyWALL USG 2000 User’s Guide...
Page 536 A smurf attacker (A) floods a router (B) with Internet Control Message Protocol (ICMP) echo request packets (pings) with the destination IP address of each packet as the broadcast address of the network. The router will broadcast the ZyWALL USG 2000 User’s Guide...
Page 537 ACK that follows the SYN-ACK, and stores all outstanding SYN-ACK responses on a backlog queue. SYN-ACKs are only moved off the queue when an ACK comes back or when an internal timer ends the three-way handshake. Once the queue is ZyWALL USG 2000 User’s Guide...
Page 538 If enough UDP packets are delivered to ports on victim, the system will go down. Protocol Anomaly Background Information The following sections may help you configure the protocol anomaly profile screen (see Section 31.3.5 on page 532) ZyWALL USG 2000 User’s Guide...
Page 539 This rule lets you receive a log or alert if certain non-RFC CHAR ATTACK characters are used in a request URI. For instance, you may want to know if there are NULL bytes in the request-URI. ZyWALL USG 2000 User’s Guide...
Page 540 This is when a TCP packet is sent where the TCP data offset ATTACK is larger than the payload. TRUNCATED-OPTIONS This is when a TCP packet is sent which doesn’t have ATTACK enough data to read. This could mean the packet was truncated. ZyWALL USG 2000 User’s Guide...
Page 541 TRUNCATED- This is when an ICMP packet is sent which has an ICMP TIMESTAMP-HEADER datagram length of less than the ICMP Time Stamp header ATTACK length. This may cause some applications to crash. ZyWALL USG 2000 User’s Guide...
Page 542 Chapter 31 ADP ZyWALL USG 2000 User’s Guide...
Page 543: Content Filtering
• Use schedule objects to define when to apply a content filter profile. • Use address and/or user/group objects to define to whose web access to apply the content filter profile. • Apply a content filter profile that you have custom-tailored. ZyWALL USG 2000 User’s Guide...
Page 544 URL. For example, with the URL www.zyxel.com.tw/news/ pressroom.php, the domain name is www.zyxel.com.tw. The file path is the characters that come after the first slash in the URL. For example, with the URL www.zyxel.com.tw/news/pressroom.php, the file path is news/pressroom.php. ZyWALL USG 2000 User’s Guide...
Page 545: Before You Begin
For example, with the URL www.zyxel.com.tw/news/pressroom.php, the ZyWALL would find “tw” in the domain name (www.zyxel.com.tw). It would also find “news” in the file path (news/pressroom.php) but it would not find “tw/news”.
Page 546: Content Filter General Screen
A content filter policy applies to web access from the IP addresses listed here. any means the content filter policy applies to all of the web access requests that the ZyWALL receives from any IP address. ZyWALL USG 2000 User’s Guide...
Page 547 Enter a message to be displayed when content filter blocks access Message to a web page. Use up to 255 characters (0-9a-zA-Z;/?:@&=+$\.- _!~*'()%,”). For example, “Access to this web page is not allowed. Please contact the network administrator”. ZyWALL USG 2000 User’s Guide...
Page 548 Click this link to go to the screen where you can register for the service. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 549: Content Filter Policy Add Or Edit Screen
Select any to have the content filter policy apply to all of the web access requests that the ZyWALL receives from any user. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 550: Content Filter Profile Screen
Categories screen. Use this screen to enable external database content filtering and select which web site categories to block and/or log. Note: You must register for external content filtering before you can use it. See Section 8.2 on page 167 for how to register. ZyWALL USG 2000 User’s Guide...
Page 551 Chapter 32 Content Filtering Chapter 33 on page 567 for how to view content filtering reports. Figure 374 Anti-X > Content Filter > Filter Profile > Add ZyWALL USG 2000 User’s Guide...
Page 552 The ZyWALL then blocks or forwards access to the web page depending on the configuration of the rest of this page. ZyWALL USG 2000 User’s Guide...
Page 553 Select Warn to display a warning message before allowing users to access web pages that the external web filtering service has not categorized. Select Log to record attempts to access web pages that are not categorized. ZyWALL USG 2000 User’s Guide...
Page 554 Phishing This category includes pages that are designed to appear as a legitimate bank or retailer with the intent to fraudulently capture sensitive data (i.e. credit card numbers, pin numbers). ZyWALL USG 2000 User’s Guide...
Page 555 These depictions are not necessarily sexual in intent or effect, but may include pages containing nude paintings or photo galleries of artistic nature. This category also includes nudist or naturist pages that contain pictures of nude individuals. ZyWALL USG 2000 User’s Guide...
Page 556 Arts/Entertainment This category includes pages that promote and provide information about motion pictures, videos, television, music and programming guides, books, comics, movie theatres, galleries, artists or reviews on entertainment. ZyWALL USG 2000 User’s Guide...
Page 557 This category includes pages sponsored by or which provide information on government, government agencies and government services such as taxation and emergency services. It also includes pages that discuss or explain laws of various governmental entities. ZyWALL USG 2000 User’s Guide...
Page 558 It does not include pages containing alternative religions such as Wicca or witchcraft or atheist beliefs (Alternative Spirituality/Occult). ZyWALL USG 2000 User’s Guide...
Page 559 Sports/Recreation/ This category includes pages that promote or provide Hobbies information about spectator sports, recreational activities, or hobbies. This includes pages that discuss or promote camping, gardening, and collecting. ZyWALL USG 2000 User’s Guide...
Page 560 Click this button to see the category recorded in the external Filter Server content filter server’s database for the web page you specified. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 561: Content Filter Customization Screen
General Settings Name Enter a descriptive name for this content filtering profile name. You may use 1-31 alphanumeric characters, underscores( ), or dashes (-), but the first character cannot be a number. This value is case-sensitive. ZyWALL USG 2000 User’s Guide...
Page 562 Do not enter the complete URL of the site – that is, do not include “http://”. All subdomains are allowed. For example, entering “zyxel.com” also allows “www.zyxel.com”, “partner.zyxel.com”, “press.zyxel.com”, etc. Use up to 63 characters (0-9a-z-). The casing does not matter.
Page 563: Content Filter Cache Screen
You can remove individual entries from the cache. When you do this, the ZyWALL queries the external content filtering database the next time someone tries to ZyWALL USG 2000 User’s Guide...
Page 564 Click this button to clear all web site addresses from the cache manually. Refresh Click this button to reload the list of content filter cache entries. Total cache This is the number of web site addresses in the content filter cache. entries ZyWALL USG 2000 User’s Guide...
Page 565 ZyWALL to reflect changes in the external content filtering database. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 566: Content Filter Technical Reference
ZyWALL, which then blocks and/or logs access to the web site based on the settings in the content filter profile. The web site’s address and category are then stored in the ZyWALL’s content filter cache. ZyWALL USG 2000 User’s Guide...
Page 567: Content Filter Reports
You need to register your iCard before you can view content filtering reports. Alternatively, you can also view content filtering reports during the free trial (up to 30 days). Go to http://www.myZyXEL.com. ZyWALL USG 2000 User’s Guide...
Page 568 Chapter 33 Content Filter Reports Fill in your myZyXEL.com account information and click Login. Figure 378 myZyXEL.com: Login ZyWALL USG 2000 User’s Guide...
Page 569 Chapter 33 Content Filter Reports A welcome screen displays. Click your ZyWALL’s model name and/or MAC address under Registered ZyXEL Products (the ZyWALL 70 is shown as an example here). You can change the descriptive name for your ZyWALL using the Rename...
Page 570 In the Service Management screen click Content Filter in the Service Name column to open the Blue Coat login screen. Figure 380 myZyXEL.com: Service Management In the Web Filter Home screen, click the Reports tab. Figure 381 Blue Coat Content Filter Reports Main Screen ZyWALL USG 2000 User’s Guide...
Page 571 Chapter 33 Content Filter Reports Select items under Global Reports to view the corresponding reports. Figure 382 Blue Coat: Report Home ZyWALL USG 2000 User’s Guide...
Page 572 Action Taken field and click Run Report.The screens vary according to the report type you selected in the Report Home screen. A chart and/or list of requested web site categories display in the lower half of the screen. Figure 383 Global Report Screen Example ZyWALL USG 2000 User’s Guide...
Page 573 Chapter 33 Content Filter Reports You can click a category in the Categories report or click URLs in the Report Home screen to see the URLs that were requested. Figure 384 Requested URLs Example ZyWALL USG 2000 User’s Guide...
Page 574 Chapter 33 Content Filter Reports ZyWALL USG 2000 User’s Guide...
Page 575: Anti-Spam
The white list can also increases the ZyWALL’s anti-spam speed and efficiency by not having the ZyWALL perform the full anti-spam checking process on legitimate e-mail. ZyWALL USG 2000 User’s Guide...
Page 576 For example, in Microsoft’s Outlook Express, select a mail and click File > Properties > Details. This displays the e-mail’s header. Click Message Source to see the source for the entire mail including both the header and the body. ZyWALL USG 2000 User’s Guide...
Page 577 (in this example it was an SMTP mail and the defined action is to drop the mail). After a positive match is found in a DNSBL, the ZyWALL does not wait for any more DNSBL responses. ZyWALL USG 2000 User’s Guide...
Page 578: Before You Begin
Select Drop to have the ZyWALL drop mail connections to stop the excess e-mail sessions. The e-mail client or server will have to re- attempt to send or receive e-mail later when the number of e-mail sessions is under the threshold. Policy Summary ZyWALL USG 2000 User’s Guide...
Page 579: The Anti-Spam Policy Add Or Edit Screen
Click the Add or Edit icon in the Anti-X > Anti-Spam > General screen to display the configuration screen as shown next. Use this screen to configure an anti-spam policy that controls what traffic direction of e-mail to check, which e- ZyWALL USG 2000 User’s Guide...
Page 580 To zone. Protocols to Select which protocols of traffic to scan for spam. Scan SMTP applies to traffic using TCP port 25. POP3 applies to traffic using TCP port 110. Scan Options ZyWALL USG 2000 User’s Guide...
Page 581: The Anti-Spam Black List Screen
Click Anti-X > Anti-Spam > Black /White List to display the Anti-Spam Black List screen. Configure the black list to identify spam e-mail. You can create black list entries based on the sender’s or relay server’s IP address or e-mail address. You can also ZyWALL USG 2000 User’s Guide...
Page 582 Apply to save and apply the change. Click an entry’s Edit icon to edit the entry. To delete an entry, click the entry’s Remove icon. The web configurator confirms that you want to delete the entry. ZyWALL USG 2000 User’s Guide...
Page 583: The Anti-Spam Black Or White List Add/Edit Screen
Configure black list header entries to check for e-mail from bulk mail programs or with content commonly used in spam. Configure white list header entries to allow certain header values that identify the e-mail as being from a trusted source. ZyWALL USG 2000 User’s Guide...
Page 584: Regular Expressions In Black Or White List Entries
You cannot use two wildcards side by side, there must be other characters between them. • The ZyWALL checks the first header with the name you specified in the entry. So if the e-mail has more than one “Received” header, the ZyWALL checks the first one. ZyWALL USG 2000 User’s Guide...
Page 585: The Anti-Spam White List Screen
This field displays whether the entry is based on the e-mail’s subject, source or relay IP address, source e-mail address, or a header. Content This field displays the subject content, source or relay IP address, source e-mail address, or header value for which the entry checks. ZyWALL USG 2000 User’s Guide...
Page 586: The Dnsbl Screen
Click Anti-X > Anti-Spam > DNSBL to display the anti-spam DNSBL screen. Use this screen to configure the ZyWALL to check the sender and relay IP addresses in e-mail headers against DNS (Domain Name Service)-based spam Black Lists (DNSBLs). Figure 391 Anti-X > Anti-Spam > DNSBL ZyWALL USG 2000 User’s Guide...
Page 587 Select drop to discard SMTP mail. Select forward to allow SMTP mail to go through. Select forward with tag to add a DNSBL timeout tag to the mail subject of an SMTP mail and send it. ZyWALL USG 2000 User’s Guide...
Page 588: The Dnsbl Add/Edit Screen
