Download Print this page

ZyXEL Communications ZyWall 35 User Manual

Internet security appliance

Hide thumbs Also See for ZyWall 35:

User manual (872 pages)

,

Support notes (335 pages)

,

Quick start manual (142 pages)

Table Of Contents

Table of Contents

Advertisement

Quick Links

Download this manual See also: User Manual

ZyWALL 35

Internet Security Appliance

User's Guide

Version 3.64

3/2005

Table of Contents

Advertisement

Table of Contents

Troubleshooting

Need help?

Need help?

Do you have a question about the ZyWall 35 and is the answer not in the manual?

Questions and answers

Summary of Contents for ZyXEL Communications ZyWall 35

Page 1 ZyWALL 35 Internet Security Appliance User’s Guide Version 3.64 3/2005...
Page 3: Copyright
ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Page 4: Federal Communications Commission (Fcc) Interference Statement
ZyWALL 35 User’s Guide Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations.
Page 5: Safety Warnings
ZyWALL 35 User’s Guide Safety Warnings For your safety, be sure to read and follow all warning notices and instructions. • To reduce the risk of fire, use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord.
Page 6: Zyxel Limited Warranty
ZyWALL 35 User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During...
Page 7: Customer Support
ZyWALL 35 User’s Guide Customer Support Please have the following information ready when you contact customer support. • Product model and serial number. • Warranty Information. • Date that you received your device. • Brief description of the problem and the steps you took to solve it.
Page 8 ZyWALL 35 User’s Guide METHOD SUPPORT E-MAIL TELEPHONE WEB SITE REGULAR MAIL SALES E-MAIL FTP SITE LOCATION technical@zyxel.co.uk +44 (0) 8702 909090 www.zyxel.co.uk ZyXEL Communications UK Ltd.,11, The Courtyard, sales@zyxel.co.uk +44 (0) 8702 909091 ftp.zyxel.co.uk UNITED KINGDOM Eastern Road, Bracknell,...
Page 9: Table Of Contents
Customer Support....................5 Preface ........................45 Chapter 1 Getting to Know Your ZyWALL ................47 1.1 ZyWALL 35 Internet Security Appliance Overview ..........47 1.2 ZyWALL Features ....................47 1.2.1 Physical Features ..................47 1.2.2 Non-Physical Features ................49 1.3 Applications for the ZyWALL ................54 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem ....54...
Page 10 ZyWALL 35 User’s Guide Chapter 3 Wizard Setup ......................73 3.1 Wizard Setup Overview ..................73 3.2 Internet Access ....................73 3.2.1 ISP Parameters ..................73 3.2.1.1 Ethernet ...................73 3.2.1.2 PPPoE Encapsulation ..............75 3.2.1.3 PPTP Encapsulation ...............76 3.2.2 Internet Access Wizard Setup Complete ..........78 3.3 VPN Wizard ......................79...
Page 11 ZyWALL 35 User’s Guide Chapter 6 Wireless LAN ......................105 6.1 Introduction ......................105 6.1.1 Additional Installation Requirements for Using 802.1x ......105 6.2 Wireless Security .....................105 6.2.1 Encryption ....................106 6.2.2 Authentication ..................106 6.2.3 Restricted Access ...................107 6.2.4 Hide ZyWALL Identity ................107 6.3 Security Parameters Summary ................107...
Page 12 ZyWALL 35 User’s Guide 7.4.1.1 Example 1 ..................130 7.4.1.2 Example 2 ..................130 7.4.2 Weighted Round Robin ................131 7.4.3 Spillover ....................131 7.5 TCP/IP Priority (Metric) ..................132 7.6 Configuring General ..................132 7.7 Configuring Load Balancing ................135 7.7.1 Least Load First ..................135 7.7.2 Weighted Round Robin ................136 7.7.3 Spillover ....................137...
Page 13 ZyWALL 35 User’s Guide 9.4.2.1 ICMP Vulnerability ................170 9.4.2.2 Illegal Commands (NetBIOS and SMTP) ........170 9.4.2.3 Traceroute ..................171 9.5 Stateful Inspection ....................171 9.5.1 Stateful Inspection Process ..............172 9.5.2 Stateful Inspection and the ZyWALL ............173 9.5.3 TCP Security ...................173 9.5.4 UDP/ICMP Security ................174 9.5.5 Upper Layer Protocols ................174...
Page 14 ZyWALL 35 User’s Guide Chapter 11 Content Filtering Screens ................... 199 11.1 Content Filtering Overview ................199 11.1.1 Restrict Web Features ................199 11.1.2 Create a Filter List .................199 11.1.3 Customize Web Site Access ..............199 11.2 General Content Filter Configuration ..............199 11.3 Content Filtering with an External Database ..........202 11.4 Categories and Registering ................202...
Page 15 ZyWALL 35 User’s Guide 13.2.1 IPSec Algorithms ..................229 13.2.2 Key Management ..................229 13.3 Encapsulation ....................229 13.3.1 Transport Mode ..................230 13.3.2 Tunnel Mode ..................230 13.4 IPSec and NAT ....................230 Chapter 14 VPN Screens......................233 14.1 VPN/IPSec Overview ..................233 14.2 IPSec Algorithms ....................233 14.2.1 AH (Authentication Header) Protocol ............233...
Page 16 ZyWALL 35 User’s Guide Chapter 15 Certificates......................265 15.1 Certificates Overview ..................265 15.1.1 Advantages of Certificates ..............266 15.2 Self-signed Certificates ..................266 15.3 Configuration Summary .................266 15.4 My Certificates ....................267 15.5 Certificate File Formats ..................268 15.6 Importing a Certificate ..................269 15.7 Creating a Certificate ..................270 15.8 My Certificate Details ..................272...
Page 17 ZyWALL 35 User’s Guide 17.4.1 Address Mapping Edit ................303 17.5 Port Forwarding ....................304 17.5.1 Default Server IP Address ..............305 17.5.2 Port Forwarding: Services and Port Numbers ........305 17.5.3 Configuring Servers Behind Port Forwarding (Example) ......305 17.5.4 NAT and Multiple WAN .................306 17.5.5 Port Translation ..................306...
Page 18 ZyWALL 35 User’s Guide 20.9.2 Maximize Bandwidth Usage With Bandwidth Borrowing ......328 20.10 Configuring Summary ..................329 20.11 Configuring Class Setup ................330 20.11.1 Bandwidth Manager Class Configuration ..........332 20.11.2 Bandwidth Management Statistics ............335 20.12 Configuring Monitor ..................336 Chapter 21 DNS........................339 21.1 DNS Overview ....................339...
Page 19 ZyWALL 35 User’s Guide 22.7.1 Requirements for Using SSH ..............362 22.8 Configuring SSH ....................362 22.9 Secure Telnet Using SSH Examples ..............363 22.9.1 Example 1: Microsoft Windows .............363 22.9.2 Example 2: Linux ..................363 22.10 Secure FTP Using SSH Example ..............364 22.11 Telnet ......................365 22.12 Configuring TELNET ..................365...
Page 20 ZyWALL 35 User’s Guide Chapter 25 Maintenance ......................395 25.1 Maintenance Overview ...................395 25.2 General Setup ....................395 25.2.1 General Setup and System Name ............395 25.2.2 Domain Name ..................395 25.3 Configuring Password ..................396 25.4 Pre-defined NTP Time Servers List ..............397 25.5 Configuring Time and Date ................398 25.5.1 Resetting the Time ................400...
Page 21 ZyWALL 35 User’s Guide 28.2 WAN Setup .....................427 28.3 Dial Backup ....................428 28.4 Configuring Dial Backup in Menu 2 ..............428 28.5 Advanced WAN Setup ..................429 28.6 Remote Node Profile (Backup ISP) ..............431 28.7 Editing PPP Options ..................433 28.8 Editing TCP/IP Options ..................433 28.9 Editing Login Script ..................435...
Page 22 ZyWALL 35 User’s Guide Chapter 33 Remote Node Setup ..................... 459 33.1 Introduction to Remote Node Setup ...............459 33.2 Remote Node Setup ..................459 33.3 Remote Node Profile Setup ................459 33.3.1 Ethernet Encapsulation .................460 33.3.2 PPPoE Encapsulation ................461 33.3.2.1 Outgoing Authentication Protocol ..........462 33.3.2.2 Nailed-Up Connection ..............462...
Page 23 ZyWALL 35 User’s Guide Chapter 37 Filter Configuration ....................493 37.1 Introduction to Filters ..................493 37.1.1 The Filter Structure of the ZyWALL ............494 37.2 Configuring a Filter Set ..................496 37.2.1 Configuring a Filter Rule ...............497 37.2.2 Configuring a TCP/IP Filter Rule ............498 37.2.3 Configuring a Generic Filter Rule ............500...
Page 24 ZyWALL 35 User’s Guide 40.3.4 GUI-based FTP Clients .................524 40.3.5 File Maintenance Over WAN ..............524 40.3.6 Backup Configuration Using TFTP ............525 40.3.7 TFTP Command Example ..............525 40.3.8 GUI-based TFTP Clients ..............526 40.3.9 Backup Via Console Port ..............526 40.4 Restore Configuration ..................527 40.4.1 Restore Using FTP ................527...
Page 25 ZyWALL 35 User’s Guide 43.2.1 Applying Policy to Packets ..............552 43.3 IP Policy Routing Example ................553 Chapter 44 Call Scheduling ....................557 44.1 Introduction to Call Scheduling ..............557 Chapter 45 Troubleshooting ....................561 45.1 Problems Starting Up the ZyWALL ..............561 45.2 Problems with the LAN Interface ..............561...
Page 26 ZyWALL 35 User’s Guide Appendix J Importing Certificates ..................643 Appendix K Command Interpreter................... 655 Appendix L Firewall Commands ..................... 657 Appendix M NetBIOS Filter Commands .................. 663 Appendix N Certificates Commands ..................667 Appendix O Brute-Force Password Guessing Protection............. 671 Appendix P Boot Commands ....................
Page 27 ZyWALL 35 User’s Guide List of Figures Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem ........ 54 Figure 2 VPN Application ....................55 Figure 3 ZyWALL Front Panel ..................... 55 Figure 4 Change Password Screen ..................58 Figure 5 Replace Certificate Screen ...................
Page 28 ZyWALL 35 User’s Guide Figure 37 Wireless: WPA-PSK .................... 117 Figure 38 Wireless: WPA ....................118 Figure 39 Wireless: 802.1x + Dynamic WEP ..............119 Figure 40 Wireless: 802.1x + Static WEP ................120 Figure 41 Wireless: 802.1x + No WEP ................122 Figure 42 Wireless: No Access 802.1x + Static WEP ............
Page 29 ZyWALL 35 User’s Guide Figure 80 My Service Rule Configuration ................191 Figure 81 My Service Example Rule Summary ..............192 Figure 82 Anti-Probing ......................195 Figure 83 Firewall Threshold ....................197 Figure 84 Content Filter : General ..................200 Figure 85 Content Filtering Lookup Procedure ..............
