Page 1 ZyWALL USG 2000 Unified Security Gateway Default Login Details LAN Port IP Address https://192.168.1.1 User Name admin Password 1234 www.zyxel.com Firmware Version 2.20 Edition 4, 4/2011 www.zyxel.com Copyright © 2011 ZyXEL Communications Corporation...
Page 3: About This User's Guide
• CLI Reference Guide The CLI Reference Guide explains how to use the Command-Line Interface (CLI) to configure the ZyWALL. Note: It is recommended you use the Web Configurator to configure the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 4 Documentation Feedback Send your comments, questions or suggestions to: techwriters@zyxel.com.tw Thank you! The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 30099, Taiwan. Need More Help? More help is available at www.zyxel.com.
Page 5 Graphics in this book may differ slightly from the product due to differences in operating systems, operating system versions, or if you installed updated firmware/software for your device. Every effort has been made to ensure that the information in this manual is accurate. ZyWALL USG 2000 User’s Guide...
Page 6: Document Conventions
For example, “k” for kilo may denote “1000” or “1024”, “M” for mega may denote “1000000” or “1048576” and so on. • “e.g.,” is a shorthand for “for instance”, and “i.e.,” means “that is” or “in other words”. ZyWALL USG 2000 User’s Guide...
Page 7 Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The ZyWALL icon is not an exact representation of your device. ZyWALL Computer Notebook computer Server Firewall Telephone Switch Router ZyWALL USG 2000 User’s Guide...
Page 8: Safety Warnings
Your product is marked with this symbol, which is known as the WEEE mark. WEEE stands for Waste Electronics and Electrical Equipment. It means that used electrical and electronic products should not be mixed with general waste. Used electrical and electronic equipment should be treated separately. ZyWALL USG 2000 User’s Guide...
Page 9: Table Of Contents
SSL User Screens ........................499 SSL User Application Screens ....................509 SSL User File Sharing ......................511 ZyWALL SecuExtender ......................519 L2TP VPN ..........................523 Application Patrol ........................527 Anti-Virus ..........................553 IDP ............................569 ADP ............................603 ZyWALL USG 2000 User’s Guide...
Page 10 Endpoint Security ........................781 System ........................... 789 Log and Report ........................841 File Manager ........................... 861 Diagnostics ..........................873 Packet Flow Explore ........................ 883 Reboot ............................. 891 Shutdown ..........................893 Troubleshooting ........................895 Product Specifications ......................917 ZyWALL USG 2000 User’s Guide...
Page 11: Table Of Contents
2.2.2 SSL VPN Network Access ..................46 2.2.3 User-Aware Access Control ..................48 2.2.4 Multiple WAN Interfaces ..................... 48 2.2.5 Device HA ........................49 Chapter 3 Web Configurator........................51 3.1 Web Configurator Requirements ..................51 3.2 Web Configurator Access ....................51 ZyWALL USG 2000 User’s Guide...
Page 12 5.5.6 VPN Advanced Wizard - Phase 2 ................94 5.5.7 VPN Advanced Wizard - Summary ................95 5.5.8 VPN Advanced Wizard - Finish ................. 96 Chapter 6 Configuration Basics......................97 6.1 Object-based Configuration ....................97 6.2 Zones, Interfaces, and Physical Ports ................. 98 ZyWALL USG 2000 User’s Guide...
Page 13 6.7 System ..........................117 6.7.1 DNS, WWW, SSH, TELNET, FTP, SNMP, Dial-in Mgmt, Vantage CNM ....117 6.7.2 Logs and Reports ......................118 6.7.3 File Manager ......................118 6.7.4 Diagnostics ........................118 6.7.5 Shutdown ........................118 Chapter 7 Tutorials ..........................121 ZyWALL USG 2000 User’s Guide...
Page 14 7.12.5 Set Up a DMZ to LAN Firewall Rule for SIP ............164 7.13 How to Use Multiple Static Public WAN IP Addresses for LAN to WAN Traffic ....165 7.13.1 Create the Public IP Address Range Object ............165 7.13.2 Configure the Policy Route ..................166 ZyWALL USG 2000 User’s Guide...
Page 15 10.2 The Port Statistics Screen ....................226 10.2.1 The Port Statistics Graph Screen ................228 10.3 Interface Status Screen ....................229 10.4 The Traffic Statistics Screen .................... 232 10.5 The Session Monitor Screen ..................235 ZyWALL USG 2000 User’s Guide...
Page 16 12.3 The IDP/AppPatrol Update Screen .................. 279 12.4 The System Protect Update Screen ................281 Chapter 13 Interfaces ..........................283 13.1 Interface Overview ......................283 13.1.1 What You Can Do in this Chapter ................283 ZyWALL USG 2000 User’s Guide...
Page 17 15.1.2 What You Need to Know ..................354 15.2 Policy Route Screen ......................356 15.2.1 Policy Route Edit Screen ..................359 15.3 IP Static Route Screen ....................363 15.3.1 Static Route Add/Edit Screen ................. 364 ZyWALL USG 2000 User’s Guide...
Page 18 19.2 The NAT Screen ......................394 19.2.1 The NAT Add/Edit Screen ..................396 19.3 NAT Technical Reference ....................399 Chapter 20 HTTP Redirect ........................403 20.1 Overview .......................... 403 20.1.1 What You Can Do in this Chapter ................403 ZyWALL USG 2000 User’s Guide...
Page 19 24.1.3 Firewall Rule Example Applications ............... 432 24.1.4 Firewall Rule Configuration Example ..............435 24.2 The Firewall Screen ......................437 24.2.1 Configuring the Firewall Screen ................438 24.2.2 The Firewall Add/Edit Screen ................. 441 24.3 The Session Limit Screen ....................442 ZyWALL USG 2000 User’s Guide...
Page 20 27.4 Bookmarking the ZyWALL ....................506 27.5 Logging Out of the SSL VPN User Screens ..............506 Chapter 28 SSL User Application Screens .................... 509 28.1 SSL User Application Screens Overview ................ 509 28.2 The Application Screen ....................509 ZyWALL USG 2000 User’s Guide...
Page 21 32.3 Application Patrol Applications ..................538 32.3.1 The Application Patrol Edit Screen ................ 539 32.3.2 The Application Patrol Policy Edit Screen ............. 543 32.4 The Other Applications Screen ..................546 32.4.1 The Other Applications Add/Edit Screen ..............549 ZyWALL USG 2000 User’s Guide...
Page 22 34.8.1 Creating or Editing a Custom Signature ..............590 34.8.2 Custom Signature Example ................... 596 34.8.3 Applying Custom Signatures .................. 598 34.8.4 Verifying Custom Signatures .................. 599 34.9 IDP Technical Reference ....................600 Chapter 35 ADP ............................603 ZyWALL USG 2000 User’s Guide...
Page 23 38.1.2 What You Need to Know ..................657 38.2 Before You Begin ......................659 38.3 The Anti-Spam General Screen ..................659 38.3.1 The Anti-Spam Policy Add or Edit Screen .............. 661 38.4 The Anti-Spam Black List Screen ..................663 ZyWALL USG 2000 User’s Guide...
Page 24 41.1.1 What You Can Do in this Chapter ................713 41.1.2 What You Need To Know ..................713 41.2 Address Summary Screen ....................713 41.2.1 Address Add/Edit Screen ..................715 41.3 Address Group Summary Screen ..................716 41.3.1 Address Group Add/Edit Screen ................717 ZyWALL USG 2000 User’s Guide...
Page 25 45.1.1 What You Can Do in this Chapter ................741 45.1.2 Before You Begin ....................741 45.1.3 Example: Selecting a VPN Authentication Method ..........741 45.2 Authentication Method Objects ..................742 45.2.1 Creating an Authentication Method Object ............743 Chapter 46 Certificates ..........................747 ZyWALL USG 2000 User’s Guide...
Page 26 49.2 Endpoint Security Screen ....................783 49.3 Endpoint Security Add/Edit ....................784 Chapter 50 System ..........................789 50.1 Overview .......................... 789 50.1.1 What You Can Do in this Chapter ................789 50.2 Host Name ........................790 ZyWALL USG 2000 User’s Guide...
Page 27 50.11.2 SNMP Traps ......................832 50.11.3 Configuring SNMP ....................832 50.12 Dial-in Management ...................... 834 50.12.1 Configuring Dial-in Mgmt ..................835 50.13 Vantage CNM ....................... 836 50.13.1 Configuring Vantage CNM ................... 837 50.14 Language Screen ......................839 ZyWALL USG 2000 User’s Guide...
Page 28 Packet Flow Explore ......................883 54.1 Overview .......................... 883 54.1.1 What You Can Do in this Chapter ................883 54.2 The Routing Status Screen ....................883 54.3 The SNAT Status Screen ....................887 Chapter 55 Reboot............................ 891 ZyWALL USG 2000 User’s Guide...
Page 29 Appendix A Log Descriptions ....................925 Appendix B Common Services..................... 989 Appendix C Displaying Anti-Virus Alert Messages in Windows..........993 Appendix D Importing Certificates..................999 Appendix E Open Software Announcements ..............1025 Appendix F Legal Information .................... 1083 Index............................. 1087 ZyWALL USG 2000 User’s Guide...
Page 30 Table of Contents ZyWALL USG 2000 User’s Guide...
Page 31: User's Guide
User’s Guide...
Page 33: Introducing The Zywall
(SFP module) with one port active at a time. 1.2 Rack-mounted Installation The ZyWALL can be mounted on an EIA standard size, 19-inch rack or in a wiring closet with other equipment. Follow the steps below to mount your ZyWALL on a ZyWALL USG 2000 User’s Guide...
Page 34: Rack-Mounted Installation Procedure
Align one bracket with the holes on one side of the ZyWALL and secure it with the included bracket screws (smaller than the rack-mounting screws). Attach the other bracket in a similar fashion. Figure 1 Attaching Mounting Brackets and Screws ZyWALL USG 2000 User’s Guide...
Page 35: Front Panel
For each interface you can connect either to the 1000Base-T port or the mini-GBIC port. The mini-GBIC ports have priority over the 1000Base-T ports. This means that if a mini-GBIC port and the corresponding 1000Base-T port are connected at the same time, the 1000Base-T port will be disabled. ZyWALL USG 2000 User’s Guide...
Page 36 • Connection speed: 1 Gigabit per second (Gbps) To avoid possible eye injury, do not look into an operating fiber-optic module’s connectors or fiber-optic cable. Transceiver and Fiber-optic Cable Installation Use the following steps to install a mini GBIC transceiver (SFP module). ZyWALL USG 2000 User’s Guide...
Page 37 When the other end of the fiber-optic cable is connected, check the LEDs to verify the link status. Figure 6 Installing the Fiber-optic Cable Fiber-optic Cable and Transceiver Removal Use the following steps to remove a mini GBIC transceiver (SFP module). ZyWALL USG 2000 User’s Guide...
Page 38 Then pull the fiber-optic cable out. Figure 7 Removing the Fiber-optic Cable Example Open the transceiver’s latch (latch styles vary). Figure 8 Opening the Transceiver’s Latch Example Pull the transceiver out of the slot. Figure 9 Transceiver Removal Example ZyWALL USG 2000 User’s Guide...
Page 39: Maximizing Throughput
The power module has malfunctioned. Turn the power module off, wait a few minutes, and turn the power module back on (see Section 1.5 on page 42). If the LED shines red again, then please contact your vendor. ZyWALL USG 2000 User’s Guide...
Page 40: Management Overview
The Ethernet link is down. The Ethernet link is up. Green The system is not transmitting/receiving Ethernet traffic. Blinking The system is transmitting/receiving Ethernet traffic. 1.4 Management Overview You can use the following ways to manage the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 41 Command Reference Guide for more information about the CLI. The default settings for the console port are as follows. Table 2 Console Port Default Settings SETTING VALUE Speed 115200 bps Data Bits Parity None Stop Bit Flow Control ZyWALL USG 2000 User’s Guide...
Page 42: Starting And Stopping The Zywall
ZyWALL simply turns off. It does not stop the system processes or write cached data to local storage. The ZyWALL does not stop or start the system processes when you apply configuration files or run shell scripts although you may temporarily lose access to network resources. ZyWALL USG 2000 User’s Guide...
Page 43: Features And Applications
Many security settings are made by zone, not by interface, port, or network. As a result, it is much simpler to set up and to change security settings in the ZyWALL. You can create your own custom zones. You can add interfaces and VPN tunnels to zones. ZyWALL USG 2000 User’s Guide...
Page 44 ZyWALL to check web sites against an external database of dynamically-updated ratings of millions of web sites. You then simply select categories to block or monitor, such as pornography or racial intolerance, from a pre-defined list. ZyWALL USG 2000 User’s Guide...
Page 45: Applications
SIP priority over all other traffic. This maximizes SIP traffic throughput for improved VoIP call sound quality. 2.2 Applications These are some example applications for your ZyWALL. See also Chapter 7 on page 121 for configuration tutorial examples. ZyWALL USG 2000 User’s Guide...
Page 46: Vpn Connectivity
ZyWALL appears to be the server to remote users. This provides an added layer of protection for your internal servers. With reverse proxy mode, remote users can easily access any web-based applications on the local network by clicking on links or entering the provided URL. ZyWALL USG 2000 User’s Guide...
Page 47 Figure 15 Network Access Mode: Full Tunnel Mode 192.168.1.100 LAN (192.168.1.X) https;// Web Mail File Share Web-based Application Application Non-Web Server ZyWALL USG 2000 User’s Guide...
Page 48: User-Aware Access Control
Set up multiple connections to the Internet on the same port, or set up multiple connections on different ports. In either case, you can balance the loads between them. Figure 17 Applications: Multiple WAN Interfaces ZyWALL USG 2000 User’s Guide...
Page 49: Device Ha
Chapter 2 Features and Applications 2.2.5 Device HA Set up an additional ZyWALL as a backup gateway to ensure the default gateway is always available for the network. Figure 18 Applications: Device HA ZyWALL USG 2000 User’s Guide...
Page 50 Chapter 2 Features and Applications ZyWALL USG 2000 User’s Guide...
Page 51: Web Configurator
• Enable Java permissions (enabled by default) • Enable cookies The recommended screen resolution is 1024 x 768 pixels. 3.2 Web Configurator Access Make sure your ZyWALL hardware is properly connected. See the Quick Start Guide. ZyWALL USG 2000 User’s Guide...
Page 52 Click Login. If you logged in using the default user name and password, the Update Admin Info screen (Figure 20 on page 52) appears. Otherwise, the dashboard (Figure 21 on page 53) appears. Figure 20 Update Admin Info Screen ZyWALL USG 2000 User’s Guide...
Page 53: Web Configurator Screens Overview
3.3 Web Configurator Screens Overview The Web Configurator screen is divided into these parts (as illustrated in Figure 21 on page 53): • A - title bar • B - navigation panel • C - main window ZyWALL USG 2000 User’s Guide...
Page 54: Title Bar
(CLI). See the CLI Reference Guide for details on the commands. Click this to open a popup window that displays the CLI commands sent by the Web Configurator. 3.3.1.1 About Click this to display basic information about the ZyWALL. Figure 23 About ZyWALL USG 2000 User’s Guide...
Page 55: Navigation Panel
The dashboard displays general device information, system status, system resource usage, licensed service status, and interface status in widgets that you can re-arrange to suit your needs. See Chapter 9 on page 211 for details on the dashboard. ZyWALL USG 2000 User’s Guide...
Page 56: Monitor Menu
Manage the ZyWALL’s URL cache. Anti-Spam Report Collect and display spam statistics. Status Displays how many mail sessions the ZyWALL is currently checking and DNSBL (Domain Name Service-based spam Black List) statistics. Lists log entries. ZyWALL USG 2000 User’s Guide...
Page 57: Configuration Menu
Configure zones used to define various policies. DDNS Profile Define and manage the ZyWALL’s DDNS domain names. Set up and manage port forwarding rules. HTTP Redirect Set up and manage HTTP redirection rules. Configure SIP, H.323, and FTP pass-through settings. ZyWALL USG 2000 User’s Guide...
Page 58: Apppatrol
Search for signatures by signature name or attributes and configure how the ZyWALL uses them. General Display and manage IDP bindings. Profile Create and manage IDP profiles. Custom Create, import, or export custom signatures. Signatures ZyWALL USG 2000 User’s Guide...
Page 59 RADIUS-Group Create and manage groups of RADIUS servers. Auth. Method Create and manage ways of authenticating users. Certificate My Certificates Create and manage the ZyWALL’s certificates. Trusted Import and manage certificates from trusted Certificates sources. ZyWALL USG 2000 User’s Guide...
Page 60 Log & Report Email Daily Configure where and how to send daily reports and Report what reports to send. Log Setting Configure settings for recording log messages, e- mailing them, and sending them to a remote server. ZyWALL USG 2000 User’s Guide...
Page 61: Main Window
Right after you log in, the Dashboard screen is displayed. See Chapter 9 on page for more information about the Dashboard screen. 3.3.3.1 Warning Messages Warning messages, such as those resulting from misconfiguration, display in a popup window. Figure 25 Warning Message ZyWALL USG 2000 User’s Guide...
Page 62 Refresh to show which configuration settings reference the object. The following example shows which configuration settings reference the ldap-users user object (in this case the first firewall rule). Figure 27 Object Reference ZyWALL USG 2000 User’s Guide...
Page 63: Tables And Lists
Click Clear to remove the currently displayed information. See the Command Reference Guide for information about the commands. 3.3.4 Tables and Lists The Web Configurator tables and lists are quite flexible and provide several options for how to display their entries. ZyWALL USG 2000 User’s Guide...
Page 64 • Select which columns to display • Group entries by field • Show entries in groups • Filter by mathematical operators (<, >, or =) or searching for text Figure 30 Common Table Column Options ZyWALL USG 2000 User’s Guide...
Page 65 Figure 32 Changing the Column Order Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time. Figure 33 Navigating Pages of Table Entries ZyWALL USG 2000 User’s Guide...
Page 66: Working With Table Entries
3.3.4.3 Working with Lists When a list of available entries displays next to a list of selected entries, you can often just double-click an entry to move it from one list to the other. In some lists ZyWALL USG 2000 User’s Guide...
Page 67 Chapter 3 Web Configurator you can also use the [Shift] or [Ctrl] key to select multiple entries, and then use the arrow button to move them to the other list. Figure 35 Working with Lists ZyWALL USG 2000 User’s Guide...
Page 68 Chapter 3 Web Configurator ZyWALL USG 2000 User’s Guide...
Page 69: Installation Setup Wizard
• Click the double arrow in the upper right corner to display or hide the help. • Click Go to Dashboard to skip the installation setup wizard or click Next to start configuring for Internet access. ZyWALL USG 2000 User’s Guide...
Page 70: Internet Access Setup - Wan Interface
Select Static if the ISP assigned a fixed IP address. 4.1.2 Internet Access: Ethernet This screen is read-only if you set the previous screen’s IP Address Assignment field to Auto. Use this screen to configure your IP address settings. ZyWALL USG 2000 User’s Guide...
Page 71 The ZyWALL uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. ZyWALL USG 2000 User’s Guide...
Page 72: Internet Access: Pppoe
[] and ?. This field can be blank. • Select Nailed-Up if you do not want the connection to time out. Otherwise, type the Idle Timeout in seconds that elapses before the router automatically disconnects from the PPPoE server. ZyWALL USG 2000 User’s Guide...
Page 73: Internet Access: Pptp
Note: Enter the Internet access information exactly as given to you by your ISP. Figure 40 Internet Access: PPTP Encapsulation 4.1.5 ISP Parameters • Authentication Type - Select an authentication protocol for outgoing calls. Options are: ZyWALL USG 2000 User’s Guide...
Page 74 The ZyWALL uses these (in the order you specify here) to resolve domain names for VPN, DDNS and the time server. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. ZyWALL USG 2000 User’s Guide...
Page 75: Internet Access Setup - Second Wan Interface
4.1.7 Internet Access - Finish You have set up your ZyWALL to access the Internet. After configuring the WAN interface(s), a screen displays with your settings. If they are not correct, click Back. Figure 42 Internet Access: Ethernet Encapsulation ZyWALL USG 2000 User’s Guide...
Page 76: Device Registration
Use the Registration > Service screen to update your service subscription status. Figure 43 Registration • Select new myZyXEL.com account if you haven’t created an account at myZyXEL.com, select this option and configure the following fields to create an account and register your ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 77 After the trial expires, you can buy an iCard and enter the license key in the Registration > Service screen to extend the service. Figure 44 Registration: Registered Device ZyWALL USG 2000 User’s Guide...
Page 78 Chapter 4 Installation Setup Wizard ZyWALL USG 2000 User’s Guide...
Page 79: Quick Setup
ISP account settings in the ZyWALL if you use PPPoE or PPTP. See Section 5.2 on page • VPN SETUP Use VPN SETUP to configure a VPN (Virtual Private Network) tunnel for a secure connection to another computer or network. See Section 5.4 on page ZyWALL USG 2000 User’s Guide...
Page 80: Wan Interface Quick Setup
Figure 47 Choose an Ethernet Interface 5.2.2 Select WAN Type WAN Type Selection: Select the type of encapsulation this connection is to use. Choose Ethernet when the WAN port is used as a regular Ethernet. ZyWALL USG 2000 User’s Guide...
Page 81: Configure Wan Settings
Use this screen to select to which zone the interface belongs and whether the interface should use a fixed or dynamic IP address. Figure 49 WAN Interface Setup: Step 2 • WAN Interface: This is the interface you are configuring for Internet access. • Zone: ZyWALL USG 2000 User’s Guide...
Page 82: Wan And Isp Connection Settings
Table 11 WAN and ISP Connection Settings LABEL DESCRIPTION ISP Parameter This section appears if the interface uses a PPPoE or PPTP Internet connection. Encapsulation This displays the type of Internet connection you are configuring. ZyWALL USG 2000 User’s Guide...
Page 83 This field displays to which security zone this interface and Internet connection will belong. IP Address This field is read-only when the WAN interface uses a dynamic IP address. If your WAN interface uses a static IP address, enter it in this field. ZyWALL USG 2000 User’s Guide...
Page 84: Quick Setup Interface Wizard: Summary
DESCRIPTION Encapsulation This displays what encapsulation this interface uses to connect to the Internet. Service Name This field only appears for a PPPoE interface. It displays the PPPoE service name specified in the ISP account. ZyWALL USG 2000 User’s Guide...
Page 85: Vpn Quick Setup
Wizard Welcome screen. The VPN wizard creates corresponding VPN connection and VPN gateway settings and address objects that you can use later in configuring more VPN connections or other features. Click Next. Figure 52 VPN Quick Setup Wizard ZyWALL USG 2000 User’s Guide...
Page 86: Vpn Setup Wizard: Wizard Type
ZyWALL using a pre-shared key and default security settings. Advanced: Use this wizard to configure detailed VPN security settings such as using certificates. The VPN connection can be to another ZLD-based ZyWALL or other IPSec device. ZyWALL USG 2000 User’s Guide...
Page 87: Vpn Express Wizard - Scenario
Only the clients can initiate the VPN tunnel. • Remote Access (Client Role) - Choose this to connect to an IPSec server. This ZyWALL is the client (dial-in user) and can initiate the VPN tunnel. ZyWALL USG 2000 User’s Guide...
Page 88: Vpn Express Wizard - Configuration
If this field is configurable, type the IP address of a computer behind the remote IPSec device. You can also specify a subnet. This must match the local IP address configured on the remote IPSec device. ZyWALL USG 2000 User’s Guide...
Page 89: Vpn Express Wizard - Summary
“.zysh” filename extension. Then you can use the file manager to run the script in order to configure the VPN connection. See the commands reference guide for details on the commands displayed in this list. ZyWALL USG 2000 User’s Guide...
Page 90: Vpn Express Wizard - Finish
Figure 57 VPN Express Wizard: Step 6 Note: If you have not already done so, use the myZyXEL.com link and register your ZyWALL with myZyXEL.com and activate trials of services like IDP. Click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 91: Vpn Advanced Wizard - Scenario
• Remote Access (Server Role) - Choose this to allow incoming connections from IPSec VPN clients. The clients have dynamic IP addresses and are also known as dial-in users. Only the clients can initiate the VPN tunnel. ZyWALL USG 2000 User’s Guide...
Page 92: Vpn Advanced Wizard - Phase 1 Settings
The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES ZyWALL USG 2000 User’s Guide...
Page 93 IPSec device. If it responds, the ZyWALL transmits the data. If it does not respond, the ZyWALL shuts down the IKE SA. • Authentication Method: Select Pre-Shared Key to use a password or Certificate to use one of the ZyWALL’s certificates. ZyWALL USG 2000 User’s Guide...
Page 94: Vpn Advanced Wizard - Phase 2
• Remote Policy (IP/Mask): Type the IP address of a computer behind the remote IPSec device. You can also specify a subnet. This must match the local IP address configured on the remote IPSec device. ZyWALL USG 2000 User’s Guide...
Page 95: Vpn Advanced Wizard - Summary
IPSec device that can use the tunnel. • Copy and paste the Configuration for Remote Gateway commands into another ZLD-based ZyWALL’s command line interface. • Click Save to save the VPN rule. ZyWALL USG 2000 User’s Guide...
Page 96: Vpn Advanced Wizard - Finish
Figure 62 VPN Wizard: Step 6: Advanced Note: If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. Click Close to exit the wizard. ZyWALL USG 2000 User’s Guide...
Page 97: Configuration Basics
You can create address objects based on an interface’s IP address, subnet, or gateway. The ZyWALL automatically updates every rule or setting that uses these ZyWALL USG 2000 User’s Guide...
Page 98: Zones, Interfaces, And Physical Ports
Port groups combine physical ports into interfaces. The physical port is where you connect a cable. In configuration, you Physical use physical ports when configuring port groups. You use interfaces Ethernet Ports and zones in configuring other features. (P1, P2, ...) ZyWALL USG 2000 User’s Guide...
Page 99: Interface Types
• The auxiliary interface, along with an external modem, provides an interface the ZyWALL can use to dial out. This interface can be used as a backup WAN interface, for example. The auxiliary interface controls the AUX port. ZyWALL USG 2000 User’s Guide...
Page 100: Default Interface And Zone Configuration
• The LAN zone contains the ge1 interface. The LAN zone is a protected zone. The ge1 interface uses 192.168.1.1. • The WAN zone contains the ge2 and ge3 interfaces (physical ports 2 and 3). They use public IP addresses to connect to the Internet. ZyWALL USG 2000 User’s Guide...
Page 101: Terminology In The Zywall
Table 18 Bandwidth Management: Differences Between the ZLD ZyWALL and ZyNOS ZYNOS FEATURE / SCREEN ZLD ZYWALL FEATURE / SCREEN Interface bandwidth management Interface (outbound) OSI level-7 bandwidth management Application patrol General bandwidth management Policy route ZyWALL USG 2000 User’s Guide...
Page 102: Packet Flow
• A policy route can be automatically disabled if the next-hop is dead. • You do not need to set up policy routes for IPSec traffic. • Policy routes can override direct routes. ZyWALL USG 2000 User’s Guide...
Page 103: Routing Table Checking Flow Enhancements
ZyWALL’s interfaces. You can override this and have the ZyWALL check the policy routes first by enabling the policy route feature’s Use Policy Route to Override Direct Route option (see Section 15.1 on page 353). ZyWALL USG 2000 User’s Guide...
Page 104: Nat Table Checking Flow
The following figure shows how the ZLD 2.20 firmware’s NAT table compares with the earlier 2.1x firmware’s NAT table.The checking flow is from top to bottom. As soon as the packets match an entry in one of the sections, the ZyWALL USG 2000 User’s Guide...
Page 105: Feature Configuration Overview
This section provides information about configuring the main features in the ZyWALL. The features are listed in the same sequence as the menu item(s) in the Web Configurator. Each feature description is organized as shown below. ZyWALL USG 2000 User’s Guide...
Page 106: Feature
MENU ITEM(S) Internet access to myZyXEL.com PREREQUISITES 6.5.3 Licensing Update Use these screens to update the ZyWALL’s signature packages for the anti-virus, IDP and application patrol, and system protect features. You must have a valid ZyWALL USG 2000 User’s Guide...
Page 107: Interface
Use policy routes to override the ZyWALL’s default routing behavior in order to send packets through the appropriate interface or VPN tunnel. You can also use policy routes for bandwidth management (out of the ZyWALL), port triggering, ZyWALL USG 2000 User’s Guide...
Page 108 FTP traffic. Note: The ZyWALL checks the policy routes in the order that they are listed. So make sure that your custom policy route comes before any other routes that would also match the FTP traffic. ZyWALL USG 2000 User’s Guide...
Page 109: Static Routes
Dynamic DNS maps a domain name to a dynamic IP address. The ZyWALL helps maintain this mapping. Configuration > Network > DDNS MENU ITEM(S) Interface PREREQUISITES 6.5.10 NAT Use Network Address Translation (NAT) to make computers on a private network behind the ZyWALL available outside the private network. ZyWALL USG 2000 User’s Guide...
Page 110: Http Redirect
Configuration > Network > HTTP Redirect MENU ITEM(S) Interfaces PREREQUISITES Example: Suppose you want HTTP requests from your LAN to go to a HTTP proxy server at IP address 192.168.3.80. Click Configuration > Network > HTTP Redirect. Add an entry. ZyWALL USG 2000 User’s Guide...
Page 111: Alg
By default, the firewall only allows management connections from the LAN, WAN zone. Configuration > Firewall MENU ITEM(S) Zones, schedules, users, user groups, addresses (source, destination), address groups (source, destination), services, service PREREQUISITES groups ZyWALL USG 2000 User’s Guide...
Page 112: Ipsec Vpn
Use SSL VPN to give remote users secure network access. Configuration > VPN > SSL VPN MENU ITEM(S) Interfaces, SSL application, users, user groups, addresses (network list, IP pool for assigning to clients, DNS and WINS server addresses), PREREQUISITES to-ZyWALL firewall, firewall ZyWALL USG 2000 User’s Guide...
Page 113: L2Tp Vpn
• Set the default policy’s access to Drop. • Add another policy. • Select the user account that you created for Bob. • You can leave the source, destination and log settings at the default. ZyWALL USG 2000 User’s Guide...
Page 114: Anti-Virus
Registration, addresses (source), schedules, users, user groups PREREQUISITES Example: You can configure a policy that blocks Bill’s access to arts and entertainment web pages during the workday. You must have already subscribed to the content filter service. ZyWALL USG 2000 User’s Guide...
Page 115: Anti-Spam
To increase network reliability, device HA lets a backup ZyWALL automatically take over if a master ZyWALL fails. Configuration > Device HA MENU ITEM(S) Interfaces (with a static IP address), to-ZyWALL firewall PREREQUISITES Example: See Chapter 7 on page 121. ZyWALL USG 2000 User’s Guide...
Page 116: Objects
Use these screens to configure the ZyWALL’s administrator and user accounts. The ZyWALL provides the following user types. Table 20 User Types TYPE ABILITIES admin Change ZyWALL configuration (web, CLI) limited-admin Look at ZyWALL configuration (web) user Access network services, browse user-mode commands (CLI) ZyWALL USG 2000 User’s Guide...