DNSBL servers. Some blacklists are more effective than others. You want a list that catches most spam and avoids false positives (identifying legitimate e-mail as spam). Different DNSBLs have different ZyWALL USG 2000 User’s Guide...
Page 589: The Anti-Spam Status Screen
Figure 393 Anti-X > Anti-Spam > Status The following table describes the labels in this screen. Table 175 Anti-X > Anti-Spam > Status LABEL DESCRIPTION Resource Status Refresh Click this button to update the information displayed on this screen. ZyWALL USG 2000 User’s Guide...
Page 590 This is the average for how long it takes to receive a reply from this Time (sec) DNSBL. No Response This is how many DNS queries the ZyWALL sent to this DNSBL without receiving a reply. ZyWALL USG 2000 User’s Guide...
Page 591: Device Ha
Device HA Device HA (593)
Page 593: Device Ha
VRRP group settings and synchronize backup ZyWALLs. 35.1.2 What You Need to Know About Device HA Active-Passive Mode and Legacy Mode • Active-passive mode lets a backup ZyWALL take over if the master ZyWALL fails. ZyWALL USG 2000 User’s Guide...
Page 594: Before You Begin
ZyWALLs are both subscribed. For example, a backup subscribed to IDP/ AppPatrol, but not anti-virus, gets IDP/AppPatrol updates from the master, but not anti-virus updates. It is highly recommended to subscribe the master and backup ZyWALLs to the same services. ZyWALL USG 2000 User’s Guide...
Page 595: Device Ha General
You can use this IP address and subnet mask to access the ZyWALL whether it is in master or backup mode. Link Status This tells whether the monitored interface’s connection is down or up. ZyWALL USG 2000 User’s Guide...
Page 596: The Active-Passive Mode Screen
ZyWALL A and backup ZyWALL B form a virtual router. Figure 396 Virtual Router Cluster ID You can have multiple ZyWALL virtual routers on your network. Use a different cluster ID to identify each virtual router. In the following example, ZyWALLs A and ZyWALL USG 2000 User’s Guide...
Page 597 IP address to manage the ZyWALL regardless of whether it is the master or the backup. For example, ZyWALL B takes over A’s 192.168.1.1 LAN interface IP address. This is a virtual router IP address. ZyWALL A keeps it’s LAN management IP address of ZyWALL USG 2000 User’s Guide...
Page 598: Configuring Active-Passive Mode Device Ha
The Device HA Active-Passive Mode screen lets you configure general active- passive mode device HA settings, view and manage the list of monitored interfaces, and synchronize backup ZyWALLs. To access this screen, click Device HA > Active-Passive Mode. Figure 399 Device HA > Active-Passive Mode ZyWALL USG 2000 User’s Guide...
Page 599 The password can consist of alphanumeric characters, the underscore, and some punctuation marks (+-/*= :; .! @$&%#~ ‘ \ () ), and it can be up to eight characters long. Authentication Types on page 273 for more information about authentication methods. ZyWALL USG 2000 User’s Guide...
Page 600 Secure FTP port number. Click the link if you need to change the FTP port number. Every ZyWALL in the virtual router must use the same port number. If the master ZyWALL changes, you have to manually change this port number in the backups. ZyWALL USG 2000 User’s Guide...
Page 601: Configuring An Active-Passive Mode Monitored Interface
IP address and subnet mask. To access this screen, click Device HA > Active-Passive Mode > Edit. Figure 400 Device HA > Active-Passive Mode > Edit ZyWALL USG 2000 User’s Guide...
Page 602: The Legacy Mode Screen
In legacy mode, you create a VRRP group to add one of its interfaces to a virtual router. You can add any Ethernet or VLAN interface with a static IP address. You do not configure VRRP groups for virtual interfaces. ZyWALL USG 2000 User’s Guide...
Page 603: Configuring The Legacy Mode Screen
The Device HA Legacy Mode screen lets you configure general legacy mode HA settings including link monitoring, configure the VRRP group and synchronize backup ZyWALLs. To access this screen, click Device HA > Legacy Mode. Figure 401 Device HA > Legacy Mode ZyWALL USG 2000 User’s Guide...
Page 604 Enter the port number that the ZyWALL you specified in the Server Address field uses for Secure FTP. Every ZyWALL in the virtual router must use the same port number. If the master ZyWALL changes, you have to manually change this port number in the backups. ZyWALL USG 2000 User’s Guide...
Page 605: The Legacy Mode Add/Edit Screen
IP address to the IP address of the virtual router. • You can only enable one VRRP group for each interface. • You can only have one active VRRP group for each virtual router (VR ID). ZyWALL USG 2000 User’s Guide...
Page 606 This management IP address should be in the same subnet as the interface IP address so the backup ZyWALL cannot synchronize with the master via this VRRP interface. Subnet Mask Enter the subnet mask of the interface’s management IP address. ZyWALL USG 2000 User’s Guide...
Page 607 Authentication Types on page 273 for more information about authentication methods. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 608: Device Ha Technical Reference
ZyWALL A is available. If ZyWALL A becomes unavailable, it stops sending messages to ZyWALL B. ZyWALL B detects this and assumes the role of the master. This is illustrated below. Figure 404 Example: VRRP, Master Becomes Unavailable 192.168.10.112 ZyWALL USG 2000 User’s Guide...
Page 609 The following synchronization restrictions apply with legacy mode. • The master ZyWALL must have at least one active VRRP group and no standby VRRP groups. ZyWALL USG 2000 User’s Guide...
Page 610 • The backup ZyWALL cannot be the master in any active VRRP group. This refers to the actual role at the time of synchronization, not the role setting in the VRRP group. The backup applies the entire configuration if it is different from the backup’s current configuration. ZyWALL USG 2000 User’s Guide...
Page 611: Objects
VIII Objects User/Group (613) Addresses (629) Services (635) Schedules (641) AAA Server (647) Authentication Method (659) Certificates (663) ISP Accounts (685) SSL Application (689)
Page 613: User/Group
User Types These are the types of user accounts the ZyWALL uses. Table 181 Types of User Accounts TYPE ABILITIES LOGIN METHOD(S) Admin Users Admin Change ZyWALL configuration (web, WWW, TELNET, SSH, FTP, CLI) Console, Dial-in ZyWALL USG 2000 User’s Guide...
Page 614 User account in the remote server. User account (Ext-User) in the ZyWALL. Default user account for AD users (ad-users), LDAP users (ldap-users) or RADIUS users (radius-users) in the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 615 • See Section 5.5.1 on page 116 for related information on these screens. • See Section 36.5 on page 626 for some information on users who use an external authentication server in order to log in. ZyWALL USG 2000 User’s Guide...
Page 616: User Summary Screen
36.2.1.1 Rules for User Names Enter a user name from 1 to 31 characters. The user name can only contain the following characters: • Alphanumeric A-z 0-9 (there is no unicode support) • _ [underscores] ZyWALL USG 2000 User’s Guide...
Page 617 • zyxel To access this screen, go to the User screen (see Section 36.2 on page 616), and click either the Add icon or an Edit icon. Figure 406 User/Group > User > Edit ZyWALL USG 2000 User’s Guide...
Page 618 Unlike Lease Time, the user has no opportunity to renew the session without logging out. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 619: User Group Summary Screen
To delete a user group, click the Remove icon next to the user group. The web configurator confirms that you want to delete the user group before doing so. If you delete the group, you do not delete the users in the group. ZyWALL USG 2000 User’s Guide...
Page 620: Group Add/Edit Screen
The Setting screen controls default settings, login settings, lockout settings, and other user settings for the ZyWALL. You can also use this screen to specify when users must log in to the ZyWALL before it routes traffic for them. ZyWALL USG 2000 User’s Guide...
Page 621 You can still change the reauthentication time for each user account. Edit To edit a user group, click the Edit icon next to the user group. The Group Edit screen appears. Miscellaneous Setting ZyWALL USG 2000 User’s Guide...
Page 622 Type the number of minutes the user must wait to try to login again, if logon retry limit is enabled and the maximum retry count is reached. This number must be between 1 and 65,535 (about 45.5 days). ZyWALL USG 2000 User’s Guide...
Page 623 It displays any if this condition applies to traffic from all destination addresses. Authenticate This field displays whether users must log in (force) or whether users do not have to log in (skip) when this condition is checked and satisfied. ZyWALL USG 2000 User’s Guide...
Page 624: Force User Authentication Policy Add/Edit Screen
Use this screen to specify a condition when users must log in or do not have to log in to the ZyWALL before their HTTP traffic can pass through the ZyWALL. Figure 410 Object > User/Group > Setting > Add/Edit ZyWALL USG 2000 User’s Guide...
Page 625: User Aware Login Example
ZyWALL. Instead, when access users log in to the ZyWALL (forced in the screen as shown in Figure 409 on page 621 or otherwise), the following screen appears. Figure 411 Web Configurator for Non-Admin Users ZyWALL USG 2000 User’s Guide...
Page 626: User /Group Technical Reference
Table 190 LDAP/RADIUS: Keywords for User Attributes KEYWORD CORRESPONDING ATTRIBUTE IN WEB CONFIGURATOR type User Type. Possible Values: admin, limited-admin, user, guest. leaseTime Lease Time. Possible Values: 1-1440 (minutes). reauthTime Reauthentication Time. Possible Values: 1-1440 (minutes). ZyWALL USG 2000 User’s Guide...
Page 627 Extract the user names from the LDAP or RADIUS server, and create a shell script that creates the user accounts. See Chapter 46 on page 749 for more information about shell scripts. ZyWALL USG 2000 User’s Guide...
Page 628 Chapter 36 User/Group ZyWALL USG 2000 User’s Guide...
Page 629: Addresses
• HOST - a host address is defined by an IP Address. • RANGE - a range address is defined by a Starting IP Address and an Ending IP Address. ZyWALL USG 2000 User’s Guide...
Page 630 To edit an address, click the Edit icon next to the address. The Address Add/Edit screen appears. To delete an address, click on the Remove icon next to the address. The web configurator confirms that you want to delete the address before doing so. ZyWALL USG 2000 User’s Guide...
Page 631: Address Add/Edit Screen
Use dotted decimal format. Interface If you selected INTERFACE IP, INTERFACE SUBNET, or INTERFACE GATEWAY as the Address Type, use this field to select the interface of the network that this address object represents. ZyWALL USG 2000 User’s Guide...
Page 632: Address Group Summary Screen
To edit an address group, click the Edit icon next to the address group. The Address Group Add/Edit screen appears. To delete an address group, click on the Remove icon next to the address group. The web configurator confirms that you want to delete the address group. ZyWALL USG 2000 User’s Guide...
Page 633: Address Group Add/Edit Screen
The order of members is not important. To remove members, select them and click the left arrow. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 634 Chapter 37 Addresses ZyWALL USG 2000 User’s Guide...
Page 635: Services
Then, the connection is terminated. In contrast, computers use UDP to send short messages to each other. There is no guarantee that the messages arrive in sequence or that the messages arrive at all. ZyWALL USG 2000 User’s Guide...
Page 636: The Service Summary Screen
38.2 The Service Summary Screen The Service summary screen provides a summary of all services and their definitions. In addition, this screen allows you to add, edit, and remove services. ZyWALL USG 2000 User’s Guide...
Page 637 To edit a service, click the Edit icon next to the service. The Service Add/Edit screen appears. To delete a service, click the Remove icon next to the service. The web configurator confirms that you want to delete the service before doing ZyWALL USG 2000 User’s Guide...
Page 638: The Service Add/Edit Screen
Click Cancel to exit this screen without saving your changes. 38.3 The Service Group Summary Screen The Service Group summary screen provides a summary of all service groups. In addition, this screen allows you to add, edit, and remove service groups. ZyWALL USG 2000 User’s Guide...
Page 639: Service Group
To edit a service group, click the Edit icon next to the service group. The Service Group Add/Edit screen appears. To delete a service group, click on the Remove icon next to the service group. The web configurator confirms that you want to delete the service group. ZyWALL USG 2000 User’s Guide...
Page 640: The Service Group Add/Edit Screen
The order of members is not important. To remove members, select them and click the left arrow. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 641: Schedules
(Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, and Saturday). Recurring schedules always begin and end in the same day. Recurring schedules are useful for defining the workday and off-work hours. ZyWALL USG 2000 User’s Guide...
Page 642: The Schedule Summary Screen