Page 30 ZyWALL 35 User’s Guide Figure 123 Telecommuters Sharing One VPN Rule Example ..........262 Figure 124 Telecommuters Using Unique VPN Rules Example ......... 263 Figure 125 Certificate Configuration Overview ..............266 Figure 126 My Certificates ....................267 Figure 127 My Certificate Import ..................269 Figure 128 My Certificate Create ..................
Page 31 ZyWALL 35 User’s Guide Figure 166 System DNS: Add Address Record ..............343 Figure 167 System DNS: Insert Name Server Record ............344 Figure 168 DNS Cache ....................... 345 Figure 169 DNS LAN ......................347 Figure 170 DDNS ........................ 349 Figure 171 HTTPS Implementation ..................
Page 32 ZyWALL 35 User’s Guide Figure 209 Device Mode (Router Mode) ................403 Figure 210 Device Mode (Bridge Mode) ................404 Figure 211 Firmware Upload ....................406 Figure 212 Firmware Upload In Process ................406 Figure 213 Network Temporarily Disconnected ..............407 Figure 214 Firmware Upload Error ..................
Page 33 ZyWALL 35 User’s Guide Figure 252 Menu 5.2: TCP/IP Setup ................... 452 Figure 253 Menu 5.2.1: IP Alias Setup ................453 Figure 254 Menu 6: Route Setup ..................455 Figure 255 Menu 6.1: Route Assessment ................455 Figure 256 Menu 6.2: Traffic Redirect ................. 456 Figure 257 Menu 6.3: Route Failover ..................
Page 34 ZyWALL 35 User’s Guide Figure 294 Outgoing Packet Filtering Process ..............493 Figure 295 Filter Rule Process .................... 495 Figure 296 Menu 21: Filter and Firewall Setup ..............496 Figure 297 Menu 21.1: Filter Set Configuration ..............496 Figure 298 Menu 21.1.1.1: TCP/IP Filter Rule ..............498 Figure 299 Executing an IP Filter ..................
Page 35 ZyWALL 35 User’s Guide Figure 337 Menu 24.7.2 As Seen Using the Console Port ..........535 Figure 338 Example Xmodem Upload ................535 Figure 339 Command Mode in Menu 24 ................537 Figure 340 Valid Commands ....................538 Figure 341 Call Control ....................... 539 Figure 342 Budget Management ..................
Page 36 ZyWALL 35 User’s Guide Figure 16 Macintosh OS X: Apple Menu ................591 Figure 17 Macintosh OS X: Network ................... 592 Figure 18 Single-Computer per Router Hardware Configuration ........602 Figure 19 ZyWALL as a PPPoE Client ................602 Figure 20 Transport PPP frames over Ethernet ..............603 Figure 21 PPTP Protocol Overview ..................
Page 37 ZyWALL 35 User’s Guide Figure 59 CA Certificate Example ..................649 Figure 60 Personal Certificate Import Wizard 1 ..............650 Figure 61 Personal Certificate Import Wizard 2 ..............650 Figure 62 Personal Certificate Import Wizard 3 ..............651 Figure 63 Personal Certificate Import Wizard 4 ..............651 Figure 64 Personal Certificate Import Wizard 5 ..............
Page 38 ZyWALL 35 User’s Guide...
Page 39 ZyWALL 35 User’s Guide List of Tables Table 1 Front Panel LEDs ....................55 Table 2 Web Configurator HOME Screen in Router Mode ..........61 Table 3 Web Configurator HOME Screen in Bridge Mode ..........63 Table 4 Bridge and Router Mode Features Comparison ............ 64 Table 5 Screens Summary ....................
Page 40 ZyWALL 35 User’s Guide Table 37 Least Load First: Example 2 ................131 Table 38 General ........................ 134 Table 39 Load Balancing: Least Load First ................ 136 Table 40 Load Balancing: Weighted Round Robin ............. 137 Table 41 Load Balancing: Spillover ..................138 Table 42 WAN: Ethernet Encapsulation ................
Page 41 ZyWALL 35 User’s Guide Table 80 VPN: Global Setting ..................... 261 Table 81 Telecommuters Sharing One VPN Rule Example ..........262 Table 82 Telecommuters Using Unique VPN Rules Example ..........263 Table 83 My Certificates ..................... 267 Table 84 My Certificate Import ................... 270 Table 85 My Certificate Create ...................
Page 42 ZyWALL 35 User’s Guide Table 123 DNS Cache ......................346 Table 124 DNS LAN ......................347 Table 125 DDNS ........................ 349 Table 126 WWW ........................ 354 Table 127 SSH ........................362 Table 128 Telnet ......................... 366 Table 129 FTP ........................367 Table 130 SNMP Traps ......................
Page 43 ZyWALL 35 User’s Guide Table 166 Menu 11.3.1: Remote Node PPP Options ............433 Table 167 Menu 11.3.2: Remote Node Network Layer Options ......... 434 Table 168 Menu 11.3.3: Remote Node Script ..............437 Table 169 Menu 3.2: DHCP Ethernet Setup Fields ............441 Table 170 Menu 3.2: LAN TCP/IP Setup Fields ..............
Page 44 ZyWALL 35 User’s Guide Table 209 Menu 25: Sample IP Routing Policy Summary ..........549 Table 210 IP Routing Policy Setup ..................550 Table 211 Menu 25.1: IP Routing Policy Setup ..............551 Table 212 Menu 25.1.1: IP Routing Policy Setup ............... 553 Table 213 Schedule Set Setup ...................
Page 45 ZyWALL 35 User’s Guide Table 32 Certificates Commands ..................667 Table 33 Brute-Force Password Guessing Protection Commands ........671 Table 34 System Maintenance Logs .................. 675 Table 35 System Error Logs ....................676 Table 36 Access Control Logs .................... 677 Table 37 TCP Reset Logs ....................
Page 46 ZyWALL 35 User’s Guide...
Page 47: Preface
Help us help you! E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan. Thank you!
Page 48: Syntax Conventions
ZyWALL 35 User’s Guide Syntax Conventions • “Enter” means for you to type one or more characters. “Select” or “Choose” means for you to use one predefined choices. • The SMT menu titles and labels are in Bold Times New Roman font. Predefined field choices are in Bold Arial font.
Page 49: Getting To Know Your Zywall
This chapter introduces the main features and applications of the ZyWALL. ZyWALL 35 Internet Security Appliance Overview The ZyWALL 35 Internet security gateway is designed for medium sized business that need the increased throughput and reliability of dual WAN ports and load balancing. The ZyWALL is loaded with security features including VPN, firewall, content filtering, and certificates.
Page 50: Dial Backup Wan
ZyWALL 35 User’s Guide DMZ Ports Public servers (Web, FTP, etc.) attached to a DeMilitarized Zone (DMZ) port are visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death) and can also be accessed from the secure LAN.
Page 51: Non-Physical Features
ZyWALL 35 User’s Guide IEEE 802.11 b/g Wireless LAN The optional wireless LAN card provides mobility and a fast network environment for small and home offices. Users can connect to the local area network without any wiring efforts and enjoy reliable high-speed connectivity.
Page 52 ZyWALL 35 User’s Guide Certificates The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. Certificates provide a way to exchange public keys for use in authentication. The ZyWALL uses the SSH (Secure Shell) secure communication protocol to provide secure encrypted communication between two hosts over an unsecured network.
Page 53: Wireless Lan Mac Address Filtering
ZyWALL 35 User’s Guide IEEE 802.1x for Network Security The ZyWALL supports the IEEE 802.1x standard that works with the IEEE 802.11 to enhance user authentication. With the local user profile, the ZyWALL allows you to configure up 32 user profiles without a network authentication server. In addition, centralized user and accounting management is possible on an optional network authentication server.
Page 54: Dynamic Dns Support
ZyWALL 35 User’s Guide Dynamic DNS Support With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider.
Page 55: Traffic Redirect
ZyWALL 35 User’s Guide Traffic Redirect Traffic Redirect forwards WAN traffic to a backup gateway on the LAN when the ZyWALL cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails. Port Forwarding Use this feature to forward incoming service requests to a server on your local network.
Page 56: Applications For The Zywall
ZyWALL 35 User’s Guide Embedded FTP and TFTP Servers The ZyWALL’s embedded FTP and TFTP Servers enable fast firmware upgrades as well as configuration file backups and restoration. 1.3 Applications for the ZyWALL Here are some examples of what you can do with your ZyWALL.
Page 57: Front Panel Leds
ZyWALL 35 User’s Guide Figure 2 VPN Application 1.3.3 Front Panel LEDs Figure 3 ZyWALL Front Panel The following table describes the LEDs. Table 1 Front Panel LEDs COLOR STATUS DESCRIPTION The ZyWALL is turned off. Green The ZyWALL is turned on.
Page 58 ZyWALL 35 User’s Guide Table 1 Front Panel LEDs (continued) COLOR STATUS DESCRIPTION Green The ZyWALL is not ready or has failed. The ZyWALL is ready and running. Flashing The ZyWALL is restarting. Green The backup port is not connected.
Page 59: Introducing The Web Configurator
ZyWALL 35 User’s Guide H A P T E R Introducing the Web Configurator This chapter describes how to access the ZyWALL web configurator and provides an overview of its screens. 2.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy ZyWALL setup and management via Internet browser.
Page 60: Resetting The Zywall
ZyWALL 35 User’s Guide Figure 4 Change Password Screen 6 Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Note: If you do not replace the default certificate here or in the CERTIFICATES screen, this screen displays every time you access the web configurator.
Page 61: Procedure To Use The Reset Button
ZyWALL 35 User’s Guide 2.3.1 Procedure To Use The Reset Button Make sure the SYS LED is on (not blinking) before you begin this procedure. 1 Press the RESET button for ten seconds, and then release it. If the SYS LED begins to blink, the defaults have been restored and the ZyWALL restarts.
Page 62: Navigating The Zywall Web Configurator
ZyWALL 35 User’s Guide 2.4 Navigating the ZyWALL Web Configurator The following summarizes how to navigate the web configurator from the HOME screen. Note: Follow the instructions you see in the HOME screen or click the icon (located in the top right corner of most screens) to view online help.
Page 63: Table 2 Web Configurator Home Screen In Router Mode
ZyWALL 35 User’s Guide Click MAINTENANCE to view information about your ZyWALL or upgrade configuration/ firmware files. Maintenance includes General, Password, Time and Date, Device Mode, F/ W (firmware) Upload, Configuration (Backup, Restore, Default), and Restart. The following table describes the labels in this screen.
Page 64: Bridge Mode