Page 117: System
(WWW, SSH, FTP, Vantage CNM), authentication methods (WWW) Example: Suppose you want to allow an administrator to use HTTPS to manage the ZyWALL from the WAN. Create an administrator account (Configuration > Object > User/Group). ZyWALL USG 2000 User’s Guide...
Page 118: Logs And Reports
It can also capture packets going through the ZyWALL’s interfaces so you can analyze them to identify network problems. Maintenance > Diagnostics MENU ITEM(S) 6.7.5 Shutdown Use this to shutdown the device in preparation for disconnecting the power. ZyWALL USG 2000 User’s Guide...
Page 119 Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the ZyWALL or remove the power. Not doing so can cause the firmware to become corrupt. Maintenance > Shutdown MENU ITEM(S) ZyWALL USG 2000 User’s Guide...
Page 120 Chapter 6 Configuration Basics ZyWALL USG 2000 User’s Guide...
Page 121: Tutorials
• DMZ servers are connected to ports P4 and P5 and need full wire speed communication with each other, so ports P4 and P5 are combined into a ge4 interface port group. It uses IP address 192.168.2.1. ZyWALL USG 2000 User’s Guide...
Page 122: Configure A Wan Ethernet Interface
Select Use Fixed IP Address and configure the IP addr ess, subnet mask, and default gateway settings and click OK. Figure 69 Configuration > Network > Interface > Ethernet > Edit ge2 7.1.2 Configure Zones Do the following to create a VPN zone. ZyWALL USG 2000 User’s Guide...
Page 123: Configure Port Grouping
Figure 70 Configuration > Network > Zone > WAN Edit 7.1.3 Configure Port Grouping Here is how to combine physical ports P4 and P5 into the ge4 interface port group. Click Configuration > Network > Interface > Port Grouping. ZyWALL USG 2000 User’s Guide...
Page 124: How To Configure A Cellular Interface
Make sure the 3G device’s SIM card is installed. Install the 3G device in the ZyWALL’s PCIMCIA slot or connect it to one of the ZyWALL’s USB ports. ZyWALL USG 2000 User’s Guide...
Page 125 Leaving Zone set to none has the ZyWALL not apply any security settings to the 3G connection. Enter the PIN Code provided by the cellular 3G service provider (0000 in this example). Figure 74 Configuration > Network > Interface > Cellular > Edit ZyWALL USG 2000 User’s Guide...
Page 126: How To Configure Load Balancing
Kbps (ge3) respectively. As these connections have different bandwidth, use the Weighted Round Robin algorithm to send traffic to wan1 and wan2 in a 2:1 ratio. Figure 76 Trunk Example ge2: 1 Mbps ge3: 512 Kbps ZyWALL USG 2000 User’s Guide...
Page 127: Set Up Available Bandwidth On Ethernet Interfaces
Enter the available bandwidth (1000 kbps) in the Egress Bandwidth field. Click OK. Figure 77 Configuration > Network > Interface > Ethernet > Edit (ge2) Repeat the process to set the egress bandwidth for ge3 to (512 Kbps). ZyWALL USG 2000 User’s Guide...
Page 128: Configure The Wan Trunk
Name the trunk and set the Load Balancing Algorithm field to Weighted Round Robin. Add ge2 and enter 2 in the Weight column. Add ge3 and enter 1 in the Weight column. Click OK. Figure 78 Configuration > Network > Interface > Trunk > Add ZyWALL USG 2000 User’s Guide...
Page 129: How To Set Up An Ipsec Vpn Tunnel
This example shows how to use the IPSec VPN configuration screens to create the following VPN tunnel, see Section 5.4 on page 86 for details on the VPN quick setup wizard. Figure 80 VPN Example 2.2.2.2 1.2.3.4 192.168.1.0/24 172.16.1.0/24 ZyWALL USG 2000 User’s Guide...
Page 130: Set Up The Vpn Gateway
Interface and ge2. For the Peer Gateway Address, select Static Address and enter 2.2.2.2 in the Primary field. For the Authentication, Select Pre-Shared Key and enter 12345678. Click OK. Figure 81 Configuration > VPN > IPSec VPN > VPN Gateway > Add ZyWALL USG 2000 User’s Guide...
Page 131: Set Up The Vpn Connection
Address Type to SUBNET. Set up the Network field to 172.16.1.0 and the Netmask to 255.255.255.0. Click OK. Figure 82 Configuration > Object > Address > Add Click Configuration > VPN > IPSec VPN > VPN Connection. Click the Add icon. ZyWALL USG 2000 User’s Guide...
Page 132: Configure Security Policies For The Vpn Tunnel
VPN connection. Make sure all firewalls between the ZyWALL and remote IPSec router allow UDP port 500 (IKE) and IP protocol 50 (AH) or 51 (ESP). If you enable NAT traversal, all firewalls between the ZyWALL and remote IPSec router should also allow UDP port 4500. ZyWALL USG 2000 User’s Guide...
Page 133: How To Configure A Hub-And-Spoke Ipsec Vpn Without A Vpn Concentrator
Gateway Policy (Phase 1) • My Address: 10.0.0.2 • Primary Remote Gateway: 10.0.0.1 Network Policy (Phase 2) • Local Network: 192.168.167.0/255.255.255.0 • Remote Network: 192.168.168.0~192.168.169.255 Headquarters (USG ZyWALL or ZyWALL 1050): VPN Gateway (VPN Tunnel 1): ZyWALL USG 2000 User’s Guide...
Page 134 • The hub router must have at least one separate VPN rule for each spoke. In the local policy, specify the IP addresses of the hub-and-spoke networks with which the spoke is to be able to have a VPN tunnel. This may require you to use more than one VPN rule. ZyWALL USG 2000 User’s Guide...
Page 135: How To Configure User-Aware Access Control
First, set up the user accounts and user groups in the ZyWALL. Then, set up user authentication using the RADIUS server. Finally, set up the policies in the table above. The ZyWALL has its default settings. ZyWALL USG 2000 User’s Guide...
Page 136: Set Up User Accounts
Repeat this process to set up the remaining user accounts. 7.6.2 Set Up User Groups Set up the user groups and assign the users to the user groups. Click Configuration > Object > User/Group > Group. Click the Add icon. ZyWALL USG 2000 User’s Guide...
Page 137: Set Up User Authentication Using The Radius Server
RADIUS server. Then, set up the authentication method, and configure the ZyWALL to use the authentication method. Finally, force users to log in to the ZyWALL before it routes traffic for them. ZyWALL USG 2000 User’s Guide...
Page 138 Set up a default policy that forces every user to log in to the ZyWALL before the ZyWALL routes traffic for them. Select Enable. Set the Authentication field to required, and make sure Force User Authentication is selected. Keep the rest of the default settings, and click OK. ZyWALL USG 2000 User’s Guide...
Page 139: Web Surfing Policies With Bandwidth Restrictions
Use application patrol (AppPatrol) to enforce the web surfing and MSN policies. You must have already subscribed for the application patrol service. You can subscribe using the Configuration > Licensing > Registration screens or using one of the wizards. ZyWALL USG 2000 User’s Guide...
Page 140 Click Configuration > AppPatrol. If application patrol and bandwidth management are not enabled, enable them, and click Apply. Figure 90 Configuration > AppPatrol > General Click the Common tab and double-click the http entry. Figure 91 Configuration > AppPatrol > Common ZyWALL USG 2000 User’s Guide...
Page 141 Figure 92 Configuration > AppPatrol > Common > http Change the access to Drop because you do not want anyone except authorized user groups to browse the web. Click OK. Figure 93 Configuration > AppPatrol > Common > http > Edit Default ZyWALL USG 2000 User’s Guide...
Page 142: Set Up Msn Policies
7.6.5 Set Up MSN Policies Set up a recurring schedule object first because Sales can only use MSN during specified times on specified days. Click Configuration > Object > Schedule. Click the Add icon for recurring schedules. ZyWALL USG 2000 User’s Guide...
Page 143: Set Up Firewall Rules
Click Configuration > Firewall > Add. Set the From field as LAN and the To field as DMZ. Set the Access field to deny, and click OK. Figure 96 Configuration > Firewall > LAN to DMZ > Add ZyWALL USG 2000 User’s Guide...
Page 144: How To Use A Radius Server To Authenticate User Accounts Based On Groups
RADIUS server authenticate groups of user accounts defined in the RADIUS server. ZyWALL USG 2000 User’s Guide...
Page 145 Class. This attribute’s value is called a group identifier; it determines to which group a user belongs. In this example the values are Finance, Engineer, Sales, and Boss. Figure 98 Configuration > Object > AAA Server > RADIUS > Add ZyWALL USG 2000 User’s Guide...
Page 146: How To Use Endpoint Security And Authentication Policies
Click Configuration > Object > Endpoint Security > Add to open the Endpoint Security Edit screen. • Select Endpoint must comply with all checking items. • Set the Endpoint Operating System to Windows and the Window Version to Windows 7. ZyWALL USG 2000 User’s Guide...
Page 147 • Select Endpoint must have Anti-Virus software installed and move the Kaspersky Internet Security and Kaspersky Anti-Virus anti-virus software entries to the allowed list. The following figure shows the configuration screen example. Figure 100 Configuration > Object > Endpoint Security > Add ZyWALL USG 2000 User’s Guide...
Page 148: Configure The Authentication Policy
ZyWALL’s login screen. • Enable EPS checking and move the EPS objects you created to the selected list. • Click OK. Figure 101 Configuration > Auth. Policy > Add ZyWALL USG 2000 User’s Guide...
Page 149: How To Configure Service Control
Figure 103 Example: Endpoint Security Error Message 7.9 How to Configure Service Control Service control lets you configure rules that control HTTP and HTTPS management access (to the Web Configurator) and separate rules that control HTTP and HTTPS ZyWALL USG 2000 User’s Guide...
Page 150: Allow Https Administrator Access Only From The Lan
In HTTPS Admin Service Control, click the Add icon. Figure 104 Configuration > System > WWW In the Zone field select LAN and click OK. Figure 105 Configuration > System > WWW > Service Control Rule Edit ZyWALL USG 2000 User’s Guide...
Page 151 Figure 106 Configuration > System > WWW (First Example Admin Service Rule Configured) In the Zone field select ALL and set the Action to Deny. Click OK. Figure 107 Configuration > System > WWW > Service Control Rule Edit ZyWALL USG 2000 User’s Guide...
Page 152: How To Allow Incoming H.323 Peer-To-Peer Calls
Suppose you have a H.323 device on the LAN for VoIP calls and you want it to be able to receive peer-to-peer calls from the WAN. Here is an example of how to configure NAT and the firewall to have the ZyWALL forward H.323 traffic destined ZyWALL USG 2000 User’s Guide...
Page 153: Turn On The Alg
7.10.2 Set Up a NAT Policy For H.323 In this example, you need a NAT policy to forward H.323 (TCP port 1720) traffic received on the ZyWALL’s 10.0.0.8 WAN IP address to LAN IP address 192.168.1.56. ZyWALL USG 2000 User’s Guide...
Page 154 Use Configuration > Object > Address > Add to create an address object for the public WAN IP address (called WAN_IP-for-H323 here). Then use it again to create an address object for the H.323 device’s private LAN IP address (called LAN_H323 here). Figure 111 Create Address Objects ZyWALL USG 2000 User’s Guide...
Page 155: Set Up A Firewall Rule For H.323
The default firewall rule for WAN-to-LAN traffic drops all traffic. Here is how to configure a firewall rule to allow H.323 (TCP port 1720) traffic received on the WAN_IP-for-H323 IP address to go to LAN IP address 192.168.1.56. ZyWALL USG 2000 User’s Guide...
Page 156: How To Allow Public Access To A Web Server
Internet (the WAN zone). In this example you have public IP address 1.1.1.1 that you will use on the ge3 interface and map to the HTTP server’s private IP address of 192.168.3.7. Figure 114 Public Server Example Network Topology 192.168.3.7 1.1.1.1 ZyWALL USG 2000 User’s Guide...
Page 157: Create The Address Objects
• HTTP traffic and the HTTP server in this example both use TCP port 80. So you set the Port Mapping Type to Port, the Protocol Type to TCP, and the original and mapped ports to 80. ZyWALL USG 2000 User’s Guide...
Page 158: Set Up A Firewall Rule
HTTP traffic to IP address 1.1.1.1 in order to access the HTTP server. If a domain name is registered for IP address 1.1.1.1, users can just go to the domain name to access the web server. ZyWALL USG 2000 User’s Guide...
Page 159: How To Use An Ippbx On The Dmz
7.12 How to Use an IPPBX on the DMZ This is an example of making an IPPBX x6004 using SIP in the DMZ zone accessible from the Internet (the WAN zone). In this example you have public IP ZyWALL USG 2000 User’s Guide...
Page 160 Chapter 7 Tutorials address 1.1.1.2 that you will use on the ge3 interface and map to the IPPBX’s private IP address of 192.168.3.7. The local SIP clients are on the LAN. Figure 119 IPPBX Example Network Topology ZyWALL USG 2000 User’s Guide...
Page 161: Turn On The Alg
Use Configuration > Object > Address > Add to create the address objects. Create a host address object named IPPBX-DMZ for the IPPBX’s private DMZ IP address of 192.168.3.9. Figure 121 Creating the Address Object for the IPPBX’s Private IP Address ZyWALL USG 2000 User’s Guide...
Page 162: Setup A Nat Policy For The Ippbx
• Set the Port Mapping Type to Port, the Protocol Type to UDP and the original and mapped ports to 5060. • Keep Enable NAT Loopback selected to allow the LAN users to use the IPPBX (see NAT Loopback on page 399 for details). ZyWALL USG 2000 User’s Guide...
Page 163: Set Up A Wan To Dmz Firewall Rule For Sip
SIP traffic to the IPPBX. If a domain name is registered for IP address 1.1.1.2, users can use it to connect to for making SIP calls. ZyWALL USG 2000 User’s Guide...
Page 164: Set Up A Dmz To Lan Firewall Rule For Sip
The firewall blocks traffic from the DMZ zone to the LAN zone by default so you need to create a firewall rule to allow the IPPBX to send SIP traffic to the SIP clients on the LAN. ZyWALL USG 2000 User’s Guide...
Page 165: How To Use Multiple Static Public Wan Ip Addresses For Lan To Wan Traffic
Click Configuration > Object > Address > Add to create the address object that represents the range of static public IP addresses. In this example you name it Public-IPs and it goes from 1.1.1.10 to 1.1.1.17. Figure 126 Creating the Public IP Address Range Object ZyWALL USG 2000 User’s Guide...
Page 166: Configure The Policy Route
Here is an example of using device HA (High Availability) to backup ZyWALL A (the master) with ZyWALL B. ZyWALL B automatically takes over all of A’s functions if A fails or loses its ge1 or ge2 connection. ZyWALL USG 2000 User’s Guide...
Page 167: Before You Start
170). To avoid an IP address conflict, do not connect ZyWALL B to the LAN subnet until after you configure its device HA settings and the instructions tell you to deploy it (in Section 7.14.4 on page 172). ZyWALL USG 2000 User’s Guide...
Page 168: Configure Device Ha On The Master Zywall
Passive Mode. Double-click ge1’s entry. Configure 192.168.1.3 as the Management IP and 255.255.255.0 as the Manage IP Subnet Mask. Click OK. Figure 130 Configuration > Device HA > Active-Passive Mode > Edit: Master ZyWALL Example ZyWALL USG 2000 User’s Guide...
Page 169 (“mySyncPassword” in this example) and click Apply. Figure 131 Configuration > Device HA > Active-Passive Mode: Master ZyWALL Example Click the General tab. Turn on device HA and click Apply. Figure 132 Configuration > Device HA > General: Master ZyWALL Example ZyWALL USG 2000 User’s Guide...
Page 170: Configure The Backup Zywall
In ZyWALL B click Configuration > Device HA > Active-Passive Mode. Click ge1’s Edit icon. Configure 192.168.1.5 as the Management IP and 255.255.255.0 as the Subnet Mask. Click OK. Figure 133 Configuration > Device HA > Active-Passive Mode > Edit: Backup ZyWALL Example ZyWALL USG 2000 User’s Guide...
Page 171 Interval to 60. Click Apply. Figure 134 Configuration > Device HA > Active-Passive Mode: Backup ZyWALL Example Click the General tab. Turn on device HA and click Apply. Figure 135 Configuration > Device HA > General: Master ZyWALL Example ZyWALL USG 2000 User’s Guide...
Page 172: Deploy The Backup Zywall
ZyWALL’s other local networks. For example, enable device HA monitoring on the DMZ interfaces and use an Ethernet switch to connect both ZyWALLs’ DMZ interfaces to your publicly available servers. ZyWALL USG 2000 User’s Guide...
Page 173: L2Tp Vpn Example
192.168.1.x subnet. 8.2 Configuring the Default L2TP VPN Gateway Example Click Configuration > VPN > Network > IPSec VPN > VPN Gateway to open the screen that lists the VPN gateways. Double-click the Default_L2TP_VPN_GW entry. ZyWALL USG 2000 User’s Guide...
Page 174 Figure 137 Configuration > VPN > IPSec VPN > VPN Gateway > Edit Select the Default_L2TP_VPN_GW entry and click Activate and click Apply to turn on the entry. Figure 138 Configuration > VPN > IPSec VPN > VPN Gateway (Enable) ZyWALL USG 2000 User’s Guide...
Page 175: Configuring The Default L2Tp Vpn Connection Example
L2TP_IFACE. • Set the Application Scenario to Remote Access (Server Role). • Set the Local Policy to use L2TP_IFACE. • Click OK. Figure 139 Configuration > VPN > IPSec VPN > VPN Connection > Edit ZyWALL USG 2000 User’s Guide...
Page 176: Configuring The L2Tp Vpn Settings Example
• This example uses the default authentication method (the ZyWALL’s local user data base). • Select a user or group of users that can use the tunnel. Here a user account named L2TP-test has been created. ZyWALL USG 2000 User’s Guide...
Page 177: Configuring L2Tp Vpn In Windows Vista, Xp, Or 2000
• For Windows 2000, use net start "ipsec policy agent". 8.5.1 Configuring L2TP in Windows Vista In Windows Vista do the following to establish an L2TP VPN connection. Click Start > Network > Network and Sharing Center > Set up a connection or network. ZyWALL USG 2000 User’s Guide...
Page 178 Select Connect to a workplace and click Next. Figure 142 Set up a connection or network: Chose a connection type Select Use my Internet connection (VPN). Figure 143 Connect to a workplace: How do you want to connect? ZyWALL USG 2000 User’s Guide...
Page 179 Figure 144 Connect to a workplace: Type the Internet address to connect to Enter the user name and password of a user account that can use the L2TP VPN connection and click Next. Figure 145 Connect to a workplace: Type your user name and password ZyWALL USG 2000 User’s Guide...
Page 180 Figure 146 Connect to a workplace: The connection is ready to use In the Network and Sharing Center screen, click Connect to a network. Right-click the L2TP VPN connection and select Properties. Figure 147 Connect L2TP to ZyWALL ZyWALL USG 2000 User’s Guide...
Page 181 Figure 149 Connect ZyWALL L2TP: Security > Advanced 10 Click Yes. When you use L2TP VPN to connect to the ZyWALL, the ZyWALL establishes an encrypted IPSec VPN tunnel first and then builds an L2TP tunnel ZyWALL USG 2000 User’s Guide...
Page 182 VPN gateway configuration that the ZyWALL is using for L2TP VPN (top-secret in this example). Click OK to close the IPSec Settings window and then click OK again to close the Properties window. Figure 152 L2TP to ZyWALL Properties > Networking > IPSec Settings ZyWALL USG 2000 User’s Guide...
Page 183 13 Select the L2TP VPN connection and click Connect. Figure 153 L2TP to ZyWALL Properties: Networking 14 Enter the user name and password of your ZyWALL user account. Click Connect. Figure 154 Connect L2TP to ZyWALL ZyWALL USG 2000 User’s Guide...
Page 184 16 If a window appears asking you to select a location for the network, you can select Work if you want your computer to be discoverable by computers behind the ZyWALL. Figure 156 Set Network Location ZyWALL USG 2000 User’s Guide...
Page 185 Figure 157 Set Network Location Successful 18 After the connection is up a connection icon displays in your system tray. Click it and then the L2TP connection to open a status screen. Figure 158 Connection System Tray Icon ZyWALL USG 2000 User’s Guide...
Page 186 20 Click Details to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20). Figure 160 ZyWALL-L2TP Status: Details 21 Access a server or other network resource behind the ZyWALL to make sure your access works. ZyWALL USG 2000 User’s Guide...
Page 187: Configuring L2Tp In Windows Xp
Click Next in the Welcome screen. Select Connect to the network at my workplace and click Next. Figure 161 New Connection Wizard: Network Connection Type Select Virtual Private Network connection and click Next. Figure 162 New Connection Wizard: Network Connection ZyWALL USG 2000 User’s Guide...
Page 188 Chapter 8 L2TP VPN Example Type L2TP to ZyWALL as the Company Name. Figure 163 New Connection Wizard: Connection Name Select Do not dial the initial connection and click Next. Figure 164 New Connection Wizard: Public Network ZyWALL USG 2000 User’s Guide...
Page 189 VPN gateway configuration that the ZyWALL is using for L2TP VPN (172.16.1.2 in this example). Figure 165 New Connection Wizard: VPN Server Selection 172.16.1.2 Click Finish. The Connect L2TP to ZyWALL screen appears. Click Properties > Security. Figure 166 Connect L2TP to ZyWALL ZyWALL USG 2000 User’s Guide...
Page 190 11 Select Optional encryption (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Figure 168 Connect ZyWALL L2TP: Security > Advanced ZyWALL USG 2000 User’s Guide...
Page 191 13 Select the Use pre-shared key for authentication check box and enter the pre- shared key used in the VPN gateway configuration that the ZyWALL is using for L2TP VPN. Click OK. Figure 170 L2TP to ZyWALL Properties > Security > IPSec Settings ZyWALL USG 2000 User’s Guide...
Page 192 Figure 172 Connect L2TP to ZyWALL 16 A window appears while the user name and password are verified. 17 A ZyWALL-L2TP icon displays in your system tray. Double-click it to open a status screen. Figure 173 ZyWALL-L2TP System Tray Icon ZyWALL USG 2000 User’s Guide...
Page 193: Configuring L2Tp In Windows 2000
Click Start > Run. Type regedit and click OK. Figure 175 Starting the Registry Editor Click Registry > Export Registry File and save a backup copy of your registry. You can go back to using this backup if you misconfigure the registry settings. ZyWALL USG 2000 User’s Guide...
Page 194 Right-click Parameters and select New > DWORD Value. Figure 177 New DWORD Value Enter ProhibitIpSec as the name. And make sure the Data displays as 0’s. Figure 178 ProhibitIpSec DWORD Value Restart the computer and continue with the next section. ZyWALL USG 2000 User’s Guide...
Page 195 IPSec policy for the computer to use. Click Start > Run. Type mmc and click OK. Figure 179 Run mmc Click Console > Add/Remove Snap-in. Figure 180 Console > Add/Remove Snap-in ZyWALL USG 2000 User’s Guide...
Page 196 Figure 181 Add > IP Security Policy Management > Finish Right-click IP Security Policies on Local Machine and click Create IP Security Policy. Click Next in the welcome screen. Figure 182 Create IP Security Policy ZyWALL USG 2000 User’s Guide...
Page 197 Name the IP security policy L2TP to ZyWALL, and click Next. Figure 183 IP Security Policy: Name Clear the Activate the default response rule check box and click Next. Figure 184 IP Security Policy: Request for Secure Communication ZyWALL USG 2000 User’s Guide...
Page 198 Leave the Edit Properties check box selected and click Finish. Figure 185 IP Security Policy: Completing the IP Security Policy Wizard In the properties dialog box, click Add > Next. Figure 186 IP Security Policy Properties > Add ZyWALL USG 2000 User’s Guide...
Page 199 Select This rule does not specify a tunnel and click Next. Figure 187 IP Security Policy Properties: Tunnel Endpoint 10 Select All network connections and click Next. Figure 188 IP Security Policy Properties: Network Type ZyWALL USG 2000 User’s Guide...
Page 200 11 Select Use this string to protect the key exchange (preshared key), type password in the text box, and click Next. Figure 189 IP Security Policy Properties: Authentication Method 12 Click Add. Figure 190 IP Security Policy Properties: IP Filter List ZyWALL USG 2000 User’s Guide...
Page 201 (172.16.1.2 in this example) in the IP Address field. Make certain the Mirrored. Also match packets with the exact opposite source and destination addresses check box is selected and click Apply. Figure 192 Filter Properties: Addressing . 16 ZyWALL USG 2000 User’s Guide...
Page 202 UDP from port 1701. Select To any port. Click Apply, OK, and then Close. Figure 193 Filter Properties: Protocol 16 Select ZyWALL WAN_IP and click Next. Figure 194 IP Security Policy Properties: IP Filter List ZyWALL USG 2000 User’s Guide...
Page 203 18 In the Console window, right-click L2TP to ZyWALL and select Assign. Figure 196 Console: L2TP to ZyWALL Assign 8.5.3.3 Configure the Windows 2000 Network Connection After you have configured the IPSec policy, use these directions to create a network connection. ZyWALL USG 2000 User’s Guide...
Page 204 Enter the domain name or WAN IP address configured as the My Address in the VPN gateway configuration that the ZyWALL is using for L2TP VPN. Click Next. Figure 199 New Connection Wizard: Destination Address 172.16.1.2 ZyWALL USG 2000 User’s Guide...
Page 205 Select For all users and click Next. Figure 200 New Connection Wizard: Connection Availability Name the connection L2TP to ZyWALL and click Finish. Figure 201 New Connection Wizard: Naming the Connection Click Properties. Figure 202 Connect L2TP to ZyWALL ZyWALL USG 2000 User’s Guide...
Page 206 Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Click Yes if a screen pops up. Figure 204 Connect L2TP to ZyWALL: Security > Advanced ZyWALL USG 2000 User’s Guide...
Page 207 Figure 206 Connect L2TP to ZyWALL 11 A ZyWALL-L2TP icon displays in your system tray. Double-click it to open a status screen. Figure 207 ZyWALL-L2TP System Tray Icon ZyWALL USG 2000 User’s Guide...
Page 208 12 Click Details and scroll down to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20). Figure 208 L2TP to ZyWALL Status: Details 13 Access a server or other network resource behind the ZyWALL to make sure your access works. ZyWALL USG 2000 User’s Guide...
Page 209: Technical Reference
Technical Reference...
Page 211: Dashboard
9.2 The Dashboard Screen The Dashboard screen displays when you log into the ZyWALL or click Dashboard in the navigation panel. The dashboard displays general device information, system status, system resource usage, licensed service status, and ZyWALL USG 2000 User’s Guide...
Page 212 Front Panel Click this to view details about the status of the ZyWALL’s front panel LEDs and connections. See Section 1.3.3 on page 39 for LED descriptions. An unconnected interface or slot appears grayed out. ZyWALL USG 2000 User’s Guide...
Page 213 If the interface is a member of an active virtual router, this field displays the IP address it is currently using. This is either the static IP address of the interface (if it is the master) or the management IP address (if it is a backup). ZyWALL USG 2000 User’s Guide...
Page 214: System Uptime
This field displays the number of users currently logged in to the Login Users ZyWALL. Click the icon to pop-open a list of the users who are currently logged in to the ZyWALL. See Section 9.2.6 on page 223. ZyWALL USG 2000 User’s Guide...
Page 215 Click the Detail icon to go to the Session Monitor screen to see details about the active sessions. Click the Show Active Sessions icon to display a chart of ZyWALL’s recent session usage. ZyWALL USG 2000 User’s Guide...
Page 216 Fault - This VRRP group is not functioning in the virtual router right now. For example, this might happen if the interface is down. n/a - Device HA is not active on the interface. Zone This field displays the zone to which the interface is currently assigned. ZyWALL USG 2000 User’s Guide...
Page 217 If this status still displays, contact your vendor. Ready - A USB storage device connected to the ZyWALL is ready for the ZyWALL to use. Unused - The ZyWALL is unable to mount a USB storage device connected to the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 218 The signature name identifies a specific intrusion pattern. Name Type This column displays when you display the entries by Signature Name. It shows the categories of intrusions. See Table 156 on page 580 more information. ZyWALL USG 2000 User’s Guide...
Page 219: The Cpu Usage Screen
The x-axis shows the time period over which the CPU usage occurred Refresh Enter how often you want this window to be automatically updated. Interval Refresh Click this to update the information in the window right away. ZyWALL USG 2000 User’s Guide...
Page 220: The Memory Usage Screen
The x-axis shows the time period over which the RAM usage occurred Refresh Enter how often you want this window to be automatically updated. Interval Refresh Click this to update the information in the window right away. ZyWALL USG 2000 User’s Guide...
Page 221: The Session Usage Screen
The x-axis shows the time period over which the session usage occurred Refresh Enter how often you want this window to be automatically updated. Interval Refresh Click this to update the information in the window right away. ZyWALL USG 2000 User’s Guide...
Page 222: The Vpn Status Screen
Use this screen to look at the IP addresses currently assigned to DHCP clients and the IP addresses reserved for specific MAC addresses. To access this screen, click the icon beside DHCP Table in the dashboard. Figure 214 Dashboard > DHCP Table ZyWALL USG 2000 User’s Guide...
Page 223: The Number Of Login Users Screen
Use this screen to look at a list of the users currently logged into the ZyWALL. To access this screen, click the dashboard’s Number of Login Users icon. Figure 215 Dashboard > Number of Login Users ZyWALL USG 2000 User’s Guide...
Page 224 This field displays the way the user logged in to the ZyWALL. IP address This field displays the IP address of the computer used to log in to the ZyWALL. Force Logout Click this icon to end a user’s session. ZyWALL USG 2000 User’s Guide...
Page 225: Monitor
Section 10.11 on page 244) to see a bandwidth usage graph and statistics for each protocol. • Use the VPN Monitor > IPSec screen (Section 10.12 on page 249) to display and manage active IPSec SAs. ZyWALL USG 2000 User’s Guide...
Page 226: The Port Statistics Screen
10.2 The Port Statistics Screen Use this screen to look at packet statistics for each Gigabit Ethernet port. To access this screen, click Monitor > System Status > Port Statistics. Figure 216 Monitor > System Status > Port Statistics ZyWALL USG 2000 User’s Guide...
Page 227 Up Time This field displays how long the physical port has been connected. System Up This field displays how long the ZyWALL has been running since it last Time restarted or was turned on. ZyWALL USG 2000 User’s Guide...
Page 228: The Port Statistics Graph Screen
This line represents traffic transmitted from the ZyWALL on the physical port since it was last connected. This line represents the traffic received by the ZyWALL on the physical port since it was last connected. ZyWALL USG 2000 User’s Guide...
Page 229: Interface Status Screen
This screen lists all of the ZyWALL’s interfaces and gives packet statistics for them. Click Monitor > System Status > Interface Status to access this screen. Figure 218 Monitor > System Status > Interface Status ZyWALL USG 2000 User’s Guide...
Page 230 VLAN or bridge interface is disabled, it does not appear in the list. For PPP interfaces: Connected - The PPP interface is connected. Disconnected - The PPP interface is not connected. If the PPP interface is disabled, it does not appear in the list. ZyWALL USG 2000 User’s Guide...
Page 231 Speed / Duplex - The interface is connected. This field displays the port speed and duplex setting (Full or Half). This field displays Connected and the accumulated connection time (hh:mm:ss) when the PPP interface is connected. ZyWALL USG 2000 User’s Guide...
Page 232: The Traffic Statistics Screen
• Most-used protocols or service ports and the amount of traffic on each one • LAN IP with heaviest traffic and how much traffic has been sent to and from each one ZyWALL USG 2000 User’s Guide...
Page 233 The progress is not tracked here real-time, but you can click the Refresh button to update it. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. Statistics ZyWALL USG 2000 User’s Guide...
Page 234 This field indicates whether the indicated protocol or service port is sending or receiving traffic. Ingress - traffic is coming into the router through the interface Egress - traffic is going out from the router through the interface ZyWALL USG 2000 User’s Guide...
Page 235: The Session Monitor Screen
It is not possible to manage sessions in this screen. The following information is displayed. • User who started the session • Protocol or service port used • Source address • Destination address • Number of bytes received (so far) ZyWALL USG 2000 User’s Guide...
Page 236 The User, Service, Source Address, and Destination Address fields display if you view all sessions. Select your desired filter criteria and click the Search button to filter the list of sessions. ZyWALL USG 2000 User’s Guide...
Page 237 This field displays the amount of information received by the source in the active session. This field displays the amount of information transmitted by the source in the active session. Duration This field displays the length of the active session in seconds. ZyWALL USG 2000 User’s Guide...