To edit a schedule, click the Edit icon next to the schedule. The Schedule Add/Edit screen appears. To delete a schedule, click the Remove icon next to the schedule. The web configurator confirms that you want to delete the schedule before doing so. Recurring ZyWALL USG 2000 User’s Guide...
Page 643: The One-Time Schedule Add/Edit Screen
To access this screen, go to the Schedule screen (see Section 39.2 on page 642), and click either the Add icon or an Edit icon in the One Time section. Figure 423 Object > Schedule > Edit (One Time) ZyWALL USG 2000 User’s Guide...
Page 644: The Recurring Schedule Add/Edit Screen
Click Cancel to exit this screen without saving your changes. 39.2.2 The Recurring Schedule Add/Edit Screen The Recurring Schedule Add/Edit screen allows you to define a recurring schedule or edit an existing one. To access this screen, go to the Schedule screen ZyWALL USG 2000 User’s Guide...
Page 645 Day - disabled Hour - 0 - 23 Minute - 0 - 59 The Hour and Minute fields are both required. To set all day (24 hours), configure the start hour and minute both to 0. ZyWALL USG 2000 User’s Guide...
Page 646 Weekly Week Days Select each day of the week the recurring schedule is effective. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 647: Aaa Server
The ZyWALL tries to bind (or log in) to the LDAP/AD server. When the binding process is successful, the ZyWALL checks the user information in the directory against the user name and password pair. If it matches, the user is allowed access. Otherwise, access is blocked. ZyWALL USG 2000 User’s Guide...
Page 648: Radius Server Overview
651) to configure the Active Directory or LDAP default server settings. • Use the Object > AAA Server > RADIUS screen (Section 40.4 on page 654) to configure the default external RADIUS server to use for user authentication. ZyWALL USG 2000 User’s Guide...
Page 649: What You Need To Know About Aaa Servers
40.2 Active Directory or LDAP Default Server Screen Directory Structure The directory entries are arranged in a hierarchical order much like a tree structure. Normally, the directory structure reflects the geographical or ZyWALL USG 2000 User’s Guide...
Page 650 The bind DN is used in conjunction with a bind password. When a bind DN is not specified, the ZyWALL will try to log in as an anonymous user. If the bind password is incorrect, the login will fail. ZyWALL USG 2000 User’s Guide...
Page 651: Configuring Active Directory Or Ldap Default Server Settings
ZyWALL disconnects from the AD or LDAP server. In this case, user authentication fails. The search timeout occurs when either the user information is not in the LDAP server or the server is down. ZyWALL USG 2000 User’s Guide...
Page 652: Active Directory Or Ldap Group Summary Screen
Group Name This field displays the descriptive name for identification purposes. Add icon Click Add to add a new entry. Click Edit to edit the settings of an entry. Click Delete to remove an entry. ZyWALL USG 2000 User’s Guide...
Page 653: Creating An Active Directory Or Ldap Group
Specify the bind DN for logging into the AD or LDAP server(s). For example, specifies as the user name. cn=zywallAdmin zywallAdmin CN Identifier Specify the unique common name that uniquely identifies a record in the AD or LDAP directory. Enter up to 63 alphanumerical characters. ZyWALL USG 2000 User’s Guide...
Page 654: Configuring A Default Radius Server
To configure the default external RADIUS server to use for user authentication, click Object > AAA Server > RADIUS to display the screen as shown. Figure 431 Object > AAA Server > RADIUS > Default ZyWALL USG 2000 User’s Guide...
Page 655: Configuring A Group Of Radius Servers
Figure 432 Object > AAA Server > RADIUS > Group The following table describes the labels in this screen. Table 206 Object > AAA Server > RADIUS > Group LABEL DESCRIPTION This field displays the index number. ZyWALL USG 2000 User’s Guide...
Page 656: Adding A Radius Server Member
Specify the timeout period (between 1 and 300 seconds) before the ZyWALL disconnects from the RADIUS server. In this case, user authentication fails. Search timeout occurs when either the user information is not in the RADIUS server or the RADIUS server is down. ZyWALL USG 2000 User’s Guide...
Page 657 Click Add to add a new RADIUS server. You can add up to four RADIUS member servers. Click Delete to remove a RADIUS server. Click OK to save the changes. Cancel Click Cancel to discard the changes. ZyWALL USG 2000 User’s Guide...
Page 658 Chapter 40 AAA Server ZyWALL USG 2000 User’s Guide...
Page 659: Authentication Method
VPN connection. Refer to the chapter on VPN for more information. Follow the steps below to specify the authentication method for a VPN connection. Access the VPN > IPSec VPN > VPN Gateway > Edit screen. ZyWALL USG 2000 User’s Guide...
Page 660: Viewing Authentication Method Objects
Figure 435 Object > Auth. Method The following table describes the labels in this screen. Table 208 Object > Auth. Method LABEL DESCRIPTION This field displays the index number. Method Name This field displays a descriptive name for identification purposes. ZyWALL USG 2000 User’s Guide...
Page 661: Creating An Authentication Method Object
ZyWALL does not continue the search on the second authentication server when you enter the username and password that doesn’t match the one on the first authentication server. Note: You can NOT select two server objects of the same type. ZyWALL USG 2000 User’s Guide...
Page 662 Click Add to add a new entry. Click Edit to edit the settings of an entry. Click Delete to delete an entry. Click OK to save the changes. Cancel Click Cancel to discard the changes. ZyWALL USG 2000 User’s Guide...
Page 663: Certificates
Tim wants to send a message to Jenny. He needs her to be sure that it comes from him, and that the message content has not been altered by anyone else along the way. Tim generates a public key pair (one public key and one private key). ZyWALL USG 2000 User’s Guide...
Page 664 • Key distribution is simple and very secure since you can freely distribute public keys and you never need to transmit private keys. Self-signed Certificates You can have the ZyWALL act as a certification authority and sign its own certificates. ZyWALL USG 2000 User’s Guide...
Page 665: Verifying A Certificate
MD5 or SHA1 algorithm. The following procedure describes how to check a certificate’s fingerprint to verify that you have the actual certificate. Browse to where you have the certificate saved on your computer. ZyWALL USG 2000 User’s Guide...
Page 666 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation. Possible examples would be over the telephone or through an HTTPS connection. ZyWALL USG 2000 User’s Guide...
Page 667: The My Certificates Screen
This field displays the date that the certificate becomes applicable. Valid To This field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired. ZyWALL USG 2000 User’s Guide...
Page 668: The My Certificates Add Screen
42.2.1 The My Certificates Add Screen Click Object > Certificate > My Certificates and then the Add icon to open the My Certificates Add screen. Use this screen to have the ZyWALL create a self- ZyWALL USG 2000 User’s Guide...
Page 669 You do not have to fill in every field, although the Common Name is mandatory. The certification authority may add fields (such as a serial number) to the subject information when it issues a certificate. It is recommended that each certificate have unique subject information. ZyWALL USG 2000 User’s Guide...
Page 670 Copy the certification request from the My Certificate Details screen (see Section 42.2.2 on page 673) and then send it to the certification authority. ZyWALL USG 2000 User’s Guide...
Page 671 CMP enrollment protocol. Just the Key field displays if your certification authority uses the SCEP enrollment protocol. For the reference number, use 0 to 99999999. For the key, use up to 31 of the following characters. a-zA-Z0- 9;|`~!@#$%^&*()_+\{}':,./<>=- ZyWALL USG 2000 User’s Guide...
Page 672 Return and check your information in the My Certificate Create screen. Make sure that the certification authority information is correct and that your Internet connection is working properly if you want the ZyWALL to enroll a certificate online. ZyWALL USG 2000 User’s Guide...
Page 673: The My Certificates Edit Screen
Click Object > Certificate > My Certificates and then the Edit icon to open the My Certificate Edit screen. You can use this screen to view in-depth certificate information and change the certificate’s name. Figure 441 Object > Certificate > My Certificates > Edit ZyWALL USG 2000 User’s Guide...
Page 674 “none” displays for a certification request. Valid To This field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired. “none” displays for a certification request. ZyWALL USG 2000 User’s Guide...
Page 675 Private Key Type the certificate’s password and click this button. Click Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save. ZyWALL USG 2000 User’s Guide...
Page 676: The My Certificates Import Screen
Type in the location of the file you want to upload in this field or click Browse to find it. You cannot import a certificate with the same name as a certificate that is already in the ZyWALL. Browse Click Browse to find the certificate file you want to upload. ZyWALL USG 2000 User’s Guide...
Page 677: The Trusted Certificates Screen
With self-signed certificates, this is the same information as in the Subject field. Valid From This field displays the date that the certificate becomes applicable. ZyWALL USG 2000 User’s Guide...
Page 678: The Trusted Certificates Edit Screen
ZyWALL to check a certification authority’s list of revoked certificates before trusting a certificate issued by the certification authority. ZyWALL USG 2000 User’s Guide...
Page 679 Chapter 42 Certificates Figure 444 Object > Certificate > Trusted Certificates > Edit ZyWALL USG 2000 User’s Guide...
Page 680 CRL directory server. Type the login name (up to 31 ASCII characters) from the entity maintaining the server (usually a certification authority). Password Type the password (up to 31 ASCII characters) from the entity maintaining the CRL directory server (usually a certification authority). ZyWALL USG 2000 User’s Guide...
Page 681 This is the certificate’s message digest that the ZyWALL calculated using the MD5 algorithm. You can use this value to verify with the certification authority (over the phone for example) that this is actually their certificate. ZyWALL USG 2000 User’s Guide...
Page 682: The Trusted Certificates Import Screen
Trusted Certificates Import screen. Follow the instructions in this screen to save a trusted certificate to the ZyWALL. Note: You must remove any spaces from the certificate’s filename before you can import the certificate. Figure 445 Object > Certificate > Trusted Certificates > Import ZyWALL USG 2000 User’s Guide...
Page 683: Certificates Technical Reference
The second is a reduction in network traffic since the ZyWALL only gets information on the certificates that it needs to verify, not a huge list. When the ZyWALL requests certificate status information, the OCSP server returns a “expired”, “current” or “unknown” response. ZyWALL USG 2000 User’s Guide...
Page 684 Chapter 42 Certificates ZyWALL USG 2000 User’s Guide...
Page 685: Isp Accounts
ISP accounts in the ZyWALL. 43.2 ISP Account Summary This screen provides a summary of ISP accounts in the ZyWALL. To access this screen, click Object > ISP Account. Figure 446 Object > ISP Account ZyWALL USG 2000 User’s Guide...
Page 686: Isp Account Edit
To open this window, open the ISP Account screen. (See Section 43.2 on page 685.) Then, click on an Add icon or Edit icon to open the ISP Account Edit screen below. Figure 447 Object > ISP Account > Edit ZyWALL USG 2000 User’s Guide...
Page 687 If this ISP account uses the PPPoE protocol, type the PPPoE service name to access. PPPoE uses the specified service name to identify and reach the PPPoE server. This field can be blank. If this ISP account uses the PPTP protocol, this field is not displayed. ZyWALL USG 2000 User’s Guide...
Page 688 ISP Account Edit screen. Cancel Click Cancel to return to the ISP Account screen without creating the profile (if it is new) or saving any changes to the profile (if it already exists). ZyWALL USG 2000 User’s Guide...
Page 689: Ssl Application
You can configure the following types of SSL applications on the ZyWALL. • Web-based A web-based application allows remote users to access an intranet site using standard web browsers. • File sharing Configure file sharing to allow users to access files on the intranet. ZyWALL USG 2000 User’s Guide...
Page 690: Example: Specifying A Web Site For Access
Select Web Page Encryption to prevent users from saving the web content. Click OK to save the settings. The configuration screen should look similar to the following figure. Figure 448 Example: SSL Application: Specifying a Web Site for Access ZyWALL USG 2000 User’s Guide...
Page 691: The Ssl Application Screen
To edit an object, click the Edit icon next to the object. To delete an object, click the Remove icon next to the object. 44.2.1 Creating/Editing a Web-based SSL Application Object A web-based application allows remote users to access an application via standard web browsers. ZyWALL USG 2000 User’s Guide...
