ZyXEL Communications ADSL2+ 4-port Security Gateway Support Notes
  1. Manuals
  2. Brands
  3. ZyXEL Communications Manuals
  4. Gateway
  5. ADSL2+ 4-port Gateway P-660H-D Series
  6. Support notes
ZyXEL Communications ADSL2+ 4-port Security Gateway Support Notes

ZyXEL Communications ADSL2+ 4-port Security Gateway Support Notes

Adsl2+ 4-port security gateway
Hide thumbs Also See for ADSL2+ 4-port Security Gateway:
Table of Contents

Advertisement

Quick Links

Download this manual See also: User Manual
P-662H-D Series
ADSL2+ 4-port Security Gateway
Support Notes
Version3.40
Mar. 2006

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the ADSL2+ 4-port Security Gateway and is the answer not in the manual?

Questions and answers

Related Manuals for ZyXEL Communications ADSL2+ 4-port Security Gateway

Summary of Contents for ZyXEL Communications ADSL2+ 4-port Security Gateway

  • Page 1 P-662H-D Series ADSL2+ 4-port Security Gateway Support Notes Version3.40 Mar. 2006...

  • Page 2: Table Of Contents

    13. How do I setup my P-662H-D for routing IPSec packets over SUA? 13 14. What is Traffic Shaping?..............14 15. Why do we perform traffic shaping in the P-662H-D?.......14 16. What do the parameters (PCR, SCR, MBS) mean? ......15 All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 3 3. How do I view the firewall log? ..........26 4. When does the P-662H-D generate the firewall alert? ..27 5. What is the difference between the log and alert?....27 VPN FAQ ....................28 All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 4 16. Can P-662H-D behave as a NAT router supporting IPSec passthrough and an IPSec gateway simultaneously? ....36 Application Notes..................37 General Application Notes ..............37 1. Internet Access Using P-662H-D under Bridge mode ..37 2. Internet Access Using P-662H-D under Routing mode ..39 All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 5 2. Firmware/Configurations Uploading and Downloading using TFTP..104 •Using TFTP client software...........104 •Using TFTP command on Windows NT........105 •Using TFTP command on UNIX ...........105 3. Using FTP to Upload the Firmware and Configuration Files .....106 CI Command Reference .................109 All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 6: Faq

    The P-662H-D allows you to transfer the firmware to P-662H-D using TFTP program via LAN. The procedure for uploading ZyNOS via TFTP is as follows. a. Use the TELNET client program in your PC to login to your P-662H-D. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 7: How Do I Restore P-662H-D Configurations By Using Tftp Client Program Via Lan

    Internet concurrently for the cost of a single user account. When Prestige acting as SUA receives a packet from a local client destined for the outside Internet, it replaces the source address in the IP packet header All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 8: What Is The Difference Between Sua And Full Feature Nat

    Yes, it is possible because P-662H-D delivers the packet to the local server by looking up to a SUA server table. Therefore, to make a local server accessible to the outside users, the port number and the inside IP address of the server All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 9: When Do I Need Select Full Feature Nat

    IP address. This allows us to specify multiple servers of different types behind the NAT for outside access. Note, if you want to map each server to one unique IGA please use the One-to-One mode. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 10: How Many Network Users Can The Sua/Nat Support

    The P-662H-D's filter sets provide a means to protect against IP spoofing attacks. The basic scheme is as follows: For the input data filter: • Deny packets from the outside that claim to be from the inside All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 11 • Destination IP Addr =a.b.c.d • Destination IP Mask =w.x.y.z • Action Matched =Drop • Action No Matched =Forward Where a.b.c.d is an IP address on your local network and w.x.y.z is your netmask. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 12: Product Faq

    Generally, the voice band uses the lower frequency ranging from 0 to 4KHz, while ADSL data transmission uses the higher frequency. The micro filter acts as a low-pass filter for your telephone set to ensure that ADSL transmissions All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 13: The P-662H-D Supports Bridge And Router Mode, What's The Difference Between Them

    It is inconvenient for the users if this IP is dynamic. With DDNS supported by the P-662H-D, you apply a DNS name (e.g., www.zyxel.com.tw) for your server (e.g., Web server) from a DDNS server. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 14: When Do I Need Ddns Service