ZyWALL 35 User’s Guide Table 2 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Interface This is the port type. Port types are: WAN1, WAN2, Dial Backup, LAN, WLAN and DMZ. Click "+" to expand or "-" to collapse the LAN and DMZ IP alias drop-down lists.
Page 65: Figure 8 Web Configurator Home Screen In Bridge Mode
ZyWALL 35 User’s Guide Figure 8 Web Configurator HOME Screen in Bridge Mode The following table describes the labels not previously discussed (Table 2 on page 61). Table 3 Web Configurator HOME Screen in Bridge Mode LABEL DESCRIPTION Network Status IP Address This is the IP address of your ZyWALL in dotted decimal notation.
Page 66: Navigation Panel
ZyWALL 35 User’s Guide Table 3 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION Bridge Port This is the port type. Port types are: WAN1, WAN2, LAN, WLAN and DMZ. Port Status For the WAN, LAN, and DMZ ports, this displays the port speed and duplex setting.
Page 67: Table 5 Screens Summary
ZyWALL 35 User’s Guide Table 4 Bridge and Router Mode Features Comparison FEATURE BRIDGE MODE ROUTER MODE Remote Management UPnP Logs Maintenance Table Key: An O in a mode’s column shows that the device mode has the specified feature. The information in this table was correct at the time of writing, although it may be subject to change.
Page 68 ZyWALL 35 User’s Guide Table 5 Screens Summary (continued) LINK FUNCTION Anti-Probing Use this screen to change your anti-probing settings. Threshold Use this screen to configure the threshold for DoS attacks. CONTENT General This screen allows you to enable content filtering and block certain FILTER web features.
Page 69: System Statistics
ZyWALL 35 User’s Guide Table 5 Screens Summary (continued) LINK FUNCTION REMOTE MGMT WWW Use this screen to configure through which interface(s) and from which IP address(es) users can use HTTPS or HTTP to manage the ZyWALL. Use this screen to configure through which interface(s) and from which IP address(es) users can use Secure Shell to manage the ZyWALL.
Page 70: Show Statistics: Line Chart
ZyWALL 35 User’s Guide Figure 9 Home : Show Statistics The following table describes the labels in this screen. Table 6 Home : Show Statistics LABEL DESCRIPTION Click the icon to display the chart of throughput statistics. Port This is the WAN1, WAN2, Dial Backup, LAN, DMZ or WLAN port.
Page 71: Dhcp Table Screen
ZyWALL 35 User’s Guide Figure 10 Home : Show Statistics: Line Chart The following table describes the labels in this screen. Table 7 Home : Show Statistics: Line Chart LABEL DESCRIPTION Click the icon to go back to the Show Statistics screen.
Page 72: Vpn Status
ZyWALL 35 User’s Guide Figure 11 Home : DHCP Table The following table describes the labels in this screen. Table 8 Home : DHCP Table LABEL DESCRIPTION This is the index number of the host computer. IP Address This field displays the IP address relative to the # field listed above.
Page 73: Figure 12 Home : Vpn Status
ZyWALL 35 User’s Guide Figure 12 Home : VPN Status The following table describes the labels in this screen. Table 9 Home : VPN Status LABEL DESCRIPTION This is the security association index number. Name This field displays the identification name for this VPN policy.
Page 74 ZyWALL 35 User’s Guide Chapter 2 Introducing the Web Configurator...
Page 75: Wizard Setup
ZyWALL 35 User’s Guide H A P T E R Wizard Setup This chapter provides information on the Wizard Setup screens in the web configurator. This chapter is only applicable when the ZyWALL is in router mode. 3.1 Wizard Setup Overview The web configurator's setup wizards help you configure WAN1 on the ZyWALL to access the Internet and edit VPN policies and configure IKE settings to establish a VPN tunnel.
Page 76: Figure 13 Isp Parameters : Ethernet Encapsulation
ZyWALL 35 User’s Guide Figure 13 ISP Parameters : Ethernet Encapsulation The following table describes the labels in this screen. Table 10 ISP Parameters : Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 77: Pppoe Encapsulation
ZyWALL 35 User’s Guide Table 10 ISP Parameters : Ethernet Encapsulation LABEL DESCRIPTION First DNS Server Enter the DNS server's IP address(es) in the field(s) to the right. Second DNS Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not...
Page 78: Pptp Encapsulation
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 11 ISP Parameters : PPPoE Encapsulation LABEL DESCRIPTION ISP Parameter for Internet Access Encapsulation Choose an encapsulation method from the pull-down list box. PPP over Ethernet forms a dial-up connection.
Page 79: Figure 15 Isp Parameters : Pptp Encapsulation
ZyWALL 35 User’s Guide Figure 15 ISP Parameters : PPTP Encapsulation The following table describes the labels in this screen. Table 12 ISP Parameters : PPTP Encapsulation ESCRIPTION LABEL ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down list box. To configure a PPTP client, you must configure the User Name and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 80: Internet Access Wizard Setup Complete
ZyWALL 35 User’s Guide Table 12 ISP Parameters : PPTP Encapsulation ESCRIPTION LABEL My IP Subnet Mask Type the subnet mask assigned to you by your ISP (if given). Server IP Address Type the IP address of the PPTP server.
Page 81: Vpn Wizard
ZyWALL 35 User’s Guide 3.3 VPN Wizard Use the VPN wizard screens to configure a VPN rule that use a pre-shared key. If you want to set the rule to use a certificate, please go to the VPN screens for configuration.
Page 82: Network Setting
ZyWALL 35 User’s Guide Table 13 VPN Wizard : Gateway Setting LABEL DESCRIPTION My ZyWALL Enter the WAN IP address or the domain name of your ZyWALL or leave the field set to 0.0.0.0. The following applies if the My ZyWALL field is configured as 0.0.0.0: •...
Page 83: Figure 18 Vpn Wizard : Network Setting
ZyWALL 35 User’s Guide Figure 18 VPN Wizard : Network Setting The following table describes the labels in this screen. Table 14 VPN Wizard : Network Setting LABEL DESCRIPTION Network Policy Property Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 84: Ike Tunnel Setting (Ike Phase 1)
ZyWALL 35 User’s Guide Table 14 VPN Wizard : Network Setting LABEL DESCRIPTION Ending IP When the Local Network field is configured to Single, this field is N/A. When the Address/ Local Network field is configured to Range IP, enter the end (static) IP address, in a Subnet Mask range of computers on the LAN behind your ZyWALL.
Page 85: Table 15 Vpn Wizard : Ike Tunnel Setting
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 15 VPN Wizard : IKE Tunnel Setting LABEL DESCRIPTION Negotiation Mode Use the radio buttons to select Main Mode or Aggressive Mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode.
Page 86: Ipsec Setting (Ike Phase 2)
ZyWALL 35 User’s Guide 3.3.3 IPSec Setting (IKE Phase 2) Figure 20 VPN Wizard : IPSec Setting The following table describes the labels in this screen. Table 16 VPN Wizard : IPSec Setting LABEL DESCRIPTION Encapsulation Mode Select Tunnel mode or Transport mode.
Page 87: Vpn Status Summary
ZyWALL 35 User’s Guide Table 16 VPN Wizard : IPSec Setting (continued) LABEL DESCRIPTION Perfect Forward Perfect Forward Secret (PFS) is disabled (None) by default in phase 2 IPSec Secret (PFS) SA setup. This allows faster IPSec setup, but is not so secure.
Page 88: Table 17 Vpn Wizard : Vpn Status
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 17 VPN Wizard : VPN Status LABEL DESCRIPTION Gateway Policy Property Name This is the name of this VPN gateway policy. Gateway Policy Setting My ZyWALL This is the WAN IP address or the domain name of your ZyWALL.
Page 89: Vpn Wizard Setup Complete
ZyWALL 35 User’s Guide Table 17 VPN Wizard : VPN Status (continued) LABEL DESCRIPTION IPSec Protocol ESP or AH are the security protocols used for an SA. Encryption Algorithm This is the method of data encryption. Options can be DES, 3DES, AES or NULL.
Page 90 ZyWALL 35 User’s Guide Chapter 3 Wizard Setup...
Page 91: Chapter 4 Lan Screens
ZyWALL 35 User’s Guide H A P T E R LAN Screens This chapter describes how to configure LAN settings. This chapter is only applicable when the ZyWALL is in router mode. 4.1 LAN Overview Local Area Network (LAN) is a shared communication system to which many computers are attached.
Page 92: Ip Address And Subnet Mask
ZyWALL 35 User’s Guide These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), read the embedded web configurator help regarding what fields need to be configured. 4.3.2 IP Address and Subnet Mask Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.
Page 93: Multicast
ZyWALL 35 User’s Guide Both RIP-2B and RIP-2M send routing data in RIP-2 format; the difference being that RIP- 2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets.
Page 94: Figure 23 Lan
ZyWALL 35 User’s Guide Figure 23 LAN The following table describes the labels in this screen. Table 18 LAN LABEL DESCRIPTION LAN TCP/IP IP Address Type the IP address of your ZyWALL in dotted decimal notation. 192.168.1.1 is the factory default. Alternatively, click the right mouse button to copy and/or paste the IP address.
Page 95: Configuring Static Dhcp
ZyWALL 35 User’s Guide Table 18 LAN (continued) LABEL DESCRIPTION Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use.
Page 96: Configuring Ip Alias
ZyWALL 35 User’s Guide Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02. To change your ZyWALL’s static DHCP settings, click LAN, then the Static DHCP tab. The screen appears as shown (some of the screen’s blank rows are not shown).
Page 97: Figure 25 Physical Network & Partitioned Logical Networks
ZyWALL 35 User’s Guide When you use IP alias, you can also configure firewall rules to control access between the LAN's logical networks (subnets). Note: Make sure that the subnets of the logical networks do not overlap. The following figure shows a LAN divided into subnets A, B, and C.
Page 98: Configuring Port Roles
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 20 IP Alias LABEL DESCRIPTION Enable IP Alias 1, Select the check box to configure another LAN network for the ZyWALL. IP Address Enter the IP address of your ZyWALL' in dotted decimal notation.
Page 99: Figure 27 Port Roles
ZyWALL 35 User’s Guide Figure 27 Port Roles After you change the LAN/DMZ port roles and click Apply, please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen. Figure 28 Port Roles Change Complete...
Page 100 ZyWALL 35 User’s Guide Chapter 4 LAN Screens...
Page 101: Chapter 5 Bridge Screens
ZyWALL 35 User’s Guide H A P T E R Bridge Screens This chapter describes how to configure bridge settings. This chapter is only applicable when the ZyWALL is in bridge mode. 5.1 Bridge Loop The ZyWALL can act as a bridge between a switch and a wired LAN or between two routers.
Page 102: Rapid Stp
ZyWALL 35 User’s Guide 5.2.1 Rapid STP The ZyWALL uses IEEE 802.1w RSTP (Rapid Spanning Tree Protocol) that allow faster convergence of the spanning tree (while also being backwards compatible with STP-only aware bridges). Using RSTP topology change information does not have to propagate to the root bridge and unwanted learned addresses are flushed from the filtering database.