Page 692 This field is optional. You only need to configure this field if you need to specify the name of the directory or file on the local server as the home page or home directory on the user screen. ZyWALL USG 2000 User’s Guide...
Page 693: Creating/Editing A File Sharing Ssl Application Object
Select File Sharing to create a file share application for VPN SSL. File Sharing Name Enter a descriptive name to identify this object. You can enter up to 31 characters (“0-9”, “a-z”, “A-Z”, “-” and “_”). Spaces are not allowed. ZyWALL USG 2000 User’s Guide...
Page 694 Click Cancel to discard the changes and return to the main SSL Application Configuration screen. Note: You must then configure the shared folder on the file server for remote access. Refer to the document that comes with your file server. ZyWALL USG 2000 User’s Guide...
Page 695: System
System System (697)
Page 697: System
SNMP screen (Figure 492 on page 740) to configure SNMP settings, including from which zones SNMP can be used to access the ZyWALL. You can also specify from which IP addresses the access can come. ZyWALL USG 2000 User’s Guide...
Page 698: Host Name
742) to configure the external serial modem. • Vantage CNM (Centralized Network Management) is a browser-based global management tool that allows an administrator to manage ZyXEL devices. Use the System > Vantage CNM screen (Figure 494 on page 743) to allow your ZyWALL to be managed by the Vantage CNM server.
Page 699 This field displays the last updated time from the time server or the mm-ss) last time configured manually. When you set Time and Date Setup to Manual, enter the new time in this field and then click Apply. ZyWALL USG 2000 User’s Guide...
Page 700 European Union you would select Last, Sunday, March. The time you type in the at field depends on your time zone. In Germany for instance, you would type 2 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1). ZyWALL USG 2000 User’s Guide...
Page 701: Pre-Defined Ntp Time Servers List
If the synchronization fails, then the ZyWALL goes through the rest of the list in order from the first one tried until either it is successful or all the pre-defined NTP time servers have been tried. ZyWALL USG 2000 User’s Guide...
Page 702: Time Server Synchronization
Select Get from Time Server under Time and Date Setup. Under Time Zone Setup, select your Time Zone from the list. As an option you can select the Enable Daylight Saving check box to adjust the ZyWALL clock for daylight savings. ZyWALL USG 2000 User’s Guide...
Page 703: Console Port Speed
IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. 45.5.1 DNS Server Address Assignment The ZyWALL can get the DNS server addresses in the following ways. ZyWALL USG 2000 User’s Guide...
Page 704: Configuring The Dns Screen
(FQDN) to an IP address. An FQDN consists of a host and domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel” is the third-level domain, “com” is the second- level domain, and “tw” is the top level domain.
Page 705 Domain Zone A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name. A “*” means all domain zones. From This displays whether the DNS server IP address is assigned by the ISP dynamically through a specified interface or configured manually.
Page 706: Address Record
An address record contains the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name. For example, www.zyxel.com is a fully qualified domain name, where “www” is the host, “zyxel” is the second-level domain, and “com” is the top level domain.
Page 707: Ptr Record
For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain.
Page 708: Adding A Domain Zone Forwarder
For example, whenever the ZyWALL receives needs to resolve a zyxel.com.tw domain name, it can send a query to the recorded name server IP address. Enter * if all domain zones are served by the specified DNS server(s).
Page 709: Mx Record
Click Cancel to exit this screen without saving 45.5.10 Adding a DNS Service Control Rule Click the Add icon in the Service Control table to add a service control rule. Figure 460 System > DNS > Service Control Rule Add ZyWALL USG 2000 User’s Guide...
Page 710: Www Overview
Note: To allow the ZyWALL to be accessed from a specified computer using a service, make sure you do not have a service control rule or to-ZyWALL firewall rule to block that traffic. • See To-ZyWALL Rules on page 322 for more on To-ZyWALL firewall rules. ZyWALL USG 2000 User’s Guide...
Page 711: Service Access Limitations
(one party can identify the other party) and data integrity (you know if data has been changed). It relies upon certificates, public keys, and private keys (see Chapter 42 on page for more information). ZyWALL USG 2000 User’s Guide...
Page 712: Configuring Www
Click System > WWW to open the WWW screen. Use this screen to specify from which zones you can access the ZyWALL using HTTP or HTTPS. You can also specify which IP addresses the access can come from. ZyWALL USG 2000 User’s Guide...
Page 713 To do that the SSL client must have a CA-signed certificate from a CA that has been imported as a trusted CA on the ZyWALL (see Section 45.6.7.5 on page 723 on importing certificates for details). ZyWALL USG 2000 User’s Guide...
Page 714 ZyWALL web configurator using HTTP connections. Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service to access the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 715 Select a method the HTTPS or HTTP server uses to authenticate a client. Authentication You must have configured the authentication methods in the Auth. Method method screen. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 716: Service Control Rules
Click System > WWW > Login Page to open the Login Page screen. Use this screen to customize the Web Configurator login screen. You can also customize the page that displays after an access user logs into the Web Configurator to ZyWALL USG 2000 User’s Guide...
Page 717 Chapter 45 System access network services like the Internet. See Chapter 36 on page 613 for more on access user accounts. Figure 465 System > WWW > Login Page ZyWALL USG 2000 User’s Guide...
Page 718 • Click Color to display a screen of web-safe colors from which to choose. • Enter the name of the desired color. • Enter a pound sign (#) followed by the six-digit hexadecimal number that represents the desired color. For example, use “#000000” for black. ZyWALL USG 2000 User’s Guide...
Page 719 Browse to locate it. Note: Use a GIF, JPG, or PNG of 100 kilobytes or less. To use a color, select Color and specify the color. ZyWALL USG 2000 User’s Guide...
Page 720: Https Example
When you attempt to access the ZyWALL HTTPS server, a Windows dialog box pops up asking if you trust the server certificate. Click View Certificate if you want to verify that the certificate is from the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 721 Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that the certificate is from the ZyWALL. If Accept this certificate temporarily for this session is selected, then click OK to continue in Netscape. ZyWALL USG 2000 User’s Guide...
Page 722 • To have the browser trust the certificates issued by a certificate authority, import the certificate authority’s certificate into your operating system as a trusted certificate. Refer to Appendix D on page 881 for details. ZyWALL USG 2000 User’s Guide...
Page 723 ZyWALL (see the ZyWALL’s Trusted CA web configurator screen). Figure 472 ZyWALL Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). ZyWALL USG 2000 User’s Guide...
Page 724 You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to the one shown next ZyWALL USG 2000 User’s Guide...
Page 725 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. Figure 475 Personal Certificate Import Wizard 2 ZyWALL USG 2000 User’s Guide...
Page 726 Figure 476 Personal Certificate Import Wizard 3 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 477 Personal Certificate Import Wizard 4 ZyWALL USG 2000 User’s Guide...
Page 727 45.6.7.6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS. Enter ‘https://ZyWALL IP Address/ in your browser’s web address field. Figure 480 Access the ZyWALL Via HTTPS ZyWALL USG 2000 User’s Guide...
Page 728: Ssh
Figure 482 Secure Web Configurator Login Screen 45.7 SSH You can use SSH (Secure SHell) to securely access the ZyWALL’s command line interface. Specify which zones allow SSH access and from which IP address the access can come. ZyWALL USG 2000 User’s Guide...
Page 729: How Ssh Works
Figure 483 SSH Communication Over the WAN Example 45.7.1 How SSH Works The following figure is an example of how a secure connection is established between two remote hosts using SSH v1. Figure 484 How SSH v1 Works Example ZyWALL USG 2000 User’s Guide...
Page 730: Ssh Implementation On The Zywall
Click System > SSH to change your ZyWALL’s Secure Shell settings. Use this screen to specify from which zones SSH can be used to manage the ZyWALL. You can also specify from which IP addresses the access can come. ZyWALL USG 2000 User’s Guide...
Page 731 This is the object name of the IP address(es) with which the computer is allowed or denied to access. Action This displays whether the computer with the IP address specified above can access the ZyWALL zone(s) configured in the Zone field (Accept) or not (Deny). ZyWALL USG 2000 User’s Guide...
Page 732: Secure Telnet Using Ssh Examples
This section describes how to access the ZyWALL using the Secure Shell Client program. Launch the SSH client and specify the connection information (IP address, port number) for the ZyWALL. Configure the SSH client to accept connection using SSH version 1. ZyWALL USG 2000 User’s Guide...
Page 733 192.168.1.1). A message displays indicating the SSH protocol version supported by the ZyWALL. Figure 487 SSH Example 2: Test $ telnet 192.168.1.1 22 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5-1.0.0 ZyWALL USG 2000 User’s Guide...
Page 734: Telnet
Click System > TELNET to configure your ZyWALL for remote Telnet access. Use this screen to specify from which zones Telnet can be used to manage the ZyWALL. You can also specify from which IP addresses the access can come. Figure 489 System > Telnet ZyWALL USG 2000 User’s Guide...
Page 735: Ftp
You can upload and download the ZyWALL’s firmware and configuration files using FTP. To use this feature, your computer must have an FTP client. Please see Chapter 46 on page 749 for more information about firmware and configuration files. ZyWALL USG 2000 User’s Guide...
Page 736: Configuring Ftp
This is the zone on the ZyWALL the user is allowed or denied to access. Address This is the object name of the IP address(es) with which the computer is allowed or denied to access. ZyWALL USG 2000 User’s Guide...
Page 737: Snmp
Simple Network Management Protocol is a protocol used for exchanging management information between network devices. Your ZyWALL supports SNMP agent functionality, which allows a manager station to manage and monitor the ZyWALL through the network. The ZyWALL supports SNMP version one (SNMPv1) ZyWALL USG 2000 User’s Guide...
Page 738 SNMP itself is a simple request/response protocol based on the manager/agent model. The manager issues a request and the agent returns responses using the following protocol operations: • Get - Allows the manager to retrieve an object variable from the agent. ZyWALL USG 2000 User’s Guide...
Page 739: Supported Mibs
45.10.1 Supported MIBs The ZyWALL supports MIB II that is defined in RFC-1213 and RFC-1215. The ZyWALL also supports private MIBs (zywall.mib and zyxel-zywall-ZLD- Common.mib) to collect information about CPU and memory usage and VPN total throughput. The focus of the MIBs is to let administrators collect statistical data and monitor status and performance.
Page 740 This is the zone on the ZyWALL the user is allowed or denied to access. Address This is the object name of the IP address(es) with which the computer is allowed or denied to access. ZyWALL USG 2000 User’s Guide...
Page 741: Dial-In Management
WAN device to hang up, in addition to issuing the drop command ATH. Response Strings The response strings tell the ZyWALL the tags, or labels, immediately preceding the various call parameters sent from the serial modem. The response strings ZyWALL USG 2000 User’s Guide...
Page 742: Configuring Dial-In Mgmt
Note: Consult the manual of your external serial modem connected to your ZyWALL’s auxiliary port for specific AT commands. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 743: Vantage Cnm
Vantage CNM (Centralized Network Management) is a browser-based global management solution that allows an administrator from any location to easily configure, manage, monitor and troubleshoot ZyXEL devices located worldwide. See the Vantage CNM User's Guide for details. If you allow your ZyWALL to be managed by the Vantage CNM server, then you should not do any configurations directly to the ZyWALL (using either the web configurator or commands) without notifying the Vantage CNM administrator.
Page 744: Language Screen
Click Reset to begin configuring this screen afresh. 45.13 Language Screen Click System > Language to open the following screen. Use this screen to select a display language for the ZyWALL’s web configurator screens. Figure 495 System > Language ZyWALL USG 2000 User’s Guide...