Page 238: The Ddns Status Screen
IP/MAC Binding to open the IP/MAC Binding Monitor > System Status > Monitor screen. This screen lists the devices that have received an IP address from ZyWALL interfaces with IP/MAC binding enabled and have ever established a ZyWALL USG 2000 User’s Guide...
Page 239 This field displays the MAC address to which the IP address is currently assigned. Last Access This is when the device last established a session with the ZyWALL through this interface. Refresh Click this button to update the information in the screen. ZyWALL USG 2000 User’s Guide...
Page 240: The Login Users Screen
This field displays the IP address of the computer used to log in to the ZyWALL. Force Logout Click this icon to end a user’s session. Refresh Click this button to update the information in the screen. ZyWALL USG 2000 User’s Guide...
Page 241: Cellular Status Screen
This field is a sequential value, and it is not associated with any interface. Extension Slot This field displays where the entry’s cellular card is located. Connected This field displays the model name of the cellular card. Device ZyWALL USG 2000 User’s Guide...
Page 242 The network type varies depending on the 3G card you inserted and could be UMTS, UMTS/HSDPA, GPRS or EDGE when you insert a GSM 3G card, or 1xRTT, EVDO Rev.0 or EVDO Rev.A when you insert a CDMA 3G card. ZyWALL USG 2000 User’s Guide...
Page 243: Usb Storage Screen
ZyWALL, such as NTFS. Filesystem This field displays what file system the USB storage device is formatted with. Speed This field displays the connection speed the USB storage device supports. ZyWALL USG 2000 User’s Guide...
Page 244: Application Patrol Statistics
- the USB device is operating normally or not connected. 10.11 Application Patrol Statistics This screen displays a bandwidth usage graph and statistics for selected protocols. Click Monitor > AppPatrol Statistics to open the following screen. ZyWALL USG 2000 User’s Guide...
Page 245: Application Patrol Statistics: General Setup
Select the protocols for which to display statistics. Protocols Select All selects all of the protocols. Clear All clears all of the protocols. Click Expand to display individual protocols. Collapse hides them. Statistics for the selected protocols display after you click Apply. ZyWALL USG 2000 User’s Guide...
Page 246: Application Patrol Statistics: Bandwidth Statistics
ZyWALL sends to the initiator of the connection. • A dotted line represents a protocol’s outgoing bandwidth usage. This is the protocol’s traffic that the ZyWALL sends out from the initiator of the connection. • Different colors represent different protocols. ZyWALL USG 2000 User’s Guide...
Page 247: Application Patrol Statistics: Protocol Statistics
This is how much of the application’s traffic the ZyWALL identified by Connection examining the IP payload. Matched This is how much of the application’s traffic the ZyWALL identified by Service Ports examining OSI level-3 information such as IP addresses and port Connection numbers. ZyWALL USG 2000 User’s Guide...
Page 248: Application Patrol Statistics: Individual Protocol Statistics By Rule
The bottom of the Monitor > AppPatrol Statistics screen displays statistics for each of the selected protocols. Click a service’s name to display this screen with statistics for each of the service’s application patrol rules. Figure 229 Monitor > AppPatrol Statistics > Service ZyWALL USG 2000 User’s Guide...
Page 249: The Ipsec Monitor Screen
Click Cancel to close this screen. 10.12 The IPSec Monitor Screen You can use the IPSec Monitor screen to display and to manage active IPSec SAs. To access this screen, click Monitor > VPN Monitor > IPSec. The following ZyWALL USG 2000 User’s Guide...
Page 250 Type a page number to go to or use the arrows to navigate the pages of entries. This field is a sequential value, and it is not associated with a specific Name This field displays the name of the IPSec SA. ZyWALL USG 2000 User’s Guide...
Page 251: Regular Expressions In Searching Ipsec Sas
“abc” and ending in “123” matches, no matter how many characters are in between. The whole VPN connection or policy name has to match if you do not use a question mark or asterisk. ZyWALL USG 2000 User’s Guide...
Page 252: The Ssl Connection Monitor Screen
This field displays the number of bytes received by the ZyWALL on this (Bytes) connection. Outbound This field displays the number of bytes transmitted by the ZyWALL on (Bytes) this connection. Refresh Click Refresh to update this screen. ZyWALL USG 2000 User’s Guide...
Page 253: L2Tp Over Ipsec Session Monitor Screen
This field displays the IP address that the ZyWALL assigned for the remote user’s computer to use within the L2TP VPN tunnel. Public IP This field displays the public IP address that the remote user is using to connect to the Internet. ZyWALL USG 2000 User’s Guide...
Page 254: The Anti-Virus Statistics Screen
Total Viruses This field displays the number of different viruses that the ZyWALL has Detected detected. Infected Files This field displays the number of files in which the ZyWALL has detected a Detected virus. ZyWALL USG 2000 User’s Guide...
Page 255 The statistics display as follows when you display the top entries by source. Figure 234 Monitor > Anti-X Statistics > Anti-Virus: Source IP The statistics display as follows when you display the top entries by destination. Figure 235 Monitor > Anti-X Statistics > Anti-Virus: Destination IP ZyWALL USG 2000 User’s Guide...
Page 256: The Idp Statistics Screen
This field displays the number of packets that the ZyWALL has dropped. Total Packet The ZyWALL can detect and drop malicious packets from network traffic. Reset This field displays the number of packets that the ZyWALL has reset. ZyWALL USG 2000 User’s Guide...
Page 257 The statistics display as follows when you display the top entries by source. Figure 237 Monitor > Anti-X Statistics > IDP: Source The statistics display as follows when you display the top entries by destination. Figure 238 Monitor > Anti-X Statistics > IDP: Destination ZyWALL USG 2000 User’s Guide...
Page 258: The Content Filter Statistics Screen
Click this button to discard all of the screen’s statistics and update the report display. Total Web This field displays the number of web pages that the ZyWALL’s content Pages filter feature has checked. Inspected ZyWALL USG 2000 User’s Guide...
Page 259: Content Filter Cache Screen
The ZyWALL only queries the external content filtering database for sites not found in the cache. ZyWALL USG 2000 User’s Guide...
Page 260 Click this button to clear all web site addresses from the cache manually. Remove Select one or more URL entries and click Delete to remove them from the cache. This is the index number of a categorized web site address record. ZyWALL USG 2000 User’s Guide...
Page 261 ZyWALL to reflect changes in the external content filtering database. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 262: The Anti-Spam Statistics Screen
Total Mails This field displays the number of e-mails that the ZyWALL’s anti-spam Scanned feature has checked. Clear Mails This is the number of e-mails that the ZyWALL has determined to not be spam. ZyWALL USG 2000 User’s Guide...
Page 263 This column displays when you display the entries by Sender Mail Address Address. This column displays the e-mail addresses from which the ZyWALL has detected the most spam. Occurrence This field displays how many spam e-mails the ZyWALL detected from the sender. ZyWALL USG 2000 User’s Guide...
Page 264: The Anti-Spam Status Screen
This is the average for how long it takes to receive a reply from this Time (sec) DNSBL. No Response This is how many DNS queries the ZyWALL sent to this DNSBL without receiving a reply. ZyWALL USG 2000 User’s Guide...
Page 265: Log Screen
Events that generate an alert (as well as a log message) display in red. Regular logs display in black. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 243 Monitor > Log ZyWALL USG 2000 User’s Guide...
Page 266 Click this button to clear the whole log, regardless of what is currently displayed on the screen. This field is a sequential value, and it is not associated with a specific log message. Time This field displays the time the log message was recorded. ZyWALL USG 2000 User’s Guide...
Page 267 Note This field displays any additional information about the log message. The Web Configurator saves the filter settings if you leave the View Log screen and return to it later. ZyWALL USG 2000 User’s Guide...
Page 268 Chapter 10 Monitor ZyWALL USG 2000 User’s Guide...
Page 269: Registration
ZyWALL’s serial number and LAN MAC address to register it. Refer to the web site’s on-line help for details. Note: To activate a service on a ZyWALL, you need to access myZyXEL.com via that ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 270 ZyXEL engine anti-virus service subscription and enter the iCard’s PIN number (license key) in the Configuration > Registration > Service screen. The one-year ZyXEL engine anti-virus service subscription is automatically extended to 18 months. ZyWALL USG 2000 User’s Guide...
Page 271: The Registration Screen
Use this screen to register your ZyWALL with myZyXEL.com and activate a service, such as content filtering. Click Configuration > Licensing > Registration in the navigation panel to open the screen as shown next. Figure 244 Configuration > Licensing > Registration ZyWALL USG 2000 User’s Guide...
Page 272 During the trial you can use these fields to change from one anti-virus engine to the other. After the service is activated, the ZyWALL can download the up-to- date signature files for the selected anti-virus engine from the update server (http://myupdate.zywall.zyxel.com). ZyWALL USG 2000 User’s Guide...
Page 273 (if any). You can still select the unchecked trial service(s) to activate it after registration. Use the Service screen to update your service subscription status. Figure 245 Configuration > Licensing > Registration: Registered Device ZyWALL USG 2000 User’s Guide...
Page 274: The Service Screen
You can continue to use IDP/AppPatrol or Anti-Virus after the registration expires, you just won’t receive updated signatures. Count This field displays how many VPN tunnels you can use with your current license. This field does not apply to the other services. License Upgrade ZyWALL USG 2000 User’s Guide...
Page 275 (specific to your ZyWALL) and enter the new PIN number to extend the service. Service License Click this button to renew service license information (such as the Refresh registration status and expiration day). ZyWALL USG 2000 User’s Guide...
Page 276 Chapter 11 Registration ZyWALL USG 2000 User’s Guide...
Page 277: Signature Update
• Schedule signature updates for a day and time when your network is least busy to minimize disruption to your network. • Your custom signature configurations are not over-written when you download new signatures. Note: The ZyWALL does not have to reboot when you upload new signatures. ZyWALL USG 2000 User’s Guide...
Page 278: The Antivirus Update Screen
You can also subscribe to signature update e-mail notifications. Signature This field displays the number of signatures in this set. Number Released This field displays the date and time the set was released. Date ZyWALL USG 2000 User’s Guide...
Page 279: The Idp/Apppatrol Update Screen
ZyWALL periodically if you have subscribed for the IDP/AppPatrol signatures service. You need to create an account at myZyXEL.com, register your ZyWALL and then subscribe for IDP service in order to be able to download new packet inspection ZyWALL USG 2000 User’s Guide...
Page 280 IDP signatures regularly at the time and day specified. You should select a time when your network is not busy for minimal interruption. Hourly Select this option to have the ZyWALL check for new IDP signatures every hour. ZyWALL USG 2000 User’s Guide...
Page 281: The System Protect Update Screen
The system-protection feature is enabled by default and can only be disabled via the commands. You do not need an IDP subscription to use the system-protection feature or to download updated system-protection signatures. Figure 249 Configuration > Licensing > Update > System Protect ZyWALL USG 2000 User’s Guide...
Page 282 Select this option to have the ZyWALL check for new signatures once a week on the day and at the time specified. Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 283: Interfaces
Ethernet interfaces to tell the ZyWALL where to route packets. You can create virtual Ethernet interfaces, virtual VLAN interfaces, and virtual bridge interfaces. • Use the Trunks screens (Chapter 14 on page 343) to configure load balancing. ZyWALL USG 2000 User’s Guide...
Page 284: What You Need To Know
See Section 13.2 on page 286, Chapter 14 on page 343, and Section 13.8 on page 333 for details. The other types of interfaces--Ethernet, PPP, cellular, VLAN, bridge, and virtual--have a lot of similar ZyWALL USG 2000 User’s Guide...
Page 285: Relationships Between Interfaces
Table 58 Relationships Between Different Types of Interfaces REQUIRED PORT / INTERFACE INTERFACE auxiliary interface auxiliary port port group physical port Ethernet interface physical port port group VLAN interface Ethernet interface bridge interface Ethernet interface* VLAN interface* ZyWALL USG 2000 User’s Guide...
Page 286: Port Grouping
(3G) interface. • See Chapter 14 on page 343 to configure load balancing using trunks. 13.2 Port Grouping This section introduces port groups and then explains the screen for port groups. ZyWALL USG 2000 User’s Guide...
Page 287: Port Grouping Overview
These are the physical ports as they appear on the front panel of the 2, 3, ...) ZyWALL. To add a physical port to a representative interface, drag the physical port onto the corresponding representative interface. ZyWALL USG 2000 User’s Guide...
Page 288: Ethernet Summary Screen
However, the routers also generate more network traffic, and some routing protocols require a significant amount of configuration and management. The ZyWALL supports two routing protocols, RIP and OSPF. See Chapter 16 on page 369 for background information about these routing protocols. ZyWALL USG 2000 User’s Guide...
Page 289 Mask This field displays the interface’s subnet mask in dot decimal notation. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 290: Ethernet Edit
• Select in which direction(s) routing information is exchanged - The ZyWALL can receive routing information, send routing information, or do both. • Set the priority used to identify the DR or BDR if one does not exist. ZyWALL USG 2000 User’s Guide...
Page 291 Chapter 13 Interfaces Figure 252 Configuration > Network > Interface > Ethernet > Edit ZyWALL USG 2000 User’s Guide...
Page 292 General. Select this to make the interface a DHCP client and automatically get the IP address, subnet mask, and gateway address from a DHCP server. You should not select this if the interface is assigned to a VRRP group. Chapter 39 on page 675. ZyWALL USG 2000 User’s Guide...
Page 293 Select icmp to have the ZyWALL regularly ping the gateway you specify to make sure it is still available. Select tcp to have the ZyWALL regularly perform a TCP handshake with the gateway you specify to make sure it is still available. ZyWALL USG 2000 User’s Guide...
Page 294 If this field is blank, the Pool Size must also be blank. In this case, the ZyWALL can assign every IP address allowed by the interface’s IP address and subnet mask, except for the first address (network address), last address (broadcast address) and the interface’s IP address. ZyWALL USG 2000 User’s Guide...
Page 295 Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific entry. ZyWALL USG 2000 User’s Guide...
Page 296 Choices are: Same-as-Area - use the default authentication method in the area None - disable authentication Text - authenticate OSPF routing information using a plain-text password MD5 - authenticate OSPF routing information using MD5 encryption ZyWALL USG 2000 User’s Guide...
Page 297: Object References
When a configuration screen includes an Object References icon, select a configuration object and click Object References to open the Object References screen. This screen displays which configuration settings reference the selected object. The fields shown vary with the type of object. ZyWALL USG 2000 User’s Guide...
Page 298: Ppp Interfaces
Click Cancel to close the screen. 13.4 PPP Interfaces Use PPPoE/PPTP interfaces to connect to your ISP. This way, you do not have to install or manage PPPoE/PPTP software on each computer in the network. ZyWALL USG 2000 User’s Guide...
Page 299: Ppp Interface Summary
At the time of writing, it is possible to set up the IP address of the gateway (ISP) using CLI commands but not in the Web Configurator. 13.4.1 PPP Interface Summary This screen lists every PPPoE/PPTP interface. To access this screen, click Configuration > Network > Interface > PPP. ZyWALL USG 2000 User’s Guide...
Page 300 Object References Select an entry and click Object References to open a screen that shows which settings use the entry. See Section 13.3.2 on page 297 for an example. This field is a sequential value, and it is not associated with any interface. ZyWALL USG 2000 User’s Guide...
Page 301: Ppp Interface Add Or Edit
Note: You have to set up an ISP account before you create a PPPoE/PPTP interface. This screen lets you configure a PPPoE or PPTP interface. To access this screen, click the Add icon or an Edit icon in the PPP Interface screen. ZyWALL USG 2000 User’s Guide...
Page 302 Table 64 Configuration > Network > Interface > PPP > Add LABEL DESCRIPTION Show Advance Click this button to display a greater or lesser number of configuration Settings / Hide fields. Advance Settings General Settings ZyWALL USG 2000 User’s Guide...
Page 303 ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first. ZyWALL USG 2000 User’s Guide...
Page 304 WAN TRUNK interface as part of a WAN trunk for load balancing. Policy Route Click Policy Route to go to the screen where you can manually configure a policy route to associate traffic with this interface. ZyWALL USG 2000 User’s Guide...
Page 305: Cellular Configuration Screen (3G)
Internet access to mobile devices. Note: The actual data rate you obtain varies depending on the 3G card you use, the signal strength to the service provider’s base station, and so on. ZyWALL USG 2000 User’s Guide...
Page 306 Note: Install (or connect) a compatible 3G card to use a cellular connection. See Chapter 58 on page 917 for details. Note: The WAN IP addresses of a ZyWALL with multiple WAN interfaces must be on different subnets. ZyWALL USG 2000 User’s Guide...
Page 307: Cellular Add/Edit Screen
To change your 3G settings, click Configuration > Network > Interface > Cellular > Add (or Edit). In the pop-up window that displays, select the slot that you want to configure. The following screen displays. ZyWALL USG 2000 User’s Guide...
Page 308 Chapter 13 Interfaces Figure 258 Configuration > Network > Interface > Cellular > Add ZyWALL USG 2000 User’s Guide...
Page 309 GSM or HSDPA 3G card. Enter the APN from your service provider. Connections with different APNs may provide different services (such as Internet access or MMS (Multi-Media Messaging Service)) and charge method. You can enter up to 63 ASCII printable characters. Spaces are allowed. ZyWALL USG 2000 User’s Guide...
Page 310 PIN code incorrectly, the 3G card may be blocked by your ISP and you cannot use the account to access the Internet. If your ISP disabled PIN code authentication, enter an arbitrary number. Interface Parameters ZyWALL USG 2000 User’s Guide...
Page 311 Configure Click Policy Route to go to the policy route summary screen where Policy Route you can configure a policy route to override the default routing and SNAT behavior for the interface. IP Address Assignment ZyWALL USG 2000 User’s Guide...
Page 312 Select this and specify the amount of time (in hours) that the 3G connection can be used within one month. If you change the value after you configure and enable budget control, the ZyWALL resets the statistics. ZyWALL USG 2000 User’s Guide...
Page 313 Log or Log-alert you can also select recurring every to have the ZyWALL send a log or alert for this event periodically. Specify how often (from 1 to 65535 minutes) to send the log or alert. ZyWALL USG 2000 User’s Guide...
Page 314: Vlan Interfaces
In this example, there are two physical networks and three departments A, B, and C. The physical networks are connected to hubs, and the hubs are connected to the router. Alternatively, you can divide the physical networks into three VLANs. Figure 260 Example: After VLAN ZyWALL USG 2000 User’s Guide...
Page 315 Note: Each VLAN interface is created on top of only one Ethernet interface. Otherwise, VLAN interfaces are similar to other interfaces in many ways. They have an IP address, subnet mask, and gateway used to make routing decisions. ZyWALL USG 2000 User’s Guide...
Page 316: Vlan Summary Screen
This field displays the name of the interface. Port/VID For VLAN interfaces, this field displays • the Ethernet interface on which the VLAN interface is created • the VLAN ID For virtual interfaces, this field is blank. ZyWALL USG 2000 User’s Guide...
Page 317: Vlan Add/Edit
DHCP settings, and connectivity check for each VLAN interface. To access this screen, click the Add icon at the top of the Add column or click an Edit icon next to a VLAN interface in the VLAN Summary screen. The following screen appears. ZyWALL USG 2000 User’s Guide...
Page 318 Chapter 13 Interfaces Figure 262 Configuration > Network > Interface > VLAN > Edit ZyWALL USG 2000 User’s Guide...
Page 319 Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. ZyWALL USG 2000 User’s Guide...
Page 320 This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. DHCP Setting The DHCP settings are available for the OPT, LAN and DMZ interfaces. ZyWALL USG 2000 User’s Guide...
Page 321 DHCP clients. The WINS server WINS Server keeps a mapping table of the computer names on your network and the IP addresses that they are currently using. ZyWALL USG 2000 User’s Guide...
Page 322 RIP packets. Choices are 1, 2, and 1 and 2. V2-Broadcast This field is effective when RIP is enabled. Select this to send RIP-2 packets using subnet broadcasting; otherwise, the ZyWALL uses multicasting. ZyWALL USG 2000 User’s Guide...
Page 323 Click Policy Route to go to the screen where you can manually Policy Route configure a policy route to associate traffic with this VLAN. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 324: Bridge Interfaces
0B:0B:0B:0B:0B:0B in the table. There is no entry yet, so the bridge broadcasts the packet on ports 1, 3, and 4. Table 70 Example: Bridge Table After Computer A Sends a Packet to Computer B MAC ADDRESS PORT 0A:0A:0A:0A:0A:0A ZyWALL USG 2000 User’s Guide...
Page 325 In this example, virtual Ethernet interface ge1:1 is also removed from the routing table when ge1 is added to br0. Virtual interfaces are automatically added to or remove from a bridge interface when the underlying interface is added or removed. ZyWALL USG 2000 User’s Guide...
Page 326: Bridge Summary
This field displays the Ethernet interfaces and VLAN interfaces in the bridge interface. It is blank for virtual interfaces. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 327: Bridge Add/Edit
DHCP settings, and connectivity check for each bridge interface. To access this screen, click the Add icon at the top of the Add column in the Bridge Summary screen, or click an Edit icon in the Bridge Summary screen. The following screen appears. ZyWALL USG 2000 User’s Guide...
Page 328 Chapter 13 Interfaces Figure 264 Configuration > Network > Interface > Bridge > Add ZyWALL USG 2000 User’s Guide...
Page 329 This field is enabled if you select Use Fixed IP Address. Enter the subnet mask of this interface in dot decimal notation. The subnet mask indicates what part of the IP address is the same for all computers in the network. ZyWALL USG 2000 User’s Guide...
Page 330 Relay Server 1 Enter the IP address of a DHCP server for the network. Relay Server 2 This field is optional. Enter the IP address of another DHCP server for the network. These fields appear if the ZyWALL is a DHCP Server. ZyWALL USG 2000 User’s Guide...
Page 331 Configure a list of static IP addresses the ZyWALL assigns to Table computers connected to the interface. Otherwise, the ZyWALL assigns an IP address dynamically using the interface’s IP Pool Start Address and Pool Size. ZyWALL USG 2000 User’s Guide...
Page 332 This field only displays when you set the Check Method to tcp. Specify the port number to use for a TCP connectivity check. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 333: Auxiliary Interface
When the ZyWALL hangs up the call, it drops the Data Terminal Ready (DTR) signal and issues the command ATH. 13.8.2 Auxiliary Use the Auxiliary screen to configure the ZyWALL’s auxiliary interface. Click Configuration > Network > Interface > Auxiliary to open it. ZyWALL USG 2000 User’s Guide...
Page 334 Pulse - select this if the telephone uses pulse-based dialing. Initial String Enter the AT command string to initialize the external modem. the most common string, but you should check the manual for the external modem for additional commands. Auxiliary Configuration ZyWALL USG 2000 User’s Guide...
Page 335: Virtual Interfaces
However, you have to manually specify the IP address and subnet mask; virtual interfaces cannot be DHCP clients. Like other interfaces, you can restrict bandwidth through virtual interfaces, but you ZyWALL USG 2000 User’s Guide...
Page 336: Virtual Interfaces Add/Edit
Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. ZyWALL USG 2000 User’s Guide...
Page 337: Interface Technical Reference
Most interfaces have an IP address and a subnet mask. This information is used to create an entry in the routing table. Figure 267 Example: Entry in the Routing Table Derived from Interfaces Table 77 Example: Routing Table Entries for Interfaces IP ADDRESS(ES) DESTINATION 100.100.1.1/16 200.200.200.1/24 ZyWALL USG 2000 User’s Guide...
Page 338 If the interface gets its IP address and subnet mask from a DHCP server, the DHCP server also specifies the gateway, if any. Interface Parameters The ZyWALL restricts the amount of traffic into and out of the ZyWALL through each interface. ZyWALL USG 2000 User’s Guide...
Page 339 DHCP requests to all of them. It is possible for an interface to be a DHCP relay and a DHCP client simultaneously. As a DHCP server, the interface provides the following information to DHCP clients. At the time of writing, the ZyWALL does not support ingress bandwidth management. ZyWALL USG 2000 User’s Guide...
Page 340 IP address. In this way WINS is similar to DNS, although WINS does not use a hierarchy (unlike DNS). A network can have more than one WINS server. Samba can also serve as a WINS server. ZyWALL USG 2000 User’s Guide...
Page 341 The first one runs on TCP port 1723. It is used to start and manage the second one. The second one uses Generic Routing Encapsulation (GRE, RFC 2890) to transfer information between the computers. PPTP is convenient and easy-to-use, but you have to make sure that firewalls support both PPTP sessions. ZyWALL USG 2000 User’s Guide...
Page 342 Chapter 13 Interfaces ZyWALL USG 2000 User’s Guide...
Page 343: Trunks
• Use the Trunk Edit screen (Section 14.3 on page 349) to configure which interfaces belong to each trunk and the load balancing algorithm each trunk uses. ZyWALL USG 2000 User’s Guide...
Page 344: What You Need To Know
WAN IP address, the server would deny them. Here is an example. Figure 268 Link Sticking LAN user A logs into server B on the Internet. The ZyWALL uses ge2 to send the request to server B. ZyWALL USG 2000 User’s Guide...
Page 345 (current) outbound throughput of WAN 1 is 412K and WAN 2 is 198K. The ZyWALL calculates the load balancing index as shown in the table below. In the load balancing section, a session may refer to normal connection-oriented, UDP or SNMP2 traffic. ZyWALL USG 2000 User’s Guide...
Page 346 Suppose the first trunk member interface uses an unlimited access Internet connection and the second is billed by usage. Spillover load balancing only uses the second interface when the traffic load exceeds the threshold on the first ZyWALL USG 2000 User’s Guide...
Page 347 Trunk screens. • See Section 7.3 on page 126 for an example of how to configure load balancing. • See Section 14.4 on page 351 for more background information on trunks. ZyWALL USG 2000 User’s Guide...
Page 348: The Trunk Summary Screen
This setting applies when you use load balancing and have multiple WAN interfaces set to active mode. Timeout Specify the time period during which sessions from one source to the same destination are to use the same link. ZyWALL USG 2000 User’s Guide...
Page 349: Configuring A Trunk
Click Configuration > Network > Interface > Trunk and then the Add (or Edit) icon to open the Trunk Edit screen. Use this screen to create or edit a WAN trunk entry. Figure 273 Configuration > Network > Interface > Trunk > Add (or Edit) ZyWALL USG 2000 User’s Guide...
Page 350 5 as part of the trunk. If you select interface ge5 as a member here, the ZyWALL will not send traffic through port 5 as part of the trunk. ZyWALL USG 2000 User’s Guide...
Page 351: Trunk Technical Reference
The next queue is given an equal amount of bandwidth, and then moves to the end of the list; and so on, depending on the number of queues being used. This works in a looping fashion until a queue is empty. ZyWALL USG 2000 User’s Guide...
Page 352 Chapter 14 Trunks ZyWALL USG 2000 User’s Guide...
Page 353: Policy And Static Routes
RIP or OSPF to propagate routing information to other routers. 15.1.1 What You Can Do in this Chapter • Use the Policy Route screens (see Section 15.2 on page 356) to list and configure policy routes. ZyWALL USG 2000 User’s Guide...
Page 354: What You Need To Know
Configure static routes if you need to use RIP or OSPF to propagate the routing information to other routers. See Chapter 16 on page 369 for more on RIP and OSPF. ZyWALL USG 2000 User’s Guide...
Page 355 DiffServ network. Based on the marking rule, different kinds of traffic can be marked for different kinds of forwarding. Resources can then be allocated according to the DSCP values and the configured policies. ZyWALL USG 2000 User’s Guide...
Page 356: Policy Route Screen
• Limiting the amount of bandwidth available and setting a priority for traffic. IPPR follows the existing packet filtering facility of RAS in style and in implementation. Figure 275 Configuration > Network > Routing > Policy Route ZyWALL USG 2000 User’s Guide...
Page 357 This is the interface on which the packets are received. Source This is the name of the source IP address (group) object. any means all IP addresses. Destination This is the name of the destination IP address (group) object. any means all IP addresses. ZyWALL USG 2000 User’s Guide...
Page 358 This is the maximum bandwidth allotted to the policy. 0 means there is no bandwidth limitation for this route. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 359: Policy Route Edit Screen
Select this to activate the policy. Description Enter a descriptive name of up to 31 printable ASCII characters for the policy. Criteria User Select a user name or user group from which the packets are sent. ZyWALL USG 2000 User’s Guide...
Page 360 HOST address object. The gateway is an immediate neighbor of your ZyWALL that will forward the packet to the destination. The gateway must be a router or switch on the same segment as your ZyWALL's interface(s). ZyWALL USG 2000 User’s Guide...
Page 361 Use this field to specify a custom DSCP value. Defined DSCP Code Address Use this section to configure NAT for the policy route. This section does Translation not apply to policy routes that use a VPN tunnel as the next hop. ZyWALL USG 2000 User’s Guide...
Page 362 This allows you to allocate bandwidth to a route and prioritize traffic that Shaping matches the routing policy. You must also enable bandwidth management in the main policy route screen (Network > Routing > Policy Route) in order to apply bandwidth shaping. ZyWALL USG 2000 User’s Guide...
Page 363: Ip Static Route Screen
Route screen. This screen displays the configured static routes. Configure static routes to be able to use RIP or OSPF to propagate the routing information to other routers. Figure 277 Configuration > Network > Routing > Static Route ZyWALL USG 2000 User’s Guide...
Page 364: Static Route Add/Edit Screen
255.255.255.255 in the subnet mask field to force the network number to be identical to the host Subnet Mask Enter the IP subnet mask here. ZyWALL USG 2000 User’s Guide...
Page 365: Policy Routing Technical Reference
If congestion occurs between classes, the traffic in the higher class (smaller numbered class) is generally given priority. Combining the classes and drop precedence produces the ZyWALL USG 2000 User’s Guide...