Page 103: Stp Port States
ZyWALL 35 User’s Guide Once a stable network topology has been established, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) transmitted from the root bridge. If a bridge does not get a Hello BPDU after a predefined interval (Max Age), the bridge assumes that the link to the root bridge is down.
Page 104: Figure 30 Bridge
ZyWALL 35 User’s Guide Figure 30 Bridge The following table describes the labels in this screen. Table 23 Bridge LABEL DESCRIPTION Bridge Setup IP Address Type the IP address of your ZyWALL in dotted decimal notation. IP Subnet Mask The subnet mask specifies the network number portion of an IP address.
Page 105: Configuring Port Roles
ZyWALL 35 User’s Guide Table 23 Bridge (continued) LABEL DESCRIPTION Rapid Spanning Tree Protocol Setup Enable Rapid Spanning Select the check box to activate RSTP on the ZyWALL. Tree Protocol Bridge Priority Enter a number between 0 and 61440 as bridge priority of the ZyWALL. 0 is the highest.
Page 106 ZyWALL 35 User’s Guide Chapter 5 Bridge Screens...
Page 107: Chapter 6 Wireless Lan
ZyWALL 35 User’s Guide H A P T E R Wireless LAN This chapter discusses how to configure Wireless LAN on the ZyWALL. 6.1 Introduction A wireless LAN can be as simple as two computers with wireless LAN adapters communicating in a peer-to-peer network or as complex as a number of computers with wireless LAN adapters communicating through access points which bridge network traffic to the wired LAN.
Page 108: Encryption
ZyWALL 35 User’s Guide Figure 31 ZyWALL Wireless Security Levels If you do not enable any wireless security on your ZyWALL, your network is accessible to any wireless networking device that is within range. Use the ZyWALL web configurator to set up your wireless LAN security settings. Refer to the chapter on using the ZyWALL web configurator to see how to access the web configurator.
Page 109: Restricted Access
ZyWALL 35 User’s Guide 6.2.3 Restricted Access The MAC Filter screen allows you to configure the AP to give exclusive access to devices (Allow Association) or exclude them from accessing the AP (Deny Association). 6.2.4 Hide ZyWALL Identity If you hide the ESSID, then the ZyWALL cannot be seen when a wireless client scans for local APs.
Page 110: Wep Encryption
ZyWALL 35 User’s Guide 6.4 WEP Encryption WEP (Wired Equivalent Privacy) as specified in the IEEE 802.11 standard provides methods for both data encryption and wireless station authentication. WEP provides a mechanism for encrypting data using encryption keys. Both the AP and the wireless stations must use the same WEP key to encrypt and decrypt data.
Page 111: Eap Authentication Overview
ZyWALL 35 User’s Guide Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: •...
Page 112: Dynamic Wep Key Exchange
ZyWALL 35 User’s Guide • The wireless station replies with identity information, including username and password. • The RADIUS server checks the user information against its user profile database and determines whether or not to authenticate the wireless station. 6.6 Dynamic WEP Key Exchange The AP maps a unique key that is generated with the RADIUS server.
Page 113: Encryption
ZyWALL 35 User’s Guide 6.7.2 Encryption WPA improves data encryption by using Temporal Key Integrity Protocol (TKIP), Message Integrity Check (MIC) and IEEE 802.1x. Temporal Key Integrity Protocol (TKIP) uses 128-bit keys that are dynamically generated and distributed by the authentication server. It includes a per-packet key mixing function, a Message Integrity Check (MIC) named Michael, an extended initialization vector (IV) with sequencing rules, and a re-keying mechanism.
Page 114: Wpa With Radius Application Example
ZyWALL 35 User’s Guide Figure 33 WPA-PSK Authentication 6.9 WPA with RADIUS Application Example You need the IP address of the RADIUS server, its port number (default is 1812), and the RADIUS shared secret. A WPA application example with an external RADIUS server looks as follows.
Page 115: Wireless Client Wpa Supplicants
ZyWALL 35 User’s Guide Figure 34 WPA with RADIUS Application Example 6.10 Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA. At the time of writing, the most widely available supplicants are the WPA patch for Windows XP, Funk Software's Odyssey client, and Meetinghouse Data Communications' AEGIS client.
Page 116: Figure 35 Wireless: No Security
ZyWALL 35 User’s Guide Figure 35 Wireless: No Security The following table describes the labels in this screen. Table 25 Wireless: No Security LABEL DESCRIPTION Enable The wireless LAN is turned off by default, before you enable the wireless LAN you Wireless LAN should configure some security by setting MAC filters and/or 802.1x security;...
Page 117: Static Wep
ZyWALL 35 User’s Guide Table 25 Wireless: No Security (continued) LABEL DESCRIPTION Fragmentation This is the threshold (number of bytes) for the fragmentation boundary for directed Threshold messages. It is the maximum data fragment size that can be sent. Select the check box to change the default value and enter a value between 256 and 2432.
Page 118: Wpa-Psk
ZyWALL 35 User’s Guide Figure 36 Wireless: Static WEP The following table describes the wireless LAN security labels in this screen. Table 26 Wireless: Static WEP LABEL DESCRIPTION Security Select Static WEP from the drop-down list. WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized Encryption wireless stations from accessing data transmitted over the wireless network.
Page 119: Figure 37 Wireless: Wpa-Psk
ZyWALL 35 User’s Guide Figure 37 Wireless: WPA-PSK The following wireless LAN security fields become available when you select WPA-PSK in the Security drop down list-box. Table 27 Wireless: WPA-PSK LABEL DESCRIPTION Security Select WPA-PSK from the drop-down list. Pre-Shared Key The encryption mechanisms used for WPA and WPA-PSK are the same.
Page 120: Wpa
ZyWALL 35 User’s Guide 6.11.3 WPA Select WPA from the Security list. Figure 38 Wireless: WPA The following wireless LAN security fields become available when you select WPA in the Security drop down list-box. Table 28 Wireless: WPA LABEL DESCRIPTION Security Select WPA from the drop-down list.
Page 121: Dynamic Wep
ZyWALL 35 User’s Guide Table 28 Wireless: WPA (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 6.11.4 802.1x + Dynamic WEP Select 802.1x + Dynamic WEP from the Security list.
Page 122: Static Wep
ZyWALL 35 User’s Guide Table 29 Wireless: 802.1x + Dynamic WEP LABEL DESCRIPTION Authentication Click Local User to go to the Local User Database screen where you can view Databases and/or edit the list of users and passwords. Click RADIUS to go to the RADIUS screen where you can configure the ZyWALL to check an external RADIUS server.
Page 123: No Wep
ZyWALL 35 User’s Guide The following wireless LAN security fields become available when you select 802.1x + Static WEP in the Security drop down list-box.. Table 30 Wireless: 802.1x + Static WEP LABEL DESCRIPTION Security Select 802.1x + Static WEP from the drop-down list.
Page 124: No Access 802.1X + Static Wep
ZyWALL 35 User’s Guide Figure 41 Wireless: 802.1x + No WEP The following table describes the wireless LAN security labels in this screen. Table 31 Wireless: 802.1x + No WEP LABEL DESCRIPTION Security Select 802.1x + No WEP from the drop-down list.
Page 125: Figure 42 Wireless: No Access 802.1X + Static Wep
ZyWALL 35 User’s Guide Figure 42 Wireless: No Access 802.1x + Static WEP The following wireless LAN security fields become available when you select No Access 802.1x + Static WEP in the Security drop down list-box. Table 32 Wireless: No Access 802.1x + Static WEP...
Page 126: No Access 802.1X + No Wep
ZyWALL 35 User’s Guide 6.11.8 No Access 802.1x + No WEP Select No Access 802.1x + No WEP to deny all wireless stations access to your wired network and block all wireless stations from communicating with the ZyWALL. 6.12 Configuring MAC Filter...
Page 127: Table 33 Mac Address Filter
ZyWALL 35 User’s Guide The following table describes the labels in this menu. Table 33 MAC Address Filter LABEL DESCRIPTION Active Select or clear the check box to enable or disable MAC address filtering. Enable MAC address filtering to have the router allow or deny access to wireless stations based on MAC addresses.
Page 128 ZyWALL 35 User’s Guide Chapter 6 Wireless LAN...
Page 129: Chapter 7 Wan Screens
ZyWALL 35 User’s Guide H A P T E R WAN Screens This chapter describes how to configure WAN settings. 7.1 WAN Overview A WAN connection is an outside connection to another network or the Internet. 7.1.1 WAN IP Address Assignment Every computer on the Internet must have a unique IP address.
Page 130: Wan Mac Address
ZyWALL 35 User’s Guide 1 The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server fields.
Page 131: Load Balancing Introduction
ZyWALL 35 User’s Guide You can use policy routing to specify the WAN port that specific services go through. An ISP may give traffic from certain (more expensive) connections priority over the traffic from other accounts. You could route delay intolerant traffic (like voice over IP calls) through this kind of connection.
Page 132: Least Load First
ZyWALL 35 User’s Guide 7.4.1 Least Load First The least load first algorithm uses the current (or recent) outbound and/or inbound bandwidth utilization of each WAN interface as the load balancing index(es) when making decisions about to which WAN interface a new LAN-originated session is to be distributed. The...
Page 133: Weighted Round Robin
ZyWALL 35 User’s Guide Since WAN 1 has a smaller load balancing index (meaning that it is less utilized than WAN 2), the ZyWALL will send the next new session traffic through WAN 1. Table 37 Least Load First: Example 2...
Page 134: Tcp/Ip Priority (Metric)
ZyWALL 35 User’s Guide In the following example figure, the upper threshold of the primary WAN interface is set to 800K. The ZyWALL sends network traffic of new sessions that exceeds this limit to the secondary WAN interface. Figure 46 Spillover Algorithm Example 7.5 TCP/IP Priority (Metric)
Page 135: Figure 47 General
ZyWALL 35 User’s Guide Figure 47 General Chapter 7 WAN Screens...
Page 136: Table 38 General
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 38 General LABEL DESCRIPTION Active/Passive Select the Active/Passive (fail over) operation mode to have the ZyWALL use the (Fail Over) Mode second highest priority WAN port as a back up. This means that the ZyWALL will normally use the highest priority (primary) WAN port (depending on the priorities you configure in the Route Priority fields).
Page 137: Configuring Load Balancing
ZyWALL 35 User’s Guide Table 38 General (continued) LABEL DESCRIPTION Check WAN1/2 Select the check box to have the ZyWALL periodically test the respective WAN Connectivity port's connection. Select Ping Default Gateway to have the ZyWALL ping the WAN port's default gateway IP address.
