ZyXEL Communications 802.11g ADSL 2+ 4-Port Security Gateway HW-D Series User Manual
  1. Manuals
  2. Brands
  3. ZyXEL Communications Manuals
  4. Gateway
  5. 802.11g ADSL 2+ 4-Port Security Gateway HW-D...
  6. User manual
ZyXEL Communications 802.11g ADSL 2+ 4-Port Security Gateway HW-D Series User Manual

ZyXEL Communications 802.11g ADSL 2+ 4-Port Security Gateway HW-D Series User Manual

802.11g adsl 2+ 4-port security gateway
Hide thumbs
1
2
3
4
5
6
7
8
9
10
Table Of Contents
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
Table of Contents

Advertisement

Quick Links

Download this manual
P-662H/HW-D Series
802.11g ADSL 2+ 4-Port Security Gateway
User's Guide
Version 3.40
Edition 1
7/2006

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the 802.11g ADSL 2+ 4-Port Security Gateway HW-D Series and is the answer not in the manual?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for ZyXEL Communications 802.11g ADSL 2+ 4-Port Security Gateway HW-D Series

Summary of Contents for ZyXEL Communications 802.11g ADSL 2+ 4-Port Security Gateway HW-D Series

  • Page 1 P-662H/HW-D Series 802.11g ADSL 2+ 4-Port Security Gateway User’s Guide Version 3.40 Edition 1 7/2006...

  • Page 3: Copyright

    ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.

  • Page 4: Certifications

    P-662H/HW-D Series User’s Guide Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations.
  • Page 5 ZyXEL Communications Corporation declared that P-662H/HW-D is limited in CH1~11 from 2400 to 2483.5 MHz by specified firmware controlled in USA. Viewing Certifications 1 Go to www.zyxel.com 2 Select your product from the drop-down list box on the ZyXEL home page to go to that product's page.

  • Page 6: Safety Warnings

    P-662H/HW-D Series User’s Guide For your safety, be sure to read and follow all warning notices and instructions. • To reduce the risk of fire, use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord. • Do NOT open the device or unit. Opening or removing covers can expose you to dangerous high voltage points or other risks.

  • Page 7: Zyxel Limited Warranty

    P-662H/HW-D Series User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During the warranty period, and upon proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the defective products or components without charge for either parts or labor, and to whatever...

  • Page 8: Customer Support

    +36-1-3259100 +7-3272-590-698 www.zyxel.kz +7-3272-590-689 1-800-255-4101 www.us.zyxel.com +1-714-632-0882 +1-714-632-0858 ftp.us.zyxel.com REGULAR MAIL ZyXEL Communications Corp. 6 Innovation Road II Science Park Hsinchu 300 Taiwan ZyXEL Costa Rica Plaza Roble Escazú Etapa El Patio, Tercer Piso San José, Costa Rica ZyXEL Communications Czech s.r.o.
  • Page 9 +46-31-744-7701 www.ua.zyxel.com +380-44-494-49-32 +44-1344 303044 www.zyxel.co.uk 08707 555779 (UK only) +44-1344 303034 ftp.zyxel.co.uk REGULAR MAIL ZyXEL Communications A/S Nils Hansens vei 13 0667 Oslo Norway ZyXEL Communications ul. Okrzei 1A 03-715 Warszawa Poland ZyXEL Russia Ostrovityanova 37a Str. Moscow, 117279...
  • Page 10 P-662H/HW-D Series User’s Guide Customer Support...

  • Page 11: Table Of Contents

    Copyright ... 3 Certifications ... 4 Safety Warnings ... 6 ZyXEL Limited Warranty... 7 Customer Support... 8 Table of Contents ... 11 List of Figures ... 25 List of Tables ... 33 Preface ... 39 Chapter 1 Getting To Know Your ZyXEL Device ... 41 1.1 Introducing the ZyXEL Device ...41 1.1.1 Features of the ZyXEL Device ...41 1.1.1.1 P-662HW Wireless Features ...45...
  • Page 12 P-662H/HW-D Series User’s Guide 2.4.6 Status: VPN Status ...59 2.4.7 Status: Packet Statistics...60 2.4.8 Changing Login Password ...62 Chapter 3 Wizard Setup for Internet Access ... 65 3.1 Introduction ...65 3.2 Internet Access Wizard Setup ...65 3.2.1 Automatic Detection ...67 3.2.2 Manual Configuration ...67 3.3 Wireless Connection Wizard Setup ...72 3.3.1 Automatically assign a WPA key ...75...
  • Page 13 5.3.1.2 Variable Bit Rate (VBR) ...89 5.3.1.3 Unspecified Bit Rate (UBR) ...90 5.4 Zero Configuration Internet Access ...90 5.5 Internet Connection ...90 5.5.1 Configuring Advanced Internet Connection ...92 5.6 Configuring More Connections ...94 5.6.1 More Connections Edit ...95 5.6.2 Configuring More Connections Advanced Setup...98 5.7 Traffic Redirect ...99 5.8 Configuring WAN Backup ...100 5.9 WAN Backup Advanced Screen ...102...
  • Page 14 P-662H/HW-D Series User’s Guide 7.3 Wireless Performance Overview ...126 7.3.1 Quality of Service (QoS) ...126 7.4 Additional Wireless Terms ...127 7.5 General Wireless LAN Screen ...127 7.5.1 No Security ...129 7.5.2 WEP Encryption Screen ...129 7.5.3 WPA(2)-PSK ...130 7.5.4 WPA(2) Authentication Screen ...132 7.5.5 Wireless LAN Advanced Setup...134 7.6 OTIST ...135 7.6.1 Enabling OTIST ...135...
  • Page 15 9.3 NAT General Setup ...160 9.4 Port Forwarding ...161 9.4.1 Default Server IP Address ...162 9.4.2 Port Forwarding: Services and Port Numbers ...162 9.4.3 Configuring Servers Behind Port Forwarding (Example) ...163 9.5 Configuring Port Forwarding ...163 9.5.1 Port Forwarding Rule Edit ...164 9.6 Address Mapping ...165 9.6.1 Address Mapping Rule Edit ...167 Chapter 10...
  • Page 16 P-662H/HW-D Series User’s Guide 11.3 Rule Logic Overview ...182 11.3.1 Rule Checklist ...182 11.3.2 Security Ramifications ...182 11.3.3 Key Fields For Configuring Rules ...183 11.3.3.1 Action ...183 11.3.3.2 Service ...183 11.3.3.3 Source Address ...183 11.3.3.4 Destination Address ...183 11.4 Connection Direction ...183 11.4.1 LAN to WAN Rules ...184 11.4.2 Alerts ...184 11.5 General Firewall Policy...
  • Page 17 13.4 Configuring Trusted Computers ...213 Chapter 14 Content Access Control ... 215 14.1 Content Access Control Overview ...215 14.1.1 Content Access Control WLAN Application ...215 14.1.2 Configuration Steps ...215 14.2 Activating CAC and Creating User Groups ...216 14.2.1 Configuring Time Schedule ...217 14.2.2 Configuring Services ...219 14.2.2.1 Available Services ...220 14.2.3 Configuring Web Site Filters ...222...
  • Page 18 P-662H/HW-D Series User’s Guide 16.2.2 ESP (Encapsulating Security Payload) Protocol ...239 16.3 My IP Address ...240 16.4 Secure Gateway Address ...241 16.4.1 Dynamic Secure Gateway Address ...241 16.5 VPN Setup Screen ...241 16.6 Keep Alive ...243 16.7 VPN, NAT, and NAT Traversal ...244 16.8 Remote DNS Server ...245 16.9 ID Type and Content ...245 16.9.1 ID Type and Content Examples ...246...
  • Page 19 17.12.1 Trusted Remote Host Certificate Fingerprints ...282 17.13 Trusted Remote Hosts Import ...283 17.14 Trusted Remote Host Certificate Details ...283 17.15 Directory Servers ...286 17.16 Directory Server Add or Edit Chapter 18 Static Route ... 289 18.1 Static Route 18.2 Configuring Static Route ...289 18.2.1 Static Route Edit ...290 Chapter 19 Bandwidth Management ...
  • Page 20 P-662H/HW-D Series User’s Guide 21.1.2 Remote Management and NAT ...310 21.1.3 System Timeout ...310 21.2 WWW ...310 21.3 Telnet ...311 21.4 Configuring Telnet ...311 21.5 Configuring FTP ...312 21.6 SNMP ...313 21.6.1 Supported MIBs ...314 21.6.2 SNMP Traps ...315 21.6.3 Configuring SNMP ...315 21.7 Configuring DNS ...317 21.8 Configuring ICMP ...317 21.9 TR-069 ...319...
  • Page 21 Chapter 25 Tools ... 345 25.1 Firmware Upgrade ...345 25.2 Configuration Screen ...347 25.2.1 Backup Configuration ...347 25.2.2 Restore Configuration ...348 25.2.3 Back to Factory Defaults ...349 25.3 Restart ...349 Chapter 26 Diagnostic... 351 26.1 General Diagnostic ...351 26.2 DSL Line Diagnostic ...352 Chapter 27 Troubleshooting ...
  • Page 22 P-662H/HW-D Series User’s Guide Macintosh OS X ... 383 Linux... 384 Appendix E IP Addresses and Subnetting ... 389 Introduction to IP Addresses ... 389 Subnet Masks ... 391 Subnetting ... 391 Example: Two Subnets ... 392 Example: Four Subnets... 393 Example Eight Subnets ...
  • Page 23 Appendix J Boot Commands ... 425 Appendix K Firewall Commands ... 427 Appendix L NetBIOS Filter Commands ... 433 Introduction ... 433 Display NetBIOS Filter Settings ... 433 NetBIOS Filter Configuration... 434 Appendix M Internal SPTGEN ... 437 Internal SPTGEN Overview ... 437 The Configuration Text File Format...
  • Page 24 P-662H/HW-D Series User’s Guide Table of Contents...

  • Page 25: List Of Figures

    P-662H/HW-D Series User’s Guide List of Figures Figure 1 ZyXEL Device Internet Access Application ... 46 Figure 2 ZyXEL Device LAN-to-LAN Application Example ... 46 Figure 3 Firewall Application ... 47 Figure 4 P-662H Front Panel ... 47 Figure 5 P-662HW Front Panel ... 47 Figure 6 Password Screen ...
  • Page 26 P-662H/HW-D Series User’s Guide Figure 39 Bandwidth Management Wizard: General Information ... 81 Figure 40 Bandwidth Management Wizard: Configuration ... 82 Figure 41 Bandwidth Management Wizard: Complete ... 83 Figure 42 Example of Traffic Shaping ... 89 Figure 43 Internet Connection (PPPoE) ... 91 Figure 44 Advanced Internet Connection ...
  • Page 27 P-662H/HW-D Series User’s Guide Figure 82 How NAT Works ... 158 Figure 83 NAT Application With IP Alias ... 159 Figure 84 NAT General ... 161 Figure 85 Multiple Servers Behind NAT Example ... 163 Figure 86 NAT Port Forwarding ... 163 Figure 87 Port Forwarding Rule Setup ...
  • Page 28 P-662H/HW-D Series User’s Guide Figure 125 Encryption and Decryption ... 234 Figure 126 IPSec Architecture ... 235 Figure 127 Transport and Tunnel Mode IPSec Encapsulation ... 236 Figure 128 IPSec Summary Fields ... 241 Figure 129 VPN Setup ... 242 Figure 130 NAT Router Between IPSec Routers ...
  • Page 29 P-662H/HW-D Series User’s Guide Figure 168 SNMP Management Model ... 314 Figure 169 Remote Management: SNMP ... 316 Figure 170 Remote Management: DNS ... 317 Figure 171 Remote Management: ICMP ... 318 Figure 172 Enabling TR-069 ... 319 Figure 173 Configuring UPnP ... 322 Figure 174 Add/Remove Programs: Windows Setup: Communication ...
  • Page 30 P-662H/HW-D Series User’s Guide Figure 211 Java (Sun) ... 361 Figure 212 Internet Options Security ... 362 Figure 213 Security Setting ActiveX Controls ... 363 Figure 214 Wall-mounting Example ... 371 Figure 215 WIndows 95/98/Me: Network: Configuration ... 374 Figure 216 Windows 95/98/Me: TCP/IP Properties: IP Address ... 375 Figure 217 Windows 95/98/Me: TCP/IP Properties: DNS Configuration ...
  • Page 31 P-662H/HW-D Series User’s Guide Figure 254 Personal Certificate Import Wizard 3 ... 416 Figure 255 Personal Certificate Import Wizard 4 ... 416 Figure 256 Personal Certificate Import Wizard 5 ... 417 Figure 257 Personal Certificate Import Wizard 6 ... 417 Figure 258 Access the ZyXEL Device Via HTTPS ...
  • Page 32 P-662H/HW-D Series User’s Guide List of Figures...

  • Page 33: List Of Tables

    P-662H/HW-D Series User’s Guide List of Tables Table 1 ADSL Standards ... 42 Table 2 Front Panel LEDs ... 47 Table 3 Web Configurator Screens Summary ... 53 Table 4 Status Screen ... 56 Table 5 Status: Any IP Table ... 58 Table 6 Status: WLAN Status ...
  • Page 34 P-662H/HW-D Series User’s Guide Table 39 Wireless: Static WEP Encryption ... 130 Table 40 Wireless: WPA(2)-PSK ... 131 Table 41 Wireless: WPA(2) ... 133 Table 42 Wireless LAN: Advanced ... 134 Table 43 OTIST ... 136 Table 44 MAC Address Filter ... 140 Table 45 WMM QoS Priorities ...
  • Page 35 P-662H/HW-D Series User’s Guide Table 82 Content Access Control: General: Web Site Filter ... 222 Table 83 Content Access Control: General: Diagnose ... 227 Table 84 Content Access Control: User Profiles ... 228 Table 85 Content Access Control: Online Status ... 229 Table 86 VPN and NAT ...
  • Page 36 P-662H/HW-D Series User’s Guide Table 125 Remote Management: WWW ... 311 Table 126 Remote Management: Telnet ... 312 Table 127 Remote Management: FTP ... 313 Table 128 SNMP Traps ... 315 Table 129 Remote Management: SNMP ... 316 Table 130 Remote Management: DNS ... 317 Table 131 Remote Management: ICMP ...
  • Page 37 P-662H/HW-D Series User’s Guide Table 168 NetBIOS Filter Default Settings ... 434 Table 169 Abbreviations Used in the Example Internal SPTGEN Screens Table ... 439 Table 170 Menu 1 General Setup (SMT Menu 1) ... 440 Table 171 Menu 3 (SMT Menu 3 ) ... 440 Table 172 Menu 4 Internet Access Setup (SMT Menu 4) ...
  • Page 38 P-662H/HW-D Series User’s Guide List of Tables...

  • Page 39: Syntax Conventions

    Congratulations on your purchase of the P-662H/HW-D series 802.11g Wireless ADSL 2+ 4- port Gateway. P-662H-D has a 4-port switch that allows you to connect up to 4 computers to the ZyXEL Device without purchasing a switch/hub. P-662HW-D comes with built-in IEEE 802.11g wireless capability allowing wireless connectivity.

  • Page 40: User Guide Feedback

    Help us help you. E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan. Thank you.

  • Page 41: Getting To Know Your Zyxel Device

    Getting To Know Your ZyXEL This chapter describes the key features and applications of your ZyXEL Device 1.1 Introducing the ZyXEL Device Your ZyXEL Device integrates high-speed 10/100Mbps auto-negotiating LAN interface(s) and a high-speed ADSL port into a single package. The ZyXEL Device is ideal for high-speed Internet browsing and making LAN-to-LAN connections to remote networks.

  • Page 42: High Speed Internet Access

    P-662H/HW-D Series User’s Guide High Speed Internet Access The ZyXEL Device is an ADSL router compatible with the ADSL/ADSL2/ADSL2+ standards. Maximum data rates attainable for each standard are shown in the next table. Table 1 ADSL Standards DATA RATE UPSTREAM DOWNSTREAM STANDARD 832 kbps ADSL...

  • Page 43: Media Bandwidth Management

    LAN/DMZ Interface The ZyXEL Device provides a LAN port that can function as a virtual DeMilitarized Zone (DMZ) port. Public servers (Web, FTP, etc.) attached to the DMZ port are visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death) and can also be accessed from the secure LAN.

  • Page 44: Dynamic Dns Support

    P-662H/HW-D Series User’s Guide Dynamic DNS Support With Dynamic DNS support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider. DHCP DHCP (Dynamic Host Configuration Protocol) allows the individual clients (computers) to obtain the TCP/IP configuration at start-up from a centralized DHCP server.

  • Page 45: P-662Hw Wireless Features

    1.1.1.1 P-662HW Wireless Features Wireless LAN The ZyXEL Device supports the IEEE 802.11g standard, which is fully compatible with the IEEE 802.11b standard, meaning that you can have both IEEE 802.11b and IEEE 802.11g wireless clients in the same wireless network. Note: The P-662HW may be prone to RF (Radio Frequency) interference from other 2.4 GHz devices such as microwave ovens, wireless phones, Bluetooth enabled devices, and other wireless LANs.

  • Page 46: Internet Access

    P-662H/HW-D Series User’s Guide 1.1.2.1 Internet Access The ZyXEL Device is the ideal high-speed Internet access solution. Your ZyXEL Device supports the TCP/IP protocol, which the Internet uses exclusively. It is compatible with all major ADSL DSLAM (Digital Subscriber Line Access Multiplexer) providers. A DSLAM is a rack of ADSL line cards with data multiplexed into a backbone network interface/connection (for example, T1, OC3, DS3, ATM or Frame Relay).

  • Page 47: Front Panel Leds

    Figure 3 Firewall Application 1.1.4 Front Panel LEDs Figure 4 P-662H Front Panel Figure 5 P-662HW Front Panel The following table describes the Lights. Table 2 Front Panel LEDs COLOR PWR/SYS Green LAN 1-4 Green None Chapter 1 Getting To Know Your ZyXEL Device STATUS DESCRIPTION The ZyXEL Device is receiving power and functioning...
  • Page 48 P-662H/HW-D Series User’s Guide Table 2 Front Panel LEDs (continued) COLOR WLAN (P- Green 662HW only) None DSL/ACT Green INTERNET Green CON/AUX Green Amber Refer to the Quick Start Guide for information on hardware connections. STATUS DESCRIPTION The ZyXEL Device is ready, but is not sending/receiving data through the wireless LAN.

  • Page 49: Introducing The Web Configurator

    This chapter describes how to access and navigate the web configurator. 2.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy ZyXEL Device setup and management via Internet browser. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions.

  • Page 50: Figure 6 Password Screen

    P-662H/HW-D Series User’s Guide only. Click Login to proceed to a screen asking you to change your password or click Cancel to revert to the default password. Figure 6 Password Screen 6 If you entered the user password, skip the next two steps and refer to page 55 for more information about the Status screen.

  • Page 51: Resetting The Zyxel Device

    Note: If you do not replace the certificate, the following screen appears every time you log in. Figure 8 Replace Factory Default Certificate 8 Select Go to Wizard setup and click Apply to display the wizard main screen. Otherwise, select Go to Advanced setup and click Apply to display the Status screen. Figure 9 Select a Mode Note: The management session automatically times out when the time period set in the Administrator Inactivity Timer field expires (default five minutes).

  • Page 52: Using The Reset Button

    P-662H/HW-D Series User’s Guide 2.3.1 Using the Reset Button 1 Make sure the POWER LED is on (not blinking). 2 Press the RESET button for 10 seconds or until the POWER LED begins to blink and then release it. When the POWER LED begins to blink, the defaults have been restored and the ZyXEL Device restarts.

  • Page 53: Table 3 Web Configurator Screens Summary

    Note: Click the embedded help. Table 3 Web Configurator Screens Summary LINK/ICON SUB-LINK Wizard INTERNET/ WIRELESS SETUP BANDWIDTH MANAGEMENT SETUP Logout Status Network Remote Node Internet Access Setup WAN Backup Setup DHCP Setup Client List IP Alias Wireless LAN General (Wireless devices only) OTIST...
  • Page 54 P-662H/HW-D Series User’s Guide Table 3 Web Configurator Screens Summary (continued) LINK/ICON SUB-LINK Threshold Anti Virus Packet Scan Registration Content Filter Keyword Schedule Trusted Content Access General Control User Profile Online Status Setup Monitor VPN Global Setting Certificates My Certificates Trusted CAs Trusted Remote Hosts...