Page 366: Port Triggering
1 using port 1234. The ZyWALL records the IP address of computer A when the packets match a policy with SNAT configured. Game server 1 responds using a port number ranging between 5670 - 5678. The ZyWALL allows and forwards the traffic to computer A. ZyWALL USG 2000 User’s Guide...
Page 367: Maximize Bandwidth Usage
The ZyWALL distributes the available bandwidth equally among policy routes with the same priority level. ZyWALL USG 2000 User’s Guide...
Page 368 Chapter 15 Policy and Static Routes ZyWALL USG 2000 User’s Guide...
Page 369: Routing Protocols
Network Size Small (with up to 15 routers) Large Metric Hop count Bandwidth, hop count, throughput, round trip time and reliability. Convergence Slow Fast Finding Out More Section 16.4 on page 380 for background information on routing protocols. ZyWALL USG 2000 User’s Guide...
Page 370: The Rip Screen
Use the RIP screen to specify the authentication method and maintain the policies for redistribution. Click Configuration > Network > Routing > RIP to open the following screen. Figure 280 Configuration > Network > Routing > RIP ZyWALL USG 2000 User’s Guide...
Page 371: The Ospf Screen
Click this button to return the screen to its last-saved settings. 16.3 The OSPF Screen OSPF (Open Shortest Path First, RFC 2328) is a link-state protocol designed to distribute routing information within a group of networks, called an Autonomous ZyWALL USG 2000 User’s Guide...
Page 372 • A Not So Stubby Area (NSSA, RFC 1587) has routing information about the OSPF AS and networks outside the OSPF AS to which the NSSA is directly connected. It does not have any routing information about other networks outside the OSPF AS. ZyWALL USG 2000 User’s Guide...
Page 373 • An Area Border Router (ABR) connects two or more areas. It is a member of all the areas to which it is connected, and it filters, summarizes, and exchanges routing information between them. ZyWALL USG 2000 User’s Guide...
Page 374 BDR in another group, and neither in a third group all at the same time. Virtual Links In some OSPF AS, it is not possible for an area to be directly connected to the backbone. In this case, you can create a virtual link through an intermediate area ZyWALL USG 2000 User’s Guide...
Page 375: Configuring The Ospf Screen
Use the first OSPF screen to specify the OSPF router the ZyWALL uses in the OSPF AS and maintain the policies for redistribution. In addition, it provides a summary of OSPF areas, allows you to remove them, and opens the OSPF Add/Edit screen to add or edit them. ZyWALL USG 2000 User’s Guide...
Page 376 OSPF AS, and it can be between 1 and 16777214. Active Static Select this to advertise routes that were learned from static routes. Route The ZyWALL advertises routes learned from static routes to all types of areas. ZyWALL USG 2000 User’s Guide...
Page 377 Type field above. Authentication This field displays the default authentication method in the area. Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 378: Ospf Area Add/Edit Screen
None uses no authentication. Text uses a plain text password that is sent over the network (not very secure). MD5 uses an MD5 password and authentication ID (most secure). ZyWALL USG 2000 User’s Guide...
Page 379: Virtual Link Add/Edit Screen
16.3.3 Virtual Link Add/Edit Screen The Virtual Link Add/Edit screen allows you to create a new virtual link or edit an existing one. When the OSPF add or edit screen (see Section 16.3.2 on page ZyWALL USG 2000 User’s Guide...
Page 380: Routing Protocol Technical Reference
Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 16.4 Routing Protocol Technical Reference Here is more detailed information about RIP and OSPF. ZyWALL USG 2000 User’s Guide...
Page 381 Alternatively, you can override the default in any interface or virtual link by selecting a specific authentication method. Please see the respective interface sections for more information. ZyWALL USG 2000 User’s Guide...
Page 382 Chapter 16 Routing Protocols ZyWALL USG 2000 User’s Guide...
Page 383: Zones
Virtual interfaces are automatically assigned to the same zone as the interface on which they run. Figure 287 Example: Zones 17.1.1 What You Can Do in this Chapter Use the Zone screens (see Section 17.2 on page 385) to manage the ZyWALL’s zones. ZyWALL USG 2000 User’s Guide...
Page 384: What You Need To Know
Finding Out More • See Section 6.5.8 on page 109 for related information on these screens. • See Section 7.1 on page 121 for an example of configuring Ethernet interfaces, port groups, and zones. ZyWALL USG 2000 User’s Guide...
Page 385: The Zone Screen
This field displays the name of the zone. Block Intra- This field indicates whether or not the ZyWALL blocks network traffic zone between members in the zone. Member This field displays the names of the interfaces that belong to each zone. ZyWALL USG 2000 User’s Guide...
Page 386: Zone Edit
Select any interfaces that you want to remove from the zone, and click the left arrow button to remove them. Click OK to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 387: Ddns
Table 96 DDNS Service Providers PROVIDER SERVICE TYPES SUPPORTED WEBSITE DynDNS Dynamic DNS, Static DNS, and Custom DNS www.dyndns.com Dynu Basic, Premium www.dynu.com No-IP No-IP www.no-ip.com Peanut Hull Peanut Hull www.oray.cn 3322 3322 Dynamic DNS, 3322 Static DNS www.3322.org ZyWALL USG 2000 User’s Guide...
Page 388: The Ddns Screen
Profile Name This field displays the descriptive profile name for this entry. DDNS Type This field displays which DDNS service you are using. Domain Name This field displays each domain name the ZyWALL can route. ZyWALL USG 2000 User’s Guide...
Page 389 ZyWALL for the IP address to use for the domain name. custom - The IP address is static. Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 390: The Dynamic Dns Add/Edit Screen
), or dashes (-), but the first character cannot be a number. This value is case-sensitive. This field is read-only when you are editing an entry. DDNS Type Select the type of DDNS service you are using. ZyWALL USG 2000 User’s Guide...
Page 391 Select the interface to use for updating the IP address mapped to the domain name. Select Any to let the domain name be used with any interface. Select None to not use a backup address. ZyWALL USG 2000 User’s Guide...
Page 392 Once your mail server is available again, the DynDNS server delivers the mail to you. See www.dyndns.org for more information about this service. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 393: Nat
Use the NAT screens (see Section 19.2 on page 394) to view and manage the list of NAT rules and see their configuration details. You can also create new NAT rules and edit or delete existing ones. ZyWALL USG 2000 User’s Guide...
Page 394: What You Need To Know
Table 99 Configuration > Network > NAT LABEL DESCRIPTION Click this to create a new entry. Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. ZyWALL USG 2000 User’s Guide...
Page 395 This field displays the new destination port(s) for the pack et. This field is blank if there is no restriction on the original destination port. Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 396: The Nat Add/Edit Screen
Type in the name of the NAT rule. The name is used to refer to the NAT rule. You may use 1-31 alphanumeric characters, underscores( ), or dashes (-), but the first character cannot be a number. This value is case-sensitive. ZyWALL USG 2000 User’s Guide...
Page 397 ZyWALL. If you select one of them, this NAT rule supports the IP address specified by the address object. User Defined This field is available if Mapped IP is User Defined. Type the translated Original IP destination IP address that this NAT rule supports. ZyWALL USG 2000 User’s Guide...
Page 398 LAN interface’s IP address as the source address for the traffic it sends to the LAN server. See NAT Loopback on page 399 for more details. If you do not enable NAT loopback, this NAT rule only applies to packets received on the rule’s specified incoming interface. ZyWALL USG 2000 User’s Guide...
Page 399: Nat Technical Reference
Suppose a NAT 1:1 rule maps a public IP address to the private IP address of a LAN SMTP e-mail server to give WAN users access. NAT loopback allows other users to also use the rule’s original IP to access the mail server. ZyWALL USG 2000 User’s Guide...
Page 400 The LAN SMTP server replies to the ZyWALL’s LAN IP address and the ZyWALL changes the source address to 1.1.1.1 before sending it to the LAN user. The return traffic’s source matches the original destination address (1.1.1.1). If the ZyWALL USG 2000 User’s Guide...
Page 401 LAN user’s computer to shut down the session. Figure 297 LAN to LAN Return Traffic Source 192.168.1.21 Source 1.1.1.1 SMTP SMTP 192.168.1.21 192.168.1.89 ZyWALL USG 2000 User’s Guide...
Page 402 Chapter 19 NAT ZyWALL USG 2000 User’s Guide...
Page 403: Http Redirect
Figure 298 HTTP Redirect Example LAN1 20.1.1 What You Can Do in this Chapter Use the HTTP Redirect screens (see Section 20.2 on page 405) to display and edit the HTTP redirect rules. ZyWALL USG 2000 User’s Guide...
Page 404: What You Need To Know
• a HTTP redirect rule to forward HTTP traffic from ge1 to proxy server A. For HTTP traffic between ge4 and ge2: • a from DMZ to WAN firewall rule (default) to allow HTTP requests from ge4 to ge2. Responses to these requests are allowed automatically. ZyWALL USG 2000 User’s Guide...
Page 405: The Http Redirect Screen
This icon is lit when the entry is active and dimmed when the entry is inactive. Name This is the descriptive name of a rule. Interface This is the interface on which the request must be received. Proxy Server This is the IP address of the proxy server. ZyWALL USG 2000 User’s Guide...
Page 406: The Http Redirect Edit Screen
Enter the IP address of the proxy server. Port Enter the port number that the proxy server uses. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 407: Alg
The ALG feature is only needed for traffic that goes through the ZyWALL’s NAT. 21.1.1 What You Can Do in this Chapter Use the ALG screen (Section 21.2 on page 411) to set up SIP, H.323, and FTP ALG settings. ZyWALL USG 2000 User’s Guide...
Page 408: What You Need To Know
Figure 302 H.323 ALG Example SIP ALG • SIP phones can be in any zone (including LAN, DMZ, WAN), and the SIP server and SIP clients can be in the same network or different networks. ZyWALL USG 2000 User’s Guide...
Page 409 LAN IP address A make calls out through WAN IP address 1. Configure another policy route to have H.323 (or SIP) calls from LAN IP addresses B and C go out through WAN IP address 2. Even though only LAN IP address A ZyWALL USG 2000 User’s Guide...
Page 410 ALG for peer-to-peer H.323 traffic. • See Section 7.12 on page 159 for an example of making an IPPBX using SIP or a SIP server in the DMZ zone accessible from the Internet (the WAN zone). ZyWALL USG 2000 User’s Guide...
Page 411: Before You Begin
SIP ALG time outs. Note: If the ZyWALL provides an ALG for a service, you must enable the ALG in order to use the application patrol on that service’s traffic. Figure 305 Configuration > Network > ALG ZyWALL USG 2000 User’s Guide...
Page 412 If you are using a custom TCP port number (not 1720) for H.323 Port traffic, enter it here. Additional H.323 If you are also using H.323 on an additional TCP port number, enter it Signaling Port here. Transformations ZyWALL USG 2000 User’s Guide...
Page 413: Alg Technical Reference
ALG-managed traffic uses. You could also have a trunk with one interface set to active and a second interface set to passive. The ZyWALL does not automatically change ALG-managed ZyWALL USG 2000 User’s Guide...
Page 414 SIP handles telephone calls and can interface with traditional circuit- switched telephone networks. When you make a VoIP call using H.323 or SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer. See RFC 1889 for details on RTP. ZyWALL USG 2000 User’s Guide...
Page 415: Ip/Mac Binding
(Section 22.2 on page 416) to bind IP addresses to MAC addresses. • Use the Exempt List screen (Section 22.3 on page 419) to configure ranges of IP addresses to which the ZyWALL does not apply IP/MAC binding. ZyWALL USG 2000 User’s Guide...
Page 416: What You Need To Know
Click Configuration > Network > IP/MAC Binding to open the IP/MAC Binding Summary screen. This screen lists the total number of IP to MAC address bindings for devices connected to each supported interface. Figure 307 Configuration > Network > IP/MAC Binding > Summary ZyWALL USG 2000 User’s Guide...
Page 417: Ip/Mac Binding Edit
Click Configuration > Network > IP/MAC Binding > Edit to open the IP/ MAC Binding Edit screen. Use this screen to configure an interface’s IP to MAC address binding settings. Figure 308 Configuration > Network > IP/MAC Binding > Edit ZyWALL USG 2000 User’s Guide...
Page 418: Static Dhcp Edit
Click Cancel to exit this screen without saving. 22.2.2 Static DHCP Edit Click Configuration > Network > IP/MAC Binding > Edit to open the IP/ MAC Binding Edit screen. Click the Add or Edit icon to open the following ZyWALL USG 2000 User’s Guide...
Page 419: Ip/Mac Binding Exempt List
Click Configuration > Network > IP/MAC Binding > Exempt List to open the IP/MAC Binding Exempt List screen. Use this screen to configure ranges of IP addresses to which the ZyWALL does not apply IP/MAC binding. Figure 310 Configuration > Network > IP/MAC Binding > Exempt List ZyWALL USG 2000 User’s Guide...
Page 420 Click the Add icon to add a new entry. Click the Remove icon to delete an entry. A window displays asking you to confirm that you want to delete it. Apply Click Apply to save your changes back to the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 421: Authentication Policy
Figure 311 Authentication Policy Using Endpoint Security 23.1.1 What You Can Do in this Chapter Use the Configuration > Auth. Policy screens (Section 23.2 on page 422) to create and manage authentication policies. ZyWALL USG 2000 User’s Guide...
Page 422: What You Need To Know
Section 7.8 on page 146 for an example of how to use endpoint security and authentication policies. 23.2 Authentication Policy Screen The Authentication Policy screen displays the authentication policies you have configured on the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 423 To turn off an entry, select it and click Inactivate. Move To move an entry to a different number in the list, click the Move icon. In the field that appears, specify the number to which you want to move the interface. ZyWALL USG 2000 User’s Guide...
Page 424: Adding Exceptional Services
Use this screen to add services that users can access without logging in. Available services appear on the left. Select any services you want users to be able to access without logging in and click the right arrow button to add them. The ZyWALL USG 2000 User’s Guide...
Page 425: Creating/Editing An Authentication Policy
Figure 313 Configuration > Auth. Policy > Add Exceptional Service 23.2.2 Creating/Editing an Authentication Policy Click Configuration > Auth. Policy and then the Add (or Edit) icon to open the Endpoint Security Edit screen. Use this screen to configure an authentication policy. ZyWALL USG 2000 User’s Guide...
Page 426 Destination Select a destination address or address group for whom this policy Address applies. Select any if the policy is effective for every destination. This is any and not configurable for the default policy. ZyWALL USG 2000 User’s Guide...
Page 427 Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 428 Chapter 23 Authentication Policy ZyWALL USG 2000 User’s Guide...
Page 429: Firewall
437) to enable or disable the firewall and asymmetrical routes, and manage and configure firewall rules. • Use the Session Limit screens (see Section 24.3 on page 442) to limit the number of concurrent NAT/firewall sessions a client can use. ZyWALL USG 2000 User’s Guide...
Page 430: What You Need To Know
• The firewall allows only LAN, WAN computers to access or manage the ZyWALL. • The ZyWALL drops most packets from the WAN zone to the ZyWALL itself, except for VRRP traffic for Device HA and ESP/AH/IKE/NATT/HTTPS services for VPN tunnels, and generates a log. ZyWALL USG 2000 User’s Guide...
Page 431 After you create a VPN tunnel and add it to a zone, you can set the firewall rules applied to VPN traffic. If you add a VPN tunnel to an existing zone (the LAN zone for example), you can configure a new LAN to LAN firewall rule or use intra-zone ZyWALL USG 2000 User’s Guide...
Page 432: Firewall Rule Example Applications
(Internet Relay Chat) through the Internet. To do this, you would configure a LAN to WAN firewall rule that blocks IRC traffic from any source IP address from going to any destination address. You do not need to specify a schedule since you need ZyWALL USG 2000 User’s Guide...
Page 433 • Has a static IP address, • You configure a static DHCP entry for it so the ZyWALL always assigns it the same IP address (see DHCP Settings on page 339 for information on DHCP). ZyWALL USG 2000 User’s Guide...
Page 434 CEO) to allow IRC traffic from any source IP address to go to any destination address. Your firewall would have the following configuration. Table 113 Limited LAN1 to WAN IRC Traffic Example 2 USER SOURCE DESTINATION SCHEDULE SERVICE ACTION Allow Deny Allow ZyWALL USG 2000 User’s Guide...
Page 435: Firewall Rule Configuration Example
At the top of the screen, click Create new Object > Address. The screen for configuring an address object opens. Configure it as follows and click OK. Figure 319 Firewall Example: Create an Address Object Click Create new Object > Service. ZyWALL USG 2000 User’s Guide...
Page 436 Select Dest_1 is selected for the Destination and Doom is selected as the Service. Enter a description and configure the rest of the screen as follows. Click OK when you are done. Figure 321 Firewall Example: Edit a Firewall Rule ZyWALL USG 2000 User’s Guide...
Page 437: The Firewall Screen
A computer on the LAN initiates a connection by sending a SYN packet to a receiving server on the WAN. The ZyWALL reroutes the packet to gateway A, which is in Subnet 2. The reply from the WAN goes to the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 438: Configuring The Firewall Screen
So for example, if you configure a NAT entry that sends WAN traffic to a LAN IP address, when you configure a corresponding firewall rule to allow the traffic, you need to set the LAN IP address as the destination. See Section 7.10 on page 152 for an example. ZyWALL USG 2000 User’s Guide...
Page 439 Note: Allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the ZyWALL. A better solution is to use virtual interfaces to put the ZyWALL and the backup gateway on separate subnets. ZyWALL USG 2000 User’s Guide...
Page 440 This is the user name or user group name to which this firewall rule applies. Source This displays the source address object to which this firewall rule applies. Destination This displays the destination address object to which this firewall rule applies. ZyWALL USG 2000 User’s Guide...
Page 441: The Firewall Add/Edit Screen
Select this check box to activate the firewall rule. From For through-ZyWALL rules, select the direction of travel of packets to which the rule applies. any means all interfaces or VPN tunnels. ZyWALL means packets destined for the ZyWALL itself. ZyWALL USG 2000 User’s Guide...
Page 442: The Session Limit Screen
Click Configuration > Firewall > Session Limit to display the Firewall Session Limit screen. Use this screen to limit the number of concurrent NAT/ firewall sessions a client can use. You can apply a default limit for all users and ZyWALL USG 2000 User’s Guide...
Page 443 [ENTER] to move the rule to the number that you typed. The ordering of your rules is important as they are applied in order of their numbering. Status This icon is lit when the entry is active and dimmed when the entry is inactive. ZyWALL USG 2000 User’s Guide...
Page 444: The Session Limit Add/Edit Screen
Use to configure any new settings objects that you need to use in this Object screen. Enable Rule Select this check box to turn on this session limit rule. Description Enter information to help you identify this rule. Use up to 64 printable ASCII characters. Spaces are allowed. ZyWALL USG 2000 User’s Guide...
Page 445 For this rule’s users and addresses, this setting overrides the Default Session per Host setting in the general Firewall Session Limit screen. Click OK to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 446 Chapter 24 Firewall ZyWALL USG 2000 User’s Guide...
Page 447: Ipsec Vpn
VPN gateway a VPN connection policy uses and which devices (behind the IPSec routers) can use the VPN tunnel and the IPSec SA settings (phase 2 settings). You can also activate / deactivate and connect / disconnect each VPN connection (each IPSec SA). ZyWALL USG 2000 User’s Guide...
Page 448: What You Need To Know
Between routers X and Y, the data is protected by tunneling, encryption, authentication, and other security features of the IPSec SA. The IPSec SA is secure because routers X and Y established the IKE SA first. ZyWALL USG 2000 User’s Guide...
Page 449 Only the clients can initiate the VPN Only this ZyWALL initiate the VPN tunnel. can initiate the VPN tunnel. tunnel. Finding Out More • See Section 6.5.15 on page 112 for related information on these screens. ZyWALL USG 2000 User’s Guide...
Page 450: Before You Begin
The VPN Connection screen lists the VPN connection policies and their associated VPN gateway(s), and various settings. In addition, it also lets you activate / deactivate and connect / disconnect each VPN connection (each IPSec ZyWALL USG 2000 User’s Guide...
Page 451 Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. Connect To connect an IPSec SA, select it and click Connect. ZyWALL USG 2000 User’s Guide...
Page 452: The Vpn Connection Add/Edit (Ike) Screen
450), and click either the Add icon or an Edit icon. If you click the Add icon, you have to select a specific VPN gateway in the VPN Gateway field before the following screen appears. ZyWALL USG 2000 User’s Guide...
Page 453 Chapter 25 IPSec VPN Figure 331 Configuration > VPN > IPSec VPN > VPN Connection > Edit (IKE) ZyWALL USG 2000 User’s Guide...
Page 454 IKE key management. See Section 25.2.2 on page 459 for how to configure the manual key fields. Note: Only use manual key as a temporary solution, because it is not as secure as a regular IPSec SA. ZyWALL USG 2000 User’s Guide...
Page 455 Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. This field is a sequential value, and it is not associated with a specific proposal. The sequence of proposals should not affect performance significantly. ZyWALL USG 2000 User’s Guide...
Page 456 DH key group. Connectivity The ZyWALL can regularly check the VPN connection to the gateway Check you specified to make sure it is still available. Enable Select this to turn on the VPN connection check. Connectivity Check ZyWALL USG 2000 User’s Guide...
Page 457 (or select Create Object to configure a new one). This is the address object for the local network. The size of the original source address range (Source) must be equal to the size of the translated source address range (SNAT). ZyWALL USG 2000 User’s Guide...
Page 458 The size of the original port range must be the same size as the size of the mapped port range. Click OK to save the changes. Cancel Click Cancel to discard all changes and return to the main VPN screen. ZyWALL USG 2000 User’s Guide...
Page 459: The Vpn Connection Add/Edit Manual Key Screen
Table 121 Configuration > VPN > IPSec VPN > VPN Connection > Add > Manual LABEL DESCRIPTION Manual Key My Address Type the IP address of the ZyWALL in the IPSec SA. 0.0.0.0 is invalid. ZyWALL USG 2000 User’s Guide...
Page 460 Select which hash algorithm to use to authenticate packet data in the Algorithm IPSec SA. Choices are SHA1 and MD5. SHA1 is generally considered stronger than MD5, but it is also slower. The ZyWALL and remote IPSec router must use the same algorithm. ZyWALL USG 2000 User’s Guide...
Page 461 12345678901234567890 for a MD5 authentication key, the ZyWALL only uses 1234567890123456. The ZyWALL still stores the longer key. Click OK to save your settings and exit this screen. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 462: The Vpn Gateway Screen
This field displays the interface or a domain name the Z yWALL uses for the VPN gateway. Secure Gateway This field displays the IP address(es) of the remote IPSec routers. VPN Connection This field displays VPN connections that use this VPN gateway. ZyWALL USG 2000 User’s Guide...
Page 463: The Vpn Gateway Add/Edit Screen
The VPN Gateway Add/Edit screen allows you to create a new VPN gateway policy or edit an existing one. To access this screen, go to the VPN Gateway summary screen (see Section 25.3 on page 462), and click either the Add icon or an Edit icon. ZyWALL USG 2000 User’s Guide...
Page 464 Chapter 25 IPSec VPN Figure 334 Configuration > VPN > IPSec VPN > VPN Gateway > Edit ZyWALL USG 2000 User’s Guide...
Page 465 Select Dynamic Address if the remote IPSec router has a dynamic IP address (and does not use DDNS). Authentication Note: The ZyWALL and remote IPSec router must use the same authentication method to establish the IKE SA. ZyWALL USG 2000 User’s Guide...
Page 466 ZyWALL during authentication. Choices are: IP - the ZyWALL is identified by an IP address DNS - the ZyWALL is identified by a domain name E-mail - the ZyWALL is identified by an e-mail address ZyWALL USG 2000 User’s Guide...
Page 467 Any - the ZyWALL does not check the identity of the remote IPSec router If the ZyWALL and remote IPSec router use certificates, there is one more choice. Subject Name - the remote IPSec router is identified by the subject name in the certificate ZyWALL USG 2000 User’s Guide...
Page 468 Type the maximum number of seconds the IKE SA can last. When (Seconds) this time has passed, the ZyWALL and remote IPSec router have to update the encryption and authentication keys and re-negotiate the IKE SA. This does not affect any existing IPSec SAs, however. ZyWALL USG 2000 User’s Guide...
Page 469 DH5 - use a 1536-bit random number The longer the key, the more secure the encryption, but also the longer it takes to encrypt and decrypt information. Both routers must use the same DH key group. ZyWALL USG 2000 User’s Guide...
Page 470 IPSec router. The password can be 1-31 ASCII characters. It is case- sensitive, but spaces are not allowed. Click OK to save your settings and exit this screen. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 471: Vpn Concentrator
You can use the ZyWALL’s VPN concentrator feature to combine multiple IPSec VPN connections into one secure network. In this example branch office A, headquarters (HQ), and branch office B all have USG ZyWALLs or ZyWALL 1050s. ZyWALL USG 2000 User’s Guide...
Page 472 • Disable Policy Enforcement Policy Route • Source: 192.168.11.0 • Destination: 192.168.12.0 • Next Hop: VPN Tunnel 1 Headquarters (USG ZyWALL or ZyWALL 1050): VPN Gateway (VPN Tunnel 1): • My Address: 10.0.0.1 • Peer Gateway Address: 10.0.0.2 ZyWALL USG 2000 User’s Guide...
Page 473 • Remote Policy: 192.168.1.0/255.255.255.0 • Disable Policy Enforcement Policy Route • Source: 192.168.12.0 • Destination: 192.168.11.0 • Next Hop: VPN Tunnel 2 25.4.1.1 VPN Concentrator Requirements and Suggestions Consider the following when using the VPN concentrator. ZyWALL USG 2000 User’s Guide...
Page 474: Vpn Concentrator Screen
These are the VPN connection policies that are part of the VPN concentrator. 25.4.3 The VPN Concentrator Add/Edit Screen The VPN Concentrator Add/Edit screen allows you to create a new VPN concentrator or edit an existing one. To access this screen, go to the VPN ZyWALL USG 2000 User’s Guide...
Page 475: Ipsec Vpn Background Information
VPN concentrator, and click the left arrow button to remove them. Click OK to save your changes in the ZyWALL. Cancel Click Cancel to exit this screen without saving. 25.5 IPSec VPN Background Information Here is some more detailed IPSec VPN background information. ZyWALL USG 2000 User’s Guide...
Page 476: Ike Sa Overview
IKE SA. In main mode, this is done in steps 1 and 2, as illustrated next. Figure 339 IKE SA: Main Negotiation Mode, Steps 1 - 2: IKE SA Proposal One or more proposals, each one consisting of: - encryption algorithm - authentication algorithm - Diffie-Hellman key group ZyWALL USG 2000 User’s Guide...
Page 477 Figure 340 IKE SA: Main Negotiation Mode, Steps 3 - 4: DH Key Exchange Diffie-Hellman key exchange DH public-key cryptography is based on DH key groups. Each key group is a fixed number of bits long. The longer the key, the more secure the encryption, but also ZyWALL USG 2000 User’s Guide...
Page 478 You have to create (and distribute) a pre-shared key. The ZyWALL and remote IPSec router use it in the authentication process, though it is not actually transmitted or exchanged. Note: The ZyWALL and the remote IPSec router must use the same pre-shared key. ZyWALL USG 2000 User’s Guide...
Page 479 ZyWALL provides another way to check the identity of the remote IPSec router (for example, extended authentication) or if you are troubleshooting a VPN tunnel. Additional Topics for IKE SA This section provides more information about IKE SA. ZyWALL USG 2000 User’s Guide...
Page 480 The routers cannot establish a VPN tunnel. Most routers like router A now have an IPSec pass-thru feature. This feature helps router A recognize VPN packets and route them appropriately. If router A has this ZyWALL USG 2000 User’s Guide...
Page 481 • Instead of using the pre-shared key, the ZyWALL and remote IPSec router check the signatures on each other’s certificates. Unlike pre-shared keys, the signatures do not have to match. ZyWALL USG 2000 User’s Guide...
Page 482: Ipsec Sa Overview
ZyWALL and remote IPSec router (for example, for remote management), not between computers on the local and remote networks. Note: The ZyWALL and remote IPSec router must use the same encapsulation. ZyWALL USG 2000 User’s Guide...
Page 483 If you do not enable PFS, the ZyWALL and remote IPSec router use the same root key that was generated when the IKE SA was established to generate encryption keys. The DH key exchange is time-consuming and may be unnecessary for data that does not require such security. ZyWALL USG 2000 User’s Guide...
Page 484 • Destination address in inbound packets - this translation is used if you want to forward packets (for example, mail) from the remote network to a specific computer (like the mail server) in the local network. ZyWALL USG 2000 User’s Guide...
Page 485 To set up this NAT, you have to specify the following information: • Source - the original source address; the remote network (B). • Destination - the original destination address; the local network (A). ZyWALL USG 2000 User’s Guide...
Page 486 IP address of the mail server in the local network (A). • Mapped Port - the translated destination port or range of destination ports. The original port range and the mapped port range must be the same size. ZyWALL USG 2000 User’s Guide...
Page 487: Ssl Vpn
ZyWALL appears to be the server to remote users. This provides an added layer of protection for your internal servers. With reverse proxy mode, remote users can easily access any web-based applications on the local network by clicking on links or entering the provided URL. ZyWALL USG 2000 User’s Guide...
Page 488 • assign private IP addresses and provide DNS/WINS server information to remote users to access internal networks. SSL Access Policy Objects The SSL access policies reference the following objects. If you update this information, in response to changes, the ZyWALL automatically propagates the ZyWALL USG 2000 User’s Guide...
Page 489 ZyWALL (after you have configured the SSL VPN settings on the ZyWALL). • See Chapter 49 on page 781 for details on endpoint security objects. • See Chapter 48 on page 773 for details on SSL application objects. ZyWALL USG 2000 User’s Guide...
Page 490: The Ssl Access Privilege Screen
This field displays the user account or user group name(s) associated to an SSL access policy. This field displays up to three names. Access Policy This field displays details about the SSL application object this policy Summary uses including its name, type, and address. ZyWALL USG 2000 User’s Guide...
Page 491 Chapter 26 SSL VPN Table 129 VPN > SSL VPN > Access Privilege LABEL DESCRIPTION Apply Click Apply to save the settings. Reset Click Reset to discard all changes. ZyWALL USG 2000 User’s Guide...
Page 492: The Ssl Access Policy Add/Edit Screen
26.2.1 The SSL Access Policy Add/Edit Screen To create a new or edit an existing SSL access policy, click the Add or Edit icon in the Access Privilege screen. Figure 348 VPN > SSL VPN > Access Privilege > Add/Edit ZyWALL USG 2000 User’s Guide...