    13. How do I setup my P-662H-D for routing IPSec packets over SUA? For outgoing IPSec tunnels, no extra setting is required. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 15: What Is Traffic Shaping

    Traffic shaping defines a set of actions taken by the P-662H-D to avoid congestion; traffic shaping takes measures to adapt to unpredictable fluctuations in traffic flows and other problems among virtual connections. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 16: What Do The Parameters (Pcr, Scr, Mbs) Mean

    Internet Content filter allows you to create and enforce Internet access policies tailored to your needs. Content filter gives you the ability to block web sites that contain key words (that you specify) in the URL. You can set a schedule for All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 17 P-662H-D performs content filtering. You can also specify trusted IP Addresses on LAN for which the P-662H-D will not perform content filtering. You can configure the details about it in Web Configurator, Advanced setup, Security -> Content Filter. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 18: Adsl Faq

    ADSL physical layer is up. 5. How does the P-662H-D work on a noisy ADSL? Depending on the line quality, the P-662H-D uses "Fall Back" and "Fall Forward" to automatically adjust the date rate. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 19: Does The Vc-Based Multiplexing Perform Better Than The Llc-Based Multiplexing

    8. What are the signaling pins of the ADSL connector? The signaling pins on the P-662H-D's ADSL connector are pin 3 and pin 4. The middle two pins for a RJ11 cable. 9. What is triple play? All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 20 • The low priority is internet access such as ftp etc … Triple Play is a port-based policy to forward packets from different LAN port to different PVCs, thus you can configure each PVC separately to assign different QoS to different application. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 21: Firewall Faq

    A key drawback of this device is performance. Stateful Inspection Firewalls restrict access by screening data packets against defined access rules. They make access control decisions based on IP All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 22: What Kind Of Firewall Is The P-662H-D

    Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources. There are four types of DoS attacks: All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 23: What Is Ping Of Death Attack

    IP address of the targeted system. This makes it appear as if the host computer sent the packets to itself, making the system unavailable while the target system tries to respond to itself. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 24: What Is Brute-Force Attack

    Note: Don’t forget to type in the Administrator Password. 2. How do I prevent others from configuring my firewall? There are several ways to protect others from touching the settings of your firewall. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 25: Why Can't I Configure My P-662H-D Using Web Configurator/Telnet Over Wan

    TELNET (For accessing Command Line Interface): Source IP= Telnet Client host Destination IP= router' WAN IP Service= TCP/23 Action=Forward (2)You have disabled WWW/Telnet service in Web Configurator, Advanced setup, Advanced -> Remote MGNT: All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 26: Why Can't I Upload The Firmware And Configuration File Using Ftp Over Wan

    FTP connection from WAN. The WAN-to-LAN ACL summary will look like as shown below. Source IP= FTP host Destination IP= P-662H-D's WAN IP Service= FTP TCP/21, TCP/20 Action=Forward All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 27: Log And Alert

    128 entries. Before you can view firewall logs there are two steps you need to do: (1) Enable log function in Centralized logs setup via either one of the following methods, All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 28: When Does The P-662H-D Generate The Firewall Alert

    A log entry is just added to the log inside the P-662H-D and e-mailed together with all other log entries at the scheduled time as configured. An alert is e-mailed immediately after an attacked is detected. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 29: Vpn Faq

    3. What are most common VPN protocols? There are currently three major tunneling protocols for VPNs. They are Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP) and Internet Protocol Security (IPSec). 4. What is PPTP? All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 30: What Is L2Tp

    IPSec service for other machines lacking of IPSec capability. In this case, Transport mode only protects the upper-layer protocols of IP payload (user data). Tunneling mode protects the entire IP payload including user data. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 31: What Is Sa

    In IKE phase 1 negotiation, IP address of remote peer is treated as an indicator to decide which VPN rule must be used to serve the incoming request. However, in some application, remote VPN box or client software is using an All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 32: What Is Fqdn

    "Aggressive mode" is recommended to be applied in phase 1 negotiation. Advanced FAQ 1. How do I configure VPN? You can configure VPN via Web Configurator, Advanced Setup, Security -> VPN -> Summary. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 33: What Kind Of Vpn Protocols Are Supported On P-662H-D