  • Page 55: Status Screen

    Table 3 Web Configurator Screens Summary (continued) LINK/ICON SUB-LINK Remote MGMT Telnet SNMP ICMP UPnP Maintenance System General Time Setting Logs View Log Log Settings Tools Firmware Configuration Restart Diagnostic General DSL Line 2.4.2 Status Screen The following summarizes how to navigate the web configurator from the Status screen. Some fields or links are not available if you entered the user password in the login password screen (see Figure 6 on page...

  • Page 56: Figure 11 Status Screen

    P-662H/HW-D Series User’s Guide Figure 11 Status Screen The following table describes the labels shown in the Status screen. Table 4 Status Screen LABEL DESCRIPTION Refresh Interval Select a number of seconds or None from the drop-down list box to refresh all screen statistics automatically at the end of every time interval or to not refresh the screen statistics.
  • Page 57 Table 4 Status Screen LABEL DESCRIPTION VPI/VCI This is the Virtual Path Identifier and Virtual Channel Identifier that you entered in the Wizard or WAN screen. LAN Information IP Address This is the LAN port IP address. IP Subnet Mask This is the LAN port IP subnet mask.

  • Page 58: Status: Any Ip Table

    P-662H/HW-D Series User’s Guide Table 4 Status Screen LABEL DESCRIPTION Summary Any IP Table Use this screen to view a list of IP addresses and MAC addresses of computers, which are not in the same subnet as the ZyXEL Device. WLAN Status This screen displays the MAC address(es) of the wireless stations that are (wireless devices...

  • Page 59: Status: Bandwidth Status

    Figure 13 Status: WLAN Status The following table describes the labels in this screen. Table 6 Status: WLAN Status LABEL DESCRIPTION This is the index number of an associated wireless station. MAC Address This field displays the MAC (Media Access Control) address of an associated wireless station.

  • Page 60: Status: Packet Statistics

    P-662H/HW-D Series User’s Guide Figure 15 Status: VPN Status The following table describes the labels in this screen. Table 7 Status: VPN Status LABEL DESCRIPTION This is the security association index number. Name This field displays the identification name for this VPN policy. Encapsulation This field displays Tunnel or Transport mode.

  • Page 61: Figure 16 Status: Packet Statistics

    Figure 16 Status: Packet Statistics The following table describes the fields in this screen. Table 8 Status: Packet Statistics LABEL DESCRIPTION System Monitor System up Time This is the elapsed time the system has been up. Current Date/Time This field displays your ZyXEL Device’s present date and time. CPU Usage This field specifies the percentage of CPU utilization.

  • Page 62: Changing Login Password

    P-662H/HW-D Series User’s Guide Table 8 Status: Packet Statistics (continued) LABEL DESCRIPTION Tx B/s This field displays the number of bytes transmitted in the last second. Rx B/s This field displays the number of bytes received in the last second. Up Time This field displays the elapsed time this port has been up.

  • Page 63: Table 9 System General: Password

    The following table describes the fields in this screen. Table 9 System General: Password LABEL DESCRIPTION Old Password Type the default password or the existing password you use to access the system in this field. New Password Type the new password in this field. Retype to Confirm Type the new password again in this field.
  • Page 64 P-662H/HW-D Series User’s Guide Chapter 2 Introducing the Web Configurator...

  • Page 65: Wizard Setup For Internet Access

    Wizard Setup for Internet Access This chapter provides information on the Wizard Setup screens for Internet access in the web configurator. 3.1 Introduction Use the Wizard Setup screens to configure your system for Internet access with the information given to you by your ISP. Note: See the advanced menu chapters for background information on these fields.

  • Page 66: Figure 19 Wizard: Welcome

    P-662H/HW-D Series User’s Guide Figure 19 Wizard: Welcome 3 The wizard attempts to detect which WAN connection type you are using. If the wizard detects your connection type and your ISP uses PPPoE or PPPoA, go to Section 3.2.1 on page If the wizard does not detect a connection type and the following screen appears (see Figure 20 on page Wireless Setup Wizard to have the ZyXEL Device detect your connection again.

  • Page 67: Automatic Detection

    Figure 21 Auto Detection: Failed 3.2.1 Automatic Detection 1 If you have a PPPoE or PPPoA connection, a screen displays prompting you to enter your Internet account information. Enter the username, password and/or service name exactly as provided. 2 Click Next and see Figure 22 Auto-Detection: PPPoE 3.2.2 Manual Configuration 1 If the ZyXEL Device fails to detect your DSL connection type, enter the Internet access...

  • Page 68: Figure 23 Internet Access Wizard Setup: Isp Parameters

    P-662H/HW-D Series User’s Guide Figure 23 Internet Access Wizard Setup: ISP Parameters The following table describes the fields in this screen. Table 10 Internet Access Wizard Setup: ISP Parameters LABEL DESCRIPTION Mode From the Mode drop-down list box, select Routing (default) if your ISP allows multiple computers to share an Internet account.

  • Page 69: Figure 24 Internet Connection With Pppoe

    2 The next wizard screen varies depending on what mode and encapsulation type you use. All screens shown are with routing mode. Configure the fields and click Next to continue. Section 3.3 on page 72 Figure 24 Internet Connection with PPPoE The following table describes the fields in this screen.

  • Page 70: Figure 26 Internet Connection With Enet Encap

    P-662H/HW-D Series User’s Guide The following table describes the fields in this screen. Table 12 Internet Connection with RFC 1483 LABEL DESCRIPTION IP Address This field is available if you select Routing in the Mode field. Type your ISP assigned IP address in this field. Back Click Back to go back to the previous wizard screen.

  • Page 71: Figure 27 Internet Connection With Pppoa

    Table 13 Internet Connection with ENET ENCAP (continued) LABEL DESCRIPTION First DNS Enter the IP addresses of the DNS servers. The DNS servers are passed to the DHCP Server clients along with the IP address and the subnet mask. Second DNS As above.

  • Page 72: Wireless Connection Wizard Setup

    P-662H/HW-D Series User’s Guide Figure 28 Connection Test Failed-1 • If the following screen displays, check if your account is activated or click Restart the Internet/Wireless Setup Wizard to verify your Internet access settings. Figure 29 Connection Test Failed-2. 3.3 Wireless Connection Wizard Setup After you configure the Internet access information, use the following screens to set up your wireless LAN.

  • Page 73: Figure 30 Connection Test Successful

    P-662H/HW-D Series User’s Guide Figure 30 Connection Test Successful 2 Use this screen to activate the wireless LAN and OTIST. Click Next to continue. Figure 31 Wireless LAN Setup Wizard 1 Chapter 3 Wizard Setup for Internet Access...

  • Page 74: Figure 32 Wireless Lan Setup Wizard 2

    P-662H/HW-D Series User’s Guide The following table describes the labels in this screen. Table 15 Wireless LAN Setup Wizard 1 LABEL Active Enable OTIST Setup Key Back Next Exit 3 Configure your wireless settings in this screen. Click Next. Figure 32 Wireless LAN Setup Wizard 2 DESCRIPTION Select the check box to turn on the wireless LAN.

  • Page 75: Automatically Assign A Wpa Key

    The following table describes the labels in this screen. Table 16 Wireless LAN Setup Wizard 2 LABEL DESCRIPTION Network Enter a descriptive name (up to 32 printable 7-bit ASCII characters) for the wireless Name(SSID) LAN. If you change this field on the ZyXEL Device, make sure all wireless stations use the same SSID in order to access the network.

  • Page 76: Manually Assign A Wep Key

    P-662H/HW-D Series User’s Guide Figure 33 Manually assign a WPA key The following table describes the labels in this screen. Table 17 Manually assign a WPA key LABEL DESCRIPTION Pre-Shared Type from 8 to 63 case-sensitive ASCII characters. You can set up the most secure wireless connection by configuring WPA in the wireless LAN screens.

  • Page 77: Figure 35 Wireless Lan Setup 3

    The following table describes the labels in this screen. Table 18 Manually assign a WEP key LABEL DESCRIPTION The WEP keys are used to encrypt data. Both the ZyXEL Device and the wireless stations must use the same WEP key for data transmission. Enter any 5, 13 or 29 ASCII characters or 10, 26 or 58 hexadecimal characters ("0-9", "A-F") for a 64-bit, 128-bit or 256-bit WEP key respectively.

  • Page 78: Figure 36 Internet Access And Wlan Wizard Setup Complete

    P-662H/HW-D Series User’s Guide Figure 36 Internet Access and WLAN Wizard Setup Complete 7 Launch your web browser and navigate to www.zyxel.com. Internet access is just the beginning. Refer to the rest of this guide for more detailed information on the complete range of ZyXEL Device features.

  • Page 79: Bandwidth Management Wizard

    Bandwidth Management Wizard This chapter shows you how to configure basic bandwidth management using the wizard screens. 4.1 Introduction Bandwidth management allows you to control the amount of bandwidth going out through the ZyXEL Device’s WAN port and prioritize the distribution of the bandwidth according to service bandwidth requirements.

  • Page 80: Bandwidth Management Wizard Setup

    P-662H/HW-D Series User’s Guide Table 19 Media Bandwidth Management Setup: Services (continued) SERVICE DESCRIPTION VoIP (SIP) Sending voice signals over the Internet is called Voice over IP or VoIP. Session Initiated Protocol (SIP) is an internationally recognized standard for implementing VoIP.

  • Page 81: Figure 38 Wizard: Welcome

    Figure 38 Wizard: Welcome 3 Activate bandwidth management and select to allocate bandwidth to packets based on the services. Figure 39 Bandwidth Management Wizard: General Information The following fields describe the label in this screen. Table 20 Bandwidth Management Wizard: General Information LABEL DESCRIPTION Active...

  • Page 82: Figure 40 Bandwidth Management Wizard: Configuration

    P-662H/HW-D Series User’s Guide 4 Use the second wizard screen to select the services that you want to apply bandwidth management and select the priorities that you want to apply to the services listed. Figure 40 Bandwidth Management Wizard: Configuration The following table describes the labels in this screen.

  • Page 83: Figure 41 Bandwidth Management Wizard: Complete

    Table 21 Bandwidth Management Wizard: Configuration LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyXEL Device. Exit Click Exit to close the wizard screen without saving your changes. 5 Follow the on-screen instructions and click Finish to complete the wizard setup and save your configuration.
  • Page 84 P-662H/HW-D Series User’s Guide Chapter 4 Bandwidth Management Wizard...

  • Page 85: Chapter 5 Wan Setup

    This chapter describes how to configure WAN settings. 5.1 WAN Overview A WAN (Wide Area Network) is an outside connection to another network or the Internet. 5.1.1 Encapsulation Be sure to use the encapsulation method required by your ISP. The ZyXEL Device supports the following methods.

  • Page 86: Pppoa

    P-662H/HW-D Series User’s Guide By implementing PPPoE directly on the ZyXEL Device (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyXEL Device does that part of the task. Furthermore, with NAT, all of the LANs’ computers will have access.

  • Page 87: Ip Address Assignment

    5.1.4 IP Address Assignment A static IP is a fixed IP that your ISP gives you. A dynamic IP is not fixed; the ISP assigns you a different one each time. The Single User Account feature can be enabled or disabled if you have either a dynamic or static IP.

  • Page 88: Metric

    P-662H/HW-D Series User’s Guide 5.2 Metric The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the measurement of cost, with a minimum of "1" for directly connected networks. The number must be between "1"...

  • Page 89: Atm Traffic Classes

    Maximum Burst Size (MBS) is the maximum number of cells that can be sent at the PCR. After MBS is reached, cell rates fall below SCR until cell rate averages to the SCR again. At this time, more cells (up to the MBS) can be sent at the PCR again. If the PCR, SCR or MBS is set to the default of "0", the system will assign a maximum value that correlates to your upstream line rate.

  • Page 90: Unspecified Bit Rate (Ubr)

    P-662H/HW-D Series User’s Guide The VBR-nRT (non real-time Variable Bit Rate) type is used with bursty connections that do not require closely controlled delay and delay variation. It is commonly used for "bursty" traffic typical on LANs. PCR and MBS define the burst levels, SCR defines the minimum level.

  • Page 91: Figure 43 Internet Connection (Pppoe)

    Figure 43 Internet Connection (PPPoE) The following table describes the labels in this screen. Table 22 Internet Connection LABEL General Name Mode Encapsulation User Name Password Service Name Multiplexing Chapter 5 WAN Setup DESCRIPTION Enter the name of your Internet Service Provider, e.g., MyISP. This information is for identification purposes only.

  • Page 92: Configuring Advanced Internet Connection

    P-662H/HW-D Series User’s Guide Table 22 Internet Connection LABEL Virtual Circuit ID IP Address Obtain an IP Address Automatically Static IP Address IP Address Subnet Mask Gateway IP address (ENET ENCAP only) Enter the gateway IP address provided by your ISP. Connection Nailed-Up Connection...

  • Page 93: Figure 44 Advanced Internet Connection

    Figure 44 Advanced Internet Connection The following table describes the labels in this screen. Table 23 Advanced Internet Connection LABEL DESCRIPTION RIP & Multicast Setup RIP Direction RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a router to exchange routing information with other routers.

  • Page 94: Configuring More Connections

    P-662H/HW-D Series User’s Guide Table 23 Advanced Internet Connection LABEL DESCRIPTION cell/sec Divide the DSL line rate (bps) by 424 (the size of an ATM cell) to find the Peak Cell Rate (PCR). This is the maximum rate at which the sender can send cells. Type the PCR here.

  • Page 95: More Connections Edit

    Figure 45 More Connections The following table describes the labels in this screen. Table 24 More Connections LABEL Active Name VPI/VCI Encapsulation Modify Apply Cancel 5.6.1 More Connections Edit Click the edit icon in the More Connections screen to configure a Chapter 5 WAN Setup DESCRIPTION This is the index number of a connection.

  • Page 96: Figure 46 More Connections Edit

    P-662H/HW-D Series User’s Guide Figure 46 More Connections Edit The following table describes the labels in this screen. Table 25 More Connections Edit LABEL Active Name Mode Encapsulation User Name Password Service Name DESCRIPTION Select the check box to activate or clear the check box to deactivate this connection.
  • Page 97 Table 25 More Connections Edit (continued) LABEL Multiplexing IP Address Subnet Mask Gateway IP address Specify a gateway IP address (supplied by your ISP). Connection Nailed-Up Connection Connect on Demand Select Connect on Demand when you don't want the connection up all the time Max Idle Timeout Back Apply...

  • Page 98: Configuring More Connections Advanced Setup

    P-662H/HW-D Series User’s Guide 5.6.2 Configuring More Connections Advanced Setup To edit your ZyXEL Device's advanced WAN settings, click the Advanced Setup button in the More Connections Edit screen. The screen appears as shown. Figure 47 More Connections Advanced Setup The following table describes the labels in this screen.

  • Page 99: Traffic Redirect

    Table 26 More Connections Advanced Setup (continued) LABEL DESCRIPTION Apply Click Apply to save the changes. Cancel Click Cancel to begin configuring this screen afresh. 5.7 Traffic Redirect Traffic redirect forwards traffic to a backup gateway when the ZyXEL Device cannot connect to the Internet.

  • Page 100: Configuring Wan Backup

    P-662H/HW-D Series User’s Guide Figure 49 Traffic Redirect LAN Setup 5.8 Configuring WAN Backup To change your ZyXEL Device’s WAN backup settings, click WAN > WAN Backup Setup. The screen appears as shown. Chapter 5 WAN Setup...

  • Page 101: Figure 50 Wan Backup Setup

    Figure 50 WAN Backup Setup The following table describes the labels in this screen. Table 27 WAN Backup Setup LABEL DESCRIPTION Backup Type Select the method that the ZyXEL Device uses to check the DSL connection. Select DSL Link to have the ZyXEL Device check if the connection to the DSLAM is up.

  • Page 102: Wan Backup Advanced Screen

    P-662H/HW-D Series User’s Guide Table 27 WAN Backup Setup (continued) LABEL DESCRIPTION Timeout Type the number of seconds (3 recommended) for your ZyXEL Device to wait for a ping response from one of the IP addresses in the Check WAN IP Address field before timing out the request.

  • Page 103: Figure 51 Wan Backup Advanced Setup

    Figure 51 WAN Backup Advanced Setup The following table describes the labels in this screen. Table 28 WAN Backup Advanced Setup LABEL DESCRIPTION Authentication Use the drop-down list box to select an authentication protocol for outgoing calls. Type Options are: CHAP/PAP - Your ZyXEL Device accepts either CHAP or PAP when requested by this remote node.
  • Page 104 P-662H/HW-D Series User’s Guide Table 28 WAN Backup Advanced Setup LABEL DESCRIPTION Advanced Click the Edit button to display the Advanced Modem Setup screen and edit the Modem Setup details of your dial backup setup. TCP/IP Options Metric This field sets this route's priority among the three routes the ZyXEL Device uses (normal, traffic redirect and dial backup).

  • Page 105: Dial Backup Modem Setup

    Table 28 WAN Backup Advanced Setup LABEL DESCRIPTION Connect on Select Connect on Demand when you don't want the connection up all the time Demand and specify an idle time-out in the Max Idle Timeout field. Max Idle Timeout Specify an idle time-out in the Max Idle Timeout field when you select Connect on Demand.

  • Page 106: Figure 52 Wan Dial Backup Modem Setup

    P-662H/HW-D Series User’s Guide Figure 52 WAN Dial Backup Modem Setup The following table describes the labels in this screen. Table 29 WAN Dial Backup Modem Setup LABEL DESCRIPTION AT Command Strings Dial Type the AT Command string to make a call. Example: atdt Drop Type the AT Command string to drop a call.
  • Page 107 Table 29 WAN Dial Backup Modem Setup LABEL DESCRIPTION Retry Interval Type a number of seconds for the ZyXEL Device to wait before trying another call after a call has failed. This applies before a phone number is blacklisted. Example: Drop Timeout Type the number of seconds for the ZyXEL Device to wait before dropping the DTR signal if it does not receive a positive disconnect confirmation.
  • Page 108 P-662H/HW-D Series User’s Guide Chapter 5 WAN Setup...

  • Page 109: Chapter 6 Lan Setup

    This chapter describes how to configure LAN settings. 6.1 LAN Overview A Local Area Network (LAN) is a shared communication system to which many computers are attached. A LAN is a computer network limited to the immediate area, usually the same building or floor of a building.

  • Page 110: Dhcp Setup

    P-662H/HW-D Series User’s Guide 6.1.2 DHCP Setup DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the ZyXEL Device as a DHCP server or disable it. When configured as a server, the ZyXEL Device provides the TCP/IP configuration for the clients.

  • Page 111: Dns Server Address Assignment

    6.1.4 DNS Server Address Assignment Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it. There are two ways that an ISP disseminates the DNS server addresses.

  • Page 112: Private Ip Addresses

    P-662H/HW-D Series User’s Guide 6.2.1.1 Private IP Addresses Every machine on the Internet must have a unique address. If your networks are isolated from the Internet, for example, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks: •...

  • Page 113: Multicast

    6.2.3 Multicast Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data.

  • Page 114: How Any Ip Works

    P-662H/HW-D Series User’s Guide Figure 54 Any IP Example The Any IP feature does not apply to a computer using either a dynamic IP address or a static IP address that is in the same subnet as the ZyXEL Device’s IP address. Note: You must enable NAT/SUA to use the Any IP feature on the ZyXEL Device.

  • Page 115: Configuring Lan Ip

    After all the routing information is updated, the computer can access the ZyXEL Device and the Internet as if it is in the same subnet as the ZyXEL Device. 6.3 Configuring LAN IP Click LAN to open the IP screen. See Figure 55 LAN IP The following table describes the fields in this screen.

  • Page 116: Figure 56 Advanced Lan Setup

    P-662H/HW-D Series User’s Guide Figure 56 Advanced LAN Setup The following table describes the labels in this screen. Table 31 Advanced LAN Setup LABEL DESCRIPTION RIP & Multicast Setup RIP Direction Select the RIP direction from None, Both, In Only and Out Only. RIP Version Select the RIP version from RIP-1, RIP-2B and RIP-2M.

  • Page 117: Dhcp Setup

    6.4 DHCP Setup Use this screen to configure the DNS server information that the ZyXEL Device sends to the DHCP client devices on the LAN. Figure 57 DHCP Setup The following table describes the labels in this screen. Table 32 DHCP Setup LABEL DHCP Setup DHCP...