Page 493 Operating System (OS) and security requirements of one of the SSL access policy’s selected endpoint security objects before granting access. Periodical Select this and specify a number of minutes to have the ZyWALL repeat checking time the endpoint security check at a regular interval. ZyWALL USG 2000 User’s Guide...
Page 494 Selectable Address Objects list and click >> to add to the Selected Address Objects list. You can select more than one network. To block access to a network, select the network name in the Selected Address Objects list and click <<. ZyWALL USG 2000 User’s Guide...
Page 495: The Ssl Global Setting Screen
Specify the IP address of the ZyWALL (or a gateway device) for full Extension Local tunnel mode SSL VPN access. Leave this field to the default settings unless it conflicts with another interface. SSL VPN Login Domain Name ZyWALL USG 2000 User’s Guide...
Page 496: How To Upload A Custom Logo
26.3.1 How to Upload a Custom Logo Follow the steps below to upload a custom logo to display on the remote user SSL VPN screens. Click VPN > SSL VPN and click the Global Setting tab to display the configuration screen. ZyWALL USG 2000 User’s Guide...
Page 497: Establishing An Ssl Vpn Connection
26.4 Establishing an SSL VPN Connection After you have configured the SSL VPN settings on the ZyWALL, use the ZyWALL login screen’s SSL VPN button to establish an SSL VPN connection. See Section 27.2 on page 500 for details. ZyWALL USG 2000 User’s Guide...
Page 498 Login screen. Clear the Login to SSL VPN check box and try logging in again. For more information on user portal screens, refer to Chapter 27 on page 499. ZyWALL USG 2000 User’s Guide...
Page 499: Ssl User Screens
ZyWALL SecuExtender client program to your computer. With the ZyWALL SecuExtender, you can access network resources, remote desktops and manage files as if you were on the local network. See Chapter 30 on page 519 for more on the ZyWALL SecuExtender. ZyWALL USG 2000 User’s Guide...
Page 500: Remote User Login
SSL VPN on the ZyWALL. 27.2 Remote User Login This section shows you how to access and log into the network through the ZyWALL. Example screens for Internet Explorer are shown. ZyWALL USG 2000 User’s Guide...
Page 501 If a token password is also required, enter it in the One-Time Password field. Click SSL VPN to log in and establish an SSL VPN connection to the network to access network resources. Figure 356 Login Screen ZyWALL USG 2000 User’s Guide...
Page 502 Figure 357 Java Needed Message The ZyWALL tries to install the SecuExtender client. As shown next, you may have to click some pop-ups to get your browser to allow the installation. Figure 358 ActiveX Object Installation Blocked by Browser ZyWALL USG 2000 User’s Guide...
Page 503 In Internet Explorer, click Run. Figure 360 SecuExtender Progress Click Next to use the setup wizard to install the SecuExtender client on your computer. Figure 361 SecuExtender Progress ZyWALL USG 2000 User’s Guide...
Page 504 11 The Application screen displays showing the list of resources available to you. Figure 363 on page 505 for a screen example. Note: Available resource links vary depending on the configuration your network administrator made. ZyWALL USG 2000 User’s Guide...
Page 505: The Ssl Vpn User Screens
This part of the screen displays a list of the resources available to you. In the Application screen, click on a link to access or display the access method. In the File Sharing screen, click on a link to open a file or directory. ZyWALL USG 2000 User’s Guide...
Page 506: Bookmarking The Zywall
To properly terminate a connection, click on the Logout icon in any remote user screen. Click the Logout icon in any remote user screen. A prompt window displays. Click OK to continue. Figure 365 Logout: Prompt ZyWALL USG 2000 User’s Guide...
Page 507 Chapter 27 SSL User Screens An information screen displays to indicate that the SSL VPN connection is about to terminate. Figure 366 Logout: Connection Termination Progress ZyWALL USG 2000 User’s Guide...
Page 508 Chapter 27 SSL User Screens ZyWALL USG 2000 User’s Guide...
Page 509: Ssl User Application Screens
(Web Server) or web-based e-mail using Microsoft Outlook Web Access (OWA). To access a web-based application, simply click a link in the Application screen to display the web screen in a separate browser window. Figure 367 Application ZyWALL USG 2000 User’s Guide...
Page 510 Chapter 28 SSL User Application Screens ZyWALL USG 2000 User’s Guide...
Page 511: Ssl User File Sharing
• Rename a file or folder. • Delete a file or folder. • Upload a file. Note: Available actions you can perform in the File Sharing screen vary depending on the rights granted to you on the file server. ZyWALL USG 2000 User’s Guide...
Page 512: The Main File Sharing Screen
You can open a file if the file extension is recognized by the web browser and the associated application is installed on your computer. Log in as a remote user and click the File Sharing tab. Click on a file share icon. ZyWALL USG 2000 User’s Guide...
Page 513 If an access user name and password are required, a screen displays as shown in the following figure. Enter the account information and click Login to continue. Figure 369 File Sharing: Enter Access User Name and Password ZyWALL USG 2000 User’s Guide...
Page 514: Downloading A File
You are prompted to download a fil e which cannot be opened using a web browser. Follow the on-screen instructions to download and save the file to your computer. Then launch the associated application to open the file. ZyWALL USG 2000 User’s Guide...
Page 515: Saving A File
Specify a descriptive name for the folder. You can enter up to 356 characters. Then click Add. Note: Make sure the length of the folder name does not exceed the maximum allowed on the file server. Figure 372 File Sharing: Save a Word File ZyWALL USG 2000 User’s Guide...
Page 516: Renaming A File Or Folder
You may not be able to open a file if you change the file extension. Figure 374 File Sharing: Rename 29.6 Deleting a File or Folder Click the Delete icon next to a file or folder to remove it. ZyWALL USG 2000 User’s Guide...
Page 517: Uploading A File
After the file is uploaded successfully, you should see the name of the file and a message in the screen. Figure 375 File Sharing: File Upload Note: Uploading a file with the same name and file extension replaces the existing file on the file server. No warning message is displayed. ZyWALL USG 2000 User’s Guide...
Page 518 Chapter 29 SSL User File Sharing ZyWALL USG 2000 User’s Guide...
Page 519: Zywall Secuextender
• Gray: the SSL VPN tunnel’s connection is suspended. This means the SSL VPN tunnel is connected, but the ZyWALL SecuExtender will not send any traffic through it until you right-click the icon and resume the connection. ZyWALL USG 2000 User’s Guide...
Page 520: Statistics
IP addresses that they are currently using. Network 1~4 These are the networks (including netmask) that you can access through the SSL VPN connection. Activity Connected Time This is how long the computer has been connected to the SSL VPN tunnel. ZyWALL USG 2000 User’s Guide...
Page 521: View Log
30.4 Suspend and Resume the Connection When the ZyWALL SecuExtender icon in the system tray is green, you can right- click the icon and select Suspend Connection to keep the SSL VPN tunnel ZyWALL USG 2000 User’s Guide...
Page 522: Stop The Connection
Click start > All Programs > ZyXEL > ZyWALL SecuExtender > Uninstall. In the confirmation screen, click Yes. Figure 379 Uninstalling the ZyWALL SecuExtender Confirmation Windows uninstalls the ZyWALL SecuExtender. Figure 380 ZyWALL SecuExtender Uninstallation ZyWALL USG 2000 User’s Guide...
Page 523: L2Tp Vpn
IPSec VPN. IPSec Configuration Required for L2TP VPN You must configure an IPSec VPN connection for L2TP VPN to use (see Chapter 25 on page 447 for details). The IPSec VPN connection must: • Be enabled. ZyWALL USG 2000 User’s Guide...
Page 524 • Set the Destination Address to the IP address pool that the ZyWALL assigns to the remote users (L2TP_POOL in the following figure). • Set the next hop to be the VPN tunnel that you are using for L2TP. Figure 382 Policy Route for L2TP VPN L2TP_POOL LAN_SUBNET ZyWALL USG 2000 User’s Guide...
Page 525: L2Tp Vpn Screen
Create new Use to configure any new settings objects that you need to use in this Object screen. Enable L2TP Use this field to turn the ZyWALL’s L2TP VPN function on or off. Over IPSec ZyWALL USG 2000 User’s Guide...
Page 526 Type the IP addresses of up to two WINS servers to assign to the remote users. You can specify these IP addresses two ways. Apply Click Apply to save your changes in the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 527: Application Patrol
ZyWALL does when it does not recognize the application, and it identifies the conditions that refine this. It also lets you open the Other Configuration Add/ Edit screen to create new conditions or edit existing ones. ZyWALL USG 2000 User’s Guide...
Page 528: What You Need To Know
Custom Ports for SIP and the SIP ALG Configuring application patrol to use custom port numbers for SIP traffic also configures the SIP ALG (see Chapter 21 on page 407) to use the same port ZyWALL USG 2000 User’s Guide...
Page 529 A connection has outbound and inbound packet flows. The ZyWALL controls the bandwidth of traffic of each flow as it is going out through an interface or VPN tunnel. ZyWALL USG 2000 User’s Guide...
Page 530 • Outbound traffic is limited to 200 kbps. The connection initiator is on the LAN so outbound means the traffic traveling from the LAN to the WAN. Each of the WAN zone’s two interfaces can send the limit of 200 kbps of traffic. ZyWALL USG 2000 User’s Guide...
Page 531 The following sections show how bandwidth management behaves with various settings. For example, you configure DMZ to WAN policies for FTP servers A and B. Each server tries to send 1000 kbps, but the WAN is set to a maximum ZyWALL USG 2000 User’s Guide...
Page 532 200 kbps. Then the ZyWALL divides the remaining bandwidth (1000 - 500 = 500) equally between the two (500 / 2 = 250 kbps for each). The priority has no effect on how much of the unused bandwidth each server gets. ZyWALL USG 2000 User’s Guide...
Page 533: Application Patrol Bandwidth Management Examples
• SIP traffic from VIP users must get through with the least possible delay regardless of if it is an outgoing call or an incoming call. The VIP users must be able to make and receive SIP calls no matter which interface they are connected ZyWALL USG 2000 User’s Guide...
Page 534: Sip Any To Wan Bandwidth Management Example
• Inbound traffic (to the LAN and DMZ from the WAN) is also limited to 200 kbps. The ZyWALL applies this limit before sending the traffic to LAN or DMZ. • Highest priority (1). Set policies for other applications to lower priorities so the SIP traffic always gets the best treatment. ZyWALL USG 2000 User’s Guide...
Page 535: Sip Wan To Any Bandwidth Management Example
HTTP traffic gets sent before non-SIP traffic. • Enable maximize bandwidth usage so the HTTP traffic can borrow unused bandwidth. Figure 389 HTTP Any to WAN Bandwidth Management Example Outbound: 200 kbps Inbound: 500 kbps ZyWALL USG 2000 User’s Guide...
Page 536: Ftp Wan To Dmz Bandwidth Management Example
• Fourth highest priority (4). • Disable maximize bandwidth usage since you do not want to give FTP more bandwidth. Figure 391 FTP LAN to DMZ Bandwidth Management Example Inbound: 50 Mbps Outbound: 50 Mbps ZyWALL USG 2000 User’s Guide...
Page 537: Application Patrol General Screen
This same setting also appears in the Network > Routing > Policy Route screen. Enabling or disabling it in one screen also enables or disables it in the other screen. ZyWALL USG 2000 User’s Guide...
Page 538: Application Patrol Applications
Use the application patrol Common, Instant Messenger, Peer to Peer, VoIP, or Streaming screen to manage traffic of individual applications. Use the Common screen (shown here as an example) to manage traffic of the most commonly used web, file transfer and e-mail protocols. ZyWALL USG 2000 User’s Guide...
Page 539: The Application Patrol Edit Screen
Click Reset to return the screen to its last-saved settings. 32.3.1 The Application Patrol Edit Screen Use this screen to edit the settings for an application. To access this screen, go to the application patrol Common, Instant Messenger, Peer to Peer, VoIP, or ZyWALL USG 2000 User’s Guide...
Page 540 Click this to create a new entry. Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. ZyWALL USG 2000 User’s Guide...
Page 541 If any displays, the policy is effective for every source. Destination This is the destination address or address group for whom this policy applies. If any displays, the policy is effective for every destination. ZyWALL USG 2000 User’s Guide...
Page 542 (7) regardless of this field’s configuration. This field shows whether the ZyWALL generates a log (log), a log and alert (log alert) or neither (no) when the application’s traffic matches this policy. ZyWALL USG 2000 User’s Guide...
Page 543: The Application Patrol Policy Edit Screen
Select this check box to turn on this policy for the application. Port Use this field to specify a specific port number to which to apply this policy. Type zero, if this policy applies for every port number. ZyWALL USG 2000 User’s Guide...
Page 544 PHB for DiffServ on page 365 for more details. Select preserve to have the ZyWALL keep the packets’ original DSCP value. Select default to have the ZyWALL set the DSCP value of the packets to ZyWALL USG 2000 User’s Guide...
Page 545 If the sum of the bandwidths for routes using the same next hop is higher than the actual transmission speed, lower priority traffic may not be sent if higher priority traffic uses all of the actual bandwidth. ZyWALL USG 2000 User’s Guide...
Page 546: The Other Applications Screen
ZyWALL should do more precisely. You can also control the bandwidth used by these other applications.This screen also allows you to add, edit, and remove conditions to this default policy. ZyWALL USG 2000 User’s Guide...
Page 547 This is the destination zone of the traffic to which this policy applies. Source This is the source address or address group for whom this policy applies. If any displays, the policy is effective for every source. ZyWALL USG 2000 User’s Guide...
Page 548 0. In this case the traffic is automatically treated as being set to the lowest priority (7) regardless of this field’s configuration. ZyWALL USG 2000 User’s Guide...
Page 549: The Other Applications Add/Edit Screen
Select this check box to turn on this policy. Port Use this field to specify a specific port number to which to apply this policy. Type zero, if this policy applies for every port number. ZyWALL USG 2000 User’s Guide...
Page 550 Select default to have the ZyWALL set the DSCP value of the packets to Bandwidth Configure these fields to set the amount of bandwidth the application Management can use. These fields only apply when Access is set to forward. ZyWALL USG 2000 User’s Guide...
Page 551 Chapter 51 on page 841 for more on logs. no - the ZyWALL does not record anything log - the ZyWALL creates a record in the log log alert - the ZyWALL creates an alert ZyWALL USG 2000 User’s Guide...
Page 552 Chapter 32 Application Patrol Table 144 AppPatrol > Other > Edit (continued) LABEL DESCRIPTION Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 553: Anti-Virus
561) to set up anti- virus black (blocked) and white (allowed) lists of virus file patterns. • Use the Signature screen (Section 33.6 on page 564) to search signatures to get more information about signatures. ZyWALL USG 2000 User’s Guide...
Page 554: What You Need To Know
• IMAP4 (Internet Message Access Protocol version 4) How the ZyWALL Anti-Virus Scanner Works The following describes the virus scanning process on the ZyWALL. The ZyWALL first identifies SMTP, POP3, IMAP4, HTTP and FTP packets through standard ports. ZyWALL USG 2000 User’s Guide...
Page 555 • ZIP file(s) within a ZIP file. Finding Out More • See Section 6.5.19 on page 114 for related information on these screens. • See Section 33.7 on page 567 for anti-virus background information. ZyWALL USG 2000 User’s Guide...
Page 556: Before You Begin
• You may need to customize the zones (in the Network > Zone) used for the anti-virus scanning direction. 33.2 Anti-Virus Summary Screen Click Configuration > Anti-X > Anti-Virus to display the configuration screen as shown next. Figure 399 Configuration > Anti-X > Anti-Virus > General ZyWALL USG 2000 User’s Guide...
Page 557 From The anti-virus policy has the ZyWALL scan traffic coming from this zone and going to the To zone. The anti-virus policy has the ZyWALL scan traffic going to this zone from the From zone. ZyWALL USG 2000 User’s Guide...
Page 558 Click this link to go to the screen you can use to download signatures Signatures from the update server. Apply Click Apply to save your changes. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 559: Anti-Virus Policy Add Or Edit Screen
FTP applies to traffic using the TCP port number specified for FTP in the ALG screen. SMTP applies to traffic using TCP port 25. POP3 applies to traffic using TCP port 110. IMAP4 applies to traffic using TCP port 143. ZyWALL USG 2000 User’s Guide...
Page 560 “zip” or “rar” file extension). The ZyWALL first (ZIP and RAR) decompresses the ZIP file and then scans the contents for viruses. Note: The ZyWALL decompresses a ZIP file once. The ZyWALL does NOT decompress any ZIP file(s) within a ZIP file. ZyWALL USG 2000 User’s Guide...
Page 561: Anti-Virus Black List
(blocked) list of virus file patterns. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 401 Configuration > Anti-X > Anti-Virus > Black/White List > Black List ZyWALL USG 2000 User’s Guide...
Page 562: Anti-Virus Black List Or White List Add/Edit
• For a white list entry, enter a file pattern that should cause the ZyWALL to allow a file. Figure 402 Configuration > Anti-X > Anti-Virus > Black/White List > Black List (or White List) > Add ZyWALL USG 2000 User’s Guide...
Page 563: Anti-Virus White List
Click Configuration > Anti-X > Anti-Virus > Black/White List > White List to display the screen shown next. Use the Black/White List screen to set up Anti-Virus black (blocked) and white (allowed) lists of virus file patterns. Click a ZyWALL USG 2000 User’s Guide...
Page 564: Signature Searching
Click Reset to return the screen to its last-saved settings. 33.6 Signature Searching Click Configuration > Anti-X > Anti-Virus > Signature to display this screen. Use this screen to locate signatures and display details about them. ZyWALL USG 2000 User’s Guide...
Page 565 No to continue. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 404 Configuration > Anti-X > Anti-Virus > Signature: Search by Severity ZyWALL USG 2000 User’s Guide...
Page 566 Category This column displays whether the signature is for identifying a virus or spyware. Click the column heading to sort your search results by category. ZyWALL USG 2000 User’s Guide...
Page 567: Anti-Virus Technical Reference
Once the virus is spread through the network, the number of infected networked computers can grow exponentially. Types of Anti-Virus Scanner The section describes two types of anti-virus scanner: host-based and network- based. ZyWALL USG 2000 User’s Guide...
Page 568 • NAV scanners stops virus threats at the network edge before they enter or exit a network. • NAV scanners reduce computing loading on computers as the read-time data traffic inspection is done on a dedicated security device. ZyWALL USG 2000 User’s Guide...
Page 569: Idp
Chapter 35 on page 603). Zone A zone is a combination of ZyWALL interfaces and VPN connections used for configuring security. See the zone chapter for details on zones and the interfaces chapter for details on interfaces. ZyWALL USG 2000 User’s Guide...
Page 570: Before You Begin
When the trial subscription expires, purchase and enter a license key using the same screens to continue the subscription. • Configure zones on the ZyWALL - see Chapter 17 on page 383 for more information. ZyWALL USG 2000 User’s Guide...
Page 571: The Idp General Screen
Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Edit Select an entry and click this to be able to modify it. ZyWALL USG 2000 User’s Guide...
Page 572 Click this link to go to the screen where you can register for the service. Signature The following fields display information on the current signature set Information that the ZyWALL is using. ZyWALL USG 2000 User’s Guide...
Page 573: Introducing Idp Profiles
You need to subscribe for IDP service in order to be able to download new signatures. In general, packet inspection signatures are created for known attacks while anomaly detection looks for abnormal behavior (see Chapter 35 on page 603 information on anomaly detection). ZyWALL USG 2000 User’s Guide...
Page 574: Base Profiles
Signatu res with a low or medium severity level (two or three) generate logs (not log alerts) and no action is taken on packets that trigger them. Signatures with a very low severity level (one) are disabled. ZyWALL USG 2000 User’s Guide...
Page 575: The Profile Summary Screen
Click this to create a new entry. Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. This is the entry’s index number in the list. ZyWALL USG 2000 User’s Guide...
Page 576: Creating New Profiles
Note: If Internet Explorer opens a warning screen about a script making Internet Explorer run slowly and the computer maybe becoming unresponsive, just click No to continue. Type a new profile name Enable or disable individual signatures. Edit the default log options and actions. ZyWALL USG 2000 User’s Guide...
Page 577: Profiles: Packet Inspection
Packet inspection signatures examine the contents of a packet for malicious data. It operates at layer-4 to layer-7. 34.6.1 Profile > Group View Screen Figure 408 Configuration > Anti-X > IDP > Profile > Edit: Group View ZyWALL USG 2000 User’s Guide...
Page 578 An alert is an e-mailed log for more serious events that may need more immediate attention. Select this option to have the ZyWALL send an alert when a packet matches a signature(s). ZyWALL USG 2000 User’s Guide...
Page 579 Very Low (1): These denote possible attacks caused by traffic such as Ping, trace route, ICMP queries etc. Policy Type This is the attack type as defined on the ZyWALL. See Table 156 on page for a description of each type. ZyWALL USG 2000 User’s Guide...
Page 580: Policy Types
Internet. A Distributed Denial of Service (DDoS) attack is one in which multiple compromised systems attack a single target, thereby causing denial of service for users of the targeted system. ZyWALL USG 2000 User’s Guide...
Page 581: Idp Service Groups
Web attacks refer to attacks on web servers such as IIS (Internet Information Services). 34.6.3 IDP Service Groups An IDP service group is a set of related packet inspection signatures. Table 157 IDP Service Groups WEB_PHP WEB_MISC WEB_IIS WEB_FRONTPAGE WEB_CGI WEB_ATTACKS TFTP TELNET ZyWALL USG 2000 User’s Guide...
Page 582: Profile > Query View Screen
34.6.4 Profile > Query View Screen Click Switch to query view in the screen as shown in Figure 408 on page 577 go to a signature query screen. In the query view screen, you can search for ZyWALL USG 2000 User’s Guide...
Page 583 ID fields are left blank, then all custom signatures are displayed. Name Type the name or part of the name of the signature(s) you want to find. Signature Type the ID or part of the ID of the signature(s) you want to find. ZyWALL USG 2000 User’s Guide...
Page 584 Click Save to save the configuration to the ZyWALL, but remain in the same page. You may then go to the another profile screen (tab) in order to complete the profile. Click OK in the final profile screen to complete the profile. ZyWALL USG 2000 User’s Guide...
Page 585: Query Example
Chapter 34 IDP 34.6.5 Query Example This example shows a search with these criteria: • Severity: severe and high • Attack Type: DDoS • Platform: Windows 2000 and Windows XP computers • Service: Any ZyWALL USG 2000 User’s Guide...
Page 586 Chapter 34 IDP • Actions: Any Figure 411 Query Example Search Criteria Figure 412 Query Example Search Results ZyWALL USG 2000 User’s Guide...
Page 587: Introducing Idp Custom Signatures
Flags are used to control whether routers are allowed to fragment a packet and to indicate the parts of a packet to the receiver. Fragment Offset This is a byte count from the start of the original sent packet. ZyWALL USG 2000 User’s Guide...
Page 588: Configuring Custom Signatures
Click the Add icon to create a new signature or click the Edit icon to edit an existing signature. You can also delete custom signatures here or save them to your computer. ZyWALL USG 2000 User’s Guide...
Page 589 This is the name of your custom signature. Duplicate names can exist, but it is advisable to use unique signature names that give some hint as to intent of the signature and the type of attack it is supposed to prevent. ZyWALL USG 2000 User’s Guide...
Page 590: Creating Or Editing A Custom Signature
Figure 414 on page 589. A packet must match all items you configure in this screen before it matches the signature. The more specific your signature (including packet contents), then the fewer false positives the signature will trigger. ZyWALL USG 2000 User’s Guide...
Page 591 Try to write signatures that target a vulnerability, for example a certain type of traffic on certain operating systems, instead of a specific exploit. Figure 415 Configuration > Anti-X > IDP > Custom Signatures > Add/Edit ZyWALL USG 2000 User’s Guide...
Page 592 If a datagram is fragmented, it contains a value that identifies the datagram to which the fragment belongs. Some intrusions use an invalid Identification number. Select the check box and then type in the invalid number that the intrusion uses. ZyWALL USG 2000 User’s Guide...
Page 593 The following fields vary depending on whether you choose TCP, UDP or ICMP. Transport Protocol: TCP Port Select the check box and then enter the source and destination TCP port numbers that will trigger this signature. ZyWALL USG 2000 User’s Guide...
Page 594 Payload Options The longer a payload option is, the more exact the match, the faster the signature processing. Therefore, if possible, it is recommended to have at least one payload option in your signature. ZyWALL USG 2000 User’s Guide...
Page 595 %2 for directory traversals, these signatures will not be triggered because the content is normalized out of the URI buffer. For example, the URI: /scripts/..%c0%af../winnt/system32/cmd.exe?/c+ver will get normalized into: /winnt/system32/cmd.exe?/c+ver ZyWALL USG 2000 User’s Guide...
Page 596: Custom Signature Example
As an example, say you want to check if your router is being overloaded with DNS queries so you create a signature to detect DNS query traffic. ZyWALL USG 2000 User’s Guide...
Page 597 From the details about DNS query you see that the protocol is UDP and the port is 53. The type of DNS packet is standard query and the Flag is 0x0100 with an offset of 2. Therefore enter |010| as the first pattern. ZyWALL USG 2000 User’s Guide...
Page 598: Applying Custom Signatures
After you create your custom signature, it becomes available in the IDP service group category in the Configuration > Anti-X > IDP > Profile > Edit screen. Custom signatures have an SID from 9000000 to 9999999. ZyWALL USG 2000 User’s Guide...
Page 599: Verifying Custom Signatures
All IDP signatures come under the IDP category. The Note column displays ACCESS FORWARD when no action is configured for the signature. It displays ACCESS DENIED if you configure the signature action to drop the packet. The ZyWALL USG 2000 User’s Guide...
Page 600: Idp Technical Reference
Disadvantages of host IDPs are that you have to install them on each device (that you want to protect) in your network and due to the necessarily tight integration with the host operating system, future operating system upgrades could cause problems. ZyWALL USG 2000 User’s Guide...
Page 601 These are some equivalent Snort terms in the ZyWALL. Table 162 ZyWALL - Snort Equivalent Terms ZYWALL TERM SNORT EQUIVALENT TERM Type Of Service Identification Fragmentation fragbits Fragmentation Offset fragoffset Time to Live IP Options ipopts ZyWALL USG 2000 User’s Guide...
Page 602: Ack Number
Payload Size dsize Offset (relative to start of offset payload) Relative to end of last match distance Content content Case-insensitive nocase Decode as URI uricontent Note: Not all Snort functionality is supported in the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 603: Adp
Traffic anomaly rules look for abnormal behavior or events such as port scanning, sweeping or network flooding. It operates at OSI layer-2 and layer-3. Traffic anomaly rules may be updated when you upload new firmware. ZyWALL USG 2000 User’s Guide...
Page 604: Before You Begin
IDP-related term definitions. • See Section 35.4 on page 615 for background information on these screens. 35.1.4 Before You Begin Configure the ZyWALL’s zones - see Chapter 17 on page 383 for more information. ZyWALL USG 2000 User’s Guide...
Page 605: The Adp General Screen
[ENTER] to move the entry to the number that you typed. This is the entry’s index number in the list. Priority This is the rank in the list of anomaly profile policies. The list is applied in order of priority. ZyWALL USG 2000 User’s Guide...
Page 606: The Profile Summary Screen
Click Reset to return the screen to its last-saved settings. 35.3 The Profile Summary Screen Use this screen to: • Create a new profile using an existing base profile • Edit an existing profile • Delete an existing profile ZyWALL USG 2000 User’s Guide...
Page 607: Base Profiles
Cancel Click Cancel to exit this screen without saving your changes. 35.3.2 Configuring The ADP Profile Summary Screen Select Configuration > Anti-X > ADP > Profile. Figure 422 Configuration > Anti-X > ADP > Profile ZyWALL USG 2000 User’s Guide...
Page 608: Creating New Adp Profiles
In the Configuration > Anti-X > ADP > Profile screen, click the Edit icon or click the Add icon and choose a base profile. If you made changes to other screens ZyWALL USG 2000 User’s Guide...
Page 609 Chapter 35 ADP belonging to this profile, make sure you have clicked OK or Save to save the changes before selecting the Traffic Anomaly tab. Figure 423 Profiles: Traffic Anomaly ZyWALL USG 2000 User’s Guide...
Page 610 The ZyWALL silently drops packets that matches the rule. Neither sender nor receiver are notified. This is the entry’s index number in the list. Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. ZyWALL USG 2000 User’s Guide...
Page 611: Protocol Anomaly Profiles
Add icon and choose a base profile, then select the Protocol Anomaly tab. If you made changes to other screens belonging to this profile, make sure you have clicked OK or Save to save the changes before selecting the Protocol Anomaly tab. ZyWALL USG 2000 User’s Guide...
Page 612 Chapter 35 ADP Figure 424 Profiles: Protocol Anomaly ZyWALL USG 2000 User’s Guide...
Page 613 To edit an item’s log option, select it and use the Log icon. Select whether to have the ZyWALL generate a log (log), log and alert (log alert) or neither (no) when traffic matches this anomaly rule. See Chapter 51 on page 841 for more on logs. ZyWALL USG 2000 User’s Guide...
Page 614 Select what the ZyWALL should do when a packet matches a rule. none: The ZyWALL takes no action when a packet matches the signature(s). block: The ZyWALL silently drops packets that matches the rule. Neither sender nor receiver are notified. ZyWALL USG 2000 User’s Guide...
Page 615: Adp Technical Reference
IP protocols such as EGP (Exterior Gateway Protocol) or IGP (Interior Gateway Protocol). Determining these additional protocols can help reveal if the destination device is a workstation, a printer, or a router. ZyWALL USG 2000 User’s Guide...
Page 616 • UDP Filtered Portscan • IP Filtered Portscan Portscan • TCP Filtered Decoy • UDP Filtered Decoy • IP Filtered Decoy Portscan Portscan Portscan • TCP Filtered • UDP Filtered Portsweep • IP Filtered Portsweep Portsweep ZyWALL USG 2000 User’s Guide...
Page 617 Figure 425 Smurf Attack TCP SYN Flood Attack Usually a client starts a session by sending a SYN (synchronize) packet to a server. The receiver returns an ACK (acknowledgment) packet and its own SYN, and then ZyWALL USG 2000 User’s Guide...
Page 618: Syn Flood
In a LAND attack, hackers flood SYN packets into a network with a spoofed source IP address of the network itself. This makes it appear as if the computers in the network sent the packets to themselves, so the network is unavailable while they try to respond to themselves. ZyWALL USG 2000 User’s Guide...
Page 619 “/abc/xyz”. Also, “/abc/./xyz” gets normalized to “/abc/xyz”. If a user wants to configure an alert, then specify “yes”, otherwise “no”. This alert may give false positives since some web sites refer to files using directory traversals. ZyWALL USG 2000 User’s Guide...