    (2) In NAT case, only IPSec tunneling mode is supported. Here’s a brief summary for IPSec and NAT: NAT Condition Supported IPSec Protocol VPN Gateway embedded NAT AH Tunnel mode, ESP Tunnel mode All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 34: Does P-662H-D Support Dynamic Secure Gateway Ip

    A by specifying ASecure GW as Router A’s DNS name, even if router B itself is dynamic IP address too. Note: In the example, the VPN connection can only be initiated from Router B. 7. What VPN gateway has been tested with P-662H-D successfully? All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 35: What Vpn Software Has Been Tested With P-662H-D Successfully

    Gateway IP Address' is the Internet IP address of the remote IPSec gateway. 10. Is the host behind NAT allowed to use IPSec? NAT Condition Supported IPSec Protocol VPN Gateway embedded AH tunnel mode, ESP tunnel mode VPN client/gateway behind ESP tunnel mode All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 36: How Do I Configure P-662H-D With Nat For Internal Servers

    VPN tunnel. With this option, whenever phase 2 SA lifetime is due, IKE negotiation procedure will be invoked automatically even without traffic to make the connection stay. But to reduce the consumption of system resource, if VPN tunnels get All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 37: Single, Range, Subnet, Which Types Of Ip Address Do P-662H-D Support In Vpn/Ipsec

    If P-662H-D is to support IPSec passthrough, you have to disable the VPN function on P-662H-D. To disable it, you can either deactivate each VPN rule or issue a CI command, "ipsec switch off" from CLI. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 38: Application Notes

    IP addresses for all that the ISP gives to you in the network TCP/IP settings. For Windows, we check the option 'Obtain an IP address automatically' in its TCP/IP setup, please see the example shown below. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 39 We will use Web Configurator to guide you through the related menu. (1) Configure P-662H-D as bridge mode and configure Internet setup parameters in Web Configurator, Advanced Setup, Network -> WAN -> All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 40: Internet Access Using P-662H-D Under Routing Mode

    Internet access, they have to install an Internet sharing device, like a router. In this case, we use the P-662H-D which works as a general Router plus an ADSL Modem. Set up your workstation (1) Ethernet connection All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 41 Routing mode for routing traffic. We will use Web Configurator to guide you through the related menu. (1) Configure P-662H-D as routing mode and configure Internet setup parameters in Web Configurator, Advanced Setup, Network -> WAN -> Internet Connection. Key Settings: All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 42: Setup The P-662H-D As A Dhcp Relay

    • Setup the P-662H-D as a DHCP Relay We could set the P-662H-D as a DHCP Relay by the following command in CLI: Ip dhcp enif0 mode relay Ip dhcp enif0 relay server [Server IP Address] All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 43: Sua Notes

    Required Settings in Port Forwarding Port/IP Application Incoming Outgoing Connection Connection HTTP None 80/client IP None 21/client IP TELNET None 23/client IP (and active Telnet service from WAN) POP3 None 110/client IP SMTP None 25/client IP All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 44 6901/client IP 6901/client IP Microsoft Messenger Service None for Chat, File None for Chat, File 4.6/ 4.7/ 5.0/… transfer, Video and transfer ,Video and Voice (none UPnP) Voice Net2Phone None 6701/client IP All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 45 SUA server must be set to 192.168.1.34. The peer Cu-SeeMe user can reach this workstation by using P-662H-D's WAN IP address which can be obtained from Web Configurator, Status -> WAN Information. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 46 Configuration To make a server visible to the outside world, specify the port number of the service and the inside address of the server in Web Configurator, Advanced All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 47 (3) If you want to change the port for Web Server, you could press button ‘Modify’ on corresponding rule, then modify and apply it. Default port numbers for some services Service Port Number All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 48 All data sent over this connection can be encrypted and compressed, and multiple network level protocols (TCP/IP, NetBEUI and IPX) can be run correctly. Windows NT Domain Login level security is preserved even across the Internet. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 49 SUA. The port number of the PPTP has to be entered in the Web Configurator, Advanced Setup, Network -> NAT -> Port Forwarding on P-662H-D to forward to the appropriate private IP address of Windows NT server. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 50 • Before making a VPN connection from Win9x to WinNT server, you need to connect P-662H-D router to your ISP first. • Enter the IP address of the PPTP server (WinNT server) and the port number for PPTP as shown below: All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 51 ISP. You must enter this IP address in the 'VPN Server' dialog box for reaching the PPTP server. After the VPN link is established, you can start the network protocol application such as IP, IPX and NetBEUI. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 52: Using Full Feature Nat