Page 138: Weighted Round Robin
ZyWALL 35 User’s Guide Figure 48 Load Balancing: Least Load First The following table describes the related fields in this screen. Table 39 Load Balancing: Least Load First LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on the Mode ZyWALL.
Page 139: Spillover
ZyWALL 35 User’s Guide Figure 49 Load Balancing: Weighted Round Robin The following table describes the related fields in this screen. Table 40 Load Balancing: Weighted Round Robin LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on the Mode ZyWALL.
Page 140: Configuring Wan Setup
ZyWALL 35 User’s Guide Figure 50 Load Balancing: Spillover The following table describes the related fields in this screen. Table 41 Load Balancing: Spillover LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on the Mode ZyWALL.
Page 141: Figure 51 Wan: Ethernet Encapsulation
ZyWALL 35 User’s Guide Figure 51 WAN: Ethernet Encapsulation The following table describes the labels in this screen. Table 42 WAN: Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 142 ZyWALL 35 User’s Guide Table 42 WAN: Ethernet Encapsulation (continued) LABEL DESCRIPTION Retype to Confirm Type your password again to make sure that you have entered is correctly. Login Server IP Type the authentication server IP address here if your ISP gave you one.
Page 143: Pppoe Encapsulation
ZyWALL 35 User’s Guide Table 42 WAN: Ethernet Encapsulation (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). Choose RIP-1, RIP-2B or RIP-2M.
Page 144: Figure 52 Wan: Pppoe Encapsulation
ZyWALL 35 User’s Guide create and offer new IP services for individuals. Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no specific configuration of the broadband modem at the customer site. By implementing PPPoE directly on the ZyWALL (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyWALL does that part of the task.
Page 145: Table 43 Wan: Pppoe Encapsulation
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 43 WAN: PPPoE Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation The PPPoE choice is for a dial-up connection using PPPoE. The router supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (i.e.
Page 146 ZyWALL 35 User’s Guide Table 43 WAN: PPPoE Encapsulation LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Choose Both, None, In Only or Out Only.
Page 147: Pptp Encapsulation
ZyWALL 35 User’s Guide 7.8.3 PPTP Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet.
Page 148: Table 44 Wan: Pptp Encapsulation
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 44 WAN: PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks.
Page 149 ZyWALL 35 User’s Guide Table 44 WAN: PPTP Encapsulation LABEL DESCRIPTION Enable NAT Network Address Translation (NAT) allows the translation of an Internet protocol (Network Address address used within one network (for example a private IP address used in a local...
Page 150: Traffic Redirect
ZyWALL 35 User’s Guide 7.9 Traffic Redirect Traffic redirect forwards WAN traffic to a backup gateway when the ZyWALL cannot connect to the Internet through its normal gateway. Connect the backup gateway on the WAN so that the ZyWALL still provides firewall protection.
Page 151: Configuring Dial Backup
ZyWALL 35 User’s Guide Figure 56 Traffic Redirect The following table describes the labels in this screen. Table 45 Traffic Redirect LABEL DESCRIPTION Active Select this check box to have the ZyWALL use traffic redirect if the normal WAN connection goes down.
Page 152: Figure 57 Dial Backup Setup
ZyWALL 35 User’s Guide Figure 57 Dial Backup Setup Chapter 7 WAN Screens...
Page 153: Table 46 Dial Backup Setup
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 46 Dial Backup Setup LABEL DESCRIPTION Dial Backup Setup Enable Dial Backup Select this check box to turn on dial backup. Basic Settings Login Name Type the login name assigned by your ISP.
Page 154 ZyWALL 35 User’s Guide Table 46 Dial Backup Setup (continued) LABEL DESCRIPTION Enable RIP Select this check box to turn on RIP (Routing Information Protocol), which allows a router to exchange routing information with other routers. RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving).
Page 155: Advanced Modem Setup
ZyWALL 35 User’s Guide Table 46 Dial Backup Setup (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 7.12 Advanced Modem Setup 7.12.1 AT Command Strings For regular telephone lines, the default Dial string tells the modem that the line uses tone dialing.
Page 156: Figure 58 Advanced Setup
ZyWALL 35 User’s Guide Figure 58 Advanced Setup The following table describes the labels in this screen. Table 47 Advanced Setup LABEL DESCRIPTION AT Command Strings Dial Type the AT Command string to make a call. Drop Type the AT Command string to drop a call. "~" represents a one second wait, for example, "~~~+++~~ath"...
Page 157 ZyWALL 35 User’s Guide Table 47 Advanced Setup (continued) LABEL DESCRIPTION Dial Timeout (sec) Type a number of seconds for the ZyWALL to try to set up an outgoing call before timing out (stopping). Retry Count Type a number of times for the ZyWALL to retry a busy or no-answer phone number before blacklisting the number.
Page 158 ZyWALL 35 User’s Guide Chapter 7 WAN Screens...
Page 159: Chapter 8 Dmz Screens
ZyWALL 35 User’s Guide H A P T E R DMZ Screens This chapter describes how to configure the ZyWALL’s DMZ. 8.1 DMZ Overview The DeMilitarized Zone (DMZ) auto-negotiating 10/100 Mbps Ethernet port provides a way for public servers (Web, e-mail, FTP, etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death).
Page 160: Figure 59 Dmz
ZyWALL 35 User’s Guide From the main menu, click DMZ. The screen appears as shown next. Figure 59 DMZ The following table describes the labels in this screen. Table 48 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address Type the IP address of your ZyWALL’s DMZ port in dotted decimal notation.
Page 161: Configuring Ip Alias
ZyWALL 35 User’s Guide Table 48 DMZ (continued) LABEL DESCRIPTION Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use.
Page 162: Figure 60 Ip Alias
ZyWALL 35 User’s Guide Figure 60 IP Alias The following table describes the labels in this screen. Table 49 IP Alias LABEL DESCRIPTION Enable IP Alias 1, Select the check box to configure another DMZ network for the ZyWALL. IP Address Enter the IP address of your ZyWALL in dotted decimal notation.
Page 163: Dmz Public Ip Address Example
ZyWALL 35 User’s Guide Table 49 IP Alias (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Page 164: Dmz Private And Public Ip Address Example
ZyWALL 35 User’s Guide 8.5 DMZ Private and Public IP Address Example The following figure shows a network setup with both private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected computers (A through C) use private IP addresses that are in one subnet.
Page 165: Figure 63 Port Roles
ZyWALL 35 User’s Guide Click DMZ, then Port Roles. The screen appears as shown. Figure 63 Port Roles After you change the LAN/DMZ port roles and click Apply, please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen.
Page 166 ZyWALL 35 User’s Guide Chapter 8 DMZ Screens...
Page 167: Chapter 9 Firewalls
ZyWALL 35 User’s Guide H A P T E R Firewalls This chapter gives some background information on firewalls and introduces the ZyWALL firewall. 9.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another.
Page 168: Stateful Inspection Firewalls
ZyWALL 35 User’s Guide 1 Information hiding prevents the names of internal systems from being made known via DNS to outside systems, since the application gateway is the only host whose name must be made known to outside systems. 2 Robust authentication and logging pre-authenticates application traffic before it reaches internal hosts and causes it to be logged more effectively than if it were logged with standard host logging.
Page 169: Denial Of Service
ZyWALL 35 User’s Guide Figure 65 ZyWALL Firewall Application 9.4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources.
Page 170: Types Of Dos Attacks
ZyWALL 35 User’s Guide 9.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data.
Page 171: Figure 67 Syn Flood
ZyWALL 35 User’s Guide response. While the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an internal timer (which is set at relatively long intervals) terminates the three-way handshake.
Page 172: Icmp Vulnerability
ZyWALL 35 User’s Guide Figure 68 Smurf Attack 9.4.2.1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 51 ICMP Commands That Trigger Alerts REDIRECT TIMESTAMP_REQUEST TIMESTAMP_REPLY ADDRESS_MASK_REQUEST ADDRESS_MASK_REPLY 9.4.2.2 Illegal Commands (NetBIOS and SMTP)
Page 173: Traceroute
ZyWALL 35 User’s Guide All SMTP commands are illegal except for those displayed in the following tables. Table 53 Legal SMTP Commands AUTH DATA EHLO ETRN EXPN HELO HELP MAIL NOOP QUIT RCPT RSET SAML SEND SOML TURN VRFY 9.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints.
Page 174: Stateful Inspection Process
ZyWALL 35 User’s Guide Figure 69 Stateful Inspection The previous figure shows the ZyWALL’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated from the WAN is blocked.
Page 175: Stateful Inspection And The Zywall
ZyWALL 35 User’s Guide temporary entries might be modified, in order to permit only packets that are valid for the current state of the connection. 8 Any additional inbound or outbound packets that belong to the connection are inspected to update the state table entry and to modify the temporary inbound access list entries as required, and are forwarded through the interface.
Page 176: Udp/Icmp Security
ZyWALL 35 User’s Guide If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the Internet. Assuming that this is an acceptable part of the security policy (as is the case with the default policy), the connection will be allowed. A cache entry is added which includes connection information such as IP addresses, TCP ports, sequence numbers, etc.
Page 177: Guidelines For Enhancing Security With Your Firewall
ZyWALL 35 User’s Guide Any protocol that operates in this way must be supported on a case-by-case basis. You can use the web configurator’s Custom Services feature to do this. 9.6 Guidelines For Enhancing Security With Your Firewall 1 Change the default password via SMT or web configurator.
Page 178: Firewall
ZyWALL 35 User’s Guide 9.7.2 Firewall • The firewall inspects packet contents as well as their source and destination addresses. Firewalls of this type employ an inspection module, applicable to all protocols, that understands data in the packet is intended for other layers, from the network layer (IP headers) up to the application layer.
Page 179: Chapter 10 Firewall Screens
ZyWALL 35 User’s Guide H A P T E R Firewall Screens This chapter shows you how to configure your ZyWALL firewall. 10.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your ZyWALL has to offer. For this reason, it is recommended that you configure your firewall using the web configurator.