Page 620 % encoding. Apache uses this standard, so for any Apache servers, make sure you have this option turned on. When this rule is enabled, ASCII decoding is also enabled to enforce correct functioning. ZyWALL USG 2000 User’s Guide...
Page 621 ICMP Decoder TRUNCATED-ADDRESS- This is when an ICMP packet is sent which has an ICMP HEADER ATTACK datagram length of less than the ICMP address header length. This may cause some applications to crash. ZyWALL USG 2000 User’s Guide...
Page 622 TRUNCATED- This is when an ICMP packet is sent which has an ICMP TIMESTAMP-HEADER datagram length of less than the ICMP Time Stamp header ATTACK length. This may cause some applications to crash. ZyWALL USG 2000 User’s Guide...
Page 623: Content Filtering
• Use schedule objects to define when to apply a content filter profile. • Use address and/or user/group objects to define to whose web access to apply the content filter profile. • Apply a content filter profile that you have custom-tailored. ZyWALL USG 2000 User’s Guide...
Page 624: Content Filtering
URL. For example, with the URL www.zyxel.com.tw/news/ pressroom.php, the domain name is www.zyxel.com.tw. The file path is the characters that come after the first slash in the URL. For example, with the URL www.zyxel.com.tw/news/pressroom.php, the file path is news/pressroom.php. ZyWALL USG 2000 User’s Guide...
Page 625: Before You Begin
Licensing > Registration screens). 36.2 Content Filter General Screen Click Configuration > Anti-X > Content Filter > General to open the Content Filter General screen. Use this screen to enable content filtering, view and order ZyWALL USG 2000 User’s Guide...
Page 626 Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. ZyWALL USG 2000 User’s Guide...
Page 627 The web page you specify here opens in a new frame below the denied access message. Use “http://” or “https://” followed by up to 255 characters (0-9a- zA-Z;/?:@&=+$\.-_!~*'()%). For example, http://192.168.1.17/ blocked access. ZyWALL USG 2000 User’s Guide...
Page 628: Content Filter Policy Add Or Edit Screen
36.3 Content Filter Policy Add or Edit Screen Click Configuration > Anti-X > Content Filter > General > Add or Edit to open the Content Filter Policy screen. Use this screen to configure a content ZyWALL USG 2000 User’s Guide...
Page 629 Select any to have the content filter policy apply to all of the web access requests that the ZyWALL receives from any user. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 630: Content Filter Profile Screen
Note: You must register for external content filtering before you can use it. See Section 11.2 on page 271 for how to register. ZyWALL USG 2000 User’s Guide...
Page 631 Chapter 36 Content Filtering Chapter 37 on page 649 for how to view content filtering reports. Figure 431 Configuration > Anti-X > Content Filter > Filter Profile > Add ZyWALL USG 2000 User’s Guide...
Page 632 Chapter 36 Content Filtering Figure 432 Configuration > Anti-X > Content Filter > Filter Profile > Add (Continue) ZyWALL USG 2000 User’s Guide...
Page 633 The ZyWALL then blocks or forwards access to the web page depending on the configuration of the rest of this page. ZyWALL USG 2000 User’s Guide...
Page 634 Select Warn to display a warning message before allowing users to access web pages that the external web filtering service has not categorized. Select Log to record attempts to access web pages that are not categorized. ZyWALL USG 2000 User’s Guide...
Page 635 (that is, it alerts that it will send personal information, be installed, or that it will log keystrokes). Note: Sites rated as spyware should have a second category assigned with them. ZyWALL USG 2000 User’s Guide...
Page 636 This category includes pages that contain images or offer the Swimsuit sale of swimsuits or intimate apparel or other types of suggestive clothing. It does not include pages selling undergarments as a subsection of other products offered. ZyWALL USG 2000 User’s Guide...
Page 637 It does not include pages that promote collecting weapons, or groups that either support or oppose weapons use. ZyWALL USG 2000 User’s Guide...
Page 638 Software Downloads This category includes pages that are dedicated to the electronic download of software packages, whether for payment or at no charge. Society/Government ZyWALL USG 2000 User’s Guide...
Page 639 This category includes pages that offer access to Usenet news Pages groups or other messaging or bulletin board systems. Also, blog specific sites or an individual with his own blog. This does not include social networking communities with blogs. ZyWALL USG 2000 User’s Guide...
Page 640 Internet Telephony This category includes pages that facilitate Internet telephony or provide Internet telephony services such as voice over IP (VoIP). Health Related ZyWALL USG 2000 User’s Guide...
Page 641 It also includes pages dedicated to selling board games as well as journals and magazines dedicated to game playing. It includes pages that support or host online sweepstakes and giveaways. ZyWALL USG 2000 User’s Guide...
Page 642 Web Advertisements This category includes pages that provide online advertisements or banners. This does not include advertising servers that serve adult-oriented advertisements. Technology Computers/Internet This category includes pages that sponsor or provide information on computers, technology, the Internet and technology-related organizations and companies. ZyWALL USG 2000 User’s Guide...
Page 643 Click this button to see the category recorded in the external Filter Category Server content filter server’s database for the web page you specified. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 644: Content Filter Blocked And Warning Messages
(allowed) web site addresses and a list of bad (blocked) web site addresses. You can also block web sites based on whether the web site’s address contains a keyword. Use this screen to add or remove specific sites or keywords from the filter list. ZyWALL USG 2000 User’s Guide...
Page 645 When this box is selected, the ZyWALL blocks Web access to trusted web sites only sites that are not on the Trusted Web Sites list. If they are chosen carefully, this is the most effective way to block objectionable material. ZyWALL USG 2000 User’s Guide...
Page 646 Click this to create a new entry. Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. ZyWALL USG 2000 User’s Guide...
Page 647: Content Filter Technical Reference
(such as Bad for example). Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. 36.7 Content Filter Technical Reference This section provides content filtering background information. ZyWALL USG 2000 User’s Guide...
Page 648 ZyWALL, which then blocks and/or logs access to the web site based on the settings in the content filter profile. The web site’s address and category are then stored in the ZyWALL’s content filter cache. ZyWALL USG 2000 User’s Guide...
Page 649: Content Filter Reports
You need to register your iCard before you can view content filtering reports. Alternatively, you can also view content filtering reports during the free trial (up to 30 days). Go to http://www.myZyXEL.com. ZyWALL USG 2000 User’s Guide...
Page 650 Chapter 37 Content Filter Reports Fill in your myZyXEL.com account information and click Login. Figure 435 myZyXEL.com: Login ZyWALL USG 2000 User’s Guide...
Page 651 Registered ZyXEL Products (the ZyWALL 70 is shown as an example here). You can change the descriptive name for your ZyWALL using the Rename button in the Service Management screen (see Figure 437 on page 652). Figure 436 myZyXEL.com: Welcome ZyWALL USG 2000 User’s Guide...
Page 652 In the Service Management screen click Content Filter in the Service Name column to open the content filter reports screens. Figure 437 myZyXEL.com: Service Management In the Web Filter Home screen, click the Reports tab. Figure 438 Content Filter Reports Main Screen ZyWALL USG 2000 User’s Guide...
Page 653 Action Taken field and a category (or enter the user name if you want to view single user reports) and click Run Report.The screens vary according to the report type you selected in the Report Home screen. ZyWALL USG 2000 User’s Guide...
Page 654 Chapter 37 Content Filter Reports A chart and/or list of requested web site categories display in the lower half of the screen. Figure 440 Global Report Screen Example ZyWALL USG 2000 User’s Guide...
Page 655 Chapter 37 Content Filter Reports You can click a category in the Categories report or click URLs in the Report Home screen to see the URLs that were requested. Figure 441 Requested URLs Example ZyWALL USG 2000 User’s Guide...
Page 656 Chapter 37 Content Filter Reports ZyWALL USG 2000 User’s Guide...
Page 657: Anti-Spam
The white list can also increases the ZyWALL’s anti-spam speed and efficiency by not having the ZyWALL perform the full anti-spam checking process on legitimate e-mail. ZyWALL USG 2000 User’s Guide...
Page 658 For example, in Microsoft’s Outlook Express, select a mail and click File > Properties > Details. This displays the e-mail’s header. Click Message Source to see the source for the entire mail including both the header and the body. ZyWALL USG 2000 User’s Guide...
Page 659: Before You Begin
Configure your zones before you configure anti-spam. 38.3 The Anti-Spam General Screen Click Configuration > Anti-X > Anti-Spam to open the Anti-Spam General screen. Use this screen to turn the anti-spam feature on or off and manage anti- ZyWALL USG 2000 User’s Guide...
Page 660 Click this to create a new entry . Select an entry and click Add to create a new entry after the selected entry. Edit Select an entry and click this to be able to modify it. ZyWALL USG 2000 User’s Guide...
Page 661: The Anti-Spam Policy Add Or Edit Screen
Click the Add or Edit icon in the Configuration > Anti-X > Anti-Spam > General screen to display the configuration screen as shown next. Use this screen to configure an anti-spam policy that controls what traffic direction of e-mail to ZyWALL USG 2000 User’s Guide...
Page 662 To zone. Protocols to Select which protocols of traffic to scan for spam. Scan SMTP applies to traffic using TCP port 25. POP3 applies to traffic using TCP port 110. ZyWALL USG 2000 User’s Guide...
Page 663: The Anti-Spam Black List Screen
Configure the black list to identify spam e-mail. You can create black list entries based on the sender’s or relay server’s IP address or e-mail address. You can also create entries that check for particular e-mail header fields with specific values or ZyWALL USG 2000 User’s Guide...
Page 664 This field displays the subject content, source or relay IP address, source e-mail address, or header value for which the entry checks. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 665: The Anti-Spam Black Or White List Add/Edit Screen
This field displays when you select the Subject type. Enter up to 63 Keyword ASCII characters of text to check for in e-mail headers. Spaces are not allowed, although you could substitute a question mark (?). See Section 38.4.2 on page 666 for more details. ZyWALL USG 2000 User’s Guide...
Page 666: Regular Expressions In Black Or White List Entries
You cannot use two wildcards side by side, there must be other characters between them. • The ZyWALL checks the first header with the name you specified in the entry. So if the e-mail has more than one “Received” header, the ZyWALL checks the first one. ZyWALL USG 2000 User’s Guide...
Page 667: The Anti-Spam White List Screen
To turn off an entry, select it and click Inactivate. Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. This is the entry’s index number in the list. ZyWALL USG 2000 User’s Guide...
Page 668: The Dnsbl Screen
DNSBL screen. Use this screen to configure the ZyWALL to check the sender and relay IP addresses in e-mail headers against DNS (Domain Name Service)-based spam Black Lists (DNSBLs). Figure 447 Configuration > Anti-X > Anti-Spam > DNSBL ZyWALL USG 2000 User’s Guide...
Page 669 Enter a message or label (up to 15 ASCII characters) to add to the mail subject of e-mails that the ZyWALL forwards if queries to the DNSBL domains time out. DNSBL Domain List Click this to create a new entry. ZyWALL USG 2000 User’s Guide...
Page 670: Anti-Spam Technical Reference
• The ZyWALL records DNSBL responses for IP addresses in a cache for up to 72 hours. The ZyWALL checks an e-mail’s sender and relay IP addresses against the cache first and only sends DNSBL queries for IP addresses that are not in the cache. ZyWALL USG 2000 User’s Guide...
Page 671 In this example it was an SMTP mail and the defined action was to drop the mail. The ZyWALL does not wait for any more DNSBL replies. ZyWALL USG 2000 User’s Guide...
Page 672 Now that the ZyWALL has received at least one non-spam reply for each of the e- mail’s routing IP addresses, the ZyWALL immediately classifies the e-mail as legitimate and forwards it. The ZyWALL does not wait for any more DNSBL replies. ZyWALL USG 2000 User’s Guide...
Page 673 In this example it was an SMTP mail and the defined action was to drop the mail. The ZyWALL does not wait for any more DNSBL replies. ZyWALL USG 2000 User’s Guide...
Page 674 Chapter 38 Anti-Spam ZyWALL USG 2000 User’s Guide...
Page 675: Device Ha
VRRP group settings and synchronize backup ZyWALLs. 39.1.2 What You Need to Know Active-Passive Mode and Legacy Mode • Active-passive mode lets a backup ZyWALL take over if the master ZyWALL fails. ZyWALL USG 2000 User’s Guide...
Page 676: Before You Begin
ZyWALLs are both subscribed. For example, a backup subscribed to IDP/ AppPatrol, but not anti-virus, gets IDP/AppPatrol updates from the master, but not anti-virus updates. It is highly recommended to subscribe the master and backup ZyWALLs to the same services. ZyWALL USG 2000 User’s Guide...
Page 677: Device Ha General
You can use this IP address and subnet mask to access the ZyWALL whether it is in master or backup mode. Link Status This tells whether the monitored interface’s connection is down or up. ZyWALL USG 2000 User’s Guide...
Page 678: The Active-Passive Mode Screen
ZyWALL A and backup ZyWALL B form a virtual router. Figure 453 Virtual Router Cluster ID You can have multiple ZyWALL virtual routers on your network. Use a different cluster ID to identify each virtual router. In the following example, ZyWALLs A and ZyWALL USG 2000 User’s Guide...
Page 679 IP address to manage the ZyWALL regardless of whether it is the master or the backup. For example, ZyWALL B takes over A’s 192.168.1.1 LAN interface IP address. This is a virtual router IP address. ZyWALL A keeps it’s LAN management IP address of ZyWALL USG 2000 User’s Guide...
Page 680: Configuring Active-Passive Mode Device Ha
HA settings, view and manage the list of monitored interfaces, and synchronize backup ZyWALLs. To access this screen, click Configuration > Device HA > Active-Passive Mode. Figure 456 Configuration > Device HA > Active-Passive Mode ZyWALL USG 2000 User’s Guide...
Page 681 The password can consist of alphanumeric characters, the underscore, and some punctuation marks (+-/*= :; .! @$&%#~ ‘ \ () ), and it can be up to eight characters long. Authentication Types on page 381 for more information about authentication methods. ZyWALL USG 2000 User’s Guide...
Page 682: Synchronization
Secure FTP port number. Click the link if you need to change the FTP port number. Every ZyWALL in the virtual router must use the same port number. If the master ZyWALL changes, you have to manually change this port number in the backups. ZyWALL USG 2000 User’s Guide...
Page 683: Configuring An Active-Passive Mode Monitored Interface
Ethernet interface to a bridge, the ZyWALL retains the interface’s device HA settings and uses them again if you later remove the interface from the bridge. If the bridge is later deleted or the interface is removed from it, Device HA will recover the interface’s setting. ZyWALL USG 2000 User’s Guide...
Page 684 Manage IP Enter the subnet mask of the interface’s management IP address. Subnet Mask Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 685: The Legacy Mode Screen
Link monitoring has a backup ZyWALL take over all of an unavailable master ZyWALL’s static IP addresses. This way the backup ZyWALL takes over all of the master ZyWALL’s functions. This also means you can only access the original master ZyWALL through its management IP address. ZyWALL USG 2000 User’s Guide...
Page 686: Configuring The Legacy Mode Screen
To turn on an entry, select it and click Activate. Activating a VRRP group has the ZyWALL monitor the connection of the group’s interface. Each interface must have a static IP address and be connected to the same subnet as the group’s interface on the other ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 687 This field is only available if Auto Synchronize is checked. Type the number of minutes to wait between synchronizations. Next Sync Time This appears the next time and date (in hh:mm yyyy-mm-dd format) the ZyWALL will synchronize with the master. ZyWALL USG 2000 User’s Guide...
Page 688 The Device HA Legacy Mode Add or Edit screen lets you configure a VRRP group. To access this screen, click Configuration > Device HA > Legacy Mode > Add (or Edit). Figure 459 Configuration > Device HA > Legacy Mode > Add ZyWALL USG 2000 User’s Guide...
Page 689 Select this if the selected interface should become the master interface if a lower-priority interface is the master when this one is enabled. (If the role is Master, the interface preempts by default.) Virtual Router Settings ZyWALL USG 2000 User’s Guide...
Page 690: Device Ha Technical Reference
Here are two ways to avoid a broadcast storm when you connect the bridge interfaces on two ZyWALLs. First Option for Connecting the Bridge Interfaces on Two ZyWALLs The first way is to activate device HA before connecting the bridge interfaces as shown in the following example. ZyWALL USG 2000 User’s Guide...
Page 691 HA. Br0 {ge4, ge5} Configure the bridge interface on the backup ZyWALL, set the bridge interface as a monitored interface, and activate device HA. Br0 {ge4, ge5} Br0 {ge4, ge5} ZyWALL USG 2000 User’s Guide...
Page 692 In this case the ZyWALLs are already connected, but the bridge faces have not been configured yet. Configure a disabled bridge interface on the master ZyWALL but disable it. Then set the bridge interface as a monitored interface, and activate device HA. Br0 {ge4, ge5} Disabled ZyWALL USG 2000 User’s Guide...
Page 693 Br0 {ge4, ge5} Disabled Br0 {ge4, ge5} Disabled Enable the bridge interface on the master ZyWALL and then on the backup ZyWALL. Br0 {ge4, ge5} Br0 {ge4, ge5} Connect the ZyWALLs. Br0 {ge4, ge5} Br0 {ge4, ge5} ZyWALL USG 2000 User’s Guide...
Page 694 The loss of ZyWALL A has no effect on the network. If there is more than one backup ZyWALL, the backup ZyWALL with the highest priority becomes the master. The other backup ZyWALLs remain backups. ZyWALL USG 2000 User’s Guide...
Page 695 • The backup ZyWALL cannot be the master in any active VRRP group. This refers to the actual role at the time of synchronization, not the role setting in the VRRP group. The backup applies the entire configuration if it is different from the backup’s current configuration. ZyWALL USG 2000 User’s Guide...
Page 696 Chapter 39 Device HA ZyWALL USG 2000 User’s Guide...
Page 697: User/Group
User Types These are the types of user accounts the ZyWALL uses. Table 186 Types of User Accounts TYPE ABILITIES LOGIN METHOD(S) Admin Users admin Change ZyWALL configuration (web, CLI) WWW, TELNET, SSH, FTP, Console, Dial-in ZyWALL USG 2000 User’s Guide...
Page 698 User account in the remote server. User account (Ext-User) in the ZyWALL. Default user account for AD users (ad-users), LDAP users (ldap-users) or RADIUS users (radius-users) in the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 699 • See Section 7.7 on page 144 for an example of how to use a RADIUS server to authenticate user accounts based on groups. ZyWALL USG 2000 User’s Guide...
Page 700: User Summary Screen
40.2.1.1 Rules for User Names Enter a user name from 1 to 31 characters. The user name can only contain the following characters: • Alphanumeric A-z 0-9 (there is no unicode support) • _ [underscores] ZyWALL USG 2000 User’s Guide...
Page 701 To access this screen, go to the User screen (see Section 40.2 on page 700), and click either the Add icon or an Edit icon. Figure 463 Configuration > User/Group > User > Add ZyWALL USG 2000 User’s Guide...
Page 702 (see Section 40.4 on page 705), the users can select this check box on their screen as well. In this case, the session is automatically renewed before the lease time expires. ZyWALL USG 2000 User’s Guide...
Page 703: User Group Summary Screen
Object Select an entry and click Object References to open a screen that References shows which settings use the entry. See Section 13.3.2 on page 297 an example. ZyWALL USG 2000 User’s Guide...
Page 704: Group Add/Edit Screen
This value is case-sensitive. User group names have to be different than user names. Description Enter the description of the user group, if any. You can use up to 60 characters, punctuation marks, and spaces. ZyWALL USG 2000 User’s Guide...
Page 705: Setting Screen
The Setting screen controls default settings, login settings, lockout settings, and other user settings for the ZyWALL. You can also use this screen to specify when users must log in to the ZyWALL before it routes traffic for them. ZyWALL USG 2000 User’s Guide...
Page 706 Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. This field is a sequential value, and it is not associated with a specific entry. ZyWALL USG 2000 User’s Guide...
Page 707 This field is effective when Enable user idle detection is checked. Type the number of minutes each access user can be logged in and idle before the ZyWALL automatically logs out the access user. User Logon Settings ZyWALL USG 2000 User’s Guide...
Page 708: Default User Authentication Timeout Settings Edit Screens
These default authentication timeout settings also control the settings for any existing user accounts that are set to use the default settings. You can still manually configure any user account’s authentication timeout settings. ZyWALL USG 2000 User’s Guide...
Page 709 Unlike Lease Time, the user has no opportunity to renew the session without logging out. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 710: User Aware Login Example
Remaining This field displays the amount of time that remains before the ZyWALL time before automatically logs the access user out, regardless of the lease time. auth. timeout ZyWALL USG 2000 User’s Guide...
Page 711: User /Group Technical Reference
Web Configurator, to create the accounts. Extract the user names from the LDAP or RADIUS server, and create a shell script that creates the user accounts. See Chapter 52 on page 861 for more information about shell scripts. ZyWALL USG 2000 User’s Guide...
Page 712 Chapter 40 User/Group ZyWALL USG 2000 User’s Guide...
Page 713: Addresses
WAN IP addresses for LAN to WAN traffic. 41.2 Address Summary Screen The address screens are used to create, maintain, and remove addresses. There are the types of address objects. • HOST - a host address is defined by an IP Address. ZyWALL USG 2000 User’s Guide...
Page 714 This field displays the IP addresses represented by each address object. If the object’s settings are based on one of the ZyWALL’s interfaces, the name of the interface displays first followed by the object’s current address settings. ZyWALL USG 2000 User’s Guide...
Page 715: Address Add/Edit Screen
This field is only available if the Address Type is SUBNET, in which case this field cannot be blank. Enter the subnet mask of the network that this address object represents. Use dotted decimal format. ZyWALL USG 2000 User’s Guide...
Page 716: Address Group Summary Screen
This field is a sequential value, and it is not associated with a specific address group. Name This field displays the name of each address group. Description This field displays the description of each address group, if any. ZyWALL USG 2000 User’s Guide...
Page 717: Address Group Add/Edit Screen
Move any members you do not want included to the Available list. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 718 Chapter 41 Addresses ZyWALL USG 2000 User’s Guide...
Page 719: Services
Then, the connection is terminated. In contrast, computers use UDP to send short messages to each other. There is no guarantee that the messages arrive in sequence or that the messages arrive at all. ZyWALL USG 2000 User’s Guide...
Page 720: The Service Summary Screen
In addition, this screen allows you to add, edit, and remove services. To access this screen, log in to the Web Configurator, and click Configuration > Object > Service > Service. Click a column’s heading cell to sort the table ZyWALL USG 2000 User’s Guide...
Page 721 This field is a sequential value, and it is not associated with a specific service. Name This field displays the name of each service. Content This field displays a description of each service. ZyWALL USG 2000 User’s Guide...
Page 722: The Service Add/Edit Screen
Click Cancel to exit this screen without saving your changes. 42.3 The Service Group Summary Screen The Service Group summary screen provides a summary of all service groups. In addition, this screen allows you to add, edit, and remove service groups. ZyWALL USG 2000 User’s Guide...
Page 723 This field displays the name of each service group. By default, the ZyWALL uses services starting with “Default_Allow_” in the firewall rules to allow certain services to connect to the ZyWALL. Description This field displays the description of each service group, if any. ZyWALL USG 2000 User’s Guide...
Page 724: The Service Group Add/Edit Screen
Move any members you do not want included to the Available list. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 725: Schedules
(Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, and Saturday). Recurring schedules always begin and end in the same day. Recurring schedules are useful for defining the workday and off-work hours. ZyWALL USG 2000 User’s Guide...
Page 726: The Schedule Summary Screen
This field displays the name of the schedule, which is used to refer to the schedule. Start Day / This field displays the date and time at which the schedule begins. Time Stop Day / This field displays the date and time at which the schedule ends. Time ZyWALL USG 2000 User’s Guide...
Page 727: The One-Time Schedule Add/Edit Screen
Name Type the name used to refer to the one-time schedule. You may use 1- 31 alphanumeric characters, underscores( ), or dashes (-), but the first character cannot be a number. This value is case-sensitive. ZyWALL USG 2000 User’s Guide...
Page 728: The Recurring Schedule Add/Edit Screen
Click Cancel to exit this screen without saving your changes. 43.2.2 The Recurring Schedule Add/Edit Screen The Recurring Schedule Add/Edit screen allows you to define a recurring schedule or edit an existing one. To access this screen, go to the Schedule screen ZyWALL USG 2000 User’s Guide...
Page 729 Weekly Week Days Select each day of the week the recurring schedule is effective. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 730 Chapter 43 Schedules ZyWALL USG 2000 User’s Guide...
Page 731: Aaa Server
The ZyWALL tries to bind (or log in) to the LDAP/AD server. When the binding process is successful, the ZyWALL checks the user information in the directory against the user name and password pair. If it matches, the user is allowed access. Otherwise, access is blocked. ZyWALL USG 2000 User’s Guide...
Page 732: Radius Server
44.1.4 What You Can Do in this Chapter • Use the Configuration > Object > AAA Server > Active Directory (or LDAP) screens (Section 44.2 on page 735) to configure Active Directory or LDAP server objects. ZyWALL USG 2000 User’s Guide...
Page 733: What You Need To Know
RADIUS server. RADIUS authentication allows you to validate a large number of users from a central location. Directory Structure The directory entries are arranged in a hierarchical order much like a tree structure. Normally, the directory structure reflects the geographical or ZyWALL USG 2000 User’s Guide...
Page 734 If the bind password is incorrect, the login will fail. Finding Out More • See Section 7.6.3 on page 137 for an example of how to set up user authentication using a radius server. ZyWALL USG 2000 User’s Guide...
Page 735: Active Directory Or Ldap Server Summary
44.2.1 Adding an Active Directory or LDAP Server Click Object > AAA Server > Active Directory (or LDAP) to display the Active Directory (or LDAP) screen. Click the Add icon or an Edit icon to display the ZyWALL USG 2000 User’s Guide...
Page 736 Specify the port number on the AD or LDAP server to which the ZyWALL sends authentication requests. Enter a number between 1 and 65535. This port number should be the same on all AD or LDAP se rver(s) in this group. ZyWALL USG 2000 User’s Guide...
Page 737: Radius Server Summary
Click OK to save the changes. Cancel Click Cancel to discard the changes. 44.3 RADIUS Server Summary Use the RADIUS screen to manage the list of RADIUS servers the ZyWALL can use in authenticating users. ZyWALL USG 2000 User’s Guide...
Page 738 Search timeout occurs when either the user information is not in the RADIUS server or the RADIUS server is down. Apply Click Apply to save the changes. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 739: Adding A Radius Server
If the RADIUS server has a backup server, enter its address here. Address Backup Specify the port number on the RADIUS server to which the ZyWALL Authentication sends authentication requests. Enter a number between 1 and 65535. Port ZyWALL USG 2000 User’s Guide...
Page 740 “sales”, “RD”, and “management”. Then you could also create a ext- group-user user object for each group. One with “sales” as the group identifier, another for “RD” and a third for “management”. Click OK to save the changes. Cancel Click Cancel to discard the changes. ZyWALL USG 2000 User’s Guide...
Page 741: Authentication Method
VPN connection. Refer to the chapter on VPN for more information. Follow the steps below to specify the authentication method for a VPN connection. Access the Configuration > VPN > IPSec VPN > VPN Gateway > Edit screen. ZyWALL USG 2000 User’s Guide...
Page 742: Authentication Method Objects
Object Select an entry and click Object References to open a screen that shows References which settings use the entry. See Section 13.3.2 on page 297 for an example. ZyWALL USG 2000 User’s Guide...
Page 743: Creating An Authentication Method Object
ZyWALL does not continue the search on the second authentication server when you enter the username and password that doesn’t match the one on the first authentication server. Note: You can NOT select two server objects of the same type. ZyWALL USG 2000 User’s Guide...
Page 744 If two accounts with the same username exist on two authentication servers you specify, the ZyWALL does not continue the search on the second authentication server when you enter the username and password that doesn’t match the one on the first authentication server. ZyWALL USG 2000 User’s Guide...
Page 745 Click Add to add a new entry. Click Edit to edit the settings of an entry. Click Delete to delete an entry. Click OK to save the changes. Cancel Click Cancel to discard the changes. ZyWALL USG 2000 User’s Guide...
Page 746 Chapter 45 Authentication Method ZyWALL USG 2000 User’s Guide...
Page 747: Certificates
Tim wants to send a message to Jenny. He needs her to be sure that it comes from him, and that the message content has not been altered by anyone else along the way. Tim generates a public key pair (one public key and one private key). ZyWALL USG 2000 User’s Guide...
Page 748 • Key distribution is simple and very secure since you can freely distribute public keys and you never need to transmit private keys. Self-signed Certificates You can have the ZyWALL act as a certification authority and sign its own certificates. ZyWALL USG 2000 User’s Guide...
Page 749: Verifying A Certificate
MD5 or SHA1 algorithm. The following procedure describes how to check a certificate’s fingerprint to verify that you have the actual certificate. Browse to where you have the certificate saved on your computer. ZyWALL USG 2000 User’s Guide...
Page 750 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields. The secure method may very based on your situation. Possible examples would be over the telephone or through an HTTPS connection. ZyWALL USG 2000 User’s Guide...
Page 751: The My Certificates Screen
This field displays the certificate index number. The certificates are listed in alphabetical order. Name This field displays the name used to identify this certificate. It is recommended that you give each certificate a unique name. ZyWALL USG 2000 User’s Guide...
Page 752: The My Certificates Add Screen