    SUA Only lookup 255’. It’s a read-only sets with two rules: Many-to-One and server mapping. Select Full Feature when you require other mapping types. Configuring NAT Address Mapping Sets and NAT Server Sets All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 53 IPs, then the Start IP is 0.0.0.0 and the 255.255.255.255 End IP is 255.255.255.255. Global Start This is the starting global IP address (IGA). If you 0.0.0.0 have a dynamic IP, enter 0.0.0.0 as the Global Start All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 54 Click the ‘Edit’ Button on the rule #1, then you can enter the window in which you can edit an individual rule and configure the Mapping Type, Local and Global Start/End IPs: All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 55 P-662H-D is 192.168.1.1) Step 2: Select one Address Mapping Set (#1~#8) by command ‘ip nat addrmap map [map #] [set name]’ (set name is optional). Suppose we configure set 2 in the example. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 56 Load the server sets of NAT into buffer “disp 1” means to display the NAT server set in buffer, ip nat server disp [1] if parameter “1” is omitted, then it will display all the All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 57 192.168.1.36 and a FTP server at 192.168.1.33, then you need to specify for port 80 (Web) the server at IP address 192.168.1.36 and for port 21 (FTP) another at IP address 192.168.1.33. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 58 • Examples • Internet Access Only • Internet Access with an Internal Server • Using Multiple Global IP addresses for clients and servers • Support Non NAT Friendly Applications (1) Internet Access Only All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 59 In this case, we do exactly as the figure (use the convenient pre-configured SUA Only set) and also go to Web Configurator, Advanced Setup, Network -> NAT -> Port Forwarding to specify the Internet Server behind the NAT as All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 60 Rule 4 (Server type) to map a web server and mail server with ILA3 (192.168.1.20) to IGA3. Type Server allows us to specify multiple servers, of different types, to other machines behind NAT on the LAN. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 61 Rule 1 Setup: Select One-to-One type to map the FTP Server 1 with ILA1 (192.168.1.10) to IGA1 (200.0.0.1). Rule 2 Setup: Selecting One-to-One type to map the FTP Server 2 with ILA2 (192.168.1.11) to IGA2 (200.0.0.2). All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 62 (200.0.0.3). Rule 4 Setup: Select Server type to map our web server and mail server with ILA3 (192.168.1.20) to IGA3. Menu Network -> NAT -> Address Mapping should look as follows now: All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 63 IP address. In this case it is better to use Many-to-Many No Overload or One-to-One NAT mapping types, thus each user login to the server using a unique global IP address. The following figure illustrates this. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 64: Using The Dynamic Dns (Ddns)

    With DDNS supported by the P-662H-D, you apply a DNS name (e.g., www.zyxel.com.tw) for your server (e.g., Web server) from a DDNS server. The outside users can always access the web server using the www.zyxel.com.tw regardless of the WAN IP of the P-662H-D. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 65 Enter the DDNS server in this field. Currently, we support Service Provider WWW.DYNDNS.ORG. Active Toggle to 'Yes'. Enter the hostname you subscribe from the above DDNS server. Host Name For example, zyxel.com.tw. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 66: Network Management Using Snmp

    If any link of IDSL or WAN is up, the trap will be sent with the port number . The port number is its interface index under the interface group. 5. authenticationFailure (defined in RFC-1215) : All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 67 (2) For fatal error : System has to reboot for some fatal errors. And traps with the message of the fatal code will be sent. • Downloading ZyXEL's private MIB • Configure the P-662H-D for SNMP All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 68 P-662H-DHW-DX will respond to all NMS managers. Enter the community name in each sent trap to the NMS. This Trap Trap Community must match what the NMS is expecting. The default is Community 'public'. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 69: Using Syslog

    'IP Alias'. In this case, an internal router is not required. For example, the network manager can divide the local network into three networks and connect them to the Internet using P-662H-D's single user account. See the figure below. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 70 P-662H-D as shown below when the three networks are configured. If the P-662H-D's DHCP is also enabled, the IP pool for the clients can be any of the three networks. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 71: Using Ip Policy Routing