  • Page 118: Lan Client List

    P-662H/HW-D Series User’s Guide Table 32 DHCP Setup LABEL Primary DNS Server Secondary DNS Server Apply Reset 6.5 LAN Client List This table allows you to assign IP addresses on the LAN to specific individual computers based on their MAC Addresses. Every Ethernet device has a unique MAC (Media Access Control) address.

  • Page 119: Lan Ip Alias

    The following table describes the labels in this screen. Table 33 LAN Client List LABEL DESCRIPTION IP Address Enter the IP address that you want to assign to the computer on your LAN with the MAC address specified below. The IP address should be within the range of IP addresses you specified in the DHCP Setup for the DHCP client.

  • Page 120: Figure 59 Physical Network & Partitioned Logical Networks

    P-662H/HW-D Series User’s Guide Figure 59 Physical Network & Partitioned Logical Networks To change your ZyXEL Device’s IP alias settings, click Network > LAN > IP Alias. The screen appears as shown. Figure 60 LAN IP Alias The following table describes the labels in this screen. Table 34 LAN IP Alias LABEL DESCRIPTION...
  • Page 121 Table 34 LAN IP Alias LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Select the RIP direction from Both/In Only/Out Only/None.
  • Page 122 P-662H/HW-D Series User’s Guide Chapter 6 LAN Setup...

  • Page 123: Chapter 7 Wireless Lan

    This chapter discusses how to configure the wireless network settings in your ZyXEL Device. This chapter applies to the P-662HW-D models only. 7.1 Wireless Network Overview The following figure provides an example of a wireless network. Figure 61 Example of a Wireless Network The wireless network is the part in the blue circle.

  • Page 124: Wireless Security Overview

    P-662H/HW-D Series User’s Guide • Every device in the same wireless network must use security compatible with the AP. Security stops unauthorized devices from using the wireless network. It can also protect the information that is sent in the wireless network. 7.2 Wireless Security Overview The following sections introduce different types of wireless security you can set up in the wireless network.

  • Page 125: Encryption

    For wireless networks, there are two typical places to store the user names and passwords for each user. • In the ZyXEL Device: this feature is called a local user database or a local database. • In a RADIUS server: this is a server used in businesses more than in homes. If your ZyXEL Device does not provide a local user database and if you do not have a RADIUS server, you cannot set up user names and passwords for your users.

  • Page 126: One-Touch Intelligent Security Technology (Otist)

    P-662H/HW-D Series User’s Guide Note: It is recommended that wireless networks use WPA-PSK, WPA, or stronger encryption. IEEE 802.1x and WEP encryption are better than none at all, but it is still possible for unauthorized wireless devices to figure out the original information pretty quickly.

  • Page 127: Additional Wireless Terms

    7.4 Additional Wireless Terms The following table describes wireless network terms and acronyms used in the ZyXEL Device. Table 36 Additional Wireless Terms TERM Intra-BSS Traffic RTS/CTS Threshold Preamble Authentication Max. Frame Burst Fragmentation Threshold Roaming 7.5 General Wireless LAN Screen Note: If you are configuring the ZyXEL Device from a computer connected to the wireless LAN and you change the ZyXEL Device’s SSID or WEP settings, you will lose your wireless connection when you press Apply to confirm.

  • Page 128: Figure 62 Wireless Lan: General

    P-662H/HW-D Series User’s Guide Figure 62 Wireless LAN: General The following table describes the general wireless LAN labels in this screen. Table 37 Wireless LAN: General LABEL DESCRIPTION Active Wireless Click the check box to activate wireless LAN. Note: You can also activate the wireless LAN by pressing the RESET Network (Service Set IDentity) The SSID identifies the Service Set with which a wireless Name(SSID)

  • Page 129: No Security

    7.5.1 No Security Select No Security to allow wireless stations to communicate with the access points without any data encryption. Note: If you do not enable any wireless security on your ZyXEL Device, your network is accessible to any wireless networking device that is within range. Figure 63 Wireless: No Security The following table describes the labels in this screen.

  • Page 130: Wpa(2)-Psk

    P-662H/HW-D Series User’s Guide Figure 64 Wireless: Static WEP Encryption The following table describes the wireless LAN security labels in this screen. Table 39 Wireless: Static WEP Encryption LABEL DESCRIPTION Security Mode Choose Static WEP from the drop-down list box. Passphrase Enter a Passphrase (up to 32 printable characters) and click Generate.

  • Page 131: Figure 65 Wireless: Wpa(2)-Psk

    Figure 65 Wireless: WPA(2)-PSK The following table describes the wireless LAN security labels in this screen. Table 40 Wireless: WPA(2)-PSK LABEL DESCRIPTION Security Mode Choose WPA-PSK or WPA2-PSK from the drop-down list box. WPA Compatible This check box is available only when you select WPA2-PSK or WPA2 in the Security Mode field.

  • Page 132: Wpa(2) Authentication Screen

    P-662H/HW-D Series User’s Guide Table 40 Wireless: WPA(2)-PSK LABEL DESCRIPTION Group Key Update The Group Key Update Timer is the rate at which the AP (if using WPA(2)-PSK Timer (In key management) or RADIUS server (if using WPA(2) key management) sends a Seconds) new group key out to all clients.

  • Page 133: Table 41 Wireless: Wpa(2)

    The following table describes the wireless LAN security labels in this screen. Table 41 Wireless: WPA(2) LABEL DESCRIPTION WPA Compatible This check box is available only when you select WPA2-PSK or WPA2 in the Security Mode field. Select the check box to have both WPA2 and WPA wireless clients be able to communicate with the ZyXEL Device even when the ZyXEL Device is using WPA2-PSK or WPA2.

  • Page 134: Wireless Lan Advanced Setup

    P-662H/HW-D Series User’s Guide Table 41 Wireless: WPA(2) LABEL DESCRIPTION Cancel Click Cancel to reload the previous configuration for this screen. Advanced Setup Click Advanced Setup to display the Wireless Advanced Setup screen and edit more details of your WLAN setup. 7.5.5 Wireless LAN Advanced Setup To configure advanced wireless settings, click the Advanced Setup button in the General screen.

  • Page 135: Otist

    Table 42 Wireless LAN: Advanced LABEL DESCRIPTION 802.11 Mode Select 802.11b Only to allow only IEEE 802.11b compliant WLAN devices to associate with the ZyXEL Device. Select 802.11g Only to allow only IEEE 802.11g compliant WLAN devices to associate with the ZyXEL Device. Select Mixed to allow either IEEE802.11b or IEEE802.11g compliant WLAN devices to associate with the ZyXEL Device.

  • Page 136: Figure 68 Otist

    P-662H/HW-D Series User’s Guide 7.6.1.1 AP Click the Wireless LAN link under Network and then the OTIST tab. The following screen displays. Figure 68 OTIST The following table describes the labels in this screen. Table 43 OTIST LABEL Setup Key DESCRIPTION Type an OTIST Setup Key of exactly eight ASCII characters in length.

  • Page 137: Wireless Client

    Table 43 OTIST LABEL Yes! Start 7.6.1.2 Wireless Client Start the ZyXEL utility and click the Adapter tab. Select the OTIST check box, enter the same Setup Key as your AP’s and click Save. Figure 69 Example Wireless Client OTIST Screen Chapter 7 Wireless LAN DESCRIPTION If you want to configure your own WPA-PSK and have OTIST use that WPA-...

  • Page 138: Starting Otist

    P-662H/HW-D Series User’s Guide 7.6.2 Starting OTIST Note: You must click Start in the AP OTIST web configurator screen and in the wireless client(s) Adapter screen all within three minutes (at the time of writing). You can start OTIST in the wireless clients and AP in any order but they must all be within range and have OTIST enabled.

  • Page 139: Mac Filter

    Figure 74 Start OTIST? 2 If an OTIST-enabled wireless client loses its wireless connection for more than ten seconds, it will search for an OTIST-enabled AP for up to one minute. (If you manually have the wireless client search for an OTIST-enabled AP, there is no timeout; click Cancel in the OTIST progress screen to stop the search.) 3 When the wireless client finds an OTIST-enabled AP, you must still click Start in the AP OTIST web configurator screen or hold in the Reset button (for one or two seconds) for...

  • Page 140: Figure 75 Mac Address Filter

    P-662H/HW-D Series User’s Guide Figure 75 MAC Address Filter The following table describes the labels in this menu. Table 44 MAC Address Filter LABEL DESCRIPTION Active MAC Select the check box to enable MAC address filtering. Filter Define the filter action for the list of MAC addresses in the MAC Address table. Filter Action Select Deny to block access to the ZyXEL Device, MAC addresses not listed will be allowed to access the ZyXEL Device...

  • Page 141: Wmm Qos

    7.8 WMM QoS WMM (Wi-Fi MultiMedia) QoS (Quality of Service) ensures quality of service in wireless networks for multimedia applications. WMM allows you to prioritize wireless traffic according to the delivery requirements of the individual and applications. WMM is a part of the IEEE 802.11e QoS enhancement to certified Wi-Fi wireless networks. 7.8.1 WMM QoS Example When WMM QoS is not enabled, all traffic streams are given the same access throughput to the wireless network.

  • Page 142: Services

    P-662H/HW-D Series User’s Guide 7.8.3 Services The commonly used services and port numbers are shown in the following table. Please refer to RFC 1700 for further information about port numbers. Next to the name of the service, two fields appear in brackets. The first field indicates the IP protocol type (TCP, UDP, or ICMP). The second field indicates the IP port number that defines the service.

  • Page 143: Table 46 Commonly Used Services

    Table 46 Commonly Used Services SERVICE AIM/New-ICQ(TCP:5190) AUTH(TCP:113) BGP(TCP:179) BOOTP_CLIENT(UDP:68) BOOTP_SERVER(UDP:67) CU-SEEME(TCP/UDP:7648, 24032) DNS(UDP/TCP:53) FINGER(TCP:79) FTP(TCP:20.21) H.323(TCP:1720) HTTP(TCP:80) HTTPS(TCP:443) ICQ(UDP:4000) IKE(UDP:500) IPSEC_TUNNEL(AH:0) IPSEC_TUNNEL(ESP:0) IRC(TCP/UDP:6667) MSN Messenger(TCP:1863) MULTICAST(IGMP:0) NEW-ICQ(TCP:5190) NEWS(TCP:144) NFS(UDP:2049) NNTP(TCP:119) PING(ICMP:0) POP3(TCP:110) PPTP(TCP:1723) PPTP_TUNNEL(GRE:0) RCMD(TCP:512) Chapter 7 Wireless LAN P-662H/HW-D Series User’s Guide DESCRIPTION AOL’s Internet Messenger service, used as a listening port by ICQ.

  • Page 144: Qos Screen

    P-662H/HW-D Series User’s Guide Table 46 Commonly Used Services SERVICE REAL_AUDIO(TCP:7070) REXEC(TCP:514) RLOGIN(TCP:513) RTELNET(TCP:107) RTSP(TCP/UDP:554) SFTP(TCP:115) SMTP(TCP:25) SNMP(TCP/UDP:161) SNMP-TRAPS(TCP/UDP:162) SQL-NET(TCP:1521) SSH(TCP/UDP:22) STRM WORKS(UDP:1558) SYSLOG(UDP:514) TACACS(UDP:49) TELNET(TCP:23) TFTP(UDP:69) VDOLIVE(TCP:7000) 7.9 QoS Screen The QoS screen by default allows you to automatically give a service a priority level according to the ToS value in the IP header of the packets it sends.

  • Page 145: Figure 76 Wireless Lan: Qos

    Click Network > Wireless LAN > QoS. The following screen displays. Figure 76 Wireless LAN: QoS The following table describes the fields in this screen. Table 47 Wireless LAN: QoS LABEL Enable WMM QoS WMM QoS Policy Name Service Dest Port Priority Modify Chapter 7 Wireless LAN...

  • Page 146: Application Priority Configuration

    P-662H/HW-D Series User’s Guide Table 47 Wireless LAN: QoS LABEL Apply Cancel 7.9.2 Application Priority Configuration To edit a WMM QoS application entry, click the edit icon under Modify. The following screen displays. Figure 77 Application Priority Configuration The following table describes the fields in this screen. Table 48 Application Priority Configuration LABEL Application Priority Configuration...

  • Page 147: Multiple Ssid (P-662Hw-D Models Only)

    Table 48 Application Priority Configuration LABEL Service Dest Port Priority Apply Cancel 7.10 Multiple SSID (P-662HW-D Models only) The ZyXEL Device supports multiple SSID which allows you to configure a second wireless network with its own security parameters. This means that you can allow two different user groups to be connected to the same access point.

  • Page 148: Multiple Ssid Commands

    P-662H/HW-D Series User’s Guide Figure 78 Multiple SSID Network Example In this section the second wireless network is referred to as the “guest wireless network” and user’s connecting to this network are referred to as “guests”. Multiple SSID is only configurable via commands. The next sections describe multiple SSID commands and show a configuration example.

  • Page 149: Table 49 Multiple Ssid Commands

    The following table gives a description of multiple SSID commands. Table 49 Multiple SSID Commands Command guestssid <SSID> mode [0:disable guestssid 1:enable guestssid] [0:disable intranet blocking 1:enable intranet blocking] setprivacy type <0:NO 1:WEP64 2:WEP128 3:WEP256> setprivacy wepkey <1-4> <Key String> setprivacy defaultkey <1-4>...

  • Page 150: Multiple Ssid Example

    P-662H/HW-D Series User’s Guide 7.10.2 Multiple SSID Example This example shows how to configure a guest wireless network with the following parameters. Table 50 Multiple SSID Example Configuration PARAMETER SSID Security WEP key Other In the following script example all typed commands and parameters have been bolded. ras>...

  • Page 151: Chapter 8 Dmz

    This chapter describes how to configure the ZyXEL Device’s DMZ. 8.1 Introduction The DeMilitarized Zone (DMZ) auto-negotiating 10/100 Mbps Ethernet port provides a way for public servers (Web, e-mail, FTP, etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death).

  • Page 152: Figure 79 Dmz

    P-662H/HW-D Series User’s Guide Figure 79 DMZ The following table describes the labels in this screen. Table 51 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address Type the IP address of your ZyXEL Device’s DMZ port in dotted decimal notation. Make sure the IP address is on a separate subnet from the LAN port. IP Subnet Mask The subnet mask specifies the network number portion of an IP address.

  • Page 153: Dmz Public Ip Address Example

    Table 51 DMZ (continued) LABEL DESCRIPTION Allow between DMZ Select this check box to forward NetBIOS packets from the LAN to the DMZ and and LAN from the DMZ to the LAN. If your firewall is enabled with the default policy set to block DMZ to LAN traffic, you also need to enable the default DMZ to LAN firewall rule that forwards NetBIOS traffic.Clear this check box to block all NetBIOS packets going from the LAN to the DMZ and from the DMZ to the LAN.

  • Page 154: Dmz Private And Public Ip Address Example

    P-662H/HW-D Series User’s Guide Figure 80 DMZ Public Address Example 8.4 DMZ Private and Public IP Address Example The following figure shows a network setup with both private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected computers (A through C) use private IP addresses that are in one subnet.

  • Page 155: Figure 81 Dmz Private And Public Address Example

    P-662H/HW-D Series User’s Guide Figure 81 DMZ Private and Public Address Example Chapter 8 DMZ...
  • Page 156 P-662H/HW-D Series User’s Guide Chapter 8 DMZ...

  • Page 157: Network Address Translation (Nat) Screens

    Network Address Translation This chapter discusses how to configure NAT on the ZyXEL Device. 9.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet, for example, the source address of an outgoing packet, used within one network to a different IP address known within another network.

  • Page 158: What Nat Does

    P-662H/HW-D Series User’s Guide 9.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.

  • Page 159: Nat Application

    9.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyXEL Device can communicate with three distinct WAN networks. More examples follow at the end of this chapter. Figure 83 NAT Application With IP Alias 9.1.5 NAT Mapping Types NAT supports five types of IP/port mapping.

  • Page 160: Sua (Single User Account) Versus Nat

    P-662H/HW-D Series User’s Guide Port numbers do NOT change for One-to-One and Many-to-Many No Overload NAT mapping types. The following table summarizes these types. Table 53 NAT Mapping Types TYPE One-to-One Many-to-One (SUA/PAT) Many-to-Many Overload Many-to-Many No Overload Server 9.2 SUA (Single User Account) Versus NAT SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server.

  • Page 161: Port Forwarding

    Figure 84 NAT General The following table describes the labels in this screen. Table 54 NAT General LABEL DESCRIPTION Active Select this check box to enable NAT. Network Address Translation (NAT) SUA Only Select this radio button if you have just one public WAN IP address for your ZyXEL Device.

  • Page 162: Default Server Ip Address

    P-662H/HW-D Series User’s Guide You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unknown services or where one server can support more than one service (for example both FTP and web service), it might be better to specify a range of port numbers.

  • Page 163: Configuring Servers Behind Port Forwarding (Example)

    9.4.3 Configuring Servers Behind Port Forwarding (Example) Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example).

  • Page 164: Port Forwarding Rule Edit

    P-662H/HW-D Series User’s Guide The following table describes the fields in this screen. Table 56 NAT Port Forwarding LABEL Default Server Setup Default Server In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports that are not specified in this screen. If you do not assign a Default Server IP address, the ZyXEL Device discards all packets received for ports that are not specified here or in the remote management setup.

  • Page 165: Address Mapping

    The following table describes the fields in this screen. Table 57 Port Forwarding Rule Setup LABEL Active Click this check box to enable the rule. Service Name Enter a name to identify this port-forwarding rule. Start Port Enter a port number in this field. To forward only one port, enter the port number again in the End Port field.

  • Page 166: Figure 88 Address Mapping Rules

    P-662H/HW-D Series User’s Guide Figure 88 Address Mapping Rules The following table describes the fields in this screen. Table 58 Address Mapping Rules LABEL DESCRIPTION This is the rule index number. Local Start IP This is the starting Inside Local IP Address (ILA). Local IP addresses are N/A for Server port mapping.

  • Page 167: Address Mapping Rule Edit

    9.6.1 Address Mapping Rule Edit To edit an address mapping rule, click the rule’s edit icon in the Address Mapping screen to display the screen shown next. Figure 89 Edit Address Mapping Rule The following table describes the fields in this screen. Table 59 Edit Address Mapping Rule LABEL Type...
  • Page 168 P-662H/HW-D Series User’s Guide Table 59 Edit Address Mapping Rule (continued) LABEL Edit Details Click this link to go to the Port Forwarding screen to edit a server mapping set that you have selected in the Server Mapping Set field. Back Click Back to return to the previous screen.

  • Page 169: Chapter 10 Firewalls

    This chapter gives some background information on firewalls and introduces the ZyXEL Device firewall. 10.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another. The networking term “firewall” is a system or group of systems that enforces an access-control policy between two networks.

  • Page 170: Application-Level Firewalls

    P-662H/HW-D Series User’s Guide 10.2.2 Application-level Firewalls Application-level firewalls restrict access by serving as proxies for external servers. Since they use programs written for specific Internet services, such as HTTP, FTP and telnet, they can evaluate network packets for valid application-specific data. Application-level gateways have a number of general advantages over the default mode of permitting application traffic directly to internal hosts: Information hiding prevents the names of internal systems from being made known via DNS...

  • Page 171: Denial Of Service Attacks

    • The LAN (Local Area Network) port attaches to a network of computers, which needs security from the outside world. These computers will have access to Internet services such as e-mail, FTP, and the World Wide Web. However, “inbound access” will not be allowed unless you configure remote management or create a firewall rule to allow a remote host to use a specific service.

  • Page 172: Types Of Dos Attacks

    P-662H/HW-D Series User’s Guide Table 60 Common IP Ports Telnet SMTP 10.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data.

  • Page 173: Figure 92 Syn Flood

    Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is established. •...

  • Page 174: Icmp Vulnerability

    P-662H/HW-D Series User’s Guide Figure 93 Smurf Attack 10.4.2.1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 61 ICMP Commands That Trigger Alerts REDIRECT TIMESTAMP_REQUEST TIMESTAMP_REPLY ADDRESS_MASK_REQUEST ADDRESS_MASK_REPLY 10.4.2.2 Illegal Commands (NetBIOS and SMTP) The only legal NetBIOS commands are the following - all others are illegal.

  • Page 175: Traceroute

    10.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints. Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute the firewall gaining knowledge of the network topology inside the firewall. Often, many DoS attacks also employ a technique known as "IP Spoofing"...