Page 180: Rule Logic Overview
ZyWALL 35 User’s Guide This prevents computers on the WAN from using the ZyWALL as a gateway to communicate with other computers on the WAN and/or managing the ZyWALL. • DMZ to LAN • DMZ to DMZ/ZyWALL This prevents computers on the DMZ from communicating between networks or subnets connected to the DMZ interface and/or managing the ZyWALL.
Page 181: Security Ramifications
ZyWALL 35 User’s Guide 10.3.2 Security Ramifications Once the logic of the rule has been defined, it is critical to consider the security ramifications created by the rule: 1 Does this rule stop LAN users from accessing critical resources on the Internet? For...
Page 182: Lan To Wan Rules
ZyWALL 35 User’s Guide LAN to LAN/ZyWALL, WAN to WAN/ZyWALL and DMZ to DMZ/ZyWALL rules apply to packets coming in on the associated interface (LAN, WAN, or DMZ respectively). LAN to LAN/ZyWALL means policies for LAN-to-ZyWALL (the policies for managing the ZyWALL through the LAN interface) and policies for LAN-to-LAN (the policies that control routing between two subnets on the LAN).
Page 183: Alerts
ZyWALL 35 User’s Guide Figure 71 WAN to LAN Traffic 10.5 Alerts Alerts are reports on events, such as attacks, that you may want to know about right away. You can choose to generate an alert when a rule is matched in the Edit Rule screen (see...
Page 184: Figure 72 Default Rule (Router Mode)
ZyWALL 35 User’s Guide Figure 72 Default Rule (Router Mode) The following table describes the labels in this screen. Table 54 Default Rule (Router Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Page 185: Figure 73 Default Rule (Bridge Mode)
ZyWALL 35 User’s Guide Figure 73 Default Rule (Bridge Mode) The following table describes the labels in this screen. Table 55 Default Rule (Bridge Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Page 186: Rule Summary
ZyWALL 35 User’s Guide 10.6.1 Rule Summary Note: The ordering of your rules is very important as rules are applied in turn. Click FIREWALL, then the Rule Summary tab to open the screen. Figure 74 Rule Summary The following table describes the labels in this screen.
Page 187: Configuring Firewall Rules
ZyWALL 35 User’s Guide Table 56 Rule Summary LABEL DESCRIPTION Destination This drop-down list box displays the destination addresses or ranges of addresses to Address which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any.
Page 188: Figure 75 Creating/Editing A Firewall Rule
ZyWALL 35 User’s Guide Figure 75 Creating/Editing A Firewall Rule Chapter 10 Firewall Screens...
Page 189: Table 57 Creating/Editing A Firewall Rule
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 57 Creating/Editing A Firewall Rule LABEL DESCRIPTION Edit Source/ Destination Address Address Type Do you want your rule to apply to packets with a particular (single) IP, a range of IP addresses (e.g., 192.168.1.10 to 192.169.1.50), a subnet or any IP address?
Page 190: Configuring Custom Services
ZyWALL 35 User’s Guide Table 57 Creating/Editing A Firewall Rule LABEL DESCRIPTION Apply Click Apply to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. 10.6.3 Configuring Custom Services Configure customized ports for services not predefined by the ZyWALL (see Section 10.8 on...
Page 191: Figure 77 Rule Summary
ZyWALL 35 User’s Guide 1 Click the FIREWALL link and then the Rule Summary tab. Select WAN to LAN from the Packet Direction drop-down list box. Figure 77 Rule Summary 2 In the Rule Summary screen, type the index number for where you want to put the rule.
Page 192: Figure 78 Rule Edit Example
ZyWALL 35 User’s Guide Figure 78 Rule Edit Example 6 In the Edit Rule screen, click Add under Custom Service to open the Edit Custom Service screen. Configure it as follows and click Apply. Figure 79 Edit Custom Service Example 7 In the Edit Rule screen, use the arrows between Available Services and Selected Service(s) to configure it as follows.
Page 193: Figure 80 My Service Rule Configuration
ZyWALL 35 User’s Guide Figure 80 My Service Rule Configuration Chapter 10 Firewall Screens...
Page 194: Predefined Services
ZyWALL 35 User’s Guide Figure 81 My Service Example Rule Summary Rule 1: Allows a My Service connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN. 10.8 Predefined Services The Available Services list box in the Edit Rule screen (see...
Page 195 ZyWALL 35 User’s Guide Table 59 Predefined Services (continued) SERVICE DESCRIPTION FINGER(TCP:79) Finger is a UNIX or Internet related command that can be used to find out if a user is logged on. FTP(TCP:20.21) File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail.
Page 196: Anti-Probing
ZyWALL 35 User’s Guide Table 59 Predefined Services (continued) SERVICE DESCRIPTION RTELNET(TCP:107) Remote Telnet. RTSP(TCP/UDP:554) The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet. SFTP(TCP:115) Simple File Transfer Protocol. SIP-V2(UDP:5060) The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet.
Page 197: Dos Thresholds
ZyWALL 35 User’s Guide Click FIREWALL, then the Anti-Probing tab to open the screen. Figure 82 Anti-Probing The following table describes the labels in this screen. Table 60 Anti-Probing LABEL DESCRIPTION Respond to PING The ZyWALL does not respond to any incoming Ping requests when Disable is selected.
Page 198: Threshold Values
ZyWALL 35 User’s Guide 10.10.1 Threshold Values Tune these parameters when something is not working and after you have checked the firewall counters. These default values should work fine for normal small offices with ADSL bandwidth. Factors influencing choices for threshold values are: 1 The maximum number of opened sessions.
Page 199: Figure 83 Firewall Threshold
ZyWALL 35 User’s Guide Whenever the number of half-open sessions with the same destination host address rises above a threshold (TCP Maximum Incomplete), the ZyWALL starts deleting half-open sessions according to one of the following methods: 1 If the Blocking Time timeout is 0 (the default), then the ZyWALL deletes the oldest existing half-open session for the host for every new connection request to the host.
Page 200 ZyWALL 35 User’s Guide Table 61 Firewall Threshold (continued) LABEL DESCRIPTION One Minute High This is the rate of new half-open sessions that causes the firewall to start deleting half-open sessions. When the rate of new connection attempts rises above this number, the ZyWALL deletes half-open sessions as required to accommodate new connection attempts.
Page 201: Content Filtering Screens
ZyWALL 35 User’s Guide H A P T E R Content Filtering Screens This chapter provides an overview of content filtering. 11.1 Content Filtering Overview Content filtering allows you to block certain web features, such as Cookies, and/or restrict specific websites. With content filtering, you can do the following: 11.1.1 Restrict Web Features...
Page 202: Figure 84 Content Filter : General
ZyWALL 35 User’s Guide Figure 84 Content Filter : General The following table describes the labels in this screen. Table 62 Content Filter : General LABEL DESCRIPTION General Setup Enable Content Filter Select this check box to enable the content filter.
Page 203 ZyWALL 35 User’s Guide Table 62 Content Filter : General LABEL DESCRIPTION Cookies Cookies are files stored on a computer’s hard drive. Some web servers use them to track usage and provide service based on ID. Web Proxy A server that acts as an intermediary between a user and the Internet to provide security, administrative control, and caching service.
Page 204: Content Filtering With An External Database
ZyWALL 35 User’s Guide 11.3 Content Filtering with an External Database When you register for and enable external database content filtering, your ZyWALL accesses an external database that has millions of web sites categorized based on content. You can have the ZyWALL block, block and/or log access to web sites based on these categories.
Page 205: Figure 86 Content Filter : Categories
ZyWALL 35 User’s Guide Figure 86 Content Filter : Categories The following table describes the labels in this screen. Table 63 Content Filter : Categories LABEL DESCRIPTION Auto Category Setup Enable External Database Enable external database content filtering to have the ZyWALL check an...
Page 206 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Unrated Web Pages Select Block to prevent users from accessing web pages that the external database content filtering has not categorized. When the external database content filtering blocks access to a web...
Page 207 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Alcohol/Tobacco Selecting this category excludes pages that promote or offer the sale alcohol/tobacco products, or provide the means to create them. It also includes pages that glorify, tout, or otherwise encourage the consumption of alcohol/tobacco.
Page 208 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Education Selecting this category excludes pages that offer educational information, distance learning and trade school information or programs. It also includes pages that are sponsored by schools, educational facilities, faculty, or alumni groups.
Page 209 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION News/Media Selecting this category excludes pages that primarily report information or comments on current events or contemporary issues of the day. It also includes radio stations and magazines. It does not include pages that can be rated in other categories.
Page 210 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Humor/Jokes Selecting this category excludes pages that primarily focus on comedy, jokes, fun, etc. This may include pages containing jokes of adult or mature nature. Pages containing humorous Adult/Mature content also have an Adult/Mature category rating.
Page 211: Customization
ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Register Click Register to go to a web site where you can register for category- based content filtering (using an external database). You can use a trial application or register your iCard’s PIN.
Page 212: Figure 87 Content Filter : Customization
ZyWALL 35 User’s Guide Figure 87 Content Filter : Customization The following table describes the labels in this screen. Table 64 Content Filter : Customization LABEL DESCRIPTION Web Site List Customization Enable Web site Select this check box to allow trusted web sites and block forbidden web customization sites.
Page 213 ZyWALL 35 User’s Guide Table 64 Content Filter : Customization (continued) LABEL DESCRIPTION Don't block Java/ActiveX/ When this box is selected, the ZyWALL will permit Java, ActiveX and Cookies/Web proxy to trusted Cookies from sites on the Trusted Web Site list to the LAN. In certain...
Page 214: Customizing Keyword Blocking Url Checking