    Policy-based routing is applied to incoming packets on a per interface basis, prior to the normal routing. Network administrators can use IPPR to distribute traffic among multiple paths. For example, if a network has both the Internet All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 72 The inclusion of length criterion is to differentiate between interactive and bulk traffic. Interactive applications, e.g., Telnet, tend to have short packets, while bulk traffic, e.g., file transfer, tends to have large packets. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 73 To implement this, we need to invoke the following command one by one: ip policyrouting set name Test (Set the name as Test of IP routing policy rule ) ip policyrouting set active (Enable the rule) ip policyrouting set criteria protocol All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 74 WAN site you apply the policy set in WAN interface. Apply to WAN Interface (Suppose we apply it to remote node in the example): wan node index wan node ippolicy All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 75: Using Call Scheduling

    Test (Set the schedule name as Test) wan callsch active (Enable schedule) wan callsch startdate 2005 12 27 (Set schedule start date as 2005-12-27) All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 76 For example, if we want to apply the call schedule set 1 to remote node 1, we could use the commands: wan node index wan node callsch wan node save All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 77: Using Ip Multicast

    The latest version is version 2 (see RFC2236). IP hosts use IGMP to report their multicast group membership to any immediate-neighbor multicast routers so the multicast routers can decide if a multicast packet All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 78: Using Bandwidth Management

    Select how you want the bandwidth to be allocated. Priority-Based means bandwidth is allocated via priority, so the traffic with highest priority would be served first, then the second priority is served secondly and so on. If All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 79 Step 2: Go to Web Configurator, Advanced Setup, Advanced -> Bandwidth MGMT-> Rule Setup, select the interface, Service, Priority, and Allocated Bandwidth for this rule, then click button ‘Add’ to apply this rule. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 80 Maximize Bandwidth Usage on the interface to meet the condition.) Service Select User-defined, SIP, FTP, or H.323 to specify the traffic types Destination Enter the IP address of destination that meets this class. IP Address All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 81: Using Zero-Configuration

    Whenever system send out all the probing patterns with specific VPI/VCI, system will wait for 5~10 seconds and get the response from ISP, the response patterns will decide which kinds of ADSL All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 82 (2) If you want to enable all service for VC hunting, the service bits will be 1+2+4+8+16+32=63(decimal)= 3f (hex), you must input 3f Need to perform save after this by command ‘wan atm vchunt save’ All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 83 Internet. If the connection test fail, it will go back to the page ask for user name and password. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 84: How Could I Configure Triple Play On P-662H-D

    With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 85 Usage: node#= 1~8, corresponding to the remote node 1~8 wan node filter <incoming|outgoing> <tcpip|generic> <set1#> <set2#> <set3#> <set4#> Usage: You can apply at most four filter sets to one remote node. wan node save All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 86 [protocol #] Set the protocol ID of the rule sys filter set sourceroute [yes|no] Set the sourceroute yes/no sys filter set destip [address] [subnet Set the destination IP address and subnet mask of All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 87 Clear the current filter set sys filter set save Save the filter set parameters Display Filter set information. W/o parameter, it will sys filter set display [set#][rule#] display buffer information. sys filter set freememory Discard Changes All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 88: Ipsec Vpn Application Notes

    PC 1 and PC 2 are secure. Because the packets go through the IPSec tunnel are encrypted. To achieve this VPN tunnel, the settings required for each Prestige are explained in the following sections. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 89 Note: For P-662H-D, you need to login Multilingual Web Configurator using Administrator account, the default password is admin (2) Go to VPN Setup page to edit a VPN Rule. On P-662H-D, you could begin with Security -> VPN -> Summery: All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 90 Local Address Type is Single and IP Address Start is PC 1’s IP, 192.168.1.33 in the example. Remote Address Type is Single and IP Address Start is PC 2’s IP, 192.168.2.33 in the example. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 91 Select one VPN Protocol from the pull-down menu, ESP in the example. Input a proper Pre-Shared Key in the right table, 01234567 in the example. Select Encryption Algorithm to DES and Authentication Algorithm to SHA1. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 92 Remote Address Type is Single and IP Address Start is PC 1’s IP, 192.168.1.33 in the example. (2) My IP Address is the WAN IP of Prestige B, 168.10.10.66 in the example. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 93 Support Engineer for a solution. The following shows an example of dumped messages. (You can refer to Support Tool -> 1 WAN/ LAN Packet Trace -> Capture the detailed logs by Hyper Terminal to do it). All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 94: How To Build A Vpn Between Secure Gateway With Dynamic Wan Ip Address