Click Refresh to display the current validity status of the certificates. 46.2.1 The My Certificates Add Screen Click Configuration > Object > Certificate > My Certificates and then the Add icon to open the My Certificates Add screen. Use this screen to have the ZyWALL USG 2000 User’s Guide...
Page 753 Chapter 46 Certificates ZyWALL create a self-signed certificate, enroll a certificate with a certification authority or generate a certification request. Figure 495 Configuration > Object > Certificate > My Certificates > Add ZyWALL USG 2000 User’s Guide...
Page 754 Create a self- Select this to have the ZyWALL generate the certificate and act as signed certificate the Certification Authority (CA) itself. This way you do not need to apply to a certification authority for certificates. ZyWALL USG 2000 User’s Guide...
Page 755 You must have the certification authority’s certificate already imported in the Trusted Certificates screen. Click Trusted CAs to go to the Trusted Certificates screen where you can view (and manage) the ZyWALL's list of certificates of trusted certification authorities. ZyWALL USG 2000 User’s Guide...
Page 756 Return and check your information in the My Certificate Create screen. Make sure that the certification authority information is correct and that your Internet connection is working properly if you want the ZyWALL to enroll a certificate online. ZyWALL USG 2000 User’s Guide...
Page 757: The My Certificates Edit Screen
Edit icon to open the My Certificate Edit screen. You can use this screen to view in-depth certificate information and change the certificate’s name. Figure 496 Configuration > Object > Certificate > My Certificates > Edit ZyWALL USG 2000 User’s Guide...
Page 758 “none” displays for a certification request. Valid To This field displays the date that the certificate expires. The text displays in red and includes an Expired! message if the certificate has expired. “none” displays for a certification request. ZyWALL USG 2000 User’s Guide...
Page 759 Private Key Type the certificate’s password and click this button. Click Save in the File Download screen. The Save As screen opens, browse to the location that you want to use and click Save. ZyWALL USG 2000 User’s Guide...
Page 760: The My Certificates Import Screen
Type in the location of the file you want to upload in this field or click Browse to find it. You cannot import a certificate with the same name as a certificate that is already in the ZyWALL. Browse Click Browse to find the certificate file you want to upload. ZyWALL USG 2000 User’s Guide...
Page 761: The Trusted Certificates Screen
Uploading a new firmware or default configuration file does not delete your certificates. To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so. Subsequent certificates move up by one when you take this action. ZyWALL USG 2000 User’s Guide...
Page 762: The Trusted Certificates Edit Screen
Edit icon to open the Trusted Certificates Edit screen. Use this screen to view in-depth information about the certificate, change the certificate’s name and set whether or not you want the ZyWALL to check a certification ZyWALL USG 2000 User’s Guide...
Page 763 Chapter 46 Certificates authority’s list of revoked certificates before trusting a certificate issued by the certification authority. Figure 499 Configuration > Object > Certificate > Trusted Certificates > Edit ZyWALL USG 2000 User’s Guide...
Page 764 (usually a certification authority). Password Type the password (up to 31 ASCII characters) from the entity maintaining the CRL directory server (usually a certification authority). Certificate These read-only fields display detailed information about the Information certificate. ZyWALL USG 2000 User’s Guide...
Page 765 This is the certificate’s message digest that the ZyWALL calculated using the MD5 algorithm. You can use this value to verify with the certification authority (over the phone for example) that this is actually their certificate. ZyWALL USG 2000 User’s Guide...
Page 766: The Trusted Certificates Import Screen
ZyWALL. Note: You must remove any spaces from the certificate’s filename before you can import the certificate. Figure 500 Configuration > Object > Certificate > Trusted Certificates > Import ZyWALL USG 2000 User’s Guide...
Page 767: Certificates Technical Reference
The second is a reduction in network traffic since the ZyWALL only gets information on the certificates that it needs to verify, not a huge list. When the ZyWALL requests certificate status information, the OCSP server returns a “expired”, “current” or “unknown” response. ZyWALL USG 2000 User’s Guide...
Page 768 Chapter 46 Certificates ZyWALL USG 2000 User’s Guide...
Page 769: Isp Accounts
ISP accounts in the ZyWALL. 47.2 ISP Account Summary This screen provides a summary of ISP accounts in the ZyWALL. To access this screen, click Configuration > Object > ISP Account. Figure 501 Configuration > Object > ISP Account ZyWALL USG 2000 User’s Guide...
Page 770: Isp Account Edit
Account screen. (See Section 47.2 on page 769.) Then, click on an Add icon or Edit icon to open the ISP Account Edit screen below. Figure 502 Configuration > Object > ISP Account > Edit ZyWALL USG 2000 User’s Guide...
Page 771 If this ISP account uses the PPPoE protocol, type the PPPoE service name to access. PPPoE uses the specified service name to identify and reach the PPPoE server. This field can be blank. If this ISP account uses the PPTP protocol, this field is not displayed. ZyWALL USG 2000 User’s Guide...
Page 772: Stac Compression
ISP Account Edit screen. Cancel Click Cancel to return to the ISP Account screen without creating the profile (if it is new) or saving any changes to the profile (if it already exists). ZyWALL USG 2000 User’s Guide...
Page 773: Ssl Application
Available SSL application names are displayed as links in remote user screens. Depending on the application type, remote users can simply click the links or follow the steps in the pop-up dialog box to access. ZyWALL USG 2000 User’s Guide...
Page 774: Example: Specifying A Web Site For Access
This example shows you how to create a web-based application for an internal web site. The address of the web site is http://info with web page encryption. Click Configuration > Object > SSL Application in the navigation panel. ZyWALL USG 2000 User’s Guide...
Page 775: The Ssl Application Screen
48.2 The SSL Application Screen The main SSL Application screen displays a list of the configured SSL application objects. Click Configuration > Object > SSL Application in the navigation panel. Figure 505 Configuration > Object > SSL Application ZyWALL USG 2000 User’s Guide...
Page 776: Creating/Editing A Web-Based Ssl Application Object
To configure a web-based application, click the Add or Edit button in the SSL Application screen and select Web Application in the Type field to display the configuration screen as shown. Figure 506 Configuration > Object > SSL Application > Add/Edit: Web Application ZyWALL USG 2000 User’s Guide...
Page 777 If a link contains a file that is not within this domain, then remote users cannot access it. Preview This field displays if the Server Type is set to Web Server, OWA or Weblink. Click Preview to access the URL you specified in a new IE web browser. ZyWALL USG 2000 User’s Guide...
Page 778: Creating/Editing A File Sharing Ssl Application Object
To configure a file share, click the Add or Edit button in the SSL Application screen and select File Sharing in the Type field. The configuration screen displays as shown. ZyWALL USG 2000 User’s Guide...
Page 779 Click this to access the URL you specified in a new IE web browser. Click Ok to save the changes and return to the main SSL Application Configuration screen. Cancel Click Cancel to discard the changes and return to the main SSL Application Configuration screen. ZyWALL USG 2000 User’s Guide...
Page 780 Chapter 48 SSL Application ZyWALL USG 2000 User’s Guide...
Page 781: Endpoint Security
SSL VPN access policy; in this example a web server. SSL VPN user C fails all of the SSL VPN’s endpoint security check and is not given any access. Figure 508 Endpoint Security ZyWALL USG 2000 User’s Guide...
Page 782: What You Can Do In This Chapter
User computers must have Sun’s Java (Java Runtime Environment or ‘JRE’) installed and enabled with a minimum version of 1.4. Finding Out More Section 7.8 on page 146 for an example of how to use endpoint security and authentication policies. ZyWALL USG 2000 User’s Guide...
Page 783: Endpoint Security Screen
Enter a message to display when a user’s computer fails the endpoint Failure security check. Use up to 1023 characters (0-9a-zA-Z;/?:@=+$\.- Message _!*'()%,”). For example, “Endpoint Security checking failed. Please contact your network administrator for help.”. ZyWALL USG 2000 User’s Guide...
Page 784: Endpoint Security Add/Edit
Click Configuration > Object > Endpoint Security and then the Add (or Edit) icon to open the Endpoint Security Edit screen. Use this screen to configure an endpoint security object. Figure 510 Configuration > Object > Endpoint Security > Add ZyWALL USG 2000 User’s Guide...
Page 785 Chapter 49 Endpoint Security ZyWALL USG 2000 User’s Guide...
Page 786 The user’s computer must have one of the listed personal firewalls to pass this checking item. For some personal firewalls the ZyWALL can also detect whether or not the firewall is activated; in those cases it must also be activated. ZyWALL USG 2000 User’s Guide...
Page 787 The user's computer must not have any of the listed applications running to pass this checking item. Include the filename extension for Linux operating systems. Click Add to create a new entry. Select one or more entries and click Remove to delete it or them. ZyWALL USG 2000 User’s Guide...
Page 788 The user’s computer must pass one of the listed file information checks to pass this checking item. Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. ZyWALL USG 2000 User’s Guide...
Page 789: System
IP addresses the access can come. You can upload and download the ZyWALL’s firmware and configuration files using FTP. Please also see Chapter 52 on page 861 for more information about firmware and configuration files. ZyWALL USG 2000 User’s Guide...
Page 790: Host Name
Enter the domain name (if you know it) here. This name is propagated to DHCP clients connected to interfaces with the DHCP server enabled. This name can be up to 254 alphanumeric characters long. Spaces are not allowed, but dashes “-” are accepted. ZyWALL USG 2000 User’s Guide...
Page 791: Usb Storage
Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 792: Date And Time
Table 228 Configuration > System > Date and Time LABEL DESCRIPTION Current Time and Date Current Time This field displays the present time of your ZyWALL. Current Date This field displays the present date of your ZyWALL. Time and Date Setup ZyWALL USG 2000 User’s Guide...
Page 793 European Union you would select Last, Sunday, March. The time you type in the at field depends on your time zone. In Germany for instance, you would type 2 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1). ZyWALL USG 2000 User’s Guide...
Page 794: Pre-Defined Ntp Time Servers List
If the synchronization fails, then the ZyWALL goes through the rest of the list in order from the first one tried until either it is successful or all the pre-defined NTP time servers have been tried. ZyWALL USG 2000 User’s Guide...
Page 795: Time Server Synchronization
Select Get from Time Server under Time and Date Setup. Under Time Zone Setup, select your Time Zone from the list. As an option you can select the Enable Daylight Saving check box to adjust the ZyWALL clock for daylight savings. ZyWALL USG 2000 User’s Guide...
Page 796: Console Port Speed
DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. ZyWALL USG 2000 User’s Guide...
Page 797: Dns Server Address Assignment
You can also configure the ZyWALL to accept or discard DNS queries. Use the Network > Interface screens to configure the DNS server information that the ZyWALL sends to the specified DHCP client devices. Figure 516 Configuration > System > DNS ZyWALL USG 2000 User’s Guide...
Page 798 A “*” means all domain zones. Type This displays whether the DNS server IP address is assigned by the ISP dynamically through a specified interface or configured manually (User-Defined). ZyWALL USG 2000 User’s Guide...
Page 799 DNS queries. Action This displays whether the ZyWALL accepts DNS queries from the computer with the IP address specified above through the specified zone (Accept) or discards them (Deny). ZyWALL USG 2000 User’s Guide...
Page 800: Address Record
IP address to a domain name. 50.6.5 Adding an Address/PTR Record Click the Add icon in the Address/PTR Record table to add an address/PTR record. Figure 517 Configuration > System > DNS > Address/PTR Record Edit ZyWALL USG 2000 User’s Guide...
Page 801: Domain Zone Forwarder
50.6.7 Adding a Domain Zone Forwarder Click the Add icon in the Domain Zone Forwarder table to add a domain zone forwarder record. Figure 518 Configuration > System > DNS > Domain Zone Forwarder Add ZyWALL USG 2000 User’s Guide...
Page 802: Mx Record
Each host or domain can have only one MX record, that is, one domain is mapping to one host. ZyWALL USG 2000 User’s Guide...
Page 803: Adding A Mx Record
Click Cancel to exit this screen without saving 50.6.10 Adding a DNS Service Control Rule Click the Add icon in the Service Control table to add a service control rule. Figure 520 Configuration > System > DNS > Service Control Rule Add ZyWALL USG 2000 User’s Guide...
Page 804: Www Overview
Note: To allow the ZyWALL to be accessed from a specified computer using a service, make sure you do not have a service control rule or to-ZyWALL firewall rule to block that traffic. ZyWALL USG 2000 User’s Guide...
Page 805: Service Access Limitations
(SSL) is an application-level protocol that enables secure transactions of data by ensuring confidentiality (an unauthorized party cannot read the transferred data), authentication (one party can identify the other party) and data integrity (you know if data has been changed). ZyWALL USG 2000 User’s Guide...
Page 806: Configuring Www Service Control
Click Configuration > System > WWW to open the WWW screen. Use this screen to specify from which zones you can access the ZyWALL using HTTP or HTTPS. You can also specify which IP addresses the access can come from. ZyWALL USG 2000 User’s Guide...
Page 807 Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the ZyWALL Web Configurator using secure HTTPs connections. ZyWALL USG 2000 User’s Guide...
Page 808 This is the object name of the IP address(es) with which the computer is allowed or denied to access. Action This displays whether the computer with the IP address specified above can access the ZyWALL zone(s) configured in the Zone field (Accept) or not (Deny). ZyWALL USG 2000 User’s Guide...
Page 809 ZyWALL zone(s) configured in the Zone field (Accept) or not (Deny). Authentication Client Select a method the HTTPS or HTTP server uses to authenticate a Authentication client. Method You must have configured the authentication methods in the Auth. method screen. ZyWALL USG 2000 User’s Guide...
Page 810: Service Control Rules
Click Cancel to exit this screen without saving 50.7.6 Customizing the WWW Login Page Click Configuration > System > WWW > Login Page to open the Login Page screen. Use this screen to customize the Web Configurator login screen. You can ZyWALL USG 2000 User’s Guide...
Page 811 Web Configurator to access network services like the Internet. See Chapter 40 on page for more on access user accounts. Figure 525 Configuration > System > WWW > Login Page ZyWALL USG 2000 User’s Guide...
Page 812 Note Message (last line of text) Figure 527 Access Page Customization Logo Title Message (color of all text) Note Message (last line of text) Window Background You can specify colors in one of the following ways: ZyWALL USG 2000 User’s Guide...
Page 813 Web Configurator to access network services like the Internet. Title Enter the title for the top of the screen. Use up to 64 printable ASCII characters. Spaces are allowed. Message Color Specify the color of the screen’s text. ZyWALL USG 2000 User’s Guide...
Page 814: Https Example
You see the following Security Alert screen in Internet Explorer. Select Yes to proceed to the Web Configurator login screen; if you select No, then Web Configurator access is blocked. Figure 528 Security Alert Dialog Box (Internet Explorer) ZyWALL USG 2000 User’s Guide...
Page 815: Netscape Navigator Warning Messages
Figure 530 Security Certificate 2 (Netscape) 50.7.7.3 Avoiding Browser Warning Messages Here are the main reasons your browser displays warnings about the ZyWALL’s HTTPS server certificate and what you can do to avoid seeing the warnings: ZyWALL USG 2000 User’s Guide...
Page 816: Login Screen
The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyWALL. You must have imported at least one trusted CA to the ZyWALL in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details). ZyWALL USG 2000 User’s Guide...
Page 817 50.7.7.5.1 Installing the CA’s Certificate Double click the CA’s trusted certificate to produce a screen similar to the one shown next. Figure 533 CA Certificate Example Click Install Certificate and follow the wizard as shown earlier in this appendix. ZyWALL USG 2000 User’s Guide...
Page 818 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate. Figure 535 Personal Certificate Import Wizard 2 ZyWALL USG 2000 User’s Guide...
Page 819 Figure 536 Personal Certificate Import Wizard 3 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 537 Personal Certificate Import Wizard 4 ZyWALL USG 2000 User’s Guide...
Page 820: Using A Certificate When Accessing The Zywall Example
50.7.7.6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS. Enter ‘https://ZyWALL IP Address/ in your browser’s web address field. Figure 540 Access the ZyWALL Via HTTPS ZyWALL USG 2000 User’s Guide...
Page 821: Ssh
Figure 542 Secure Web Configurator Login Screen 50.8 SSH You can use SSH (Secure SHell) to securely access the ZyWALL’s command line interface. Specify which zones allow SSH access and from which IP address the access can come. ZyWALL USG 2000 User’s Guide...
Page 822: How Ssh Works
The client automatically saves any new server public keys. In subsequent connections, the server public key is checked against the saved version on the client computer. ZyWALL USG 2000 User’s Guide...
Page 823: Ssh Implementation On The Zywall
Click Configuration > System > SSH to change your ZyWALL’s Secure Shell settings. Use this screen to specify from which zones SSH can be used to manage the ZyWALL. You can also specify from which IP addresses the access can come. ZyWALL USG 2000 User’s Guide...
Page 824 Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. ZyWALL USG 2000 User’s Guide...
Page 825: Secure Telnet Using Ssh Examples
Configure the SSH client to accept connection using SSH version 1. A window displays prompting you to store the host key in you computer. Click Yes to continue. Figure 546 SSH Example 1: Store Host Key ZyWALL USG 2000 User’s Guide...
Page 826: Telnet
Administrator@192.168.1.1's password: The CLI screen displays next. 50.9 Telnet You can use Telnet to access the ZyWALL’s command line interface. Specify which zones allow Telnet access and from which IP address the access can come. ZyWALL USG 2000 User’s Guide...
Page 827: Configuring Telnet
To change an entry’s position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. ZyWALL USG 2000 User’s Guide...
Page 828: Ftp
50.10.1 Configuring FTP To change your ZyWALL’s FTP settings, click Configuration > System > FTP tab. The screen appears as shown. Use this screen to specify from which zones FTP can ZyWALL USG 2000 User’s Guide...
Page 829 Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so. Note that subsequent entries move up by one when you take this action. ZyWALL USG 2000 User’s Guide...
Page 830: Snmp
Simple Network Management Protocol is a protocol used for exchanging management information between network devices. Your ZyWALL supports SNMP agent functionality, which allows a manager station to manage and monitor the ZyWALL through the network. The ZyWALL supports SNMP version one (SNMPv1) ZyWALL USG 2000 User’s Guide...
Page 831 SNMP itself is a simple request/response protocol based on the manager/agent model. The manager issues a request and the agent returns responses using the following protocol operations: • Get - Allows the manager to retrieve an object variable from the agent. ZyWALL USG 2000 User’s Guide...
Page 832: Supported Mibs
This trap is sent when an SNMP request comes from non-authenticated hosts. 50.11.3 Configuring SNMP To change your ZyWALL’s SNMP settings, click Configuration > System > SNMP tab. The screen appears as shown. Use this screen to configure your SNMP ZyWALL USG 2000 User’s Guide...
Page 833 SNMP manager. The default is public and allows all requests. Destination Type the IP address of the station to send your SNMP traps to. Service This specifies from which computers you can access which ZyWALL Control zones. ZyWALL USG 2000 User’s Guide...
Page 834: Dial-In Management
ATDP. DTR Signal The majority of WAN devices default to hanging up the current call when the DTR (Data Terminal Ready) signal is dropped by the DTE. When the Drop DTR When ZyWALL USG 2000 User’s Guide...
Page 835: Configuring Dial-In Mgmt
Select this check box to stop the external serial modem from making audible sounds during a dial-in management session. Answer Rings Set how many times the ZyWALL lets the incoming dial-in management session ring before processing it. ZyWALL USG 2000 User’s Guide...
Page 836: Vantage Cnm
If you allow your ZyWALL to be managed by the Vantage CNM server, then you should not do any configurations directly to the ZyWALL (using either the Web Configurator or commands) without notifying the Vantage CNM administrator. ZyWALL USG 2000 User’s Guide...
Page 837: Configuring Vantage Cnm
If the Vantage CNM server is behind a firewall, you may have to create a rule on the firewall to allow UDP port 11864 traffic through to the Vantage CNM server (most (new) ZyXEL firewalls automatically allow this). ZyWALL USG 2000 User’s Guide...
Page 838 Select the Vantage CNM server’s certificate. This applies when you Certificate enable HTTPS authentication. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 839: Language Screen
You also need to open a new browser session to display the screens in the new language. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. ZyWALL USG 2000 User’s Guide...
Page 840 Chapter 50 System ZyWALL USG 2000 User’s Guide...
Page 841: Log And Report
51.2 Email Daily Report Use the Email Daily Report screen to start or stop data collection and view various statistics about traffic passing through your ZyWALL. Note: Data collection may decrease the ZyWALL’s traffic throughput rate. ZyWALL USG 2000 User’s Guide...
Page 842 Click Configuration > Log & Report > Email Daily Report to display the following screen. Configure this screen to have the ZyWALL e-mail you system statistics every day. Figure 556 Configuration > Log & Report > Email Daily Report ZyWALL USG 2000 User’s Guide...
Page 843: Log Setting Screens
The ZyWALL provides a system log and supports e-mail profiles and remote syslog servers. The system log is available on the View Log tab, the e-mail profiles are used to mail log messages to the specified destinations. You can also have the ZyWALL USG 2000 User’s Guide...
Page 844: Log Setting Summary
Log Summary screen to edit this information for all logs at the same time. 51.3.1 Log Setting Summary To access this screen, click Configuration > Log & Report > Log Setting. Figure 557 Configuration > Log & Report > Log Setting ZyWALL USG 2000 User’s Guide...
Page 845: Edit System Log Settings
The Log Settings Edit screen controls the detailed settings for each log in the system log (which includes the e-mail profiles). Go to the Log Settings Summary screen (see Section 51.3.1 on page 844), and click the system log Edit icon. ZyWALL USG 2000 User’s Guide...
Page 846 Chapter 51 Log and Report Figure 558 Configuration > Log & Report > Log Setting > Edit (System Log) ZyWALL USG 2000 User’s Guide...
Page 847 Chapter 51 Log and Report ZyWALL USG 2000 User’s Guide...
Page 848 2 also has normal logs enabled, the ZyWALL will e-mail logs to them. enable normal logs and debug logs (yellow check mark) - create log messages, alerts, and debugging information for all categories. The ZyWALL does not e-mail debugging information, even if this setting is selected. ZyWALL USG 2000 User’s Guide...
Page 849 (green check mark) and/or in alerts (red exclamation point) for the e-mail settings specified in E-Mail Server 2. The ZyWALL does not e-mail debugging information, even if it is recorded in the System log. Log Consolidation ZyWALL USG 2000 User’s Guide...
Page 850 Message field. Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 851: Edit Log On Usb Storage Setting
The Edit Log on USB Storage Setting screen controls the detailed settings for saving logs to a connected USB . Go to the Log Setting Summary screen (see Section 51.3.1 on page 844), and click the USB storage Edit icon. ZyWALL USG 2000 User’s Guide...
Page 852 Chapter 51 Log and Report Figure 559 Configuration > Log & Report > Log Setting > Edit (USB Storage) s ZyWALL USG 2000 User’s Guide...
Page 853 Select this to have the ZyWALL save a copy of its system logs to a to USB storage connected USB storage device. Use the Active Log section to specify (if ready) what kinds of messages to include. Active Log ZyWALL USG 2000 User’s Guide...
Page 854 (yellow check mark) - log regular information, alerts, and debugging information from this category Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 855: Edit Remote Server Log Settings
(syslog). Go to the Log Settings Summary screen (see Section 51.3.1 on page 844), and click a remote server Edit icon. Figure 560 Configuration > Log & Report > Log Setting > Edit (Remote Server) ZyWALL USG 2000 User’s Guide...
Page 856 (yellow check mark) - log regular information, alerts, and debugging information from this category Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 857: Active Log Summary Screen
This screen provides a different view and a different way of indicating which messages are included in each log and each alert. Please see Section 51.3.2 on page 845, where this process is discussed. (The Default category includes debugging messages generated by open source software.) ZyWALL USG 2000 User’s Guide...
Page 858 2 settings. enable normal logs (green check mark) - e-mail log messages for all categories to e-mail server 2. enable alert logs (red exclamation point) - e-mail alerts for all categories to e-mail server 2. ZyWALL USG 2000 User’s Guide...
Page 859 (yellow check mark) - log regular information, alerts, and debugging information from this category Click this to save your changes and return to the previous screen. Cancel Click this to return to the previous screen without saving your changes. ZyWALL USG 2000 User’s Guide...
Page 860 Chapter 51 Log and Report ZyWALL USG 2000 User’s Guide...
Page 861: File Manager
When you apply a configuration file, the ZyWALL uses the factory default settings for any features that the configuration file does not include. When you run a shell script, the ZyWALL only applies the commands that it contains. Other settings do not change. ZyWALL USG 2000 User’s Guide...
Page 862: Comments In Configuration Files Or Shell Scripts
Comments in Configuration Files or Shell Scripts In a configuration file or shell script, use “#” or “!” as the first character of a command line to have the ZyWALL treat the line as a comment. ZyWALL USG 2000 User’s Guide...
Page 863 The ZyWALL ignores any errors in the configuration file or shell script and applies all of the valid commands. The ZyWALL still generates a log for any errors. ZyWALL USG 2000 User’s Guide...
Page 864: The Configuration File Screen
The ZyWALL still generates a log for any errors. Figure 563 Maintenance > File Manager > Configuration File Do not turn off the ZyWALL while configuration file upload is in progress. ZyWALL USG 2000 User’s Guide...
Page 865 Click OK to delete the configuration file or click Cancel to close the screen without deleting the configuration file. Download Click a configuration file’s row to select it and click Download to save the configuration to your computer. ZyWALL USG 2000 User’s Guide...
Page 866 Specify a name for the duplicate configuration file. Use up to 25 characters (including a-zA-Z0-9;‘~!@#$%^&()_+[]{}’,.=-). Click OK to save the duplicate or click Cancel to close the screen without saving a duplicate of the configuration file. ZyWALL USG 2000 User’s Guide...
Page 867 The total number of configuration files that you can save depends on the sizes of the configuration files and the available flash storage space. ZyWALL USG 2000 User’s Guide...
Page 868: The Firmware Package Screen
52.3 The Firmware Package Screen Click Maintenance > File Manager > Firmware Package to open the Firmware Package screen. Use the Firmware Package screen to check your current firmware version and upload firmware to the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 869 Browse... Click Browse... to find the .bin file you want to upload. Remember that you must decompress compressed (.zip) files before you can upload them. Upload Click Upload to begin the upload process. This process may take up to two minutes. ZyWALL USG 2000 User’s Guide...
Page 870: The Shell Script Screen
Click Maintenance > File Manager > Shell Script to open the Shell Script screen. Use the Shell Script screen to store, name, download, upload and run shell script files. You can store multiple shell script files on the ZyWALL at the same time. ZyWALL USG 2000 User’s Guide...
Page 871 Click OK to delete the shell script file or click Cancel to close the screen without deleting the shell script file. Download Click a shell script file’s row to select it and click Download to save the configuration to your computer. ZyWALL USG 2000 User’s Guide...
Page 872 Type in the location of the file you want to upload in this field or click Browse ... to find it. Browse... Click Browse... to find the .zysh file you want to upload. Upload Click Upload to begin the upload process. This process may take up to several minutes. ZyWALL USG 2000 User’s Guide...
Page 873: Diagnostics
53.2 The Diagnostic Screen The Diagnostic screen provides an easy way for you to generate a file containing the ZyWALL’s configuration and diagnostic information. You may need to send this file to customer support for troubleshooting. ZyWALL USG 2000 User’s Guide...
Page 874: The Diagnostics Files Screen
This screen lists the files of diagnostic information the ZyWALL has collected and stored in a connected USB storage device. You may need to send these files to customer support for troubleshooting. Figure 575 Maintenance > Diagnostics > Files ZyWALL USG 2000 User’s Guide...
Page 875: The Packet Capture Screen
Select User Defined to be able to enter an IP address. Host Port This field is configurable when you set the IP Type to any, tcp, or udp. Specify the port number of traffic to capture. ZyWALL USG 2000 User’s Guide...
Page 876 Modifying the file suffix also avoids making new capture files that overwrite existing files of the same name. The file name format is “interface name-file suffix.cap”, for example “vlan2-packet-capture.cap”. ZyWALL USG 2000 User’s Guide...
Page 877: The Packet Capture Files Screen
ZyWALL or a connected USB storage device. You can download the files to your computer where you can study them using a packet analyzer (also known as a network or protocol analyzer) such as Wireshark. Figure 577 Maintenance > Diagnostics > Packet Capture > Files ZyWALL USG 2000 User’s Guide...
Page 878: Example Of Viewing A Packet Capture File
Here is an example of a packet capture file viewed in the Wireshark packet analyzer. Notice that the size of frame 15 on the wire is 1514 bytes while the captured size is only 1500 bytes. The ZyWALL truncated the frame because the ZyWALL USG 2000 User’s Guide...
Page 879: Core Dump Screen
Use the Core Dump screen to have the ZyWALL save a process’s core dump to an attached USB storage device if the process terminates abnormally (crashes). You may need to send this file to customer support for troubleshooting. ZyWALL USG 2000 User’s Guide...
Page 880: Core Dump Files Screen
This screen lists the core dump files stored on the ZyWALL or a connected USB storage device. You may need to send these files to customer support for troubleshooting. Figure 580 Maintenance > Diagnostics > Core Dump > Files ZyWALL USG 2000 User’s Guide...
Page 881: The System Log Screen
This column displays the number for each file entry. The total number of files that you can save depends on the file sizes and the available storage space. File Name This column displays the label that identifies the file. ZyWALL USG 2000 User’s Guide...