  • Page 176: Stateful Inspection Process

    P-662H/HW-D Series User’s Guide The previous figure shows the ZyXEL Device’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated from the WAN is blocked.

  • Page 177: Tcp Security

    • Allow certain types of traffic from the Internet to specific hosts on the LAN. • Allow access to a Web server to everyone but competitors. • Restrict use of certain protocols, such as Telnet, to authorized users on the LAN. These custom rules work by evaluating the network traffic’s Source IP address, Destination IP address, IP protocol type, and comparing these to rules set by the administrator.

  • Page 178: Upper Layer Protocols

    P-662H/HW-D Series User’s Guide A similar situation exists for ICMP, except that the ZyXEL Device is even more restrictive. Specifically, only outgoing echoes will allow incoming echo replies, outgoing address mask requests will allow incoming address mask replies, and outgoing timestamp requests will allow incoming timestamp replies.

  • Page 179: Security In General

    10.6.1 Security In General You can never be too careful! Factors outside your firewall, filtering or NAT can cause security breaches. Below are some generalizations about what you can do to minimize them. • Encourage your company or organization to develop a comprehensive security plan. Good network administration takes into account what hackers can do and prepares against attacks.

  • Page 180: Packet Filtering

    P-662H/HW-D Series User’s Guide 10.7.1 Packet Filtering: • The router filters packets as they pass through the router’s interface according to the filter rules you designed. • Packet filtering is a powerful tool, yet can be complex to configure and maintain, especially if you need a chain of rules to filter a service.

  • Page 181: Chapter 11 Firewall Configuration

    This chapter shows you how to enable and configure the ZyXEL Device firewall. 11.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your ZyXEL Device has to offer. For this reason, it is recommended that you configure your firewall using the web configurator.

  • Page 182: Rule Logic Overview

    P-662H/HW-D Series User’s Guide Note: If you configure firewall rules without a good understanding of how they work, you might inadvertently introduce security risks to the firewall and to the protected network. Make sure you test your rules after you configure them. For example, you may create rules to: •...

  • Page 183: Key Fields For Configuring Rules

    4 Does a rule that allows Internet users access to resources on the LAN create a security vulnerability? For example, if FTP ports (TCP 20, 21) are allowed from the Internet to the LAN, Internet users may be able to connect to computers with running FTP servers. 5 Does this rule conflict with any existing rules? 6 Once these questions have been answered, adding rules is simply a matter of plugging the information into the correct fields in the web configurator screens.

  • Page 184: Lan To Wan Rules

    P-662H/HW-D Series User’s Guide 11.4.1 LAN to WAN Rules The default rule for LAN to WAN traffic is that all users on the LAN are allowed non- restricted access to the WAN. When you configure a LAN to WAN rule, you in essence want to limit some or all users from accessing certain services on the WAN.

  • Page 185: Firewall Rules Summary

    The following table describes the labels in this screen. Table 64 Firewall: General LABEL DESCRIPTION Active Firewall Select this check box to activate the firewall. The ZyXEL Device performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.

  • Page 186: Figure 96 Firewall Rules

    P-662H/HW-D Series User’s Guide Figure 96 Firewall Rules The following table describes the labels in this screen. Table 65 Firewall Rules LABEL DESCRIPTION Firewall Rules This read-only bar shows how much of the ZyXEL Device's memory for recording Storage Space firewall rules it is currently using.

  • Page 187: Configuring Firewall Rules

    Table 65 Firewall Rules (continued) LABEL DESCRIPTION Action This field displays whether the firewall silently discards packets (Drop), discards packets and sends a TCP reset packet or an ICMP destination-unreachable message to the sender (Reject) or allows the passage of packets (Permit). Schedule This field tells you whether a schedule is specified (Yes) or not (No).

  • Page 188: Figure 97 Firewall: Edit Rule

    P-662H/HW-D Series User’s Guide Figure 97 Firewall: Edit Rule Chapter 11 Firewall Configuration...

  • Page 189: Table 66 Firewall: Edit Rule

    The following table describes the labels in this screen. Table 66 Firewall: Edit Rule LABEL DESCRIPTION Active Select this option to enable this firewall rule. Action for Matched Use the drop-down list box to select what the firewall is to do with packets that Packet match this rule.

  • Page 190: Customized Services

    P-662H/HW-D Series User’s Guide Table 66 Firewall: Edit Rule (continued) LABEL DESCRIPTION Apply Click Apply to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. 11.6.2 Customized Services Configure customized services and port numbers not predefined by the ZyXEL Device. For a comprehensive list of port numbers and services, visit the IANA (Internet Assigned Number Authority) website.

  • Page 191: Configuring A Customized Service

    11.6.3 Configuring A Customized Service Click a rule number in the Firewall Customized Services screen to create a new custom port or edit an existing one. This action displays the following screen. Refer to Section 10.1 on page 169 Figure 99 Firewall: Configure Customized Services The following table describes the labels in this screen.

  • Page 192: Figure 100 Firewall Example: Rules

    P-662H/HW-D Series User’s Guide Figure 100 Firewall Example: Rules 3 In the Rules screen, select the index number after that you want to add the rule. For example, if you select “6”, your new rule becomes number 7 and the previous rule 7 (if there is one) becomes rule 8.

  • Page 193: Figure 102 Firewall Example: Edit Rule: Destination Address

    P-662H/HW-D Series User’s Guide Figure 102 Firewall Example: Edit Rule: Destination Address 9 Use the Add >> and Remove buttons between Available Services and Selected Services list boxes to configure it as follows. Click Apply when you are done. Note: Custom services show up with an “*” before their names in the Services list box and the Rules list box.

  • Page 194: Figure 103 Firewall Example: Edit Rule: Select Customized Services

    P-662H/HW-D Series User’s Guide Figure 103 Firewall Example: Edit Rule: Select Customized Services On completing the configuration procedure for this Internet firewall rule, the Rules screen should look like the following. Rule 1 allows a “MyService” connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN.

  • Page 195: Predefined Services

    Figure 104 Firewall Example: Rules: MyService 11.8 Predefined Services The Available Services list box in the Edit Rule screen (see displays all predefined services that the ZyXEL Device already supports. Next to the name of the service, two fields appear in brackets. The first field indicates the IP protocol type (TCP, UDP, or ICMP).
  • Page 196 P-662H/HW-D Series User’s Guide Table 69 Predefined Services (continued) SERVICE H.323(TCP:1720) HTTP(TCP:80) HTTPS ICQ(UDP:4000) IPSEC_TRANSPORT/ TUNNEL(AH:0) IPSEC_TUNNEL(ESP:0) IRC(TCP/UDP:6667) MSN Messenger(TCP:1863) MULTICAST(IGMP:0) NEWS(TCP:144) NFS(UDP:2049) NNTP(TCP:119) PING(ICMP:0) POP3(TCP:110) PPTP(TCP:1723) PPTP_TUNNEL(GRE:0) RCMD(TCP:512) REAL_AUDIO(TCP:7070) REXEC(TCP:514) RLOGIN(TCP:513) RTELNET(TCP:107) RTSP(TCP/UDP:554) SFTP(TCP:115) SMTP(TCP:25) SNMP(TCP/UDP:161) SNMP-TRAPS (TCP/ UDP:162) SQL-NET(TCP:1521) DESCRIPTION Net Meeting uses this protocol.

  • Page 197: Anti-Probing

    Table 69 Predefined Services (continued) SERVICE SSDP(UDP:1900) SSH(TCP/UDP:22) STRMWORKS(UDP:1558) SYSLOG(UDP:514) TACACS(UDP:49) TELNET(TCP:23) TFTP(UDP:69) VDOLIVE(TCP:7000) 11.9 Anti-Probing If an outside user attempts to probe an unsupported port on your ZyXEL Device, an ICMP response packet is automatically returned. This allows the outside user to know the ZyXEL Device exists.

  • Page 198: Dos Thresholds

    P-662H/HW-D Series User’s Guide The following table describes the labels in this screen. Table 70 Firewall: Anti Probing LABEL DESCRIPTION Respond to PING The ZyXEL Device does not respond to any incoming ping requests when Disable is selected. Select the interface which you want to reply to incoming ping requests. Do Not Respond to Select this option to prevent hackers from finding the ZyXEL Device by probing for Requests for...

  • Page 199: Half-Open Sessions

    You should make any changes to the threshold values before you continue configuring firewall rules. 11.10.2 Half-Open Sessions An unusually high number of half-open sessions (either an absolute number or measured as the arrival rate) could indicate that a Denial of Service attack is occurring. For TCP, "half- open"...

  • Page 200: Configuring Firewall Thresholds

    P-662H/HW-D Series User’s Guide 11.10.3 Configuring Firewall Thresholds The ZyXEL Device also sends alerts whenever TCP Maximum Incomplete is exceeded. The global values specified for the threshold and timeout apply to all TCP connections. Click Firewall, and Threshold to bring up the next screen. Figure 106 Firewall: Threshold The following table describes the labels in this screen.
  • Page 201 Table 71 Firewall: Threshold (continued) LABEL DESCRIPTION Maximum This is the number of existing half-open Incomplete Low sessions that causes the firewall to stop deleting half-open sessions. The ZyXEL Device continues to delete half-open requests as necessary, until the number of existing half-open sessions drops below this number.
  • Page 202 P-662H/HW-D Series User’s Guide Chapter 11 Firewall Configuration...

  • Page 203: Chapter 12 Anti-Virus Packet Scan

    Anti-Virus Packet Scan This chapter introduces and shows you how to configure the anti-virus packet scan. 12.1 Overview A computer virus is a small program designed to corrupt and/or alter the operation of other legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates itself.

  • Page 204: Computer Virus Infection And Prevention

    P-662H/HW-D Series User’s Guide For maximum protection, you must keep the pattern file up-to-date. 12.2.1 Computer Virus Infection and Prevention The follow describes a simplistic life cycle of a computer virus. 1 A computer gets a copy of a virus from an unknown source (such as the Internet, e-mail, file sharing or any removable storage media).

  • Page 205: How The Zyxel Device Virus Scan Works

    This is an Internet file transfer service that operates on the Internet and over TCP/IP networks. A system running the FTP server accepts commands from a system running an FTP client. The service allows users to send commands to the server for uploading and downloading files.

  • Page 206: Figure 108 Anti-Virus: Packet Scan

    P-662H/HW-D Series User’s Guide Click Security > AntiVirus to display the configuration screen as shown next. Figure 108 Anti-Virus: Packet Scan The following table describes the labels in this screen. Table 73 Anti-Virus: Packet Scan LABEL DESCRIPTION Packet Scan Configuration Active Select this check box to enable the anti-virus packet scan on the ZyXEL Device.

  • Page 207: Registration And Online Update

    Table 73 Anti-Virus: Packet Scan (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyXEL Device. Cancel Click Cancel to return to the previously saved settings. 12.5 Registration and Online Update Use the Registration and Virus Information Update screen to register for and activate the anti-virus packet scan feature on the ZyXEL Device.

  • Page 208: Figure 109 Anti-Virus: Registration And Virus Information Update

    P-662H/HW-D Series User’s Guide Figure 109 Anti-Virus: Registration and Virus Information Update The following table describes the labels in this screen. Table 74 Anti-Virus: Registration and Virus Information Update LABEL DESCRIPTION Registration You must register for the anti-virus service before you can use the packet scan feature on the ZyXEL Device.

  • Page 209: Updating The Anti-Virus Packet Scan

    12.5.1 Updating the Anti-Virus Packet Scan Follow the steps below to update the virus scan on the ZyXEL Device manually. Note: Do not turn off the ZyXEL Device while the virus scan update is in progress! 1 In the Registration and Virus Information Update screen, click Update Now. An update progress screen displays as shown.
  • Page 210 P-662H/HW-D Series User’s Guide Chapter 12 Anti-Virus Packet Scan...

  • Page 211: Chapter 13 Content Filtering

    This chapter covers how to configure content filtering. 13.1 Content Filtering Overview Internet content filtering allows you to create and enforce Internet access policies tailored to your needs. Content filtering gives you the ability to block web sites that contain key words (that you specify) in the URL.

  • Page 212: Configuring The Schedule

    P-662H/HW-D Series User’s Guide The following table describes the labels in this screen. Table 75 Content Filter: Keyword LABEL Active Keyword Blocking Block Websites that contain these keywords in the URL: Delete Clear All Keyword Add Keyword Apply Cancel 13.3 Configuring the Schedule To set the days and times for the ZyXEL Device to perform content filtering, click Security >...

  • Page 213: Configuring Trusted Computers

    The following table describes the labels in this screen. Table 76 Content Filter: Schedule LABEL DESCRIPTION Schedule Select Active Everyday to Block to make the content filtering active everyday. Otherwise, select Edit Daily to Block and configure which days of the week (or everyday) and which time of the day you want the content filtering to be active.
  • Page 214 P-662H/HW-D Series User’s Guide Chapter 13 Content Filtering...

  • Page 215: Content Access Control

    Content Access Control This chapter gives some background information on Content Access Control and explains how to get started with the ZyXEL Device Content Access Control. 14.1 Content Access Control Overview Content Access Control (CAC) lets a LAN administrator control a LAN user’s Internet access privileges by blocking services that you specify.

  • Page 216: Activating Cac And Creating User Groups

    P-662H/HW-D Series User’s Guide 14.2 Activating CAC and Creating User Groups From the main menu click Security > Content Access Control and General to open the configuration screen. Use this screen to activate Content Access Control and set up the four user groups. Note: You must set up all four user groups.

  • Page 217: Configuring Time Schedule

    Table 78 Content Access Control: General LABEL DESCRIPTION Service Click Edit to select the services you wish to block access for a user group. Web Browsing Click Edit to specify the web site category(ies) and/or key words in a web site address you wish to block access for a user group.

  • Page 218: Figure 117 Control Access Control: General: Time Scheduling

    P-662H/HW-D Series User’s Guide Figure 117 Control Access Control: General: Time Scheduling The following table describes the labels in this screen. Table 79 Control Access Control: General: Time Scheduling LABEL DESCRIPTION Time Scheduling Select the first radio button to allow everyday access at the same times to the Internet.

  • Page 219: Configuring Services

    14.2.2 Configuring Services To customize services for each user group, click Edit under Services for that user group in the Content Access Control: General screen. Figure 118 Content Access Control: General: Services The following table describes the labels in this screen. Table 80 Content Access Control: General: Services LABEL DESCRIPTION...

  • Page 220: Available Services

    P-662H/HW-D Series User’s Guide Table 80 Content Access Control: General: Services (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyXEL Device. Cancel Click Cancel to return to the previously saved settings. 14.2.2.1 Available Services The Available Services list box in the Services screen displays some predefined services that the ZyXEL Device supports.
  • Page 221 Table 81 Available Services (continued) SERVICE MULTICAST(IGMP:0) NEW-ICQ(TCP:5190) NEWS(TCP:144) NFS(UDP:2049) NNTP(TCP:119) PING(ICMP:0) PING(ICMP:0) PPTP(TCP:1723) PPTP_TUNNEL(GRE:0) RCMD(TCP:512) REAL_AUDIO(TCP:7070) REXEC(TCP:514) RLOGIN(TCP:513) RTELNET(TCP:107) RTSP(TCP/UDP:554) SFTP(TCP:115) SMTP(TCP:25) SNMP(TCP/UDP:161) SNMP-TRAPS(TCP/ UDP:162) SQL-NET(TCP:1521) SSH(TCP/UDP:22) STRM WORKS(UDP:1558) SYSLOG(UDP:514) TACACS(UDP:49) TELNET(TCP:23) TFTP(UDP:69) VDOLIVE(TCP:7000) Chapter 14 Content Access Control P-662H/HW-D Series User’s Guide DESCRIPTION Internet Group Multicast Protocol is used when sending packets to a...

  • Page 222: Configuring Web Site Filters

    P-662H/HW-D Series User’s Guide 14.2.3 Configuring Web Site Filters To enable content filtering and to configure URL keyword blocking for a user group, click Edit under Web Browsing in the Content Access Control: General screen. A screen displays as shown next. Figure 119 Content Access Control: General: Web Site Filter The following table describes the labels in this screen.
  • Page 223 Table 82 Content Access Control: General: Web Site Filter (continued) LABEL Log Matched Web Site Select this option to record attempts to access prohibited web pages. Select Blocked Categories Select All Select this check box to restrict access to all site categories listed below. Clear All Select this check box to clear the selected categories below.
  • Page 224 P-662H/HW-D Series User’s Guide Table 82 Content Access Control: General: Web Site Filter (continued) LABEL Abortion Selecting this category excludes pages that provide information or Arts/Entertainment Selecting this category excludes pages that promote and provide information Business/Economy Selecting this category excludes pages devoted to business firms, business Cult/Occult Selecting this category excludes pages that promote or offer methods, Illegal Drugs Selecting this category excludes pages that promote, offer, sell, supply, Education Selecting this category excludes pages that offer educational information,...
  • Page 225 Table 82 Content Access Control: General: Web Site Filter (continued) LABEL Health Selecting this category excludes pages that provide advice and information Computers/Internet Selecting this category excludes pages that sponsor or provide information Hacking/Proxy Avoidance Search Engines/Portals Selecting this category excludes pages that support searching the Internet, Web Communications Selecting this category excludes pages that allow or offer Web-based Job Search/Careers Selecting this category excludes pages that provide assistance in finding News/Media Selecting this category excludes pages that primarily report information or...
  • Page 226 P-662H/HW-D Series User’s Guide Table 82 Content Access Control: General: Web Site Filter (continued) LABEL Society/Lifestyle Selecting this category excludes pages providing information on matters of Gay/Lesbian Selecting this category excludes pages that provide information, promote, or Restaurants/Dining/ Food Sports/Recreation/ Hobbies Travel Selecting this category excludes pages that promote or provide opportunity Vehicles Selecting this category excludes pages that provide information on or...

  • Page 227: Testing Web Site Access Privileges

    Table 82 Content Access Control: General: Web Site Filter (continued) LABEL Keyword Back Apply Cancel 14.2.4 Testing Web Site Access Privileges To check the access restrictions of a web site, click Diagnose under Web Browsing in the Content Access Control: General screen. A screen displays as shown next. The ZyXEL Device first checks the web site address for the specified keyword(s) to block.

  • Page 228: User Account Setup

    P-662H/HW-D Series User’s Guide 14.3 User Account Setup With Content Access Control, the ZyXEL Device requires LAN users to login with valid username and password before they are allowed to access the Internet. Use the User Profile screen to set up user accounts. From the main menu click Security > Content Access >...

  • Page 229: User Online Status

    14.4 User Online Status To view the online status of each user, click Security > Content Access Control > Online Status to display the screen as shown. Figure 122 Content Access Control: Online Status The following table describes the labels in this screen. Table 85 Content Access Control: Online Status LABEL DESCRIPTION...

  • Page 230: Content Access Control Logins

    P-662H/HW-D Series User’s Guide 14.5 Content Access Control Logins The following sections describe the user and administrator login experience. 14.5.1 User Login 1 Once the initial configuration is complete, a computer on the network cannot gain Internet access without first logging into the ZyXEL Device. 2 When you attempt to access a website, you are directed to the ZyXEL Device’s user login screen.

  • Page 231: Administrator Login

    14.5.2 Administrator Login The administrator can log into the system. • The administrator opens their browser and is directed to the ZyXEL Device user login page (this is the same as the user login). • The administrator enters “admin” as the username and the system password. •...
  • Page 232 P-662H/HW-D Series User’s Guide Chapter 14 Content Access Control...

  • Page 233: Chapter 15 Introduction To Ipsec

    This chapter introduces the basics of IPSec VPNs. 15.1 VPN Overview A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication.

  • Page 234: Data Confidentiality

    P-662H/HW-D Series User’s Guide Figure 125 Encryption and Decryption 15.1.3.2 Data Confidentiality The IPSec sender can encrypt packets before transmitting them across a network. 15.1.3.3 Data Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.

  • Page 235: Ipsec Architecture

    15.2 IPSec Architecture The overall IPSec architecture is shown as follows. Figure 126 IPSec Architecture 15.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure (including implementation algorithms).

  • Page 236: Transport Mode

    P-662H/HW-D Series User’s Guide Figure 127 Transport and Tunnel Mode IPSec Encapsulation 15.3.1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP).

  • Page 237: Table 86 Vpn And Nat

    NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet. When using AH protocol, packet contents (the data payload) are not encrypted.
  • Page 238 P-662H/HW-D Series User’s Guide Chapter 15 Introduction to IPSec...