ZyWALL 35 User’s Guide 11.6 Customizing Keyword Blocking URL Checking You can use commands to set how much of a website’s URL the content filter is to check for keyword blocking. See the appendices for information on how to access and use the command interpreter.
Page 215: Content Filtering Cache
ZyWALL 35 User’s Guide 11.7 Content Filtering Cache To view and configure your ZyWALL’s URL caching, click CONTENT FILTER, then the Cache tab. The screen appears as shown. You can use this screen to configure how long a categorized web site address remains in the cache as well as view those web site addresses to which access has been allowed or blocked based on the responses from the external content filtering server.
Page 216 ZyWALL 35 User’s Guide Table 65 Content Filter : Cache (continued) LABEL DESCRIPTION Flush Click this button to clear all web site addresses from the cache manually. Refresh Click this button to reload the cache. This is the index number of a categorized web site address record.
Page 217: Content Filtering Registration And Reports
ZyWALL 35 User’s Guide H A P T E R Content Filtering Registration and Reports This chapter describes how to register for content filtering and view content filtering reports. Before you activate content filtering, you must create an account at myZyXEL.com and register your device.
Page 218: A Note On Myzyxel.com Numbers
ZyWALL 35 User’s Guide 12.1.1 A Note on myZyXEL.com Numbers You need the following (unique) numbers to register and activate device-specific feature(s). Table 66 myZyXEL.com Numbers TYPES DESCRIPTION Serial Number You need the serial number to register your ZyXEL device. Locate the serial number on your ZyXEL device.
Page 219: Figure 90 Myzyxel.com Account Registration
ZyWALL 35 User’s Guide Figure 90 myZyXEL.com Account Registration 4 A screen appears indicating you have created an account at myZyXEL.com. Figure 91 Account Registration Successful 5 You will receive a confirmation e-mail. Click the URL in the e-mail to activate your account.
Page 220: Registering Your Zyxel Device
ZyWALL 35 User’s Guide Figure 92 Account Confirmation E-Mail 6 Click Continue to go to the myZyXEL.com login screen. Figure 93 myZyXEL.com Account Activation 12.3 Registering Your ZyXEL Device 1 After you have created a myZyXEL.com account, log in and register your ZyXEL device by clicking the hyperlink as shown in the next screen.
Page 221: Figure 94 Logged Into Myzyxel.com
ZyWALL 35 User’s Guide Figure 94 Logged Into myZyXEL.com Click here to register a new product. 2 Click Add in the next screen. Figure 95 Product Registration 3 The Add New Product screen displays. Enter the product serial number in the Serial Number field.
Page 222: Figure 96 Add New Product
ZyWALL 35 User’s Guide Figure 96 Add New Product Your ZyXEL device MAC address may already be entered here. 8 Specify the purchase information and click Continue. Figure 97 Product Survey 9 Click Continue again. 10After you have registered your ZyXEL device, you can view its registration details in the screen shown next.
Page 223: Content Filtering Registration
ZyWALL 35 User’s Guide Figure 98 Service Management 12.4 Content Filtering Registration 1 In your ZyXEL device’s web configurator, click CONTENT FILTER, Categories and then the Register button. The following screen opens. 2 Enter the user name and password from your myZyXEL.com account (see...
Page 224: Figure 100 Myzyxel.com: Service Management
ZyWALL 35 User’s Guide Figure 100 myZyXEL.com: Service Management. 6 Enter the PIN code exactly as shown on your iCard (you do not enter a PIN if you are registering for the trial period) in the License Key (PIN code) field.
Page 225: Checking Content Filtering Activation
ZyWALL 35 User’s Guide Figure 102 Service Registration: Successful Figure 103 Service Management: Service Registered 9 You can go on to update your product registration information, view content filtering reports or click LOGOUT at any time to exit myZyXEL.com. 12.5 Checking Content Filtering Activation After you register for content filtering, the web site displays a registration successful web page.
Page 226: Updating Product Registration Information
ZyWALL 35 User’s Guide 3 Enter a valid URL or IP address of a web site in the Test if Web site is blocked field and click the Test Against Internet Server button. When content filtering is active, you should see an access blocked or access forwarded message.
Page 227: Figure 104 Cerberian Login Screen
ZyWALL 35 User’s Guide Figure 104 Cerberian Login Screen 2 Enter your ZyXEL device's MAC address (in lower case) in the Name field. Type the password that you configured during account registration at myZyXEL.com. 3 Click Reports. Figure 105 Content Filtering Reports Main Screen Note: The ZyWALL does not support Single User Reports at the time of writing.
Page 228: Configuration File
ZyWALL 35 User’s Guide Figure 106 Global Report Screen Example 6 Click a category to see the URLs that were requested. Figure 107 Requested URLs Example 12.8 Configuration File If you restore the ZyWALL to the default rom file or upload a different rom file after you...
Page 229: Chapter 13 Introduction To Ipsec
ZyWALL 35 User’s Guide H A P T E R Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 13.1 VPN Overview A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication.
Page 230: Data Confidentiality
ZyWALL 35 User’s Guide Figure 108 Encryption and Decryption 13.1.3.2 Data Confidentiality The IPSec sender can encrypt packets before transmitting them across a network. 13.1.3.3 Data Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.
Page 231: Ipsec Architecture
ZyWALL 35 User’s Guide 13.2 IPSec Architecture The overall IPSec architecture is shown as follows. Figure 109 IPSec Architecture 13.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure (including implementation algorithms).
Page 232: Transport Mode
ZyWALL 35 User’s Guide Figure 110 Transport and Tunnel Mode IPSec Encapsulation 13.3.1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP).
Page 233: Table 67 Vpn And Nat
ZyWALL 35 User’s Guide NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet. When using AH protocol, packet contents (the data payload) are not encrypted.
Page 234 ZyWALL 35 User’s Guide Chapter 13 Introduction to IPSec...
Page 235: Chapter 14 Vpn Screens
ZyWALL 35 User’s Guide H A P T E R VPN Screens This chapter introduces the VPN Web Configurator. See Chapter 24 on page 385 information on viewing logs and Appendix Q on page 675 for IPSec log descriptions. 14.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN connections.
Page 236: My Zywall
ZyWALL 35 User’s Guide Table 68 ESP and AH Encryption DES (default) Data Encryption Standard (DES) is a widely used method of data encryption using a secret key. DES applies a 56-bit key to each 64-bit block of data. 3DES...
Page 237: Dynamic Remote Gateway Address
ZyWALL 35 User’s Guide You can also enter a remote secure gateway’s domain name in the Remote Gateway Address field if the remote secure gateway has a dynamic WAN IP address and is using DDNS. The ZyWALL has to rebuild the VPN tunnel each time the remote secure gateway’s WAN IP address changes (there may be a delay until the DDNS servers are updated with the remote gateway’s new WAN IP address).
Page 238: Nat Traversal Configuration
ZyWALL 35 User’s Guide Figure 111 NAT Router Between IPSec Routers Normally you cannot set up a VPN connection with a NAT router between the two IPSec routers because the NAT router changes the header of the IPSec packet. In the previous figure, IPSec router A sends an IPSec packet in an attempt to initiate a VPN.
Page 239: Id Type And Content Examples
ZyWALL 35 User’s Guide between three encryption algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN rule (see Section 14.12.2 on page 249). The ID type and content act as an extra level of identification for incoming SAs.
Page 240: Ike Phases
ZyWALL 35 User’s Guide Table 71 Matching ID Type and Content Configuration Example ZYWALL A ZYWALL B Peer ID type: IP Peer ID type: E-mail Peer ID content: 1.1.1.2 Peer ID content: tom@yourcompany.com The two ZyWALLs in this example cannot complete their negotiation because ZyWALL B’s Local ID type is IP, but ZyWALL A’s Peer ID type is set to E-mail.
Page 241: Negotiation Mode
ZyWALL 35 User’s Guide • Choose an authentication algorithm. • Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2). • Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out. An IKE SA times out when the IKE SA lifetime period expires.
Page 242: Diffie-Hellman (Dh) Key Groups
ZyWALL 35 User’s Guide 14.8.3 Diffie-Hellman (DH) Key Groups Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 - DH1) and 1024-bit (Group 2 –...
Page 243: Icons Key
ZyWALL 35 User’s Guide 14.10 Icons Key The following table describes the icons used in the VPN screens. Table 73 VPN screen Icons Key ICON DESCRIPTION This represents your ZyWALL. This represents the remote secure gateway. This represents the local network.
Page 244: Ike Vpn Rule Summary Screen
ZyWALL 35 User’s Guide Figure 113 Gateway and Network Policies This figure helps explain the main fields in the VPN setup. Figure 114 IPSec Summary Fields Note: Local and remote network IP addresses must be static. 14.12 IKE VPN Rule Summary Screen Click VPN to display the VPN Rules (IKE) screen.
Page 245: Configuring An Ike Gateway Policy
ZyWALL 35 User’s Guide Figure 115 VPN Rules (IKE) Note: The Recycle Bin gateway policy is a virtual placeholder for any network policy(ies) without an associated gateway policy. When there is a network policy in the Recycle Bin, the Recycle Bin gateway policy automatically displays in this screen.
Page 246: Figure 116 Vpn Rules (Ike): Gateway Policy: Edit
ZyWALL 35 User’s Guide Figure 116 VPN Rules (IKE): Gateway Policy: Edit Chapter 14 VPN Screens...
Page 247: Table 74 Vpn Rules (Ike): Gateway Policy: Edit
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 74 VPN Rules (IKE): Gateway Policy: Edit LABEL DESCRIPTION Property Name Type up to 32 characters to identify this VPN gateway policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 248 ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Pre-Shared Key Select the Pre-Shared Key radio button and type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation.
Page 249 ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Content The configuration of the peer content depends on the peer ID type. Do the following when you set Authentication Key to Pre-shared Key. •...
Page 250 ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION User Name Enter a user name for your ZyWALL to be authenticated by the VPN peer (in server mode). The user name can be up to 31 case-sensitive ASCII characters, but spaces are not allowed.
Page 251: Configuring An Ike Network Policy
ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 14.12.2 Configuring an IKE Network Policy...
Page 252: Figure 117 Vpn Rules (Ike): Network Policy Edit