Page 745 You also need to open a new browser session to display the screens in the new language. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 746 Chapter 45 System ZyWALL USG 2000 User’s Guide...
Page 747: Maintenance, Troubleshooting, & Specifications
Maintenance, Troubleshooting, & Specifications File Manager (749) Logs (761) Reports (775) Diagnostics (793) Reboot (795) Troubleshooting (797) Product Specifications (803)
Page 749: File Manager
When you apply a configuration file, the ZyWALL uses the factory default settings for any features that the configuration file does not include. When you run a shell script, the ZyWALL only applies the commands that it contains. Other settings do not change. ZyWALL USG 2000 User’s Guide...
Page 750: Comments In Configuration Files Or Shell Scripts
Comments in Configuration Files or Shell Scripts In a configuration file or shell script, use “#” or “!” as the first character of a command line to have the ZyWALL treat the line as a comment. ZyWALL USG 2000 User’s Guide...
Page 751 The ZyWALL ignores any errors in the configuration file or shell script and applies all of the valid commands. The ZyWALL still generates a log for any errors. ZyWALL USG 2000 User’s Guide...
Page 752: The Configuration File Screen
If there isn’t a lastgood.conf configuration file or it also has an error, the ZyWALL applies the system-default.conf configuration file. ZyWALL USG 2000 User’s Guide...
Page 753 Files This column displays the number for each configuration file entry. The total number of configuration files that you can save depends on the sizes of the configuration files and the available flash storage space. ZyWALL USG 2000 User’s Guide...
Page 754 Specify a name for the duplicate configuration file. Use up to 25 characters (including a-zA-Z0-9;‘~!@#$%^&()_+[]{}’,.=-). Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file. ZyWALL USG 2000 User’s Guide...
Page 755 If you upload startup-config.conf, it will replace the current configuration and immediately apply the new settings. File Path Type in the location of the file you want to upload in this field or click Browse ... to find it. ZyWALL USG 2000 User’s Guide...
Page 756: The Firmware Package Screen
See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it. Find the firmware package at www.zyxel.com in a file that (usually) uses the system model name with a .bin extension, for example, “zywall.bin”.
Page 757 The ZyWALL automatically restarts causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop. Figure 502 Network Temporarily Disconnected After five minutes, log in again and check your new firmware version in the HOME screen. ZyWALL USG 2000 User’s Guide...
Page 758: The Shell Script Screen
File Name This column displays the label that identifies a shell script file. Size This column displays the size (in KB) of a shell script file. Last This column displays the date and time that the individual shell script files Modified were last changed or saved. ZyWALL USG 2000 User’s Guide...
Page 759 You may need to wait awhile for the ZyWALL to finish applying the commands. Upload The bottom part of the screen allows you to upload a new or previously saved Shell shell script file from your computer to your ZyWALL. Script ZyWALL USG 2000 User’s Guide...
Page 760 Type in the location of the file you want to upload in this field or click Browse ... to find it. Browse... Click Browse... to find the .zysh file you want to upload. Upload Click Upload to begin the upload process. This process may take up to several minutes. ZyWALL USG 2000 User’s Guide...
Page 761: Logs
All Logs, or you can select a specific category of log messages (for example, firewall or user). You can also look at the debugging log by selecting Debug Log. All debugging messages have the same priority. ZyWALL USG 2000 User’s Guide...
Page 762 The log will display every log message with this priority or higher. Choices are: any, emerg, alert, crit, error, warn, notice, and info, from highest priority to lowest priority. ZyWALL USG 2000 User’s Guide...
Page 763 This field displays the priority of the log message. It has the same range of values as the Priority field above. Category This field displays the log that generated the log message. It is the same value used in the Display and (other) Category fields. ZyWALL USG 2000 User’s Guide...
Page 764: Log Setting Screens
Alternatively, if you want to edit what events is included in each log, you can also use the Active Log Summary screen to edit this information for all logs at the same time. ZyWALL USG 2000 User’s Guide...
Page 765: Log Setting Summary
Log Format This field displays the format of the log. Internal - system log; you can view the log on the View Log tab. VRPT/Syslog - ZyXEL’s Vantage Report, syslog-compatible format. CEF/Syslog - Common Event Format, syslog-compatible format. Summary This field is a summary of the settings for each log. Please see Section 47.4.2 on page 766...
Page 766: Edit System Log Settings
The Log Settings Edit screen controls the detailed settings for each log in the system log (which includes the e-mail profiles). Go to the Log Settings Summary screen (see Section 47.4.1 on page 765), and click the system log Edit icon. ZyWALL USG 2000 User’s Guide...
Page 767 Chapter 47 Logs Figure 510 Maintenance > Log > Log Setting > Edit (System Log) ZyWALL USG 2000 User’s Guide...
Page 768 This field displays each category of messages. It is the same value used Category in the Display and Category fields in the View Log tab. The Default category includes debugging messages generated by open source software. ZyWALL USG 2000 User’s Guide...
Page 769 Message field. Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 770: Edit Remote Server Log Settings
(syslog). Go to the Log Settings Summary screen (see Section 47.4.1 on page 765), and click a remote server Edit icon. Figure 511 Maintenance > Log > Log Setting > Edit (Remote Server) ZyWALL USG 2000 User’s Guide...
Page 771: Active Log Summary Screen
Active Log section. Log Format This field displays the format of the log information. It is read-only. VRPT/Syslog - ZyXEL’s Vantage Report, syslog-compatible format. CEF/Syslog - Common Event Format, syslog-compatible format. Server Type the server name or the IP address of the syslog server to which to Address send log information.
Page 772 This screen provides a different view and a different way of indicating which messages are included in each log and each alert. Please see Section 47.4.2 on page 766, where this process is discussed. (The Default category includes debugging messages generated by open source software.) ZyWALL USG 2000 User’s Guide...
Page 773 If you check one of the check boxes for All Logs, it affects the settings for every category. Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 774 Chapter 47 Logs ZyWALL USG 2000 User’s Guide...
Page 775: Reports
ZyWALL counts HTTP GET packets. Please see Table 251 on page 776 for more information. • Most-used protocols or service ports and the amount of traffic on each one ZyWALL USG 2000 User’s Guide...
Page 776 Web Site Hits - displays the most-visited Web sites and how many times each one has been visited. Each type of report has different information in the report (below). Refresh Click this button to update the report display. ZyWALL USG 2000 User’s Guide...
Page 777 Table 252 on page 778. These fields are available when the Traffic Type is Web Site Hits. This field is the rank of each record. The domain names are sorted by the number of hits. ZyWALL USG 2000 User’s Guide...
Page 778: The Session Monitor Screen
You can look at all the active sessions by user or by service, or you can filter the information by user, protocol / service or service group, source address, and/or destination address and view it by user. ZyWALL USG 2000 User’s Guide...
Page 779 You cannot include the source port. Destination This field displays when View is set to all sessions. Type the Address destination IP address whose sessions you want to view. You cannot include the destination port. ZyWALL USG 2000 User’s Guide...
Page 780 This field displays the length of the active session in seconds. Count This field displays the number of active sessions for each user, service, or IP address. This field does not display when you are viewing all sessions (since each session is displayed individually). ZyWALL USG 2000 User’s Guide...
Page 781: The Anti-Virus Report Screen
Summary Total Files This field displays the number of files that the ZyWALL has scanned. Scanned Total Viruses This field displays the number of different viruses that the ZyWALL has Detected detected. Statistics ZyWALL USG 2000 User’s Guide...
Page 782 The statistics display as follows when you display the top entries by source. Figure 516 Maintenance > Report > Anti-Virus: Source The statistics display as follows when you display the top entries by destination. Figure 517 Maintenance > Report > Anti-Virus: Destination ZyWALL USG 2000 User’s Guide...
Page 783: The Idp Report Screen
This field displays the number of packets that the ZyWALL has dropped. Total Packet The ZyWALL can detect and drop malicious packets from network traffic. Reset This field displays the number of packets that the ZyWALL has reset. Statistics ZyWALL USG 2000 User’s Guide...
Page 784 This field displays the sum of the occurrences of the events in the entries. The statistics display as follows when you display the top entries by source. Figure 519 Maintenance > Report > IDP: Source ZyWALL USG 2000 User’s Guide...
Page 785: The Content Filter Report Screen
Figure 520 Maintenance > Report > IDP: Destination 48.6 The Content Filter Report Screen Click Maintenance > Report > Content Filter to display the following screen. This screen displays content filter statistics. Figure 521 Maintenance > Report > Content Filter ZyWALL USG 2000 User’s Guide...
Page 786 This is the number of web pages to which the ZyWALL did not allow Blocked access because they were not rated by the external database content Without Policy filtering service. Web Pages This is the number of web pages to which the ZyWALL allowed access. Passed ZyWALL USG 2000 User’s Guide...
Page 787: The Anti-Spam Report Screen
48.7 The Anti-Spam Report Screen Click Maintenance > Report > Anti-Spam to display the following screen. This screen displays spam statistics. Figure 522 Maintenance > Report > Anti-Spam: Sender IP ZyWALL USG 2000 User’s Guide...
Page 788 You can see the ZyWALL’s threshold of concurrent e-mail sessions in the Anti-Spam > Status screen. Use the Anti-Spam > General screen to set whether the ZyWALL forwards or drops sessions that exceed this threshold. ZyWALL USG 2000 User’s Guide...
Page 789 ZyWALL has detected the most spam. Occurrence This field displays how many spam e-mails the ZyWALL detected from the sender. Total This field displays the sum of the occurrences of the events in the entries. ZyWALL USG 2000 User’s Guide...
Page 790: The Email Daily Report Screen
The following table describes the labels in this screen. Table 258 Maintenance > Report > Email Daily Report LABEL DESCRIPTION General Settings Enable Email Select this to send reports by e-mail every day. Daily Report Email Settings ZyWALL USG 2000 User’s Guide...
Page 791 Click this to discard all report data and start all of the counters over at Counters zero. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. ZyWALL USG 2000 User’s Guide...
Page 792 Chapter 48 Reports ZyWALL USG 2000 User’s Guide...
Page 793: Diagnostics
This is the size of the most recently created diagnostic file. Collect Now Click this to have the ZyWALL create a new diagnostic file. Download Click this to save the most recent diagnostic file to a computer. ZyWALL USG 2000 User’s Guide...
Page 794 Chapter 49 Diagnostics ZyWALL USG 2000 User’s Guide...
Page 795: Reboot
Click the Reboot button to restart the ZyWALL. Wait a few minutes until the login screen appears. If the login screen does not appear, type the IP address of the device in your Web browser. You can also use the CLI command reboot to restart the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 796 Chapter 50 Reboot ZyWALL USG 2000 User’s Guide...
Page 797: Troubleshooting
If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into both ZyXEL IPSec routers and check the settings in each field methodically and slowly. Make sure both the ZyWALL and remote IPSec router have the same security settings for the VPN tunnel.
Page 798 The VPN wizard automatically creates a corresponding policy route. If you use the VPN > IPSec VPN or VPN > L2TP VPN screens to set up a VPN tunnel, you need to manually configure a policy route for the VPN tunnel. ZyWALL USG 2000 User’s Guide...
Page 799: Resetting The Zywall
51.1 Resetting the ZyWALL If you cannot access the ZyWALL by any method, try restarting it by disconnecting and reconnecting the power. If you still cannot access the ZyWALL by any method ZyWALL USG 2000 User’s Guide...
Page 800: Changing A Power Module
You only need to turn off the power module that has failed. The ZyWALL can continue operating on power from the other power module. Disconnect the power cord from the power outlet. Disconnect the power cord from the ZyWALL’s power module. ZyWALL USG 2000 User’s Guide...