  • Page 239: Chapter 16 Vpn Screens

    This chapter introduces the VPN screens. See the Logs chapter for information on viewing logs and the appendix for IPSec log descriptions. 16.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN connections. 16.2 IPSec Algorithms The ESP and AH protocols are necessary to create a Security Association (SA), the foundation of an IPSec VPN.

  • Page 240: My Ip Address

    P-662H/HW-D Series User’s Guide Table 87 AH and ESP DES (default) Data Encryption Standard (DES) is a widely used method of data encryption using a private (secret) key. DES applies a 56-bit key to each 64-bit block of data. 3DES Triple DES (3DES) is a variant of DES, which iterates three times with three separate keys ENCRYPTION...

  • Page 241: Secure Gateway Address

    16.4 Secure Gateway Address Secure Gateway Address is the WAN IP address or domain name of the remote IPSec router (secure gateway). If the remote secure gateway has a static WAN IP address, enter it in the Secure Gateway Address field. You may alternatively enter the remote secure gateway’s domain name (if it has one) in the Secure Gateway Address field.

  • Page 242: Figure 129 Vpn Setup

    P-662H/HW-D Series User’s Guide Figure 129 VPN Setup The following table describes the fields in this screen. Table 88 VPN Setup LABEL DESCRIPTION This is the VPN policy index number. Click a number to edit VPN policies. Active This field displays whether the VPN policy is active or not. A Yes signifies that this VPN policy is active.

  • Page 243: Keep Alive

    Table 88 VPN Setup LABEL DESCRIPTION Remote This is the IP address(es) of computer(s) on the remote network behind the remote Address IPSec router. This field displays N/A when the Secure Gateway Address field displays 0.0.0.0. In this case only the remote IPSec router can initiate the VPN. The same (static) IP address is displayed twice when the Remote Address Type field in the VPN-IKE (or VPN-Manual Key) screen is configured to Single.

  • Page 244: Vpn, Nat, And Nat Traversal

    P-662H/HW-D Series User’s Guide 16.7 VPN, NAT, and NAT Traversal NAT is incompatible with the AH protocol in both transport and tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet, but a NAT device between the IPSec endpoints rewrites the source or destination address.

  • Page 245: Remote Dns Server

    Y* - This is supported in the ZyXEL Device if you enable NAT traversal. 16.8 Remote DNS Server In cases where you want to use domain names to access Intranet servers on a remote network that has a DNS server, you must identify that DNS server. You cannot use DNS servers on the LAN or from the ISP since these DNS servers cannot resolve domain names to private IP addresses on the remote network The following figure depicts an example where three VPN tunnels are created from ZyXEL...

  • Page 246: Id Type And Content Examples

    P-662H/HW-D Series User’s Guide With main mode (see provide identity protection. In this case the ZyXEL Device can only distinguish between up to 12 different incoming SAs that connect from remote IPSec routers that have dynamic WAN IP addresses. The ZyXEL Device can distinguish up to 12 incoming SAs because you can select between three encryption algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN rule (see Section 16.13 on page...

  • Page 247: Pre-Shared Key

    The two ZyXEL Devices in this example can complete negotiation and establish a VPN tunnel. Table 92 Matching ID Type and Content Configuration Example ZYXEL DEVICE A Local ID type: E-mail Local ID content: tom@yourcompany.com Peer ID type: IP Peer ID content: 1.1.1.2 The two ZyXEL Devices in this example cannot complete their negotiation because ZyXEL Device B’s Local ID type is IP, but ZyXEL Device A’s Peer ID type is set to E-mail.

  • Page 248: Figure 132 Edit Vpn Policies

    P-662H/HW-D Series User’s Guide Figure 132 Edit VPN Policies The following table describes the fields in this screen. Table 94 Edit VPN Policies LABEL DESCRIPTION IPSec Setup Active Select this check box to activate this VPN policy. This option determines whether a VPN rule is applied before a packet leaves the firewall.
  • Page 249 Table 94 Edit VPN Policies LABEL DESCRIPTION NAT Traversal This function is available if the VPN protocol is ESP. Select this check box if you want to set up a VPN tunnel when there are NAT routers between the ZyXEL Device and remote IPSec router. The remote IPSec router must also enable NAT traversal, and the NAT routers have to forward UDP port 500 packets to the remote IPSec router behind the NAT router.
  • Page 250 P-662H/HW-D Series User’s Guide Table 94 Edit VPN Policies LABEL DESCRIPTION Remote Remote IP addresses must be static and correspond to the remote IPSec router's configured local IP addresses. The remote fields do not apply when the Secure Gateway IP Address field is configured to 0.0.0.0. In this case only the remote IPSec router can initiate the VPN.
  • Page 251 Table 94 Edit VPN Policies LABEL DESCRIPTION Peer ID Type Select IP to identify the remote IPSec router by its IP address. Select DNS to identify the remote IPSec router by a domain name. Select E-mail to identify the remote IPSec router by an e-mail address. Content The configuration of the peer content depends on the peer ID type.

  • Page 252: Ike Phases

    P-662H/HW-D Series User’s Guide Table 94 Edit VPN Policies LABEL DESCRIPTION Encryption Select DES, 3DES, AES or NULL from the drop-down list box. Algorithm When you use one of these encryption algorithms for data communications, both the sending device and the receiving device must use the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code.

  • Page 253: Negotiation Mode

    • Authenticate the connection by entering a pre-shared key. • Choose an encryption algorithm. • Choose an authentication algorithm. • Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2). • Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out.

  • Page 254: Diffie-Hellman (Dh) Key Groups

    P-662H/HW-D Series User’s Guide 16.12.2 Diffie-Hellman (DH) Key Groups Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 - DH1) and 1024-bit (Group 2 – DH2) Diffie-Hellman groups are supported.

  • Page 255: Figure 134 Advanced Vpn Policies

    Figure 134 Advanced VPN Policies The following table describes the fields in this screen. Table 95 Advanced VPN Policies LABEL DESCRIPTION VPN - IKE Protocol Enter 1 for ICMP, 6 for TCP, 17 for UDP, etc. 0 is the default and signifies any protocol.
  • Page 256 P-662H/HW-D Series User’s Guide Table 95 Advanced VPN Policies LABEL DESCRIPTION Negotiation Mode Select Main or Aggressive from the drop-down list box. Multiple SAs connecting through a secure gateway must have the same negotiation mode. Pre-Shared Key Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation.

  • Page 257: Manual Key Setup

    Table 95 Advanced VPN Policies LABEL DESCRIPTION Authentication Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and Algorithm SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower.

  • Page 258: Figure 135 Vpn: Manual Key

    P-662H/HW-D Series User’s Guide Figure 135 VPN: Manual Key The following table describes the fields in this screen. Table 96 VPN: Manual Key LABEL DESCRIPTION IPSec Setup Active Select this check box to activate this VPN policy. Name Type up to 32 characters to identify this VPN policy. You may use any character, including spaces, but the ZyXEL Device drops trailing spaces.
  • Page 259 Table 96 VPN: Manual Key (continued) LABEL DESCRIPTION DNS Server (for If there is a private DNS server that services the VPN, type its IP address here. IPSec VPN) The ZyXEL Device assigns this additional DNS server to the ZyXEL Device 's DHCP clients that have IP addresses in this IPSec rule's range of local addresses.

  • Page 260: Viewing Sa Monitor

    P-662H/HW-D Series User’s Guide Table 96 VPN: Manual Key (continued) LABEL DESCRIPTION My IP Address Enter the WAN IP address of your ZyXEL Device. The VPN tunnel has to be rebuilt if this IP address changes. The following applies if this field is configured as 0.0.0.0: The ZyXEL Device uses the current ZyXEL Device WAN IP address (static or dynamic) to set up the VPN tunnel.

  • Page 261: Configuring Global Setting

    When there is outbound traffic but no inbound traffic, the SA times out automatically after two minutes. A tunnel with no outbound or inbound traffic is "idle" and does not timeout until the SA lifetime period expires. See Device renegotiate an IPSec SA when the SA lifetime expires, even if there is no traffic. Figure 136 VPN: SA Monitor The following table describes the fields in this screen.

  • Page 262: Telecommuter Vpn/Ipsec Examples

    P-662H/HW-D Series User’s Guide The following table describes the fields in this screen. Table 98 VPN: Global Setting LABEL Windows Networking (NetBIOS over TCP/IP) Allow NetBIOS Traffic Through All IPSec Tunnels Apply Cancel 16.18 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyXEL Device at headquarters.

  • Page 263: Telecommuters Using Unique Vpn Rules Example

    Table 99 Telecommuters Sharing One VPN Rule Example FIELDS TELECOMMUTERS My IP Address: 0.0.0.0 (dynamic IP address assigned by the ISP) Secure Gateway IP Public static IP address Address: Local IP Address: Telecommuter A: 192.168.2.12 Telecommuter B: 192.168.3.2 Telecommuter C: 192.168.4.15 Remote IP Address: 192.168.1.10 16.18.2 Telecommuters Using Unique VPN Rules Example In this example the telecommuters (A, B and C in the figure) use IPSec routers with domain...

  • Page 264: Vpn And Remote Management

    P-662H/HW-D Series User’s Guide Table 100 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS All Telecommuter Rules: My IP Address 0.0.0.0 Secure Gateway Address: bigcompanyhq.com Remote IP Address: 192.168.1.10 Peer ID Type: E-mail Peer ID Content: bob@bigcompanyhq.com Telecommuter A (telecommutera.dydns.org) Local ID Type: IP Local ID Content: 192.168.2.12 Local IP Address: 192.168.2.12 Telecommuter B (telecommuterb.dydns.org)

  • Page 265: Chapter 17 Certificates

    This chapter gives background information about public-key certificates and explains how to use them. 17.1 Certificates Overview The ZyXEL Device can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. A certificate contains the certificate owner’s identity and public key.

  • Page 266: Advantages Of Certificates

    P-662H/HW-D Series User’s Guide A certification path is the hierarchy of certification authority certificates that validate a certificate. The ZyXEL Device does not trust a certificate if any certificate on its path has expired or been revoked. Certification authorities maintain directory servers with databases of valid and revoked certificates.

  • Page 267: My Certificates

    Use the Directory Servers screen to configure a list of addresses of directory servers (that contain lists of valid and revoked certificates). 17.4 My Certificates Click Security > Certificates > My Certificates to open the My Certificates screen. This is the ZyXEL Device’s summary list of certificates and certification requests.
  • Page 268 P-662H/HW-D Series User’s Guide Table 101 My Certificates (continued) LABEL DESCRIPTION Type This field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request.

  • Page 269: My Certificate Import

    17.5 My Certificate Import Click Security > Certificates > My Certificates and then Import to open the My Certificate Import screen. Follow the instructions in this screen to save an existing certificate to the ZyXEL Device. Note: You can only import a certificate that matches a corresponding certification request that was generated by the ZyXEL Device.

  • Page 270: My Certificate Create

    P-662H/HW-D Series User’s Guide The following table describes the labels in this screen. Table 102 My Certificate Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. Browse Click Browse to find the certificate file you want to upload.

  • Page 271: Table 103 My Certificate Create

    The following table describes the labels in this screen. Table 103 My Certificate Create LABEL Certificate Name Subject Information Common Name Organizational Unit Organization Country Key Length Enrollment Options Create a self-signed certificate Create a certification request and save it locally for later manual enrollment Create a certification...

  • Page 272: My Certificate Details

    P-662H/HW-D Series User’s Guide Table 103 My Certificate Create (continued) LABEL Enrollment Protocol CA Server Address CA Certificate Request Authentication Apply Cancel After you click Apply in the My Certificate Create screen, you see a screen that tells you the ZyXEL Device is generating the self-signed certificate or certification request.

  • Page 273: Figure 144 My Certificate Details

    P-662H/HW-D Series User’s Guide Figure 144 My Certificate Details Chapter 17 Certificates...

  • Page 274: Table 104 My Certificate Details

    P-662H/HW-D Series User’s Guide The following table describes the labels in this screen. Table 104 My Certificate Details LABEL Name Property Default self-signed certificate which signs the imported remote host certificates. Certification Path Refresh Certificate Information Type Version Serial Number Subject Issuer Signature Algorithm...

  • Page 275: Trusted Cas

    Table 104 My Certificate Details (continued) LABEL Key Algorithm Subject Alternative Name Key Usage Basic Constraint MD5 Fingerprint SHA1 Fingerprint Certificate in PEM (Base-64) Encoded Format Export Apply Cancel 17.8 Trusted CAs Click Security > Certificates > Trusted CAs to open the Trusted CAs screen. This screen displays a summary list of certificates of the certification authorities that you have set the ZyXEL Device to accept as trusted.

  • Page 276: Figure 145 Trusted Cas

    P-662H/HW-D Series User’s Guide Figure 145 Trusted CAs The following table describes the labels in this screen. Table 105 Trusted CAs LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyXEL Device’s PKI storage space that is Space in Use currently in use.

  • Page 277: Trusted Ca Import

    Table 105 Trusted CAs (continued) LABEL DESCRIPTION Import Click Import to open a screen where you can save the certificate of a certification authority that you trust, from your computer to the ZyXEL Device. Refresh Click this button to display the current validity status of the certificates. 17.9 Trusted CA Import Click Security >...

  • Page 278: Trusted Ca Details

    P-662H/HW-D Series User’s Guide 17.10 Trusted CA Details Click Security > Certificates > Trusted CAs to open the Trusted CAs screen. Click the details icon to open the Trusted CA Details screen. Use this screen to view in-depth information about the certification authority’s certificate, change the certificate’s name and set whether or not you want the ZyXEL Device to check a certification authority’s list of revoked certificates before trusting a certificate issued by the certification authority.

  • Page 279: Table 107 Trusted Ca Details

    The following table describes the labels in this screen. Table 107 Trusted CA Details LABEL Name Property Check incoming certificates issued by this CA against a Certification Path Refresh Certificate Information Type Version Serial Number Subject Issuer Signature Algorithm Valid From Valid To Chapter 17 Certificates DESCRIPTION...

  • Page 280: Trusted Remote Hosts

    P-662H/HW-D Series User’s Guide Table 107 Trusted CA Details (continued) LABEL Key Algorithm Subject Alternative Name Key Usage Basic Constraint CRL Distribution Points MD5 Fingerprint SHA1 Fingerprint Certificate in PEM (Base-64) Encoded Format Export Apply Cancel 17.11 Trusted Remote Hosts Click Security >...

  • Page 281: Figure 148 Trusted Remote Hosts

    Figure 148 Trusted Remote Hosts The following table describes the labels in this screen. Table 108 Trusted Remote Hosts LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyXEL Device’s PKI storage space that is Space in Use currently in use.

  • Page 282: Verifying A Trusted Remote Host's Certificate

    P-662H/HW-D Series User’s Guide 17.12 Verifying a Trusted Remote Host’s Certificate Certificates issued by certification authorities have the certification authority’s signature for you to check. Self-signed certificates only have the signature of the host itself. This means that you must be very careful when deciding to import (and thereby trust) a remote host’s self- signed certificate.

  • Page 283: Trusted Remote Hosts Import

    Verify (over the phone for example) that the remote host has the same information in the Thumbprint Algorithm and Thumbprint fields. 17.13 Trusted Remote Hosts Import Click Security > Certificates > Trusted Remote Hosts to open the Trusted Remote Hosts screen and then click Import to open the Trusted Remote Host Import screen.

  • Page 284: Figure 152 Trusted Remote Host Details

    P-662H/HW-D Series User’s Guide Figure 152 Trusted Remote Host Details Chapter 17 Certificates...

  • Page 285: Table 110 Trusted Remote Host Details

    The following table describes the labels in this screen. Table 110 Trusted Remote Host Details LABEL Name Certification Path Refresh Certificate Information These read-only fields display detailed information about the certificate. Type Version Serial Number Subject Issuer Signature Algorithm Valid From Valid To Key Algorithm Subject Alternative...

  • Page 286: Directory Servers

    P-662H/HW-D Series User’s Guide Table 110 Trusted Remote Host Details (continued) LABEL MD5 Fingerprint SHA1 Fingerprint Certificate in PEM (Base-64) Encoded Format Export Apply Cancel 17.15 Directory Servers Click Security > Certificates > Directory Servers to open the Directory Servers screen. This screen displays a summary list of directory servers (that contain lists of valid and revoked certificates) that have been saved into the ZyXEL Device.

  • Page 287: Directory Server Add Or Edit

    Figure 153 Directory Servers The following table describes the labels in this screen. Table 111 Directory Servers LABEL DESCRIPTION PKI Storage Space This bar displays the percentage of the ZyXEL Device’s PKI storage space that is in Use currently in use. The bar turns from green to red when the maximum is being approached.

  • Page 288: Figure 154 Directory Server Add

    P-662H/HW-D Series User’s Guide Figure 154 Directory Server Add The following table describes the labels in this screen. Table 112 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name Type up to 31 ASCII characters (spaces are not permitted) to identify this directory server.

  • Page 289: Chapter 18 Static Route

    This chapter shows you how to configure static routes for your ZyXEL Device. 18.1 Static Route Each remote node specifies only the network to which the gateway is directly connected, and the ZyXEL Device has no knowledge of the networks beyond. For instance, the ZyXEL Device knows about network N2 in the following figure through remote node Router 1.

  • Page 290: Static Route Edit

    P-662H/HW-D Series User’s Guide Figure 156 Static Route The following table describes the labels in this screen. Table 113 Static Route LABEL DESCRIPTION This is the number of an individual static route. Active This field shows whether this static route is active (Yes) or not (No). Name This is the name that describes or identifies this route.

  • Page 291: Figure 157 Static Route Edit

    Figure 157 Static Route Edit The following table describes the labels in this screen. Table 114 Static Route Edit LABEL DESCRIPTION Active This field allows you to activate/deactivate this static route. Route Name Enter the name of the IP static route. Leave this field blank to delete this static route. Destination IP This parameter specifies the IP network address of the final destination.
  • Page 292 P-662H/HW-D Series User’s Guide Chapter 18 Static Route...

  • Page 293: Chapter 19 Bandwidth Management

    Bandwidth Management This chapter contains information about configuring bandwidth management, editing rules and viewing the ZyXEL Device’s bandwidth management logs. 19.1 Bandwidth Management Overview ZyXEL’s Bandwidth Management allows you to specify bandwidth management rules based on an application and/or subnet. You can allocate specific amounts of bandwidth capacity (bandwidth budgets) to different bandwidth rules.

  • Page 294: Application And Subnet-Based Bandwidth Management

    P-662H/HW-D Series User’s Guide Figure 158 Subnet-based Bandwidth Management Example 19.4 Application and Subnet-based Bandwidth Management You could also create bandwidth classes based on a combination of a subnet and an application. The following example table shows bandwidth allocations for application specific traffic from separate LAN subnets.

  • Page 295: Fairness-Based Scheduler

    19.5.2 Fairness-based Scheduler The ZyXEL Device divides bandwidth equally among bandwidth classes when using the fairness-based scheduler; thus preventing one bandwidth class from using all of the interface’s bandwidth. 19.6 Maximize Bandwidth Usage The maximize bandwidth usage option (see Device to divide up any available bandwidth on the interface (including unallocated bandwidth and any allocated bandwidth that a class is not using) among the bandwidth classes that require more bandwidth.

  • Page 296: Maximize Bandwidth Usage Example

    P-662H/HW-D Series User’s Guide 19.6.2 Maximize Bandwidth Usage Example Here is an example of a ZyXEL Device that has maximize bandwidth usage enabled on an interface. The following table shows each bandwidth class’s bandwidth budget. The classes are set up based on subnets. The interface is set to 10240 kbps. Each subnet is allocated 2048 kbps.

  • Page 297: Fairness-Based Allotment Of Unused And Unbudgeted Bandwidth

    • Research requires more bandwidth but only gets its budgeted 2048 kbps because all of the unbudgeted and unused bandwidth goes to the higher priority sales and marketing classes. 19.6.2.2 Fairness-based Allotment of Unused and Unbudgeted Bandwidth The following table shows the amount of bandwidth that each class gets. Table 118 Fairness-based Allotment of Unused and Unbudgeted Bandwidth Example BANDWIDTH CLASSES AND ALLOTMENTS Root Class: 10240 kbps...

  • Page 298: Figure 159 Bandwidth Management: Summary

    P-662H/HW-D Series User’s Guide Figure 159 Bandwidth Management: Summary The following table describes the labels in this screen. Table 120 Media Bandwidth Management: Summary LABEL DESCRIPTION Interface These read-only labels represent the physical interfaces. Select an interface’s check box to enable bandwidth management on that interface. Bandwidth management applies to all traffic flowing out of the router through the interface, regardless of the traffic’s source.