Page 882 Table 263 Maintenance > Diagnostics > System Log LABEL DESCRIPTION Size This column displays the size (in bytes) of a file. Last This column displays the date and time that the individual files were saved. Modified ZyWALL USG 2000 User’s Guide...
Page 883: Packet Flow Explore
• use policy routes to control 1-1 NAT by using the policy control-virtual- server-rules activate command. • select use policy routes to control dynamic IPSec rules in the CONFIGURATION > VPN > IPSec VPN > VPN Connection screen. ZyWALL USG 2000 User’s Guide...
Page 884 Figure 583 Maintenance > Packet Flow Explore > Routing Status (Policy Route) Figure 584 Maintenance > Packet Flow Explore > Routing Status (1-1 SNAT) Figure 585 Maintenance > Packet Flow Explore > Routing Status (SitetoSite VPN) ZyWALL USG 2000 User’s Guide...
Page 885 Figure 587 Maintenance > Packet Flow Explore > Routing Status (Static-Dynamic Route) Figure 588 Maintenance > Packet Flow Explore > Routing Status (Default WAN Trunk) Figure 589 Maintenance > Packet Flow Explore > Routing Status (Main Route) ZyWALL USG 2000 User’s Guide...
Page 886 This is the DSCP value of incoming packets to which this policy route applies. See Section 15.2 on page 356 for more information. Next Hop This is the type of the next hop to which packets are directed. Type ZyWALL USG 2000 User’s Guide...
Page 887: The Snat Status Screen
Maintenance > Packet Flow Explore > SNAT Status. The order of the SNAT flow may vary depending on whether you: • select use default SNAT in the CONFIGURATION > Network > Interface > Trunk screen. ZyWALL USG 2000 User’s Guide...
Page 888 Figure 591 Maintenance > Packet Flow Explore > SNAT Status (1-1 SNAT) Figure 592 Maintenance > Packet Flow Explore > SNAT Status (Loopback SNAT) Figure 593 Maintenance > Packet Flow Explore > SNAT Status (Default SNAT) ZyWALL USG 2000 User’s Guide...
Page 889 This indicates which source IP address the SNAT rule uses finally. For example, Outgoing Interface IP means that the ZyWALL uses the IP address of the outgoing interface as the source IP address for the matched packets it sends out through this rule. ZyWALL USG 2000 User’s Guide...
Page 890 Chapter 54 Packet Flow Explore ZyWALL USG 2000 User’s Guide...
Page 891: Reboot
Click the Reboot button to restart the ZyWALL. Wait a few minutes until the login screen appears. If the login screen does not appear, type the IP address of the device in your Web browser. You can also use the CLI command reboot to restart the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 892 Chapter 55 Reboot ZyWALL USG 2000 User’s Guide...
Page 893: Shutdown
Click the Shutdown button to shut down the ZyWALL. Wait for the device to shut down before you manually turn off or remove the power. It does not turn off the power. You can also use the CLI command shutdown to shutdown the ZyWALL. ZyWALL USG 2000 User’s Guide...
Page 894 Chapter 56 Shutdown ZyWALL USG 2000 User’s Guide...
Page 895: Troubleshooting
• Replace the ZyWALL power module that has a red PWR light. Cannot access the ZyWALL from the LAN. • Check the cable connection between the ZyWALL and your computer or switch. ZyWALL USG 2000 User’s Guide...
Page 896: Troubleshooting
• Make sure your ZyWALL has the anti-virus service registered and that the license is not expired. Purchase a new license if the license is expired. • Make sure your ZyWALL is connected to the Internet. ZyWALL USG 2000 User’s Guide...
Page 897 The ZyWALL checks the policy routes in the order that they are listed. So make sure that your custom policy route comes before any other routes that the traffic would also match. The ZyWALL is not applying the custom firewall rule I configured. ZyWALL USG 2000 User’s Guide...
Page 898 For example, if you change LAN1’s IP address, the ZyWALL automatically updates the corresponding interface-based, LAN1 subnet address object. I cannot set up a PPP interface. You have to set up an ISP account before you create a PPPoE or PPTP interface. ZyWALL USG 2000 User’s Guide...
Page 899 You have to connect an external modem to the ZyWALL’s auxiliary port to use the auxiliary interface. The ZyWALL is not applying an interface’s configured ingress bandwidth limit. At the time of writing, the ZyWALL does not support ingress bandwidth management. ZyWALL USG 2000 User’s Guide...
Page 900 The ZyWALL is deleting some zipped files. The anti-virus policy may be set to delete zipped files that the ZyWALL cannot unzip. The ZyWALL cannot unzip password protected ZIP files or a ZIP file within ZyWALL USG 2000 User’s Guide...
Page 901 Not all Snort functionality is supported in the ZyWALL. The ZyWALL’s performance seems slower after configuring ADP. Depending on your network topology and traffic load, applying an anomaly profile to each and every packet direction may affect the ZyWALL’s performance. ZyWALL USG 2000 User’s Guide...
Page 902 I cannot create a second HTTP redirect rule for an incoming interface. You can configure up to one HTTP redirect rule for each (incoming) interface. I cannot get the application patrol to manage SIP traffic. Make sure you have the SIP ALG enabled. ZyWALL USG 2000 User’s Guide...
Page 903 Here are some general suggestions. See also Chapter 25 on page 447. • The system log can often help to identify a configuration problem. • If you enable NAT traversal, the remote IPSec device must also have NAT traversal enabled. ZyWALL USG 2000 User’s Guide...
Page 904 If the ZyWALL’s certificate is self-signed, import it into the remote IPsec router. If it is signed by a CA, make sure the remote IPsec router trusts that CA. The ZyWALL uses one ZyWALL USG 2000 User’s Guide...
Page 905 If you have the Configuration > VPN > IPSec VPN > VPN Connection screen’s Use Policy Route to control dynamic IPSec rules option enabled, check the routing policies to see if they are sending traffic elsewhere instead of through the VPN tunnels. ZyWALL USG 2000 User’s Guide...
Page 906 The ZyWALL classifies the firmware package as not being able to be decompressed and deletes it. You can upload the firmware package to the ZyWALL with the option enabled, so you only need to clear the Destroy compressed files that could not be ZyWALL USG 2000 User’s Guide...
Page 907 I configured policy routes to manage the bandwidth of TCP and UDP traffic but the bandwidth management is not being applied properly. It is recommended to use application patrol instead of policy routes to manage the bandwidth of TCP and UDP traffic. Device HA is not working. ZyWALL USG 2000 User’s Guide...
Page 908 If the ZyWALL tries to use the local database to authenticate an ext- user, the authentication attempt will always fail. (This is related to AAA servers and authentication methods, which are discussed in Chapter 44 on page 731 Chapter 45 on page 741, respectively.) ZyWALL USG 2000 User’s Guide...
Page 909 For My Certificates, you can import a certificate that matches a corresponding certification request that was generated by the ZyWALL. You can also import a certificate in PKCS#12 format, including the certificate’s public and private keys. ZyWALL USG 2000 User’s Guide...
Page 910 I uploaded a logo to display on the upper left corner of the Web Configurator login screen and access page but it does not display properly. Make sure the logo file is a GIF, JPG, or PNG of 100 kilobytes or less. ZyWALL USG 2000 User’s Guide...
Page 911 I cannot get the firmware uploaded using the commands. The Web Configurator is the recommended method for uploading firmware. You only need to use the command line interface if you need to recover the firmware. ZyWALL USG 2000 User’s Guide...
Page 912 You need to clear your browser’s cache. For example, if you use Internet Explorer on Windows XP, you can do this by following the steps: Select Tools > Internet Options from your browser. In the Internet Options screen, click the Delete button in the Browsing history section. ZyWALL USG 2000 User’s Guide...
Page 913: Resetting The Zywall
ZyWALL should still be available afterwards. Use the following procedure to reset the ZyWALL to its factory-default settings. This overwrites the settings in the startup-config.conf file with the settings in the system-default.conf file. Note: This procedure removes the current configuration. ZyWALL USG 2000 User’s Guide...
Page 914: Changing A Power Module
Disconnect the power cord from the power outlet. Disconnect the power cord from the ZyWALL’s power module. Use a screwdriver to remove the power module’s retaining screw. Figure 596 Removing the Power Module Retaining Screw ZyWALL USG 2000 User’s Guide...
Page 915 Use the handle to slide out the power module and remove it. Figure 597 Removing the Power Module Install the new ZyWALL power module. Figure 598 Installing the Replacement Power Module Tighten the power module’s retaining screw. Figure 599 Replacing the Power Module Retaining Screw ZyWALL USG 2000 User’s Guide...
Page 916: Getting More Troubleshooting Help
Reconnect the power cord to the power outlet. 10 Push the ZyWALL power module switch to the on position. 57.3 Getting More Troubleshooting Help Search for support information for your model at www.zyxel.com for more troubleshooting suggestions. ZyWALL USG 2000 User’s Guide...
Page 917: Product Specifications
The -45 connectors support auto-negotiation and auto- MDI/MDIX (auto-crossover). Compatible SFP SFP-SX (Multi-mode, distance: 550m, wavelength: 850nm) Transceivers SFP-LX-10 (Single-mode, distance: 10Km, wavelength: 1,310nm) SFP-LHX1310-40 (Single-mode, distance: 40Km, wavelength: 1,310nm) SFP-ZX-80 (Single-mode, distance: 80Km, wavelength: 1,550nm) Management interface RS-232, DB9F connector ZyWALL USG 2000 User’s Guide...
Page 918 430 (W) x 487 (D) x 89 (H) mm Weight 10.5 kg Rack-mounting Rack-mountable (rack-mount kit included) This table gives details about the ZyWALL’s features. Table 268 ZyWALL USG 2000 Feature Specifications VERSION # V2.10 V2.11, V2.12 V2.20 FEATURE # of MAC...
Page 919: Static Routes
Chapter 58 Product Specifications Table 268 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.20 FEATURE Static Routes 10,000 (shared 10,000 (shared 10,000 (shared with the policy with the policy with the policy routes) routes) routes) Policy Routes...
Page 920 Chapter 58 Product Specifications Table 268 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.20 FEATURE Maximum Number of LDAP Groups Maximum Number of LDAP Servers for Each LDAP Group Maximum Number of RADIUS Groups Maximum Number of RADIUS...
Page 921: Statistics
Chapter 58 Product Specifications Table 268 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.20 FEATURE Syslog Servers Maximum Number of IDP Profiles Custom Signatures Maximum Number of IDP Rules Maximum Number of ADP Profiles Maximum Number of ADP Rules...
Page 922 Chapter 58 Product Specifications Table 268 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.20 FEATURE Maximum Number of Concurrent 200 ZIP files 200 ZIP files 200 ZIP files ZIP File Decompression Sessions 32 RAR-LZSS or 32 RAR-LZSS or...
Page 923: Pcmcia Card Installation
IP/IPv4 RFC 791 RFC 793 58.1 3G PCMCIA Card Installation Only insert a compatible 3G card. Slide the connector end of the card into the slot. Note: Do not force, bend or twist the card. ZyWALL USG 2000 User’s Guide...
Page 924 Chapter 58 Product Specifications ZyWALL USG 2000 User’s Guide...
Page 925: Appendix A Log Descriptions
%s: website host The device allowed access to a web site. The content filtering %s: Service is not service is unregistered and the default policy is not set to registered block. %s: website host ZyWALL USG 2000 User’s Guide...
Page 926 The web site contains Java applet and access was blocked %s: Contains Java according to a profile. applet %s: website host The web site contains a cookie and access was blocked %s: Contains cookie according to a profile. %s: website host ZyWALL USG 2000 User’s Guide...
Page 927 The anti-spam white list rule with the specified index number White List rule %d has (%d) has been turned on. been activated. The anti-spam white list rule with the specified index number White List rule %d has (%d) has been turned off. been deactivated. ZyWALL USG 2000 User’s Guide...
Page 928 %s) and Subject (second %s) header values are listed. From:%s Subject:%s The number of concurrent e-mail sessions has exceeded the Mail sessions have maximum number of concurrent e-mail sessions that the reached the maximum anti-spam feature can handle (%d). threshold of %d. ZyWALL USG 2000 User’s Guide...
Page 929 The listed address object (first %s) is not the right kind for The %s address-object the second WINS server specified in the listed SSL VPN is wrong type for policy (second %s). '2nd-wins' in SSL Policy %s. ZyWALL USG 2000 User’s Guide...
Page 930 SSL VPN policy rule %s position (%d) in the list of SSL VPN policies. has been moved to %d. The listed SSL VPN policy has been removed. SSL VPN policy rule %s has been deleted. ZyWALL USG 2000 User’s Guide...
Page 931 SSLVPN from %s exist. (incorrect password or inexistent username) Messages were not received from the UAM daemon. %s: Failed to receive messages from uam daemon. ZyWALL USG 2000 User’s Guide...
Page 932 L2TP over IPSec may not work because the configuration of L2TP over IPSec the IPSec VPN connection it uses (Crypto Map %s) has been sessions have been all changed. disconnected since configuration of Tunnel %s has been changed ZyWALL USG 2000 User’s Guide...
Page 933 Can't append entry: %s! 1st:zysh entry name 1st:zysh entry name Can't set entry: %s! Can't define entry: %s! 1st:zysh entry name 1st:zysh list name %s: list is full! 1st:zysh list name Can't undefine %s ZyWALL USG 2000 User’s Guide...
Page 934 1st:zysh entry num Unable to move entry #%d! 1st:zysh table name %s: apply failed at initial stage! 1st:zysh table name %s: apply failed at main stage! 1st:zysh table name %s: apply failed at closing stage! ZyWALL USG 2000 User’s Guide...
Page 935 The ZyWALL’s ADP feature detected traffic with the same IP LAND attack packet. address set as both the source and the destination. Source IP is the same as Destination IP. ZyWALL USG 2000 User’s Guide...
Page 936 A file matched a file pattern in the anti-virus black list. %s, %s matched the Black-List %s 1st %s: The protocol of the packet. 2nd %s: The filename of the related file. 3rd %s: The file pattern that the file matched. ZyWALL USG 2000 User’s Guide...
Page 937 (2nd %d). been moved to %d All of the anti-virus rules have been deleted. Anti-Virus rules have been flushed. The anti-virus rule of the specified number has been Anti-Virus rule %d has deleted. been deleted. ZyWALL USG 2000 User’s Guide...
Page 938 2nd %s: The filename of the related file. 3rd %s: Whether the file was deleted (DESTROY) or forwarded (PASS). Updating of the signature file information failed due to an Update signature info internal error. has failed. ZyWALL USG 2000 User’s Guide...
Page 939 Too many failed login attempts were made from an IP Address %u.%u.%u.%u has address so the ZyWALL is blocking login attempts from that been put into lockout IP address. state %u.%u.%u.%u: the source address of the user’s login attempt ZyWALL USG 2000 User’s Guide...
Page 940 Device registration failed, an error message returned by the Device registration MyZyXEL.com server will be appended to this log. has failed:%s. %s: error message returned by the myZyXEL.com server The device registered successfully with the myZyXEL.com Device registration server. has succeeded. ZyWALL USG 2000 User’s Guide...
Page 941 The device could not connect to the MyZyXEL.com server. Connect to MyZyXEL.com server has failed. The device started to check whether or not the user name in Do account check. MyZyXEL.com's database. ZyWALL USG 2000 User’s Guide...
Page 942 File download to the update server again. after %d seconds. The device already has the latest version of the file so no Device has latest update is needed. file. No need to update. ZyWALL USG 2000 User’s Guide...
Page 943 Some information was missing in the packets that the device Build query message sent to the server. has failed. The device could not process an HTTPS connection because it Verify server's could not verify the server's certificate. certificate has failed. ZyWALL USG 2000 User’s Guide...
Page 944 Load trusted root the device can verify a server's certificate. This log displays if certificates has the device failed to load it. failed. Verification of a server’s certificate failed because it has Certificate has expired. expired. ZyWALL USG 2000 User’s Guide...
Page 945 The device turned off the use of the IDP signature file. Disable IDP succeeded. The device failed to turn on the IDP engine. Enable IDP engine failed. The device failed to turn off the IDP engine. Disable IDP engine failed. ZyWALL USG 2000 User’s Guide...
Page 946 (second num), and the number of the custom signature is <num. Adding custom (third num) that was not added display. signature number is <num>. The device failed to get the custom IDP signature number. Get custom signature number error. ZyWALL USG 2000 User’s Guide...
Page 947 The setting for IDP Out of memory. IDP activation has not changed. activation unchanged. Activation of the IDP system-protect function failed due to System-protect error. an internal system error. Create IDP proc failed. IDP activation failed. ZyWALL USG 2000 User’s Guide...
Page 948 Checking for duplicated signature IDs failed. There was an Check duplicate sid error while allocating memory. failed. Allocate memory error. Checking for duplicated signature IDs failed. Opening a Check duplicate sid temporary file failed. failed. Open file error. ZyWALL USG 2000 User’s Guide...
Page 949 An application patrol rule has been modified. 1st %s: Rule %s:%s has been Protocol Name, 2nd: Rule Index. modified Application patrol was turned on. App. Patrol has been activated. Application patrol was turned off. App. Patrol has been deactivated. ZyWALL USG 2000 User’s Guide...
Page 950 System fatal error: 60011003. The device failed to turn application patrol off while the System fatal error: system was initiating. 60011004. The specified MSN user has logged in or logged out. MSN user %s has logged ZyWALL USG 2000 User’s Guide...
Page 951 [SA] : Tunnel [%s] authentication method did not match. Phase 1 authentication method mismatch %s is the tunnel name. When negotiating Phase-1, the [SA] : Tunnel [%s] encryption algorithm did not match. Phase 1 encryption algorithm mismatch ZyWALL USG 2000 User’s Guide...
Page 952 %s is the tunnel name. The tunnel is a dynamic tunnel and Could not dial dynamic the device cannot dial it. tunnel "%s" %s is the tunnel name. The tunnel setting is not complete. Could not dial incomplete tunnel "%s" ZyWALL USG 2000 User’s Guide...
Page 953 %s is the tunnel name. When IKE request is already sent but Tunnel [%s] IKE still attempting to dial a tunnel. Negotiation is in process %s is the gateway name. An administrator disabled the VPN VPN gateway %s was gateway. disabled ZyWALL USG 2000 User’s Guide...
Page 954 When the ZyWALL tried to fall back to the listed VPN Fall Back [%s] gateway’s primary gateway phase 1 negotiation passed, but negotiate phase 2 phase 2 failed. fail, please check remote configurations ZyWALL USG 2000 User’s Guide...
Page 955 %s is the VPN connection name. An administrator enabled the VPN connection %s was VPN connection. enabled. %s is the VPN connection name. The number of active Due to active connections exceeded the maximum allowed. connection allowed exceeded, %s was deleted. ZyWALL USG 2000 User’s Guide...
Page 956 Asymmetrical Route has been turned off. The Asymmetrical Route has been disabled. Table 286 Sessions Limit Logs LOG MESSAGE DESCRIPTION %d is maximum sessions per host. Maximum sessions per host (%d) was exceeded. ZyWALL USG 2000 User’s Guide...
Page 957 Policy-route rule %d was deleted. %d: the policy route rule number Policy routing rules are cleared. Policy-route rules were flushed. The global setting for bandwidth management on the ZyWALL BWM has been has been turned on. activated. ZyWALL USG 2000 User’s Guide...
Page 958 SSH port has been the default (22). changed to default port. An administrator assigned a nonexistent certificate to SSH. SSH certificate:%s does not exist. SSH %s is certificate name assigned by user service will not work. ZyWALL USG 2000 User’s Guide...
Page 959 %s is interface name. The DNS option of DHCP pool has retrieved from it An administrator changed the time zone. Set timezone to %s. %s is time zone value ZyWALL USG 2000 User’s Guide...
Page 960 %s is interface name Forwarder removes DNS servers in records. Ping check disabled, add DNS servers in bind. Interface %s ping check is disabled. %s is interface name Zone Forwarder adds DNS servers in records. ZyWALL USG 2000 User’s Guide...
Page 961 Table 289 System Logs LOG MESSAGE DESCRIPTION When LINK is up, %d is the port number. Port %d is up!! When LINK is down, %d is the port number. Port %d is down!! ZyWALL USG 2000 User’s Guide...
Page 962 The device received an ARP response from the client issuing Receive an ARP the DHCP request. response from the client issuing the DHCP request The device received an ARP response from an unknown client. Receive an ARP response from an unknown client ZyWALL USG 2000 User’s Guide...
Page 963 FQDN %s is invalid. The FQDN format is malformed for DynDNS server, 1st %s is Update the profile %s the profile name, 2nd %s is the FQDN of the profile. has failed because the FQDN %s is malformed. ZyWALL USG 2000 User’s Guide...
Page 964 DDNS profile needs password, %s is the profile name. Update the profile %s has failed because Password was empty. DDNS profile needs domain name, %s is the profile name. Update the profile %s has failed because Domain name was empty. ZyWALL USG 2000 User’s Guide...
Page 965 HA iface, %s is the profile name has failed because ping-check of HA interface has failed. DDNS is disabled by Device-HA, because all VRRP groups are DDNS has been disabled standby. by Device-HA. ZyWALL USG 2000 User’s Guide...
Page 966 The packet trace did not exist so the ZyWALL created it Directory automatically. packet_trace not existed. Create it automatically. A debug directory did not exist so the ZyWALL created it Directory debug not automatically. existed! Create it automatically. ZyWALL USG 2000 User’s Guide...
Page 967 The connectivity check process can't get netmask address of Can't get NETMASK interface. address of %s interface %s: interface name The connectivity check process can't get broadcast address of Can't get BROADCAST interface address of %s interface %s: interface name ZyWALL USG 2000 User’s Guide...
Page 968 The System Startup configuration file synchronized from the Master configuration Master is the same with the one in the Backup, so the is the same with configuration does not have to be updated. Backup. Skip updating ZyWALL USG 2000 User’s Guide...
Page 969 Master. 1st %s: The object to syncing %s since %s is be synchronized, 2ed %s: The feature name for the object to be synchronized, 3rd %s: unlicensed or license expired. ZyWALL USG 2000 User’s Guide...
Page 970 %s for %s due to transmission timeout. %s: The name of the VRRP interface. VRRP interface %s has been shutdown. %s: The name of the VRRP interface. VRRP interface %s has been brought up. ZyWALL USG 2000 User’s Guide...
Page 971 RIP global version has been changed to %s. RIP redistribute OSPF routes has been enabled. RIP redistribute OSPF routes has been enabled. RIP redistribute static routes has been enabled. RIP redistribute static routes has been enabled. ZyWALL USG 2000 User’s Guide...
Page 972 Interface Name because Device-HA binds this interface. One or more interfaces are still using this area, so area %s Area %s cannot be cannot be removed. %s: OSPF Area removed. This area is in use. ZyWALL USG 2000 User’s Guide...
Page 973 %s H.323 ALG has Disable succeeded. Extra H.323 ALG port has been changed. Extra signal port of H.323 ALG has been modified. Default H.323 ALG port has been changed. Signal port of H.323 ALG has been modified. ZyWALL USG 2000 User’s Guide...
Page 974 "%s" successfully The router was not able to create anPKCS#12 format Generate PKCS#12 certificate with the specified name. See Table 295 on page certificate "%s" for details about the error number. failed, errno %d ZyWALL USG 2000 User’s Guide...
Page 975 Certificates. %s is the certificate request name. certificate "%s" from "My Certificate" successfully The device was not able to export a PKCS#12 format Export PKCS#12 certificate from My Certificates. %s is the certificate request certificate "%s" from name. "My Certificate" failed ZyWALL USG 2000 User’s Guide...
Page 976 Certificate decoding failed. Certificate was not found (anywhere). Certificate chain looped (did not find trusted root). Certificate contains critical extension that was not handled. Certificate issuer was not valid (CA specific information missing). (Not used) ZyWALL USG 2000 User’s Guide...
Page 977 PPP interface must reapply, %s is the interface name. reapply because Device HA become active status. Device-ha was deleted and free PPP base interface, PPP Interface %s will interface must reapply, %s is the interface name. reapply because Device HA is not running. ZyWALL USG 2000 User’s Guide...
Page 978 Tx packets, 2nd %u variable: interface Rx RxB/s=%u packets, 3rd %u: interface packets collisions, 4th %u: interface Tx Bytes/s, 5th %u: interface Rx Bytes/s. A PPP or aux interface started dialing to a server. %s: Interface %s start interface name. dailing. ZyWALL USG 2000 User’s Guide...
Page 979 (or occurred while connected to) the listed slot (%s). Remove and reinstall the negotiating with the device. device in %s. Please try to remove then insert the device. ZyWALL USG 2000 User’s Guide...
Page 980 This could be due to an error or being out of range of the cannot connect to the ISP’s cellular station. service provider. The listed cellular interface (%d) does not have the correct "Interface cellular%d APN (Access Point Name) configured. is configured with incorrect APN. ZyWALL USG 2000 User’s Guide...
Page 981 The listed cellular interface (%d) with the listed SIM card "Cellular%d (IMSI=%s IMSI number or IMEI/ESN number went over the listed or ESN=%s) over data percentage of the data budget threshold value. budget %d%% (budget = %.2f Mbytes, used = %.2f Mbytes). ZyWALL USG 2000 User’s Guide...
Page 982 The system default PPP interface cannot be activ ated because Related system default it is related to an internal interface. ppp interface can not be activated since interface property is internal. ZyWALL USG 2000 User’s Guide...
Page 983 DHCP client and has no members in its group. In this changing Port Group. case the DHCP client will be disabled. %s: interface name. Disable DHCP client. ZyWALL USG 2000 User’s Guide...
Page 984 2nd %s is error message when apply CLI command. Run script failed, this log will be what wrong CLI command is WARNING:#%s, %s and what warning message is. 1st %s is CLI command. 2nd %s is warning message when apply CLI command. ZyWALL USG 2000 User’s Guide...
Page 985 The daily e-mail report function has been turned off. The Email Daily Report has ZyWALL will not e-mail daily reports. been deactivated. The ZyWALL sent a daily e-mail report mail successfully. Email daily report has been sent successfully. ZyWALL USG 2000 User’s Guide...
Page 986 The ZyWALL cannot get the auth. policy rule and related error! operation index. Get lock id has failed Cannot get semaphore locked ID. Lock buffer id has Cannot use the current semaphore related buffer. failed ZyWALL USG 2000 User’s Guide...
Page 987 %s A user’s computer did not match the Windows version check in Windows version the specified EPS object. check fail in %s A user’s computer passed the EPS check. EPS checking result is pass. ZyWALL USG 2000 User’s Guide...
Page 988 Appendix A Log Descriptions ZyWALL USG 2000 User’s Guide...
Page 989: Appendix B Common Services
Border Gateway Protocol. BOOTP_CLIENT DHCP Client. BOOTP_SERVER DHCP Server. CU-SEEME 7648 A popular videoconferencing solution from White Pines Software. 24032 TCP/UDP Domain Name Server, a service that matches web names (for example www.zyxel.com) to IP numbers. ZyWALL USG 2000 User’s Guide...
Page 990: Tcp
ICMP echo requests to test whether or not a remote host is reachable. POP3 Post Office Protocol version 3 lets a client computer get e-mail from a POP3 server through a temporary connection (TCP/IP or other). ZyWALL USG 2000 User’s Guide...
Page 991 Telnet is the login and terminal emulation protocol common on the Internet and in UNIX en vironments. It operates over TCP/IP networks. Its primary function is to allow users to log into remote host systems. ZyWALL USG 2000 User’s Guide...
Page 992 PROTOCOL PORT(S) DESCRIPTION TFTP Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP, but uses the UDP (User Datagram Protocol) rather than TCP (Transmission Control Protocol). VDOLIVE 7000 Another videoconferencing solution. ZyWALL USG 2000 User’s Guide...
Page 993: Appendix C Displaying Anti-Virus Alert Messages In Windows
Windows XP Click Start > Control Panel > Administrative Tools > Services. Figure 600 Windows XP: Opening the Services Window ZyWALL USG 2000 User’s Guide...
Page 994 Figure 601 Windows XP: Starting the Messenger Service Close the window when you are done. Windows 2000 Click Start > Settings > Control Panel > Administrative Tools > Services. Figure 602 Windows 2000: Opening the Services Window ZyWALL USG 2000 User’s Guide...
Page 995 WinPopup window displays as shown. Figure 604 Windows 98 SE: WinPopup If you want to display the WinPopup window at startup, follow the steps below for Windows 98 SE (steps are similar for Windows Me). ZyWALL USG 2000 User’s Guide...
Page 996 Right-click on the program task bar and click Properties. Figure 605 WIndows 98 SE: Program Task Bar Click the Start Menu Programs tab and click Advanced ... Figure 606 Windows 98 SE: Task Bar Properties Double-click Programs and click StartUp. ZyWALL USG 2000 User’s Guide...
Page 997 Right-click in the StartUp pane and click New, Shortcut. Figure 607 Windows 98 SE: StartUp A Create Shortcut window displays. Enter “winpopup” in the Command line field and click Next. Figure 608 Windows 98 SE: Startup: Create Shortcut ZyWALL USG 2000 User’s Guide...
Page 998 A shortcut is created in the StartUp pane. Restart the computer when prompted. Figure 610 Windows 98 SE: Startup: Shortcut Note: The WinPopup window displays after the computer finishes the startup process (see Figure 604 on page 995). ZyWALL USG 2000 User’s Guide...
Page 999: Appendix D Importing Certificates
• Opera on page 1013 • Konqueror on page 1020 Internet Explorer The following example uses Microsoft Internet Explorer 7 on Windows XP Professional; however, they can also apply to Internet Explorer on Windows Vista. ZyWALL USG 2000 User’s Guide...
Page 1000: Appendix D Importing Certificates
Figure 611 Internet Explorer 7: Certification Error Click Continue to this website (not recommended). Figure 612 Internet Explorer 7: Certification Error In the Address Bar, click Certificate Error > View certificates. Figure 613 Internet Explorer 7: Certificate Error 1000 ZyWALL USG 2000 User’s Guide...
Page 1001 Appendix D Importing Certificates In the Certificate dialog box, click Install Certificate. Figure 614 Internet Explorer 7: Certificate In the Certificate Import Wizard, click Next. Figure 615 Internet Explorer 7: Certificate Import Wizard 1001 ZyWALL USG 2000 User’s Guide...
Page 1002 Next again and then go to step 9. Figure 616 Internet Explorer 7: Certificate Import Wizard Otherwise, select Place all certificates in the following store and then click Browse. Figure 617 Internet Explorer 7: Certificate Import Wizard 1002 ZyWALL USG 2000 User’s Guide...
Page 1003 In the Select Certificate Store dialog box, choose a location in which to save the certificate and then click OK. Figure 618 Internet Explorer 7: Select Certificate Store In the Completing the Certificate Import Wizard screen, click Finish. Figure 619 Internet Explorer 7: Certificate Import Wizard 1003 ZyWALL USG 2000 User’s Guide...

ZyXEL Communications ZyWall USG 2000 User Manual

About this User's Guide

Document Conventions

Safety Warnings

Contents Overview

Table of Contents

User's Guide

PART I User's Guide

Chapter 1 Introducing the Zywall

Chapter 2 Features and Applications

Chapter 3 Web Configurator

Chapter 4 Installation Setup Wizard

Chapter 5 Quick Setup

Chapter 6 Configuration Basics

Chapter 7 Tutorials

Chapter 8 L2TP VPN Example

Technical Reference

Part II: Technical Reference

Chapter 9 Dashboard

Chapter 10 Monitor

Chapter 11 Registration

Chapter 12 Signature Update

Chapter 13 Interfaces

Chapter 14 Trunks

Chapter 15 Policy and Static Routes

Chapter 16 Routing Protocols

Chapter 17 Zones

Quick Links

Troubleshooting

Related Manuals for ZyXEL Communications ZyWall USG 2000

Summary of Contents for ZyXEL Communications ZyWall USG 2000