    Then after a successful or failed VPN connection, we could view the relevant information from Web Configurator, Maintenance -> Logs -> View Log: 2. How to build a VPN between Secure Gateway with Dynamic WAN IP Address? All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 95 • Prestige dynamic WAN IP v.s. peer side dynamic IP In this case, we need to use DDNS (Dynamic Domain Name Service). There are many different solutions for it: (1) Prestige v.s. Prestige Solution 1: All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 96: Configure Nat For Internal Servers

    Generally, without IPSec, to configure an internal server for outside access, we need to configure the server private IP and its service port in SUA/NAT Server Table. The NAT router then will forward the incoming connections to the All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 97: Vpn Routing Between Branch Office Through Headquarter

    Through VPN routing, Prestige series now provide you a solution to let PCs in branch offices talk to each other through the existing VPN tunnels concentrated on the headquarter. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 98 Advanced button. Please make sure that parameters you set in this menu match with all the parameters with the corresponding VPN rule in headquarter. We don’t make any advanced setup in the example. Step 2: Setup VPN in branch office B All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 99 B. Remote Address Type is Range Address and IP Address Start is 192.168.3.0, IP Address End is 192.168.3.255. This section covers the LAN segment of branch office A. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 100 • The correspondent rule for Branch_B_1 in headquarter (1) Local Address Type is Range Address and IP Address Start is 192.168.1.0, IP Address End is 192.168.1.255. This section covers the LAN segment of Headquarter office. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 101 Advanced button. Please make sure that parameters you set in this menu match with all the parameters with the corresponding VPN rule in headquarter. We don’t make any advanced setup in the example. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 102: Support Tool

    • Enable the trace log by entering: sys trcp sw on & sys trcl sw on • Display the brief trace online by entering: sys trcd brief • Display the detailed trace online by entering: sys trcd parse All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 103 & sys trcl sw on • Display the brief trace online by entering: sys trcd brief • Display the detailed trace online by entering: sys trcd parse Example: All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 104: Offline Trace

    • Disable the trace log by entering: sys trcp sw off & sys trcl sw off • Display the trace briefly by entering: sys trcp brief • Display specific packets by using: sys trcp parse <from_index> <to_index> All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 105: Firmware/Configurations Uploading And Downloading Using Tftp

    Step 1: TELNET to your Prestige first before running the TFTP software Step 2: Type the command 'sys stdio 0' to disable console idle timeout in Command Line Interface (CLI). Step 3: Run the TFTP client software All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 106: Using Tftp Command On Windows Nt

    Step 4: Upload P-662H-D configurations via LAN: c:\tftp -i [PrestigeIP] put [localfile] rom-0 Step 5: Download P-662H-D configurations via LAN: c:\tftp -i [PrestigeIP] get rom-0 [localfile] • Using TFTP command on UNIX Before you begin: All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 107: Using Ftp To Upload The Firmware And Configuration Files

    IP address of the Prestige. Press 'Enter' key to ignore the username, because the Prestige does Step2 not check the username. Enter the CLI password as the FTP login password, the default is Step 3 'admin'. All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 108 Step 2: Press 'OK' to ignore the 'Username' prompt. Step 3: To upload the firmware file, we transfer the local 'ras' file to overwrite the remote 'ras' file. To upload the configuration file, we transfer the local 'rom-0' to overwrite All contents copyright © 2006 ZyXEL Communications Corporation.
  • Page 109 P-662H-D Series Support Notes the remote 'rom-0' file. Step 4: The Prestige reboots automatically after the uploading is finished. Please do not power off the router at this moment. All contents copyright © 2006 ZyXEL Communications Corporation.

  • Page 110: Ci Command Reference

    The latest CI Command list is available in release note of every ZyXEL firmware release. Please goto ZyXEL public WEB site http://www.zyxel.com/support/download_index.php to download firmware package (*.zip), you should unzip the package to get the release note in PDF format. All contents copyright © 2006 ZyXEL Communications Corporation.

This manual is also suitable for:

P-662h-d series

Table of Contents