  • Page 299: Bandwidth Management Rule Setup

    19.8 Bandwidth Management Rule Setup You must use the Bandwidth Management Summary screen to enable bandwidth management on an interface before you can configure rules for that interface. Click Advanced > Bandwidth MGMT > Rule Setup to open the following screen. Figure 160 Bandwidth Management: Rule Setup The following table describes the labels in this screen.

  • Page 300: Rule Configuration

    P-662H/HW-D Series User’s Guide Table 121 Bandwidth Management: Rule Setup (continued) LABEL Modify Apply Cancel 19.8.1 Rule Configuration Click the Edit icon or select User Defined from the Service drop-down list in the Rule Setup screen to configure a bandwidth management rule. Use bandwidth rules to allocate specific amounts of bandwidth capacity (bandwidth budgets) to specific applications and/or subnets.

  • Page 301: Table 122 Bandwidth Management Rule Configuration

    The following table describes the labels in this screen. Table 122 Bandwidth Management Rule Configuration LABEL Rule Configuration Active Rule Name BW Budget Priority Use All Managed Bandwidth Filter Configuration Service Destination Address Enter the destination IP address in dotted decimal notation. Destination Subnet Netmask Chapter 19 Bandwidth Management...

  • Page 302: Bandwidth Monitor

    P-662H/HW-D Series User’s Guide Table 122 Bandwidth Management Rule Configuration (continued) LABEL Destination Port Source Address Source Subnet Netmask Source Port Protocol Back Apply Cancel The following table describes common services with their associated port numbers. Table 123 Services and Port Numbers SERVICES ECHO FTP (File Transfer Protocol)

  • Page 303: Figure 162 Bandwidth Management: Monitor

    P-662H/HW-D Series User’s Guide Figure 162 Bandwidth Management: Monitor Chapter 19 Bandwidth Management...
  • Page 304 P-662H/HW-D Series User’s Guide Chapter 19 Bandwidth Management...

  • Page 305: Chapter 20 Dynamic Dns Setup

    This chapter discusses how to configure your ZyXEL Device to use Dynamic DNS. 20.1 Dynamic DNS Overview Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an IP address that changes each time you reconnect.

  • Page 306: Figure 163 Dynamic Dns

    P-662H/HW-D Series User’s Guide Figure 163 Dynamic DNS The following table describes the fields in this screen. Table 124 Dynamic DNS LABEL DESCRIPTION Dynamic DNS Setup Active Dynamic Select this check box to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider. Dynamic DNS Select the type of service that you are registered for from your Dynamic DNS Type...
  • Page 307 Table 124 Dynamic DNS (continued) LABEL DESCRIPTION Dynamic DNS Select this option only when there are one or more NAT routers between the ZyXEL server auto Device and the DDNS server. This feature has the DDNS server automatically detect IP detect and use the IP address of the NAT router that has a public IP address.
  • Page 308 P-662H/HW-D Series User’s Guide Chapter 20 Dynamic DNS Setup...

  • Page 309: Remote Management Configuration

    This chapter provides information on configuring remote management. 21.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which ZyXEL Device interface (if any) from which computers. Note: When you configure remote management to allow management from the WAN, you still need to configure a firewall rule to allow access.

  • Page 310: Remote Management And Nat

    P-662H/HW-D Series User’s Guide • The IP address in the Secured Client IP field does not match the client IP address. If it does not match, the ZyXEL Device will disconnect the session immediately. • There is already another remote management session with an equal or higher priority running.

  • Page 311: Telnet

    The following table describes the labels in this screen. Table 125 Remote Management: WWW LABEL DESCRIPTION Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Access Status Select the interface(s) through which a computer may access the ZyXEL Device using this service.

  • Page 312: Configuring Ftp

    P-662H/HW-D Series User’s Guide Figure 166 Remote Management: Telnet The following table describes the labels in this screen. Table 126 Remote Management: Telnet LABEL Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.

  • Page 313: Snmp

    Figure 167 Remote Management: FTP The following table describes the labels in this screen. Table 127 Remote Management: FTP LABEL DESCRIPTION Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management. Access Status Select the interface(s) through which a computer may access the ZyXEL Device using this service.

  • Page 314: Supported Mibs

    P-662H/HW-D Series User’s Guide Figure 168 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyXEL Device). An agent translates the local management information from the managed device into a form compatible with SNMP.

  • Page 315: Snmp Traps

    21.6.2 SNMP Traps The ZyXEL Device will send traps to the SNMP manager when any one of the following events occurs: Table 128 SNMP Traps TRAP # TRAP NAME coldStart (defined in RFC-1215) warmStart (defined in RFC-1215) whyReboot (defined in ZYXEL- MIB) For intentional reboot: For fatal error:...

  • Page 316: Figure 169 Remote Management: Snmp

    P-662H/HW-D Series User’s Guide Figure 169 Remote Management: SNMP The following table describes the labels in this screen. Table 129 Remote Management: SNMP LABEL SNMP Port Access Status Secured Client IP SNMP Configuration Get Community Set Community Trap Community Destination Apply Cancel DESCRIPTION...

  • Page 317: Configuring Dns

    21.7 Configuring DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to the chapter on LAN for background information. To change your ZyXEL Device’s DNS settings, click Advanced > Remote MGMT > DNS. The screen appears as shown.

  • Page 318: Figure 171 Remote Management: Icmp

    P-662H/HW-D Series User’s Guide If an outside user attempts to probe an unsupported port on your ZyXEL Device, an ICMP response packet is automatically returned. This allows the outside user to know the ZyXEL Device exists. Your ZyXEL Device supports anti-probing, which prevents the ICMP response packet from being sent.

  • Page 319: 319

    21.9 TR-069 TR-069 is a protocol that defines how your ZyXEL Device can be managed via a management server such as ZyXEL’s Vantage CNM Access. An administrator can use CNM Access to remotely set up the ZyXEL device, modify settings, perform firmware upgrades as well as monitor and diagnose the ZyXEL device.
  • Page 320 P-662H/HW-D Series User’s Guide Table 132 TR-069 Commands Command or Root Command Subdirectory periodicEnable [0:Disable/ 1:Enable] informInterval [sec] save Description Whether or not the device must periodically send information to CNM Access. It is recommended to set this value to 1 in order for the ZyXEL Device to send information to CNM Access.

  • Page 321: Universal Plug-And-Play (Upnp)

    Universal Plug-and-Play (UPnP) This chapter introduces the UPnP feature in the web configurator. 22.1 Introducing Universal Plug and Play Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network.

  • Page 322: Cautions With Upnp

    P-662H/HW-D Series User’s Guide 22.1.3 Cautions with UPnP The automated nature of NAT traversal applications in establishing their own services and opening firewall ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments. When a UPnP device joins a network, it announces its presence with a multicast message.

  • Page 323: Table 133 Configuring Upnp

    The following table describes the fields in this screen. Table 133 Configuring UPnP LABEL Active the Universal Plug and Play (UPnP) Feature Allow users to make configuration changes through UPnP Allow UPnP to pass through Firewall Apply Cancel 22.3 Installing UPnP in Windows Example This section shows how to install UPnP in Windows Me and Windows XP.

  • Page 324: Figure 174 Add/Remove Programs: Windows Setup: Communication

    P-662H/HW-D Series User’s Guide Figure 174 Add/Remove Programs: Windows Setup: Communication 3 In the Communications window, select the Universal Plug and Play check box in the Components selection box. Figure 175 Add/Remove Programs: Windows Setup: Communication: Components 4 Click OK to go back to the Add/Remove Programs Properties window and click Next. 5 Restart the computer when prompted.

  • Page 325: Installing Upnp In Windows Xp

    Installing UPnP in Windows XP Follow the steps below to install the UPnP in Windows XP. 1 Click Start and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components ….

  • Page 326: Using Upnp In Windows Xp Example

    P-662H/HW-D Series User’s Guide Figure 178 Networking Services 6 Click OK to go back to the Windows Optional Networking Component Wizard window and click Next. 22.4 Using UPnP in Windows XP Example This section shows you how to use the UPnP feature in Windows XP. You must already have UPnP installed in Windows XP and UPnP activated on the ZyXEL Device.

  • Page 327: Figure 179 Network Connections

    P-662H/HW-D Series User’s Guide Figure 179 Network Connections 3 In the Internet Connection Properties window, click Settings to see the port mappings there were automatically created. Figure 180 Internet Connection Properties Chapter 22 Universal Plug-and-Play (UPnP)

  • Page 328: Figure 181 Internet Connection Properties: Advanced Settings

    P-662H/HW-D Series User’s Guide 4 You may edit or delete the port mappings or click Add to manually add port mappings. Figure 181 Internet Connection Properties: Advanced Settings Figure 182 Internet Connection Properties: Advanced Settings: Add 5 When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically.

  • Page 329: Figure 183 System Tray Icon

    Figure 183 System Tray Icon 7 Double-click on the icon to display your current Internet connection status. Figure 184 Internet Connection Status Web Configurator Easy Access With UPnP, you can access the web-based configurator on the ZyXEL Device without finding out the IP address of the ZyXEL Device first.

  • Page 330: Figure 185 Network Connections

    P-662H/HW-D Series User’s Guide Figure 185 Network Connections 4 An icon with the description for each UPnP-enabled device displays under Local Network. 5 Right-click on the icon for your ZyXEL Device and select Invoke. The web configurator login screen displays. Chapter 22 Universal Plug-and-Play (UPnP)

  • Page 331: Figure 186 Network Connections: My Network Places

    P-662H/HW-D Series User’s Guide Figure 186 Network Connections: My Network Places 6 Right-click on the icon for your ZyXEL Device and select Properties. A properties window displays with basic information about the ZyXEL Device. Figure 187 Network Connections: My Network Places: Properties: Example Chapter 22 Universal Plug-and-Play (UPnP)
  • Page 332 P-662H/HW-D Series User’s Guide Chapter 22 Universal Plug-and-Play (UPnP)

  • Page 333: Chapter 23 System

    Use this screen to configure the ZyXEL Device’s time and date settings. 23.1 General Setup 23.1.1 General Setup and System Name General Setup contains administrative and system-related information. System Name is for identification purposes. However, because some ISPs check this name you should enter your computer's "Computer Name".

  • Page 334: Figure 188 System General Setup

    P-662H/HW-D Series User’s Guide Figure 188 System General Setup The following table describes the labels in this screen. Table 134 System General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name”...

  • Page 335: Time Setting

    Table 134 System General Setup LABEL DESCRIPTION Admin Password In addition to the wizard setup, if you log in with the admin password you can also view and configure the advanced features on the ZyXEL Device. Old Password Type the default administrator password (1234) or the existing password you use to access the system for configuring advanced features in this field.

  • Page 336: Table 135 System Time Setting

    P-662H/HW-D Series User’s Guide The following table describes the fields in this screen. Table 135 System Time Setting LABEL DESCRIPTION Current Time and Date Current Time This field displays the time of your ZyXEL Device. Each time you reload this page, the ZyXEL Device synchronizes the time with the time server.
  • Page 337 Table 135 System Time Setting (continued) LABEL DESCRIPTION Start Date Configure the day and time when Daylight Saving Time starts if you selected Enable Daylight Saving. The o'clock field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time starts in most parts of the United States on the first Sunday of April.
  • Page 338 P-662H/HW-D Series User’s Guide Chapter 23 System...

  • Page 339: Chapter 24 Logs

    This chapter contains information about configuring general log settings and viewing the ZyXEL Device’s logs. Refer to the appendix for example log message explanations. 24.1 Logs Overview The web configurator allows you to choose which categories of events and/or alerts to have the ZyXEL Device log and then display the logs or have the ZyXEL Device send them to an administrator (as e-mail) or to a syslog server.

  • Page 340: Configuring Log Settings

    P-662H/HW-D Series User’s Guide Figure 190 View Log The following table describes the fields in this screen. Table 136 View Log LABEL DESCRIPTION Display The categories that you select in the Log Settings screen display in the drop-down list box. Select a category of logs to view;...

  • Page 341: Figure 191 Log Settings

    Alerts are e-mailed as soon as they happen. Logs may be e-mailed as soon as the log is full. Selecting many alert and/or log categories (especially Access Control) may result in many e- mails being sent. Figure 191 Log Settings The following table describes the fields in this screen.
  • Page 342 P-662H/HW-D Series User’s Guide Table 137 Log Settings LABEL DESCRIPTION Send Log To The ZyXEL Device sends logs to the e-mail address specified in this field. If this field is left blank, the ZyXEL Device does not send logs via e-mail. Send Alerts To Alerts are real-time notifications that are sent as soon as an event, such as a DoS attack, system error, or forbidden web access attempt occurs.

  • Page 343: Smtp Error Messages

    24.4 SMTP Error Messages The following table lists common SMTP errors. Table 138 SMTP Error Messages -1 means ZyXEL Device out of socket -2 means tcp SYN fail -3 means smtp server OK fail -4 means HELO fail -5 means MAIL FROM fail -6 means RCPT TO fail -7 means DATA fail -8 means mail data send fail...
  • Page 344 P-662H/HW-D Series User’s Guide Chapter 24 Logs...

  • Page 345: Chapter 25 Tools

    This chapter describes how to upload new firmware, manage configuration and restart your ZyXEL Device. 25.1 Firmware Upgrade Find firmware at www.zyxel.com in a file that (usually) uses the system model name with a.bin extension, for example, "ZyXEL Device.bin". The upload process uses HTTP (Hypertext Transfer Protocol) and may take up to two minutes.

  • Page 346: Figure 194 Firmware Upload In Progress

    P-662H/HW-D Series User’s Guide Table 139 Firmware Upgrade (continued) LABEL DESCRIPTION Browse... Click Browse... to find the .bin file you want to upload. Remember that you must decompress compressed (.zip) files before you can upload them. Upload Click Upload to begin the upload process. This process may take up to two minutes.

  • Page 347: Configuration Screen

    Figure 196 Error Message 25.2 Configuration Screen Click Maintenance > Tools > Configuration. Information related to factory defaults, backup configuration, and restoring configuration appears as shown next. Figure 197 Configuration 25.2.1 Backup Configuration Backup configuration allows you to back up (save) the ZyXEL Device’s current configuration to a file on your computer.

  • Page 348: Restore Configuration

    P-662H/HW-D Series User’s Guide 25.2.2 Restore Configuration Restore configuration allows you to upload a new or previously saved configuration file from your computer to your ZyXEL Device. Table 140 Maintenance Restore Configuration LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse... to find Browse...

  • Page 349: Back To Factory Defaults

    Figure 200 Configuration Restore Error 25.2.3 Back to Factory Defaults Pressing the Reset button in this section clears all user-entered configuration information and returns the ZyXEL Device to its factory defaults. You can also press the RESET button on the rear panel to reset the factory defaults of your ZyXEL Device.
  • Page 350 P-662H/HW-D Series User’s Guide Chapter 25 Tools...

  • Page 351: Chapter 26 Diagnostic

    These read-only screens display information to help you identify problems with the ZyXEL Device. 26.1 General Diagnostic Click Maintenance > Diagnostic to open the screen shown next. Figure 202 Diagnostic: General The following table describes the fields in this screen. Table 141 Diagnostic: General LABEL DESCRIPTION...

  • Page 352: Dsl Line Diagnostic

    P-662H/HW-D Series User’s Guide 26.2 DSL Line Diagnostic Click Maintenance > Diagnostic > DSL Line to open the screen shown next. Figure 203 Diagnostic: DSL Line The following table describes the fields in this screen. Table 142 Diagnostic: DSL Line LABEL ATM Status Click this button to view ATM status.

  • Page 353: Chapter 27 Troubleshooting

    This chapter covers potential problems and the corresponding remedies. 27.1 Problems Starting Up the ZyXEL Device Table 143 Troubleshooting Starting Up Your ZyXEL Device PROBLEM CORRECTIVE ACTION None of the Make sure that the ZyXEL Device’s power adaptor is connected to the ZyXEL Device LEDs turn on and plugged in to an appropriate power source.

  • Page 354: Problems With The Wan

    P-662H/HW-D Series User’s Guide 27.3 Problems with the WAN Table 145 Troubleshooting the WAN PROBLEM CORRECTIVE ACTION The DSL LED is Check the telephone wire and connections between the ZyXEL Device DSL port off. and the wall jack. Make sure that the telephone company has checked your phone line and set it up for DSL service.

  • Page 355: Problems Accessing The Zyxel Device

    27.4 Problems Accessing the ZyXEL Device Table 146 Troubleshooting Accessing the ZyXEL Device PROBLEM CORRECTIVE ACTION I cannot The default user password is “user” and admin password is “1234”. The Password access the field is case-sensitive. Make sure that you enter the correct password using the proper ZyXEL Device.

  • Page 356: Figure 204 Pop-Up Blocker

    P-662H/HW-D Series User’s Guide Figure 204 Pop-up Blocker You can also check if pop-up blocking is disabled in the Pop-up Blocker section in the Privacy tab. 1 In Internet Explorer, select Tools, Internet Options, Privacy. 2 Clear the Block pop-ups check box in the Pop-up Blocker section of the screen. This disables any web pop-up blockers you may have enabled.

  • Page 357: Figure 206 Internet Options

    P-662H/HW-D Series User’s Guide Figure 206 Internet Options 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites. Chapter 27 Troubleshooting...

  • Page 358: Javascripts

    P-662H/HW-D Series User’s Guide Figure 207 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. 27.4.1.2 JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed.

  • Page 359: Figure 208 Internet Options

    P-662H/HW-D Series User’s Guide Figure 208 Internet Options 2 Click the Custom Level... button. 3 Scroll down to Scripting. 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is selected (the default). 6 Click OK to close the window.

  • Page 360: Java Permissions

    P-662H/HW-D Series User’s Guide Figure 209 Security Settings - Java Scripting 27.4.1.3 Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is selected. 5 Click OK to close the window.

  • Page 361: Figure 210 Security Settings - Java

    Figure 210 Security Settings - Java 27.4.1.3.1 JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 make sure that Use Java 2 for <applet> under Java (Sun) is selected. 3 Click OK to close the window. Figure 211 Java (Sun) Chapter 27 Troubleshooting P-662H/HW-D Series User’s Guide...

  • Page 362: Activex Controls In Internet Explorer

    P-662H/HW-D Series User’s Guide 27.4.2 ActiveX Controls in Internet Explorer If ActiveX is disabled, you will not be able to download ActiveX controls or to use Trend Micro Security Services. Make sure that ActiveX controls are allowed in Internet Explorer. Screen shots for Internet Explorer 6 are shown.

  • Page 363: Figure 213 Security Setting Activex Controls

    P-662H/HW-D Series User’s Guide Figure 213 Security Setting ActiveX Controls Chapter 27 Troubleshooting...
  • Page 364 P-662H/HW-D Series User’s Guide Chapter 27 Troubleshooting...

  • Page 365: Appendix A Product Specifications

    See also the Introduction chapter for a general overview of the key features. Specification Tables Table 147 Device Default IP Address Default Subnet Mask Default Password DHCP Pool Dimensions Weight Power Specification Detachable Antenna Built-in Switch Operation Temperature Storage Temperature Operation Humidity Storage Humidity Appendix A Product Specifications...

  • Page 366: Table 148 Firmware

    P-662H/HW-D Series User’s Guide Table 148 Firmware ADSL Standards Other Protocol Support Management Multi-Mode standard (ANSI T1.413,Issue 2; G.dmt(G.992.1); G.lite(G992.2)). ADSL2 G.dmt.bis (G.992.3) ADSL2 G.lite.bis (G.992.4) ADSL2+ (G.992.5) Reach-Extended ADSL (RE ADSL) SRA (Seamless Rate Adaptation) Auto-negotiating rate adaptation ADSL physical connection ATM AAL5 (ATM Adaptation Layer type 5) Multi-protocol over AAL5 (RFC2684/1483) PPP over ATM AAL5 (RFC 2364) PPP over Ethernet (RFC 2516)
  • Page 367 Table 148 Firmware (continued) Wireless (P-662HW only) Firewall NAT/SUA Content Filtering Static Routes Other Features Appendix A Product Specifications IEEE 802.11g Compliance Wireless g+ technology Frequency Range: 2.4 GHz Advanced Orthogonal Frequency Division Multiplexing (OFDM) Data Rates: 108Mbps and Auto Fallback Wired Equivalent Privacy (WEP) Data Encryption 64/128/256 bit.
  • Page 368 P-662H/HW-D Series User’s Guide Product Specifications...