Page 801 Use a Philips screwdriver to remove the power module’s retaining screw. Figure 526 Removing the Power Module Retaining Screw Use the handle to slide out the power module and remove it. Figure 527 Removing the Power Module ZyWALL USG 2000 User’s Guide...
Page 802: Getting More Troubleshooting Help
Reconnect the power cord to the power outlet. 10 Push the ZyWALL power module switch to the on position. 51.3 Getting More Troubleshooting Help Search for support information for your model at www.zyxel.com for more troubleshooting suggestions. ZyWALL USG 2000 User’s Guide...
Page 803: Product Specifications
SFP-SX (Multi-mode, distance: 550m, wavelength: 850nm) Transceivers SFP-LX-10 (Single-mode, distance: 10Km, wavelength: 1,310nm) SFP-LHX1310-40 (Single-mode, distance: 40Km, wavelength: 1,310nm) SFP-ZX-80 (Single-mode, distance: 80Km, wavelength: 1,550nm) Management interface RS-232, DB9F connector AUX port RS-232, DB9M connector ZyWALL USG 2000 User’s Guide...
Page 804 4 per interface Bridge ROUTING Static Routes 10,000 (shared 10,000 (shared with the policy with the policy routes) routes) Policy Routes 10,000 (shared 10,000 (shared with the static with the static routes) routes) Sessions 1,000,000 1,000,000 ZyWALL USG 2000 User’s Guide...
Page 805 Each LDAP Group Maximum Number of RADIUS Groups Maximum Number of RADIUS Servers for Each RADIUS Group Maximum Number of AD Groups Maximum Number of AD Servers for Each AD Group Maximum Number of Authentication Methods ZyWALL USG 2000 User’s Guide...
Page 806 Admin E-mail Addresses Syslog Servers Maximum Number of IDP Profiles Custom Signatures Maximum Number of ADP Profiles Maximum Number of ADP Rules Maximum Number of ADP Blocked 1,000 1,000 Hosts Maximum Blocking Period 3,600 3,600 CONTENT FILTER ZyWALL USG 2000 User’s Guide...
Page 807 200 ZIP files 200 ZIP files ZIP File Decompression Sessions 32 RAR-LZSS or 32 RAR-LZSS or 4 RAR-PPM 4 RAR-PPM SSL VPN OTHERS Maximum Number of Device HA VRRP Groups Maximum Number of OSPF Areas ZyWALL USG 2000 User’s Guide...
Page 808 Used by Time service RFCs 3339 Used by Telnet service RFCs 318, 854, 1413 Used by SIP ALG RFCs 3261, 3264 DHCP relay RFC 1541 ZySH W3C XML standard RFC 826 IP/IPv4 RFC 791 RFC 793 ZyWALL USG 2000 User’s Guide...
Page 809: Appendices And Index
Appendices and Index Common Services (871) Displaying Anti-Virus Alert Messages in Windows (875) Open Software Announcements (887) Legal Information (933) Index (937)
Page 811: Appendix A Log Descriptions
%s: website host The device allowed access to a web site. The content filtering %s: Service is not service is unregistered and the default policy is not set to registered block. %s: website host ZyWALL USG 2000 User’s Guide...
Page 812 The web site contains Java applet and access was blocked %s: Contains Java according to a profile. applet %s: website host The web site contains a cookie and access was blocked %s: Contains cookie according to a profile. %s: website host ZyWALL USG 2000 User’s Guide...
Page 813 The anti-spam white list rule with the specified index number White List rule %d has (%d) has been turned on. been activated. The anti-spam white list rule with the specified index number White List rule %d has (%d) has been turned off. been deactivated. ZyWALL USG 2000 User’s Guide...
Page 814 %s) and Subject (second %s) header values are listed. From:%s Subject:%s The number of concurrent e-mail sessions has exceeded the Mail sessions have maximum number of concurrent e-mail sessions that the reached the maximum anti-spam feature can handle (%d). threshold of %d. ZyWALL USG 2000 User’s Guide...
Page 815 The listed address object (first %s) is not the right kind for The %s address-object the second WINS server specified in the listed SSL VPN is wrong type for policy (second %s). '2nd-wins' in SSL Policy %s. ZyWALL USG 2000 User’s Guide...
Page 816 SSL VPN policy rule %s position (%d) in the list of SSL VPN policies. has been moved to %d. The listed SSL VPN policy has been removed. SSL VPN policy rule %s has been deleted. ZyWALL USG 2000 User’s Guide...
Page 817 The listed user (%s) failed to log into SSL VPN because of Failed login attempt entering an incorrect password or a user name that does not to SSLVPN from %s exist. (incorrect password or inexistent username) ZyWALL USG 2000 User’s Guide...
Page 818 L2TP over IPSec may not work because the configuration of L2TP over IPSec the IPSec VPN connection it uses (Crypto Map %s) has been sessions have been all changed. disconnected since configuration of Tunnel %s has been changed ZyWALL USG 2000 User’s Guide...
Page 819 Can't append entry: %s! 1st:zysh entry name 1st:zysh entry name Can't set entry: %s! Can't define entry: %s! 1st:zysh entry name 1st:zysh list name %s: list is full! 1st:zysh list name Can't undefine %s ZyWALL USG 2000 User’s Guide...
Page 820 1st:zysh entry num Unable to move entry #%d! 1st:zysh table name %s: apply failed at initial stage! 1st:zysh table name %s: apply failed at main stage! 1st:zysh table name %s: apply failed at closing stage! ZyWALL USG 2000 User’s Guide...
Page 821 The ZyWALL’s ADP feature detected traffic with the same IP LAND attack packet. address set as both the source and the destination. Source IP is the same as Destination IP. ZyWALL USG 2000 User’s Guide...
Page 822 A file matched a file pattern in the anti-virus black list. %s, %s matched the Black-List %s 1st %s: The protocol of the packet. 2nd %s: The filename of the related file. 3rd %s: The file pattern that the file matched. ZyWALL USG 2000 User’s Guide...
Page 823 (2nd %d). been moved to %d All of the anti-virus rules have been deleted. Anti-Virus rules have been flushed. The anti-virus rule of the specified number has been Anti-Virus rule %d has deleted. been deleted. ZyWALL USG 2000 User’s Guide...
Page 824 2nd %s: The filename of the related file. 3rd %s: Whether the file was deleted (DESTROY) or forwarded (PASS). Updating of the signature file information failed due to an Update signature info internal error. has failed. ZyWALL USG 2000 User’s Guide...
Page 825 Too many failed login attempts were made from an IP Address %u.%u.%u.%u has address so the ZyWALL is blocking login attempts from that been put into lockout IP address. state %u.%u.%u.%u: the source address of the user’s login attempt ZyWALL USG 2000 User’s Guide...
Page 826 Device registration failed, an error message returned by the Device registration MyZyXEL.com server will be appended to this log. has failed:%s. %s: error message returned by the myZyXEL.com server The device registered successfully with the myZyXEL.com Device registration server. has succeeded. ZyWALL USG 2000 User’s Guide...
Page 827 The device could not connect to the MyZyXEL.com server. Connect to MyZyXEL.com server has failed. The device started to check whether or not the user name in Do account check. MyZyXEL.com's database. ZyWALL USG 2000 User’s Guide...
Page 828 File download to the update server again. after %d seconds. The device already has the latest version of the file so no Device has latest update is needed. file. No need to update. ZyWALL USG 2000 User’s Guide...
Page 829 Some information was missing in the packets that the device Build query message sent to the server. has failed. The device could not process an HTTPS connection because it Verify server's could not verify the server's certificate. certificate has failed. ZyWALL USG 2000 User’s Guide...
Page 830 Load trusted root the device can verify a server's certificate. This log displays if certificates has the device failed to load it. failed. Verification of a server’s certificate failed because it has Certificate has expired. expired. ZyWALL USG 2000 User’s Guide...
Page 831 The device turned off the use of the IDP signature file. Disable IDP succeeded. The device failed to turn on the IDP engine. Enable IDP engine failed. The device failed to turn off the IDP engine. Disable IDP engine failed. ZyWALL USG 2000 User’s Guide...
Page 832 (second num), and the number of the custom signature is <num. Adding custom (third num) that was not added display. signature number is <num>. The device failed to get the custom IDP signature number. Get custom signature number error. ZyWALL USG 2000 User’s Guide...
Page 833 The setting for IDP Out of memory. IDP activation has not changed. activation unchanged. Activation of the IDP system-protect function failed due to System-protect error. an internal system error. Create IDP proc failed. IDP activation failed. ZyWALL USG 2000 User’s Guide...
Page 834 Checking for duplicated signature IDs failed. There was an Check duplicate sid error while allocating memory. failed. Allocate memory error. Checking for duplicated signature IDs failed. Opening a Check duplicate sid temporary file failed. failed. Open file error. ZyWALL USG 2000 User’s Guide...
Page 835 An application patrol rule has been modified. 1st %s: Rule %s:%s has been Protocol Name, 2nd: Rule Index. modified Application patrol was turned on. App. Patrol has been activated. Application patrol was turned off. App. Patrol has been deactivated. ZyWALL USG 2000 User’s Guide...
Page 836 The device failed to get the application patrol protocol list. System fatal error: 60011002. The device failed to initiate XML. System fatal error: 60011003. The device failed to turn application patrol off while the System fatal error: system was initiating. 60011004. ZyWALL USG 2000 User’s Guide...
Page 837 [SA] : Tunnel [%s] authentication method did not match. Phase 1 authentication method mismatch %s is the tunnel name. When negotiating Phase-1, the [SA] : Tunnel [%s] encryption algorithm did not match. Phase 1 encryption algorithm mismatch ZyWALL USG 2000 User’s Guide...
Page 838 %s is the tunnel name. The tunnel is a dynamic tunnel and Could not dial dynamic the device cannot dial it. tunnel "%s" %s is the tunnel name. The tunnel setting is not complete. Could not dial incomplete tunnel "%s" ZyWALL USG 2000 User’s Guide...
Page 839 %s is the tunnel name. When IKE request is already sent but Tunnel [%s] IKE still attempting to dial a tunnel. Negotiation is in process %s is the gateway name. An administrator disabled the VPN VPN gateway %s was gateway. disabled ZyWALL USG 2000 User’s Guide...
Page 840 An outgoing packet needed to be transformed but was longer Encapsulated packet than 65535. too big with length When performing inbound processing for incoming IPSEC Get inbound transform packets and ICMPs related to them, the engine cannot obtain fail the transform context. ZyWALL USG 2000 User’s Guide...
Page 841 %d is the global index of rule Firewall rule %d has been deleted. Firewall rules were flushed Firewall rules have been flushed. %d is the global index of rule, %s is appended/inserted/ Firewall rule %d was modified ZyWALL USG 2000 User’s Guide...
Page 842 Failed to send control message to policy routing manager. To send message to policy route daemon failed! Allocating policy routing rule fails: insufficient memory. The policy route %d allocates memory fail! %d: the policy route rule number ZyWALL USG 2000 User’s Guide...
Page 843 %s %u.%u.%u.%u is IP address %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET An administrator assigned a nonexistent certificate to HTTPS. HTTPS certificate:%s does not exist. HTTPS %s is certificate name assigned by user service will not work. ZyWALL USG 2000 User’s Guide...
Page 844 An administrator changed the port number for SNMP back to SNMP port has been the default (161). changed to default port. An administrator changed the console port baud rate. Console baud has been changed to %s. %s is baud rate assigned by user ZyWALL USG 2000 User’s Guide...
Page 845 An administrator modified the rule %u. DNS access control rule %u has been %u is rule number modified An administrator removed the rule %u. DNS access control rule %u has been %u is rule number deleted. ZyWALL USG 2000 User’s Guide...
Page 846 %u is the index of the access control rule. %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET. An access control rule was inserted successfully. Access control rule %u of %s was inserted. %u is the index of the access control rule. %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET. ZyWALL USG 2000 User’s Guide...
Page 847 Memory usage drops below the threshold of %d%%: mem- threshold-min. When local storage usage drops below threshold-min, %s: partition_name file system drops below the threshold of %d%%: disk-threshold-min. DHCP Server executed with cautious mode enabled. DHCP Server executed with cautious mode enabled ZyWALL USG 2000 User’s Guide...
Page 848 %s is the time format. The device was not able to synchronize with the NTP time NTP update failed server successfully. An administrator restarted the device. Device is rebooted by administrator! Cannot allocate system memory. Insufficient memory. ZyWALL USG 2000 User’s Guide...
Page 849 Update profile failed because the feature requested is only Update the profile %s available to donators, %s is the profile name. has failed because the feature requested is only available to donators. ZyWALL USG 2000 User’s Guide...
Page 850 The profile is paused by Device-HA, because the VRRP status The profile %s has of that HA iface is standby, %s is the profile name. been paused because the HA interface of VRRP status was standby. ZyWALL USG 2000 User’s Guide...
Page 851 - Server did not respond. The diagnostics scripts were executed successfully. Collect Diagnostic Infomation has succeeded. The specified port has it’s link up. Port %d is up!! The specified port has it’s link down. Port %d is down!! ZyWALL USG 2000 User’s Guide...
Page 852 The connectivity check process can't get netmask address of Can't get NETMASK interface. address of %s interface %s: interface name The connectivity check process can't get broadcast address of Can't get BROADCAST interface address of %s interface %s: interface name ZyWALL USG 2000 User’s Guide...
Page 853 The System Startup configuration file synchronized from the Master configuration Master is the same with the one in the Backup, so the is the same with configuration does not have to be updated. Backup. Skip updating ZyWALL USG 2000 User’s Guide...
Page 854 Master. 1st %s: The object to syncing %s since %s is be synchronized, 2ed %s: The feature name for the object to be synchronized, 3rd %s: unlicensed or license expired. ZyWALL USG 2000 User’s Guide...
Page 855 %s for %s due to transmission timeout. %s: The name of the VRRP interface. VRRP interface %s has been shutdown. %s: The name of the VRRP interface. VRRP interface %s has been brought up. ZyWALL USG 2000 User’s Guide...
Page 856 Interface Name interface %s has been changed to BiDir. RIP text or md5 authentication has been disabled. RIP authentication has benn disabled. RIP text authentication key has been deleted. RIP text authentication key has been deleted. ZyWALL USG 2000 User’s Guide...
Page 857 %s: Virtual-Link link %d md5 authentication of area Virtual-link %s text authentication has been set without Invalid OSPF virtual- setting text authentication key first. %s: Virtual-Link ID link %s text authentication of area ZyWALL USG 2000 User’s Guide...
Page 858 SIP ALG has been modified. Default SIP ALG port has been changed. Signal port of SIP ALG has been modified. SIP ALG apply additional signal port failed. Register SIP ALG extra port=%d failed. %d: Port number ZyWALL USG 2000 User’s Guide...
Page 859 The device was unable to use CMP to enroll a certificate. 1st CMP enrollment "%s" %s is a request name, 2nd %s is the CA name, 3rd %s is the failed, CA "%s", URL "%s" ZyWALL USG 2000 User’s Guide...
Page 860 Trusted Certificates. %s is the certificate request name. certificate "%s" from "Trusted Certificate" failed The device exported a x509 format certificate from My Export X509 Certificates. %s is the certificate request name. certificate "%s" from "My Certificate" successfully ZyWALL USG 2000 User’s Guide...
Page 861 CRL was not found (anywhere). CRL was not added to the cache. CRL decoding failed. CRL is not currently valid, but in the future. CRL contains duplicate serial numbers. Time interval is not continuous. Time information not available. ZyWALL USG 2000 User’s Guide...
Page 862 1st %s is interface name, 2nd %s is is disabled now. interface. An administrator changed an interface’s configuration. %s: Interface %s has been interface name. changed. An administrator added a new interface. %s: interface name. Interface %s has been added. ZyWALL USG 2000 User’s Guide...
Page 863 MS-CHAPv2 authentication failed (the server must support Interface %s connect mS-CHAPv2 and verify that the authentication failed, this failed: MS-CHAPv2 does not include cases where the servers does not support mutual authentication MS-CHAPv2). %s: interface name. failed. ZyWALL USG 2000 User’s Guide...
Page 864 %s. Please try to remove then insert the device. The PIN code configured for the listed cellular interface (%d) "PIN code is required is incorrect or missing. for inteface cellular%d. Please check the PIN code setting. ZyWALL USG 2000 User’s Guide...
Page 865 %s, but current inserted device is %s. The cellular device (identified by its manufacturer and model) "Cellular device [%s has been inserted in or connected to the specified slot. %s] has been inserted into %s. ZyWALL USG 2000 User’s Guide...
Page 866 There was an EAP timeout for a wireless client connected to WPA or WPA2 enterprise the specified WLAN interface (first %s). The MAC address of EAP timeout. the wireless client is listed (second %s). Interface: %s, MAC: ZyWALL USG 2000 User’s Guide...
Page 867 Account %s %s has been changed. 1st %s: profile type, 2nd %s: profile name. A user added a new ISP account profile. Account %s %s has been added. 1st %s: profile type, 2nd %s: profile name. ZyWALL USG 2000 User’s Guide...
Page 868 2nd %s is error message when apply CLI command. Apply configuration failed, this log will be what CLI command WARNING:#%s, %s is and what warning message is. 1st %s is CLI command. 2nd %s is warning message when apply CLI command. ZyWALL USG 2000 User’s Guide...
Page 869 ACK to the client. DHCP server assigned %s The DHCP server feature assigned a client the IP address that to %s(%s) it requested. The DHCP client’s hostname and MAC address are listed. ZyWALL USG 2000 User’s Guide...
Page 870 The interface the packet came in %s#%u.%u.%u.%u#%0 through, the sender’s IP address and MAC address, are also 2X:%02X:%02X:%02X: shown along with the binding type (“s” for static or “d” for %02X:%02X. dynamic). ZyWALL USG 2000 User’s Guide...
Page 871: Appendix B Common Services
Border Gateway Protocol. BOOTP_CLIENT DHCP Client. BOOTP_SERVER DHCP Server. CU-SEEME 7648 A popular videoconferencing solution from White Pines Software. 24032 TCP/UDP Domain Name Server, a service that matches web names (for example www.zyxel.com) to IP numbers. ZyWALL USG 2000 User’s Guide...
Page 872 ICMP echo requests to test whether or not a remote host is reachable. POP3 Post Office Protocol version 3 lets a client computer get e-mail from a POP3 server through a temporary connection (TCP/IP or other). ZyWALL USG 2000 User’s Guide...
Page 873 TELNET Telnet is the login and terminal emulation protocol common on the Internet and in UNIX environments. It operates over TCP/IP networks. Its primary function is to allow users to log into remote host systems. ZyWALL USG 2000 User’s Guide...
Page 874 PROTOCOL PORT(S) DESCRIPTION TFTP Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP, but uses the UDP (User Datagram Protocol) rather than TCP (Transmission Control Protocol). VDOLIVE 7000 Another videoconferencing solution. ZyWALL USG 2000 User’s Guide...
Page 875: Appendix C Displaying Anti-Virus Alert Messages In Windows
Windows XP Click Start > Control Panel > Administrative Tools > Services. Figure 530 Windows XP: Opening the Services Window ZyWALL USG 2000 User’s Guide...
Page 876: Windows 2000
Figure 531 Windows XP: Starting the Messenger Service Close the window when you are done. Windows 2000 Click Start > Settings > Control Panel > Administrative Tools > Services. Figure 532 Windows 2000: Opening the Services Window ZyWALL USG 2000 User’s Guide...
Page 877 WinPopup window displays as shown. Figure 534 Windows 98 SE: WinPopup If you want to display the WinPopup window at startup, follow the steps below for Windows 98 SE (steps are similar for Windows Me). ZyWALL USG 2000 User’s Guide...
Page 878 Right-click on the program task bar and click Properties. Figure 535 WIndows 98 SE: Program Task Bar Click the Start Menu Programs tab and click Advanced ... Figure 536 Windows 98 SE: Task Bar Properties Double-click Programs and click StartUp. ZyWALL USG 2000 User’s Guide...
Page 879 Right-click in the StartUp pane and click New, Shortcut. Figure 537 Windows 98 SE: StartUp A Create Shortcut window displays. Enter “winpopup” in the Command line field and click Next. Figure 538 Windows 98 SE: Startup: Create Shortcut ZyWALL USG 2000 User’s Guide...
Page 880 A shortcut is created in the StartUp pane. Restart the computer when prompted. Figure 540 Windows 98 SE: Startup: Shortcut Note: The WinPopup window displays after the computer finishes the startup process (see Figure 534 on page 877). ZyWALL USG 2000 User’s Guide...
Page 881: Appendix D Importing Certificates
To have Internet Explorer trust a ZyWALL certificate issued by a certificate authority, import the certificate authority’s certificate into your operating system as a trusted certification authority. ZyWALL USG 2000 User’s Guide...
Page 882 In Internet Explorer, double click the lock shown in the following screen. Figure 542 Login Screen Click Install Certificate to open the Install Certificate wizard. Figure 543 Certificate General Information before Import ZyWALL USG 2000 User’s Guide...
Page 883 Appendix D Importing Certificates Click Next to begin the Install Certificate wizard. Figure 544 Certificate Import Wizard 1 Select where you would like to store the certificate and then click Next. Figure 545 Certificate Import Wizard 2 ZyWALL USG 2000 User’s Guide...
Page 884 Appendix D Importing Certificates Click Finish to complete the Import Certificate wizard. Figure 546 Certificate Import Wizard 3 ZyWALL USG 2000 User’s Guide...
Page 885 Appendix D Importing Certificates Click Yes to add the ZyWALL certificate to the root store. Figure 547 Root Certificate Store Figure 548 Certificate General Information after Import ZyWALL USG 2000 User’s Guide...
Page 886 Appendix D Importing Certificates ZyWALL USG 2000 User’s Guide...
Page 887: Appendix E Open Software Announcements
No part may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, except the express written permission of ZyXEL Communications Corporation. Note: This Product includes ppp-2.4.2 software under the PPP License PPP License Copyright (c) 1993 The Australian National University.
Page 888 Note: This Product includes ntp-4.1.2 software under the NTP License NTP License Copyright (c) David L. Mills 1992-2004 Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that ZyWALL USG 2000 User’s Guide...
Page 889 The GNU General Public License, Version 1 • This license is compatible with The GNU General Public License, Version 2 This is just like a Simple Permissive license, but it requires that a copyright notice be maintained. ZyWALL USG 2000 User’s Guide...
Page 890 For written permission, please contact openssl-core@openssl.org. 5. Products derived from this software may not be called "OpenSSL" nor may “OpenSSL" appear in their names without prior written permission of the OpenSSL Project. ZyWALL USG 2000 User’s Guide...
Page 891 3. All advertising materials mentioning features or use of this software must display the following acknowledgement: "This product includes cryptographic ZyWALL USG 2000 User’s Guide...
Page 892 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. ZyWALL USG 2000 User’s Guide...
Page 893 Portions Copyright (C) 1996-2001 Nominum, Inc. Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. ZyWALL USG 2000 User’s Guide...
Page 894 Internet Systems Consortium, Inc. 950 Charter Street Redwood City, CA 94063 <info@isc.org> http://www.isc.org/ Note: This Product includes httpd-2.0.55 software developed by the Apache Software Foundation under Apache License. Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ ZyWALL USG 2000 User’s Guide...
Page 895 Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed ZyWALL USG 2000 User’s Guide...
Page 896 NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; ZyWALL USG 2000 User’s Guide...
Page 897 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or ZyWALL USG 2000 User’s Guide...
Page 898 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ZyWALL USG 2000 User’s Guide...
Page 899 To protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions ZyWALL USG 2000 User’s Guide...
Page 900 Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances. ZyWALL USG 2000 User’s Guide...
Page 901 Activities other than copying, distribution and modification are not covered by this License; they ZyWALL USG 2000 User’s Guide...
Page 902 Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. ZyWALL USG 2000 User’s Guide...
Page 903 Section 6.) Otherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself. ZyWALL USG 2000 User’s Guide...
Page 904 7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of ZyWALL USG 2000 User’s Guide...
Page 905 Many people have made generous contributions to the ZyWALL USG 2000 User’s Guide...
Page 906 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR ZyWALL USG 2000 User’s Guide...
Page 907 To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you ZyWALL USG 2000 User’s Guide...
Page 908 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications ZyWALL USG 2000 User’s Guide...
Page 909 Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the ZyWALL USG 2000 User’s Guide...
Page 910 License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit ZyWALL USG 2000 User’s Guide...
Page 911 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/ OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ZyWALL USG 2000 User’s Guide...
Page 912 Original Code, prior Modifications used by a Contributor, and the Modifications made by that particular Contributor. 1.3. "Covered Code" means the Original Code or Modifications or the combination of the Original Code and Modifications, in each case including portions thereof. ZyWALL USG 2000 User’s Guide...
Page 913 Source Code of computer software code which is described in the Source Code notice required by Exhibit A as Original Code, and which, at the time of its release under this License is not already Covered Code governed by this License. 1.10.1. "Patent Claims" ZyWALL USG 2000 User’s Guide...