  • Page 369: Appendix B About Adsl

    Introduction to DSL DSL (Digital Subscriber Line) technology enhances the data capacity of the existing twisted- pair wire that runs between the local telephone company switching offices and most homes and offices. While the wire itself can handle higher frequencies, the telephone switching equipment is designed to cut off signals above 4,000 Hz to filter noise off the voice line, but now everybody is searching for ways to get more bandwidth to improve access to the Web - hence DSL technologies.
  • Page 370 P-662H/HW-D Series User’s Guide 2 Because your line is dedicated (not shared), transmission speeds between you and the device to which you connect at your service provider are not affected by other users. With cable modems, transmission speeds drop significantly as more users go on-line because the line is shared.

  • Page 371: Wall-Mounting Instructions

    Do the following to hang your ZyXEL Device on a wall. Note: See the product specifications appendix for the size of screws to use and how far apart to place them. 1 Locate a high position on wall that is free of obstructions. Use a sturdy wall. 2 Drill two holes for the screws.
  • Page 372 P-662H/HW-D Series User’s Guide Appendix C Wall-mounting Instructions...

  • Page 373: Setting Up Your Computer's Ip Address

    Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/ IP on your computer.

  • Page 374: Installing Components

    P-662H/HW-D Series User’s Guide Figure 215 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add.

  • Page 375: Figure 216 Windows 95/98/Me: Tcp/Ip Properties: Ip Address

    3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click 5 Restart your computer so the changes you made take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab.

  • Page 376: Figure 217 Windows 95/98/Me: Tcp/Ip Properties: Dns Configuration

    P-662H/HW-D Series User’s Guide Figure 217 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab. • • 5 Click OK to save and close the TCP/IP Properties window. 6 Click OK to close the Network window. Insert the Windows CD if prompted. 7 Turn on your ZyXEL Device and restart your computer when prompted.

  • Page 377: Figure 218 Windows Xp: Start Menu

    Figure 218 Windows XP: Start Menu 2 In the Control Panel, double-click Network Connections (Network and Dial-up Connections in Windows 2000/NT). Figure 219 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties. Appendix D Setting up Your Computer’s IP Address P-662H/HW-D Series User’s Guide...

  • Page 378: Figure 220 Windows Xp: Control Panel: Network Connections: Properties

    P-662H/HW-D Series User’s Guide Figure 220 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties. Figure 221 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP).

  • Page 379: Figure 222 Windows Xp: Internet Protocol (Tcp/Ip) Properties

    • • Figure 222 Windows XP: Internet Protocol (TCP/IP) Properties 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK. Do one or more of the following if you want to configure additional IP addresses: •...

  • Page 380: Figure 223 Windows Xp: Advanced Tcp/Ip Properties

    P-662H/HW-D Series User’s Guide Figure 223 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es). If you know your DNS server IP address(es), click Use the following DNS server addresses, and type them in the Preferred DNS server and Alternate DNS server fields.

  • Page 381: Macintosh Os 8/9

    Figure 224 Windows XP: Internet Protocol (TCP/IP) Properties 8 Click OK to close the Internet Protocol (TCP/IP) Properties window. 9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 10 Close the Network Connections window (Network and Dial-up Connections in Windows 2000/NT).

  • Page 382: Figure 225 Macintosh Os 8/9: Apple Menu

    P-662H/HW-D Series User’s Guide Figure 225 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 226 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. Appendix D Setting up Your Computer’s IP Address...

  • Page 383: Macintosh Os X

    4 For statically assigned settings, do the following: • • • • 5 Close the TCP/IP Control Panel. 6 Click Save if prompted, to save changes to your configuration. 7 Turn on your ZyXEL Device and restart your computer (if prompted). Verifying Settings Check your TCP/IP properties in the TCP/IP Control Panel window.

  • Page 384: Linux

    P-662H/HW-D Series User’s Guide Figure 228 Macintosh OS X: Network 4 For statically assigned settings, do the following: • • • • 5 Click Apply Now and close the window. 6 Turn on your ZyXEL Device and restart your computer (if prompted). Verifying Settings Check your TCP/IP properties in the Network window.

  • Page 385: Using The K Desktop Environment (Kde)

    Note: Make sure you are logged in as the root administrator. Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setting and click Network.

  • Page 386: Using Configuration Files

    P-662H/HW-D Series User’s Guide • • 3 Click OK to save the changes and close the Ethernet Device General screen. 4 If you know your DNS server IP address(es), click the DNS tab in the Network Configuration screen. Enter the DNS server information in the fields provided. Figure 231 Red Hat 9.0: KDE: Network Configuration: DNS 5 Click the Devices tab.

  • Page 387: Figure 233 Red Hat 9.0: Dynamic Ip Address Setting In Ifconfig-Eth0

    1 Assuming that you have only one network card on the computer, locate the configuration file (where eth0 configuration file with any plain text editor. • Figure 233 Red Hat 9.0: Dynamic IP Address Setting in ifconfig-eth0 DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp USERCTL=no PEERDNS=yes TYPE=Ethernet...

  • Page 388: Verifying Settings

    P-662H/HW-D Series User’s Guide Figure 236 Red Hat 9.0: Restart Ethernet Card [root@localhost init.d]# network restart Shutting down interface eth0: Shutting down loopback interface: Setting network parameters: Bringing up loopback interface: Bringing up interface eth0: Verifying Settings Enter in a terminal screen to check your TCP/IP properties. ifconfig Figure 237 Red Hat 9.0: Checking TCP/IP Properties [root@localhost]# ifconfig...

  • Page 389: Ip Addresses And Subnetting

    IP Addresses and Subnetting This appendix introduces IP addresses, IP address classes and subnet masks. You use subnet masks to subdivide a network into smaller logical networks. Introduction to IP Addresses An IP address has two parts: the network number and the host ID. Routers use the network number to send packets to the correct network, while the host ID identifies a single device on the network.

  • Page 390: Table 149 Classes Of Ip Addresses

    P-662H/HW-D Series User’s Guide The following table shows the network number and host ID arrangement for classes A, B and Table 149 Classes of IP Addresses IP ADDRESS OCTET 1 Class A Network number Class B Network number Class C Network number An IP address with host IDs of all zeros is the IP address of the network (192.168.1.0 for example).

  • Page 391: Subnet Masks

    Subnet Masks A subnet mask is used to determine which bits are part of the network number, and which bits are part of the host ID (using a logical AND operation). A subnet mask has 32 bits. If a bit in the subnet mask is a “1” then the corresponding bit in the IP address is part of the network number.

  • Page 392: Example: Two Subnets

    P-662H/HW-D Series User’s Guide Table 152 Alternative Subnet Mask Notation (continued) SUBNET MASK 255.255.255.240 255.255.255.248 255.255.255.252 The first mask shown is the class “C” natural mask. Normally if no mask is specified it is understood that the natural mask is being used. Example: Two Subnets As an example, you have a class “C”...

  • Page 393: Example: Four Subnets

    Table 154 Subnet 1 (continued) IP/SUBNET MASK Subnet Address: 192.168.1.0 Broadcast Address: 192.168.1.127 Table 155 Subnet 2 IP/SUBNET MASK IP Address IP Address (Binary) Subnet Mask Subnet Mask (Binary) Subnet Address: 192.168.1.128 Broadcast Address: 192.168.1.255 Host IDs of all zeros represent the subnet itself and host IDs of all ones are the broadcast address for that subnet, so the actual number of hosts available on each subnet in the example above is 2 –...

  • Page 394: Example Eight Subnets

    P-662H/HW-D Series User’s Guide Table 156 Subnet 1 (continued) IP/SUBNET MASK Subnet Address: 192.168.1.0 Broadcast Address: 192.168.1.63 Table 157 Subnet 2 IP/SUBNET MASK IP Address IP Address (Binary) Subnet Mask (Binary) Subnet Address: 192.168.1.64 Broadcast Address: 192.168.1.127 Table 158 Subnet 3 IP/SUBNET MASK IP Address IP Address (Binary)

  • Page 395: Subnetting With Class A And Class B Networks

    The following table shows class C IP address last octet values for each subnet. Table 160 Eight Subnets SUBNET SUBNET ADDRESS FIRST ADDRESS The following table is a summary for class “C” subnet planning. Table 161 Class C Subnet Planning NO.

  • Page 396: Table 162 Class B Subnet Planning

    P-662H/HW-D Series User’s Guide The following table is a summary for class “B” subnet planning. Table 162 Class B Subnet Planning NO. “BORROWED” HOST BITS SUBNET MASK NO. SUBNETS 255.255.128.0 (/17) 255.255.192.0 (/18) 255.255.224.0 (/19) 255.255.240.0 (/20) 255.255.248.0 (/21) 255.255.252.0 (/22) 255.255.254.0 (/23) 255.255.255.0 (/24) 255.255.255.128 (/25)

  • Page 397: Wireless Lan Topologies

    Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless stations (A, B, C). Any time two or more wireless adapters are within range of each other, they can set up an independent network, which is commonly referred to as an Ad-hoc network or Independent Basic Service Set (IBSS).

  • Page 398: Figure 239 Basic Service Set

    P-662H/HW-D Series User’s Guide Figure 239 Basic Service Set An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type of wireless LAN topology is called an Infrastructure WLAN.

  • Page 399: Channel

    Figure 240 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.11a/b/g wireless devices. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a different channel than an adjacent AP (access point) to reduce interference.

  • Page 400: Fragmentation Threshold

    P-662H/HW-D Series User’s Guide Figure 241 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations.

  • Page 401: Preamble Type

    A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size.

  • Page 402: Ieee 802.1X

    P-662H/HW-D Series User’s Guide IEEE 802.1x In June 2001, the IEEE 802.1x standard was designed to extend the features of IEEE 802.11 to support extended authentication as well as providing additional accounting and control features. It is supported by Windows XP and a number of network devices. Some advantages of IEEE 802.1x are: •...

  • Page 403: Types Of Authentication

    • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: •...

  • Page 404: Dynamic Wep Key Exchange

    P-662H/HW-D Series User’s Guide EAP-TLS (Transport Layer Security) With EAP-TLS, digital certifications are needed by both the server and the wireless stations for mutual authentication. The server presents a certificate to the client. After validating the identity of the server, the client sends a different certificate to the server. The exchange of certificates is done in the open before a secured tunnel is created.

  • Page 405: Wpa(2)

    For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are often deployed in corporate environments, but for public deployment, a simple user name and password pair is more practical. The following table is a comparison of the features of authentication types. Table 164 Comparison of EAP Authentication Types Mutual Authentication Certificate –...
  • Page 406 P-662H/HW-D Series User’s Guide TKIP uses 128-bit keys that are dynamically generated and distributed by the authentication server. AES (Advanced Encryption Standard) is a block cipher that uses a 256-bit mathematical algorithm called Rijndael. They both include a per-packet key mixing function, a Message Integrity Check (MIC) named Michael, an extended initialization vector (IV) with sequencing rules, and a re-keying mechanism.

  • Page 407: Security Parameters Summary

    Security Parameters Summary Refer to this table to see what other security parameters you should configure for each Authentication Method/ key management protocol type. MAC address filters are not dependent on how you configure these security features. Table 165 Wireless Security Relational Matrix AUTHENTICATION METHOD/ KEY MANAGEMENT PROTOCOL...
  • Page 408 P-662H/HW-D Series User’s Guide Appendix F Wireless LANs...

  • Page 409: Appendix G Importing Certificates

    This appendix shows importing certificates examples using Internet Explorer 5. Import ZyXEL Device Certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the ZyXEL Device’s server certificate by importing it into your operating system as a trusted certification authority. Select Accept This Certificate Permanently in the following screen to do this.

  • Page 410: Figure 243 Login Screen

    P-662H/HW-D Series User’s Guide 1 In Internet Explorer, double click the lock shown in the following screen. Figure 243 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 244 Certificate General Information before Import 3 Click Next to begin the Install Certificate wizard. Appendix G Importing Certificates...

  • Page 411: Figure 245 Certificate Import Wizard 1

    Figure 245 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next. Figure 246 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard. Appendix G Importing Certificates P-662H/HW-D Series User’s Guide...

  • Page 412: Figure 247 Certificate Import Wizard 3

    P-662H/HW-D Series User’s Guide Figure 247 Certificate Import Wizard 3 6 Click Yes to add the ZyXEL Device certificate to the root store. Figure 248 Root Certificate Store Appendix G Importing Certificates...

  • Page 413: Enrolling And Importing Ssl Client Certificates

    Figure 249 Certificate General Information after Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyXEL Device. You must have imported at least one trusted CA to the ZyXEL Device in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details).

  • Page 414: Figure 250 Zyxel Device Trusted Ca Screen

    P-662H/HW-D Series User’s Guide Figure 250 ZyXEL Device Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). Installing the CA’s Certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown next.

  • Page 415: Figure 252 Personal Certificate Import Wizard 1

    Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to the one shown next 1 Click Next to begin the wizard.

  • Page 416: Figure 254 Personal Certificate Import Wizard 3

    P-662H/HW-D Series User’s Guide Figure 254 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 255 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process.

  • Page 417: Using A Certificate When Accessing The Zyxel Device Example

    Figure 256 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 257 Personal Certificate Import Wizard 6 Using a Certificate When Accessing the ZyXEL Device Example Use the following procedure to access the ZyXEL Device via HTTPS. 1 Enter ‘https://ZyXEL Device IP Address/ in your browser’s web address field.

  • Page 418: Figure 259 Ssl Client Authentication

    P-662H/HW-D Series User’s Guide Figure 259 SSL Client Authentication 3 You next see the ZyXEL Device login screen. Figure 260 ZyXEL Device Secure Login Screen Appendix G Importing Certificates...

  • Page 419: Appendix H Command Interpreter

    The following describes how to use the command interpreter. Note: Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable. Command Syntax • The command keywords are in courier new font. • Enter the command keywords exactly as shown, do not abbreviate. •...
  • Page 420 P-662H/HW-D Series User’s Guide Appendix H Command Interpreter...

  • Page 421: Certificates Commands

    The following describes the certificate commands. See information on the command structure. All of these commands start with certificates. Table 166 Certificates Commands COMMAND DESCRIPTION my_cert create create create create Appendix I Certificates Commands P-662H/HW-D Series User’s Guide P P E N D I X Certificates Commands Appendix H on page 419 Create a self-signed local host certificate.
  • Page 422 P-662H/HW-D Series User’s Guide Table 166 Certificates Commands (continued) COMMAND DESCRIPTION create import export view verify delete list rename def_self_sig Create a certificate request and enroll for a cmp_enroll certificate immediately online using CMP <name> <CA protocol. <name> specifies a descriptive name addr>...
  • Page 423 Table 166 Certificates Commands (continued) COMMAND DESCRIPTION replace_fact ca_trusted import export view verify delete list rename crl_issuer remote_trusted import export view verify Appendix I Certificates Commands P-662H/HW-D Series User’s Guide Create a certificate using your device MAC address that will be specific to this device. The factory default certificate is a common default certificate for all ZyWALL models.
  • Page 424 P-662H/HW-D Series User’s Guide Table 166 Certificates Commands (continued) COMMAND DESCRIPTION delete list rename dir_server delete view edit list rename cert_manager reinit Delete the specified trusted remote host <name> certificate. <name> specifies the name of the certificate to be deleted. List all trusted remote host certificate names and basic information.

  • Page 425: Appendix J Boot Commands

    The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your ZyXEL Device, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen.

  • Page 426: Figure 262 Boot Module Commands

    P-662H/HW-D Series User’s Guide Figure 262 Boot Module Commands just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time ATDA(y,m,d) change system date to year/month/day or show...

  • Page 427: Appendix K Firewall Commands

    The following describes the firewall commands. Table 167 Firewall Commands FUNCTION COMMAND Firewall SetUp config edit firewall active <yes | no> config retrieve firewall config save firewall Display config display firewall config display firewall set <set #> config display firewall set <set #>...
  • Page 428 P-662H/HW-D Series User’s Guide Table 167 Firewall Commands (continued) FUNCTION COMMAND E-mail config edit firewall e-mail mail-server <ip address of mail server> config edit firewall e-mail return-addr <e-mail address> config edit firewall e-mail email-to <e-mail address> config edit firewall e-mail policy <full | hourly | daily | weekly>...
  • Page 429 Table 167 Firewall Commands (continued) FUNCTION COMMAND config edit firewall attack minute-high <0-255> config edit firewall attack minute-low <0-255> config edit firewall attack max-incomplete-high <0-255> config edit firewall attack max-incomplete-low <0-255> config edit firewall attack tcp-max-incomplete <0-255> Sets config edit firewall set <set #>...
  • Page 430 P-662H/HW-D Series User’s Guide Table 167 Firewall Commands (continued) FUNCTION COMMAND Config edit firewall set <set #> tcp-idle-timeout <seconds> Config edit firewall set <set #> log <yes | no> Rules Config edit firewall set <set #> rule <rule #> permit <forward | block>...
  • Page 431 Table 167 Firewall Commands (continued) FUNCTION COMMAND config edit firewall set <set #> rule <rule #> destaddr- single <ip address> config edit firewall set <set #> rule <rule #> destaddr- subnet <ip address> <subnet mask> config edit firewall set <set #>...
  • Page 432 P-662H/HW-D Series User’s Guide Table 167 Firewall Commands (continued) FUNCTION COMMAND config delete firewall set <set #> rule<rule #> DESCRIPTION This command removes the specified rule in a firewall configuration set. Appendix K Firewall Commands...

  • Page 433: Netbios Filter Commands

    The following describes the NetBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls. You can configure NetBIOS filters to do the following: •...

  • Page 434: Netbios Filter Configuration

    P-662H/HW-D Series User’s Guide The filter types and their default settings are as follows. Table 168 NetBIOS Filter Default Settings NAME DESCRIPTION Between LAN This field displays whether NetBIOS packets are blocked or forwarded and WAN between the LAN and the WAN. Between LAN This field displays whether NetBIOS packets are blocked or forwarded and DMZ...
  • Page 435 sys filter netbios config 3 on sys filter netbios config 4 off Appendix L NetBIOS Filter Commands This command blocks IPSec NetBIOS packets. This command stops NetBIOS commands from initiating calls. P-662H/HW-D Series User’s Guide...
  • Page 436 P-662H/HW-D Series User’s Guide Appendix L NetBIOS Filter Commands...

  • Page 437: Appendix M Internal Sptgen

    Internal SPTGEN Overview Internal SPTGEN (System Parameter Table Generator) is a configuration text file useful for efficient configuration of multiple ZyXEL Device. Internal SPTGEN lets you configure, save and upload multiple menus at the same time using just one configuration text file – eliminating the need to navigate and configure individual SMT menus for each ZyXEL Device.

  • Page 438: Internal Sptgen Ftp Download Example

    P-662H/HW-D Series User’s Guide Some parameters are dependent on others. For example, if you disable the Configured field in menu 1 (see Figure 263 on page If you enter a parameter that is invalid in the Input column, the ZyXEL Device will not save the configuration and the command line will display the Field Identification Number.

  • Page 439: Internal Sptgen Ftp Upload Example

    Figure 266 Internal SPTGEN FTP Download Example c:\ftp 192.168.1.1 220 PPP FTP version 1.0 ready at Sat Jan 1 03:22:12 2000 User (192.168.1.1:(none)): 331 Enter PASS command Password: 230 Logged in ftp>bin 200 Type I OK ftp> get rom-t ftp>bye c:\edit rom-t (edit the rom-t text file by a text editor and save it) Note: You can rename your “...