Page 914 You delete from the Original Code; 2) separate from the Original Code; or 3) for infringements caused by: i) the modification of the Original Code or ii) the combination of the Original Code with other software or devices. ZyWALL USG 2000 User’s Guide...
Page 915 Any Modification which You create or to which You contribute must be made available in Source Code form under the terms of this License either on the same media as an Executable version or via an accepted Electronic Distribution ZyWALL USG 2000 User’s Guide...
Page 916 Contributor represents that, except as disclosed pursuant to Section 3.4 (a) above, Contributor believes that Contributor's Modifications are Contributor's original creation(s) and/or Contributor has sufficient rights to grant the rights conveyed by this License. 3.5. Required Notices. ZyWALL USG 2000 User’s Guide...
Page 917 4. Inability to Comply Due to Statute or Regulation. If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Code due to statute, judicial order, or ZyWALL USG 2000 User’s Guide...
Page 918 The entire risk as to the quality and performance of the covered code is with you. Should any covered code prove defective in any respect, you ZyWALL USG 2000 User’s Guide...
Page 919 8.4. In the event of termination under Sections 8.1 or 8.2 above, all end user license agreements (excluding distributors and resellers) which have been validly ZyWALL USG 2000 User’s Guide...
Page 920 United Nations Convention on Contracts for the International Sale of Goods is expressly excluded. Any law or regulation which provides that the language of a contract shall be construed against the drafter shall not apply to this License. 12. Responsibility for claims ZyWALL USG 2000 User’s Guide...
Page 921 NOTE: The text of this Exhibit A may differ slightly from the text of the notices in the Source Code files of the Original Code. You should use the text of this Exhibit A rather than the text found in the Original Code Source Code for Your Modifications. ZyWALL USG 2000 User’s Guide...
Page 922 Such altered versions also must not be misrepresented as being Info-ZIP releases--including, ZyWALL USG 2000 User’s Guide...
Page 923 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ZyWALL USG 2000 User’s Guide...
Page 924 The OpenLDAP Foundation may revise this license from time to time.Each revision is distinguished by a version number. You may use this Software under terms of this license revision or under the terms of any subsequent revision of the license. ZyWALL USG 2000 User’s Guide...
Page 925 Portions copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007Pierre-Alain Joye (pierre@libgd.org). Portions relating to JPEG and to color quantization copyright 2000, 2001, 2002, Doug Becker and copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, ZyWALL USG 2000 User’s Guide...
Page 926 1. The origin of this software must not be misrepresented; you must not claim that you wrote the origi- nal software. If you use this software in a product, an acknowledgment in the product documentation ZyWALL USG 2000 User’s Guide...
Page 927 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the ZyWALL USG 2000 User’s Guide...
Page 928 THE TERMS CAREFULLY BEFORE COMPLETING THE INSTALLATION PROCESS AS INSTALLING THE SOFTWARE WILL INDICATE YOUR ASSENT TO THEM. IF YOU DO NOT AGREE TO THESE TERMS, THEN ZyXEL, INC. IS UNWILLING TO LICENSE THE SOFTWARE TO YOU, IN WHICH EVENT YOU SHOULD RETURN THE UNINSTALLED SOFTWARE AND PACKAGING TO THE PLACE FROM WHICH IT WAS ACQUIRED, AND YOUR MONEY WILL BE REFUNDED.
Page 929 Software as long as this License Agreement remains in full force and effect. Ownership of the Software, Documentation and all intellectual property rights therein shall remain at all times with ZyXEL. Any other use of the Software by any other entity is strictly forbidden and is a violation of this License Agreement.
Page 930 AND NO WARRANTIES SHALL APPLY AFTER THAT PERIOD. 7.Limitation of Liability IN NO EVENT WILL ZyXEL BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, INDIRECT, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES FOR LOSS OF...
Page 931 Software and Documentation in your possession or under your control. ZyXEL may terminate this License Agreement for any reason, including, but not limited to, if ZyXEL finds that you have violated any of the terms of this License Agreement. Upon notification of termination, you agree to destroy or return to ZyXEL all copies of the Software and Documentation and to certify in writing that all known copies, including backup copies, have been destroyed.
Page 932 Appendix E Open Software Announcements ZyWALL USG 2000 User’s Guide...
Page 933: Appendix F Legal Information
Published by ZyXEL Communications Corporation. All rights reserved. Disclaimer ZyXEL does not assume any liability arising out of the application or use of any products, or software described herein. Neither does it convey any license under its patent rights nor the patent rights of others. ZyXEL further reserves the right to make changes in any products described herein without notice.
Page 934 注意 ! 依據低功率電波輻射性電機管理辦法第十二條經型式認證合格之低功率射頻電機，非經許可，公司、商號或使用者均不得擅自變更頻率、加大功率或變更原設計之特性及功能。第十四條低功率射頻電機之使用不得影響飛航安全及干擾合法通信；經發現有干擾現象時，應立即停用，並改善至無干擾時方得繼續使用。前項合法通信，指依電信規定作業之無線電信。低功率射頻電機須忍受合法通信或工業、科學及醫療用電波輻射性電機設備之干擾。 Notices Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. ZyWALL USG 2000 User’s Guide...
Page 935 Canada. Viewing Certifications Go to http://www.zyxel.com. Select your product on the ZyXEL home page to go to that product's page. Select the certification you wish to view from this page. ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase.
Page 936 Appendix F Legal Information ZyWALL USG 2000 User’s Guide...
Page 937: Index
RADIUS default and content filtering 543, 544, 549 RADIUS group and firewall RADIUS group members and force user authentication policies RADIUS, see also RADIUS. and FTP and SNMP access and SSH access control attacks and Telnet ZyWALL USG 2000 User’s Guide...
Page 938 473, 474 and transport mode alert message alerts 764, 768, 771, 772, 773 alerts anti-spam black list 480, 482 anti-virus boot sector virus configuration overview 305, 311 EICAR and firewall 305, 308 e-mail virus ZyWALL USG 2000 User’s Guide...
Page 939 448, 449, 461, 466 non-RFC-defined-char over allotment of bandwidth non-RFC-HTTP-delimiter port-less obsolete-options ports oversize-chunk-encoding prerequisites oversize-len priority oversize-offset priority effect oversize-request-uri-directory protocol statistics ZyWALL USG 2000 User’s Guide...
Page 940 AUX LED bridge interfaces AUX port 182, 223 and virtual interfaces of members See also auxiliary interface. basic characteristics auxiliary interface 182, 230, 231, 741 effect on routing table when used member interfaces ZyWALL USG 2000 User’s Guide...
Page 941 578, 788, 789 fingerprints configuration 675, 681 importing object-based in IPSec overview in the VPN wizard web-based SSL application example not used for encryption configuration files revoked at restart ZyWALL USG 2000 User’s Guide...
Page 942 543, 544 DDoS attacks prerequisites decompression of files (in anti-virus) registration status 170, 548, 552 default reports, see content filtering reports. firewall behavior statistics interfaces and zones testing LAN IP address trial service activation ZyWALL USG 2000 User’s Guide...
Page 943 Domain Name System, see DNS. dial backup DoS (Denial of Service) attacks dial backup port and dial-in management double-encoding attack DIAL BACKUP port See also auxiliary interface. dial-in management Dynamic Domain Name System, see DDNS. answer rings ZyWALL USG 2000 User’s Guide...
Page 944 IPSec and IPSec VPN error messages and logs and port triggering 346, 374 and schedules and transport mode 333, 460, 462, 464 and service groups Ethereal and services 334, 636 Ethernet interfaces 119, 182 ZyWALL USG 2000 User’s Guide...
Page 945 Transport Layer Security (TLS) packet flow full tunnel mode prerequisites 44, 380, 384 Fully-Qualified Domain Name (FQDN) HTTPS 135, 711 ZyWALL USG 2000 User’s Guide...
Page 946 IP address, remote IPSec router log options IP address, ZyXEL device monitor profile local identity packet inspection profiles main mode 367, 371 packet inspection signatures NAT traversal policies negotiation mode policy types password ZyWALL USG 2000 User’s Guide...
Page 947 IP v4 packet headers Ethernet, see also Ethernet interfaces. IP/MAC binding gateway exempt list general characteristics monitor IP address static DHCP metric IPSec active protocol overlapping IP address and subnet mask port groups, see also port groups. ZyWALL USG 2000 User’s Guide...
Page 948 VPN gateway IPSec SA active protocol and firewall Java 323, 798 and to-ZyWALL firewall permissions authentication algorithms 368, 369 JavaScripts authentication key (manual keys) destination NAT for inbound traffic encapsulation ZyWALL USG 2000 User’s Guide...
Page 949 SSL directory logout directory structure SSL user Distinguished Name, see DN. web configurator 650, 651, 653 logs group and firewall group members configuration overview host 651, 653 descriptions password 651, 653 ZyWALL USG 2000 User’s Guide...
Page 950 Overflow (MS-05-39) attack port triggering, see also port triggering. mini GBIC ports traversal connection speed trigger port, see also policy routes. connector type NBNS transceiver installation 195, 221, 229, 238, 384 transceiver removal NetBIOS ZyWALL USG 2000 User’s Guide...
Page 951 SSL application chunk-encoding attack users, user groups len attack obsolete-options attack offset attack offset (patterns) request-uri-directory attack One-Time Password (OTP) Online Certificate Status Protocol (OCSP) vs CRL Open Shortest Path First, see OSPF. ZyWALL USG 2000 User’s Guide...
Page 952 IPSec power module changing policy routes connecting actions disconnecting and address objects 254, 255, 625 and ALG power off 307, 308, 311 and HTTP redirect power on and interfaces 254, 255 and IPSec PPP interfaces ZyWALL USG 2000 User’s Guide...
Page 953 RADIUS 648, 649 collecting data advantages configuration overview and IKE SA content filtering and PPPoE 199, 238 daily and users daily e-mail user attributes ZyWALL USG 2000 User’s Guide...
Page 954 670, 674, 681 service subscription status See also ALG. service trials services 635, 636, 871 and device HA and firewall 334, 636 and IDP and policy routes 255, 636 safety warnings and port triggering ZyWALL USG 2000 User’s Guide...
Page 955 Simple Mail Transfer Protocol. See SMTP. and certificates Simple Network Management Protocol, see and zones SNMP. client requirements Simple Traversal of UDP through NAT, see encryption methods STUN. for secure Telnet how connection is established versions ZyWALL USG 2000 User’s Guide...
Page 956 44, 380 IDP, see also IDP. network access mode new IDP/AppPatrol signatures prerequisites SSL VPN reverse proxy mode 43, 379 SSL VPN, see also SSL VPN. See also SSL status 170, 455, 478 where used ZyWALL USG 2000 User’s Guide...
Page 957 SYN (synchronize) Triple Data Encryption Standard, see 3DES. SYN flood trojan attacks window size troubleshooting 793, 797 TCPdump ZyWALL USG 2000 User’s Guide...
Page 958 (ICMP) certificates unsafe web pages login logout unsolicited commercial e-mail required information update system requirements configuration overview user-aware prerequisites users updating access, see also access users. anti-virus signatures Admin (type) IDP and application patrol signatures ZyWALL USG 2000 User’s Guide...
Page 959 IPSec vs asymmetrical routes IPSec SA vs triangle routes proposal Virtual Local Area Network, see VLAN. security associations (SA) Virtual Private Network, see VPN. See also IKE SA. virtual router See also IPSec ZyWALL USG 2000 User’s Guide...
Page 960 Web attack and SSH web configurator 36, 47 and Telnet access and VPN 102, 275 access users and WWW requirements block intra-zone traffic 278, 329 supported browsers configuration overview web features default ActiveX extra-zone traffic ZyWALL USG 2000 User’s Guide...
Page 961 Index inter-zone traffic intra-zone traffic prerequisites types of traffic where used ZyWALL terminology differences ZyXEL web site ZyWALL USG 2000 User’s Guide...
Page 962 Index ZyWALL USG 2000 User’s Guide...
Page 963 Index ZyWALL USG 2000 User’s Guide...
Page 964 Index ZyWALL USG 2000 User’s Guide...

ZyXEL Communications ZYWALL USG 2000 Manual

About this User's Guide

Document Conventions

Safety Warnings

Contents Overview

Table of Contents

Getting Started

Part I: Getting Started

Chapter 1 Introducing the Zywall

Chapter 2 Features and Applications

Chapter 3 Web Configurator

Chapter 4 Wizard Setup

Chapter 5 Configuration Basics

Chapter 6 Tutorials

Chapter 7 Status

Chapter 8 Registration

Chapter 9 Signature Update

Network

Part II: Network

Chapter 10 Interface

Chapter 11 Trunks

Chapter 12 Policy and Static Routes

Chapter 13 Routing Protocols

Chapter 14 Zones

Chapter 15 DDNS

Chapter 16 Virtual Servers

Chapter 17 HTTP Redirect

Chapter 18 ALG

Chapter 19 IP/MAC Binding

Part III: Firewall

Firewall

Chapter 20 Firewall

Vpn

Part IV: VPN

Quick Links

Troubleshooting

Related Manuals for ZyXEL Communications ZYWALL USG 2000

Summary of Contents for ZyXEL Communications ZYWALL USG 2000