  • Page 440: Table 170 Menu 1 General Setup (Smt Menu 1)

    P-662H/HW-D Series User’s Guide Table 169 Abbreviations Used in the Example Internal SPTGEN Screens Table (continued) ABBREVIATION MEANING Parameter Values Allowed INPUT An example of what you may enter Applies to the ZyXEL Device. The following are Internal SPTGEN screens associated with the SMT screens of your ZyXEL Device.
  • Page 441 Table 171 Menu 3 (SMT Menu 3 (continued)) / Menu 3.2 TCP/IP and DHCP Ethernet Setup (SMT Menu 3.2) 30200001 = DHCP 30200002 = Client IP Pool Starting Address 30200003 = Size of Client IP Pool 30200004 = Primary DNS Server 30200005 = Secondary DNS Server 30200006 =...
  • Page 442 P-662H/HW-D Series User’s Guide Table 171 Menu 3 (SMT Menu 3 (continued)) 30201008 = IP Alias #1 Incoming protocol filters Set 3 30201009 = IP Alias #1 Incoming protocol filters Set 4 30201010 = IP Alias #1 Outgoing protocol filters Set 1 30201011 = IP Alias #1 Outgoing protocol filters...
  • Page 443 Table 171 Menu 3 (SMT Menu 3 (continued)) 30500004 = RTS Threshold 30500005 = FRAG. Threshold 30500006 = 30500007 = Default Key 30500008 = WEP Key1 30500009 = WEP Key2 30500010 = WEP Key3 30500011 = WEP Key4 30500012 = Wlan Active */ MENU 3.5.1 WLAN MAC ADDRESS FILTER (SMT MENU 3.5.1) 30501001 =...

  • Page 444: Table 172 Menu 4 Internet Access Setup (Smt Menu 4)

    P-662H/HW-D Series User’s Guide Table 172 Menu 4 Internet Access Setup (SMT Menu 4) (continued) 40000002 = Active 40000003 = ISP's Name 40000004 = Encapsulation 40000005 = Multiplexing 40000006 = VPI # 40000007 = VCI # 40000008 = Service Name 40000009 = My Login 40000010 =...

  • Page 445: Table 173 Menu 12 (Smt Menu 12)

    Table 172 Menu 4 Internet Access Setup (SMT Menu 4) (continued) 40000032= RIP Version 40000033= Nailed-up Connection Table 173 Menu 12 (SMT Menu 12) / Menu 12.1.1 IP Static Route Setup (SMT Menu 12.1.1) 120101001 = IP Static Route set #1, Name 120101002 = IP Static Route set #1, Active 120101003 =...
  • Page 446 P-662H/HW-D Series User’s Guide Table 173 Menu 12 (SMT Menu 12) (continued) / Menu 12.1.4 IP Static Route Setup (SMT Menu 12.1.4) 120104001 = IP Static Route set #4, Name 120104002 = IP Static Route set #4, Active 120104003 = IP Static Route set #4, Destination IP address 120104004 =...
  • Page 447 Table 173 Menu 12 (SMT Menu 12) (continued) 120107006 = IP Static Route set #7, Metric 120107007 = IP Static Route set #7, Private / Menu 12.1.8 IP Static Route Setup (SMT Menu 12.1.8) 120108001 = IP Static Route set #8, Name 120108002 = IP Static Route set #8, Active 120108003 =...
  • Page 448 P-662H/HW-D Series User’s Guide Table 173 Menu 12 (SMT Menu 12) (continued) 120111004 = IP Static Route set #11, Destination IP subnetmask 120111005 = IP Static Route set #11, Gateway 120111006 = IP Static Route set #11, Metric 120111007 = IP Static Route set #11, Private */ Menu 12.1.12 IP Static Route Setup (SMT Menu 12.1.12) 120112001 =...
  • Page 449 Table 173 Menu 12 (SMT Menu 12) (continued) 120115002 = IP Static Route set #15, Active 120115003 = IP Static Route set #15, Destination IP address 120115004 = IP Static Route set #15, Destination IP subnetmask 120115005 = IP Static Route set #15, Gateway 120115006 = IP Static Route set #15, Metric 120115007 =...

  • Page 450: Table 174 Menu 15 Sua Server Setup (Smt Menu 15)

    P-662H/HW-D Series User’s Guide Table 174 Menu 15 SUA Server Setup (SMT Menu 15) (continued) 150000014 = SUA Server #4 Port Start 150000015 = SUA Server #4 Port End 150000016 = SUA Server #4 Local IP address 150000017 = SUA Server #5 Active 150000018 = SUA Server #5 Protocol 150000019 =...

  • Page 451: Table 175 Menu 21.1 Filter Set #1 (Smt Menu 21.1)

    Table 174 Menu 15 SUA Server Setup (SMT Menu 15) (continued) 150000048 = SUA Server #11 Protocol 150000049 = SUA Server #11 Port Start 150000050 = SUA Server #11 Port End 150000051 = SUA Server #11 Local IP address 150000052 = SUA Server #12 Active 150000053 = SUA Server #12 Protocol...
  • Page 452 P-662H/HW-D Series User’s Guide Table 175 Menu 21.1 Filter Set #1 (SMT Menu 21.1) (continued) / Menu 21.1.1.2 set #1, rule #2 (SMT Menu 21.1.1.2) 210102001 = IP Filter Set 1,Rule 2 Type 210102002 = IP Filter Set 1,Rule 2 Active 210102003 = IP Filter Set 1,Rule 2 Protocol 210102004 =...
  • Page 453 Table 175 Menu 21.1 Filter Set #1 (SMT Menu 21.1) (continued) 210103013 = IP Filter Set 1,Rule 3 Act Match 210103014 = IP Filter Set 1,Rule 3 Act Not Match / Menu 21.1.1.4 set #1, rule #4 (SMT Menu 21.1.1.4) 210104001 = IP Filter Set 1,Rule 4 Type 210104002 =...

  • Page 454: Table 176 Menu 21.1 Filer Set #2, (Smt Menu 21.1)

    P-662H/HW-D Series User’s Guide Table 175 Menu 21.1 Filter Set #1 (SMT Menu 21.1) (continued) 210105009 = IP Filter Set 1,Rule 5 Src Subnet Mask 210105010 = IP Filter Set 1,Rule 5 Src Port 210105011 = IP Filter Set 1,Rule 5 Src Port Comp 210105013 = IP Filter Set 1,Rule 5 Act Match 210105014 =...
  • Page 455 Table 176 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) / Menu 21.1.2.1 Filter set #2, rule #1 (SMT Menu 21.1.2.1) 210201001 = IP Filter Set 2, Rule 1 Type 210201002 = IP Filter Set 2, Rule 1 Active 210201003 = IP Filter Set 2, Rule 1 Protocol 210201004 =...
  • Page 456 P-662H/HW-D Series User’s Guide Table 176 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 210202009 = IP Filter Set 2, Rule 2 Src Subnet Mask 210202010 = IP Filter Set 2,Rule 2 Src Port 210202011 = IP Filter Set 2, Rule 2 Src Port Comp 210202013 = IP Filter Set 2, Rule 2 Act Match...
  • Page 457 Table 176 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 210204002 = IP Filter Set 2, Rule 4 Active 210204003 = IP Filter Set 2, Rule 4 Protocol 210204004 = IP Filter Set 2, Rule 4 Dest IP address 210204005 = IP Filter Set 2, Rule 4 Dest Subnet Mask...
  • Page 458 P-662H/HW-D Series User’s Guide Table 176 Menu 21.1 Filer Set #2, (SMT Menu 21.1) (continued) 210205011 = IP Filter Set 2, Rule 5 Src Port Comp 210205013 = IP Filter Set 2, Rule 5 Act Match 210205014 = IP Filter Set 2, Rule 5 Act Not Match / Menu 21.1.2.6 Filter set #2, rule #6 (SMT Menu 21.1.2.5) 210206001 =...

  • Page 459: Table 177 Menu 23 System Menus (Smt Menu 23)

    Table 177 Menu 23 System Menus (SMT Menu 23) */ Menu 23.1 System Password Setup (SMT Menu 23.1) 230000000 = System Password */ Menu 23.2 System security: radius server (SMT Menu 23.2) 230200001 = Authentication Server Configured 230200002 = Authentication Server Active 230200003 = Authentication Server IP Address 230200004 =...

  • Page 460: Command Examples

    P-662H/HW-D Series User’s Guide Table 177 Menu 23 System Menus (SMT Menu 23) (continued) 230400008 = WPA Mixed Mode 230400009 = Data Privacy for Broadcast/ Multicast packets 230400010 = WPA Broadcast/Multicast Key Update Timer Table 178 Menu 24.11 Remote Management Control (SMT Menu 24.11) / Menu 24.11 Remote Management Control (SMT Menu 24.11) 241100001 = TELNET Server Port...
  • Page 461 Table 179 Command Examples (continued) 990000001 = ADSL OPMD Appendix M Internal SPTGEN P-662H/HW-D Series User’s Guide INPUT INPUT <0(etsi)|1(normal) |2(gdmt)|3(multimo de)>...
  • Page 462 P-662H/HW-D Series User’s Guide Appendix M Internal SPTGEN...

  • Page 463: Splitters And Microfilters

    This appendix tells you how to install a POTS splitter or a telephone microfilter. Connecting a POTS Splitter When you use the Full Rate (G.dmt) ADSL standard, you can use a POTS (Plain Old Telephone Service) splitter to separate the telephone and ADSL signals. This allows simultaneous Internet access and telephone service on the same line.

  • Page 464: Zyxel Device With Isdn

    P-662H/HW-D Series User’s Guide 1 Connect a phone cable from the wall jack to the single jack end of the Y- Connector. 2 Connect a cable from the double jack end of the Y-Connector to the “wall side” of the microfilter.

  • Page 465: Appendix O Log Descriptions

    This appendix provides descriptions of example log messages. Table 180 System Maintenance Logs LOG MESSAGE Time calibration is successful Time calibration failed WAN interface gets IP:%s DHCP client IP expired DHCP server assigns%s Successful WEB login WEB login failed Successful TELNET login TELNET login failed Successful FTP login FTP login failed...

  • Page 466: Table 181 System Error Logs

    P-662H/HW-D Series User’s Guide Table 180 System Maintenance Logs (continued) LOG MESSAGE Successful HTTPS login HTTPS login failed Table 181 System Error Logs LOG MESSAGE %s exceeds the max. number of session per host! setNetBIOSFilter: calloc error readNetBIOSFilter: calloc error WAN connection is down.

  • Page 467: Table 183 Tcp Reset Logs

    Table 183 TCP Reset Logs LOG MESSAGE Under SYN flood attack, sent TCP RST Exceed TCP MAX incomplete, sent TCP RST Peer TCP state out of order, sent TCP RST Firewall session time out, sent TCP RST Exceed MAX incomplete, sent TCP RST Access block, sent TCP Table 184 Packet Filter Logs...

  • Page 468: Table 185 Icmp Logs

    P-662H/HW-D Series User’s Guide Table 185 ICMP Logs LOG MESSAGE Firewall default policy: ICMP <Packet Direction>, <type:%d>, <code:%d> Firewall rule [NOT] match: ICMP <Packet Direction>, <rule:%d>, <type:%d>, <code:%d> Triangle route packet forwarded: ICMP Packet without a NAT table entry blocked: ICMP Unsupported/out-of-order ICMP: ICMP Router reply ICMP packet: ICMP...

  • Page 469: Table 188 Upnp Logs

    Table 187 PPP Logs (continued) LOG MESSAGE ppp:LCP Closing ppp:IPCP Closing Table 188 UPnP Logs LOG MESSAGE UPnP pass through Firewall Table 189 Content Filtering Logs LOG MESSAGE %s: Keyword blocking %s: Not in trusted web list %s: Forbidden Web site The web site is in the forbidden web site list. %s: Contains ActiveX %s: Contains Java applet...

  • Page 470: Table 190 Attack Logs

    P-662H/HW-D Series User’s Guide Table 189 Content Filtering Logs (continued) LOG MESSAGE Connecting to content filter server fail License key is invalid The external content filtering license key is invalid. Table 190 Attack Logs LOG MESSAGE attack [TCP | UDP | IGMP | ESP | GRE | OSPF] attack ICMP (type:%d, code:%d)

  • Page 471: Table 191 Ipsec Logs

    Table 191 IPSec Logs LOG MESSAGE Discard REPLAY packet Inbound packet authentication failed Receive IPSec packet, but no corresponding tunnel exists Rule <%d> idle time out, disconnect WAN IP changed to <IP> Table 192 IKE Logs LOG MESSAGE Active connection allowed exceeded Start Phase 2: Quick Mode Verifying Remote ID failed:...
  • Page 472 P-662H/HW-D Series User’s Guide Table 192 IKE Logs (continued) LOG MESSAGE Cannot resolve Secure Gateway Addr for rule <%d> Peer ID: <peer id> <My remote type> -<My local type> vs. My Remote <My remote> - <My remote> vs. My Local <My local>-<My local>...
  • Page 473 Table 192 IKE Logs (continued) LOG MESSAGE XAUTH fail! Username: <Username> Rule[%d] Phase 1 negotiation mode mismatch Rule [%d] Phase 1 encryption algorithm mismatch Rule [%d] Phase 1 authentication algorithm mismatch Rule [%d] Phase 1 authentication method mismatch Rule [%d] Phase 1 key group mismatch Rule [%d] Phase 2 protocol mismatch...

  • Page 474: Table 193 Pki Logs

    P-662H/HW-D Series User’s Guide Table 192 IKE Logs (continued) LOG MESSAGE Rule [%d] phase 2 mismatch Rule [%d] Phase 2 key length mismatch Table 193 PKI Logs LOG MESSAGE Enrollment successful Enrollment failed Failed to resolve <SCEP CA server url> Enrollment successful Enrollment failed Failed to resolve <CMP...

  • Page 475: Table 194 Certificate Path Verification Failure Reason Codes

    Table 193 PKI Logs (continued) LOG MESSAGE Rcvd data <size> too large! Max size allowed: <max size> Cert trusted: <subject name> Due to <reason codes>, cert not trusted: <subject name> Table 194 Certificate Path Verification Failure Reason Codes CODE DESCRIPTION Algorithm mismatch between the certificate and the search constraints.

  • Page 476: Table 195 802.1X Logs

    P-662H/HW-D Series User’s Guide Table 194 Certificate Path Verification Failure Reason Codes (continued) CODE DESCRIPTION Database method failed. Path was not verified. Maximum path length reached. Table 195 802.1X Logs LOG MESSAGE Local User Database accepts user. Local User Database reports user credential error.

  • Page 477: Table 196 Acl Setting Notes

    Table 196 ACL Setting Notes PACKET DIRECTION (L to W) (W to L) (D to L) (D to W) (W to D) (L to D) (L to L) (W to W) (D to D) Table 197 ICMP Notes TYPE CODE Appendix O Log Descriptions DIRECTION DESCRIPTION...

  • Page 478: Table 198 Syslog Logs

    P-662H/HW-D Series User’s Guide Table 197 ICMP Notes (continued) TYPE CODE Table 198 Syslog Logs LOG MESSAGE <Facility*8 + Severity>Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP:dstPort>" msg="<msg>" note="<note>" devID="<mac address last three numbers>" cat="<category> The following table shows RFC-2408 ISAKMP payload types that the log displays. Please refer to the RFC for detailed information on each type.

  • Page 479: Log Commands

    ZyXEL Device is to record. 2 Use sys logs category to view a list of the log categories. Figure 271 Displaying Log Categories Example Copyright (c) 1994 - 2004 ZyXEL Communications Corp. ras>? Valid commands are: certificates ras>...

  • Page 480: Displaying Logs

    P-662H/HW-D Series User’s Guide Use 0 to not record logs for that category, 1 to record only logs for that category, 2 to record only alerts for that category, and 3 to record both logs and alerts for that category. Not every parameter is available with every category.

  • Page 481: Appendix P Triangle Route

    The Ideal Setup When the firewall is on, your ZyXEL Device acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the ZyXEL Device to protect your LAN against attacks. Figure 273 Ideal Setup The “Triangle Route”...

  • Page 482: The "Triangle Route" Solutions

    P-662H/HW-D Series User’s Guide Figure 274 “Triangle Route” Problem The “Triangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface.

  • Page 483: Gateways On The Wan Side

    Figure 275 IP Alias Gateways on the WAN Side A second solution to the “triangle route” problem is to put all of your network gateways on the WAN side as the following figure shows. This ensures that all incoming network traffic passes through your ZyXEL Device to your LAN.
  • Page 484 P-662H/HW-D Series User’s Guide Appendix P Triangle Route...

  • Page 485: Index

    Address Assignment Address Resolution Protocol (ARP) ADSL standards Advanced Encryption Standard AH Protocol alternative subnet mask notation antenna gain Anti-virus Online update Registration Anti-virus packet scan Configuration Anti-virus scan packet types Any IP 42, 113 How it works note Any IP Setup AP (access point) applicaions Internet access...
  • Page 486 P-662H/HW-D Series User’s Guide BW Budget CBR (Continuous Bit Rate) certificate Certificate Authority change password at login Channel Interference Channel ID compact compact guide Computer virus Computer virus infection and prevention Computer virus types Configuration Content Access Control activation Administrator Login Application configuration steps Content Filtering Service...
  • Page 487 Content filtering content filtering 42, 222 CTS (Clear to Send) Custom Ports Creating/Editing Customized Services Customized services Data Confidentiality Data Integrity Data Origin Authentication Default default LAN IP address Denial of Service 170, 171, 199 Destination Address device model number DHCP 44, 110, 111, 305, 333 DHCP client...
  • Page 488 P-662H/HW-D Series User’s Guide EAP Authentication ECHO E-mail virus embedded help Encapsulated Routing Link Protocol (ENET ENCAP) Encapsulation 85, 235 ENET ENCAP PPP over Ethernet PPPoA RFC 1483 Encapsulation Security Payload Encryption 233, 405 ESP Protocol Ethernet Extended Service Set Extended Service Set IDentification Extended wireless security Fairness-based Scheduler...
  • Page 489 upload upload error Fragmentation Threshold Fragmentation threshold Frame Relay 162, 309, 312 FTP Restrictions Full Rate General Setup General wireless LAN screen Half-Open Sessions Hidden node Host 63, 334, 335 How ZyXEL Device virus scan works HTTP 162, 170, 171, 172 HTTP (Hypertext Transfer Protocol) IANA IANA (Internet Assigned Number Authority)
  • Page 490 P-662H/HW-D Series User’s Guide Internet Access 42, 46 Internet access Internet Access Setup Internet access wizard setup Internet Assigned Numbers AuthoritySee IANA Internet Control Message Protocol (ICMP) Internet Key Exchange Internet Protocol Security IP Address 111, 162, 163, 164 IP Address Assignment ENET ENCAP PPPoA or PPPoE RFC 1483...
  • Page 491 MAC Address Filtering MAC Filter Macro virus Management Information Base (MIB) Manually Update Virus Information Maximize Bandwidth Usage Maximum Burst Size (MBS) Max-incomplete High Max-incomplete Low Media Bandwidth Management Message Integrity Check (MIC) Metric Multicast Multiplexing multiplexing LLC-based VC-based Multiprotocol Encapsulation My IP Address Nailed-Up Connection 111, 162, 163...
  • Page 492 P-662H/HW-D Series User’s Guide Packet Filtering Packet filtering When to use Packet Filtering Firewalls Pairwise Master Key (PMK) Parental Control Pattern file Peak Cell Rate (PCR) 88, 94, 98 Perfect Forward Secrecy Ping of Death Point to Point Protocol over ATM Adaptation Layer 5 (AAL5) Point-to-Point Point-to-Point Tunneling Protocol POP3...
  • Page 493 RF (Radio Frequency) RFC 1483 RFC 1631 RFC2516 RIPSee Routing Information Protocol Routing Information Protocol Direction Version RTS (Request To Send) RTS Threshold 399, 400 Rules Checklist Key Fields LAN to WAN Logic Predefined Services Safety Warnings Saving the State Scanning engine Scheduler Secure Gateway Address...
  • Page 494 P-662H/HW-D Series User’s Guide Static Route SUA (Single User Account) SUA vs NAT subnet Subnet Mask 111, 189 subnet mask subnetting Supporting Disk Sustain Cell Rate (SCR) Sustained Cell Rate (SCR) SYN Flood 172, 173 SYN-ACK Syntax Conventions Syslog System Name System Parameter Table Generator System Timeout TCP Maximum Incomplete...
  • Page 495 Universal Plug and Play (UPnP) Update Schedule Update the virus scan UPnP Forum security issues Upper Layer Protocols 177, 178 URL keyword blocking User Authentication User Name VBR (Variable Bit Rate) Viewing Certifications Virtual Channel Identifier (VCI) virtual circuit (VC) Virtual Path Identifier (VPI) Virtual Private Network Virus attack...
  • Page 496 P-662H/HW-D Series User’s Guide WPA2-PSK WPA-PSK Zero Configuration Internet Access Zero configuration Internet access ZyXEL Device anti-virus packet scan ZyXEL_s Firewall Introduction Index...

This manual is also suitable for:

P-662h seriesP-662h-d - v3.40P-662hw-d series

Table of Contents