ZyWALL 35 User’s Guide Figure 117 VPN Rules (IKE): Network Policy Edit Chapter 14 VPN Screens...
Page 253: Table 75 Vpn Rules (Ike): Network Policy Edit
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 75 VPN Rules (IKE): Network Policy Edit LABEL DESCRIPTION Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 254 ZyWALL 35 User’s Guide Table 75 VPN Rules (IKE): Network Policy Edit (continued) LABEL DESCRIPTION Starting IP Address When the Address Type field is configured to Single Address, enter a (static) IP address on the LAN behind your ZyWALL. When the Address Type field is configured to Range Address, enter the beginning (static) IP address, in a range of computers on the LAN behind your ZyWALL.
Page 255: Associating A Network Policy To A Gateway Policy
ZyWALL 35 User’s Guide Table 75 VPN Rules (IKE): Network Policy Edit (continued) LABEL DESCRIPTION Authentication MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash Algorithm algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for maximum security.
Page 256: Manual Vpn Rule Summary Screen
ZyWALL 35 User’s Guide Figure 118 VPN Rules (IKE): Network Policy Move The following table describes the labels in this screen. Table 76 VPN Rules (IKE): Network Policy Move LABEL DESCRIPTION Network Policy The following fields display the general network settings of this VPN policy.
Page 257: Figure 119 Vpn Rule (Manual)
ZyWALL 35 User’s Guide Refer to Table 73 on page 241 for descriptions of the icons used in this screen. Figure 119 VPN Rule (Manual) The following table describes the labels in this screen. Table 77 VPN Rules (Manual) LABEL DESCRIPTION This is the VPN policy index number.
Page 258: Editing Manual Vpn Rules
ZyWALL 35 User’s Guide Table 77 VPN Rules (Manual) (continued) LABEL DESCRIPTION Remote Gateway This is the static WAN IP address or domain name of the remote IPSec router. Address Modify Click the edit icon to edit the VPN policy.
Page 259: Figure 120 Vpn Rules (Manual): Edit
ZyWALL 35 User’s Guide Figure 120 VPN Rules (Manual): Edit The following table describes the labels in this screen. Table 78 VPN Rules (Manual) Edit LABEL DESCRIPTION Property Active Select this check box to activate this VPN policy. Name Type up to 32 characters to identify this VPN policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 260 ZyWALL 35 User’s Guide Table 78 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION Local Network Local IP addresses must be static and correspond to the remote IPSec router's configured remote IP addresses. Two active SAs cannot have the local and remote IP address(es) both the same.
Page 261 ZyWALL 35 User’s Guide Table 78 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION My ZyWALL Enter the WAN IP address or domain name of your ZyWALL or leave the field set to 0.0.0.0. The VPN tunnel has to be rebuilt if the My ZyWALL IP address changes after setup.
Page 262: Viewing Sa Monitor
ZyWALL 35 User’s Guide Table 78 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 14.14 Viewing SA Monitor In the web configurator, click VPN and the SA Monitor tab. Use this screen to display and manage active VPN connections.
Page 263: Configuring Global Setting
ZyWALL 35 User’s Guide 14.15 Configuring Global Setting To change your ZyWALL’s global settings, click VPN, then the Global Setting tab. The screen appears as shown. Figure 122 VPN: Global Setting The following table describes the labels in this screen. .
Page 264: Telecommuter Vpn/Ipsec Examples
ZyWALL 35 User’s Guide 14.16 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyWALL at headquarters. The telecommuters use IPSec routers with dynamic WAN IP addresses. The ZyWALL at headquarters has a static public IP address.
Page 265: Figure 124 Telecommuters Using Unique Vpn Rules Example
ZyWALL 35 User’s Guide With aggressive negotiation mode (see Section 14.8.1 on page 239), the ZyWALL can use the ID types and contents to distinguish between VPN rules. Telecommuters can each use a separate VPN rule to simultaneously access a ZyWALL at headquarters. They can use different IPSec parameters.
Page 266: Vpn And Remote Management
ZyWALL 35 User’s Guide Table 82 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS HEADQUARTERS Telecommuter B (telecommuterb.dydns.org) Headquarters ZyWALL 35 Rule 2: Local ID Type: DNS Peer ID Type: DNS Local ID Content: telecommuterb.com Peer ID Content: telecommuterb.com Local IP Address: 192.168.3.2 Remote Gateway Address: telecommuterb.dydns.org...
Page 267: Chapter 15 Certificates
ZyWALL 35 User’s Guide H A P T E R Certificates This chapter gives background information about public-key certificates and explains how to use them. 15.1 Certificates Overview The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs.
Page 268: Advantages Of Certificates
ZyWALL 35 User’s Guide Certification authorities maintain directory servers with databases of valid and revoked certificates. A directory of certificates that have been revoked before the scheduled expiration is called a CRL (Certificate Revocation List). The ZyWALL can check a peer’s certificate against a directory server’s list of revoked certificates.
Page 269: My Certificates
ZyWALL 35 User’s Guide 15.4 My Certificates Click CERTIFICATES, My Certificates to open the ZyWALL’s summary list of certificates and certification requests. Certificates display in black and certification requests display in gray. See the following figure. Figure 126 My Certificates The following table describes the labels in this screen.
Page 270: Certificate File Formats
ZyWALL 35 User’s Guide Table 83 My Certificates (continued) LABEL DESCRIPTION Type This field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request.
Page 271: Importing A Certificate
ZyWALL 35 User’s Guide • Binary X.509: This is an ITU-T recommendation that defines the formats for X.509 certificates. • PEM (Base-64) encoded X.509: This Privacy Enhanced Mail format uses 64 ASCII characters to convert a binary X.509 certificate into a printable form.
Page 272: Creating A Certificate
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 84 My Certificate Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 273: Table 85 My Certificate Create
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 85 My Certificate Create LABEL DESCRIPTION Certificate Name Type up to 31 ASCII characters (not including spaces) to identify this certificate. Subject Information Use these fields to record information that identifies the owner of the certificate.
Page 274: My Certificate Details
ZyWALL 35 User’s Guide Table 85 My Certificate Create (continued) LABEL DESCRIPTION Enrollment Protocol Select the certification authority’s enrollment protocol from the drop-down list box. Simple Certificate Enrollment Protocol (SCEP) is a TCP-based enrollment protocol that was developed by VeriSign and Cisco.
Page 275: Figure 129 My Certificate Details
ZyWALL 35 User’s Guide Figure 129 My Certificate Details Chapter 15 Certificates...
Page 276: Table 86 My Certificate Details
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 86 My Certificate Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this certificate. You may use any character (not including spaces).
Page 277: Trusted Cas
ZyWALL 35 User’s Guide Table 86 My Certificate Details (continued) LABEL DESCRIPTION Subject Alternative This field displays the certificate owner‘s IP address (IP), domain name (DNS) or Name e-mail address (EMAIL). Key Usage This field displays for what functions the certificate’s key can be used. For example, “DigitalSignature”...
Page 278: Figure 130 Trusted Cas
ZyWALL 35 User’s Guide Figure 130 Trusted CAs The following table describes the labels in this screen. Table 87 Trusted CAs LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use.
Page 279: Importing A Trusted Ca's Certificate
ZyWALL 35 User’s Guide Table 87 Trusted CAs (continued) LABEL DESCRIPTION CRL Issuer This field displays Yes if the certification authority issues Certificate Revocation Lists for the certificates that it has issued and you have selected the Issues certificate revocation lists (CRL) check box in the certificate’s details screen to have the ZyWALL check the CRL before trusting any certificates issued by the certification authority.
Page 280: Trusted Ca Certificate Details
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 88 Trusted CA Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 281: Figure 132 Trusted Ca Details
ZyWALL 35 User’s Guide Figure 132 Trusted CA Details The following table describes the labels in this screen. Table 89 Trusted CA Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 282 ZyWALL 35 User’s Guide Table 89 Trusted CA Details (continued) LABEL DESCRIPTION Certification Path Click the Refresh button to have this read-only text box display the end entity’s certificate and a list of certification authority certificates that shows the hierarchy of certification authorities that validate the end entity’s certificate.
Page 283: Trusted Remote Hosts
ZyWALL 35 User’s Guide Table 89 Trusted CA Details (continued) LABEL DESCRIPTION CRL Distribution This field displays how many directory servers with Lists of revoked certificates Points the issuing certification authority of this certificate makes available. This field also displays the domain names or IP addresses of the servers.
Page 284: Figure 133 Trusted Remote Hosts
ZyWALL 35 User’s Guide Figure 133 Trusted Remote Hosts The following table describes the labels in this screen. Table 90 Trusted Remote Hosts LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use.
Page 285: Verifying A Trusted Remote Host's Certificate
ZyWALL 35 User’s Guide Table 90 Trusted Remote Hosts (continued) LABEL DESCRIPTION Import Click Import to open a screen where you can save the certificate of a remote host (which you trust) from your computer to the ZyWALL. Refresh Click this button to display the current validity status of the certificates.
Page 286: Importing A Trusted Remote Host's Certificate
ZyWALL 35 User’s Guide Figure 135 Certificate Details Verify (over the phone for example) that the remote host has the same information in the Thumbprint Algorithm and Thumbprint fields. 15.14 Importing a Trusted Remote Host’s Certificate Click CERTIFICATES, Trusted Remote Hosts to open the Trusted Remote Hosts screen and then click Import to open the Trusted Remote Host Import screen.
Page 287: Trusted Remote Host Certificate Details
ZyWALL 35 User’s Guide Figure 136 Trusted Remote Host Import The following table describes the labels in this screen. Table 91 Trusted Remote Host Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 288: Figure 137 Trusted Remote Host Details
ZyWALL 35 User’s Guide Figure 137 Trusted Remote Host Details The following table describes the labels in this screen. Table 92 Trusted Remote Host Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 289 ZyWALL 35 User’s Guide Table 92 Trusted Remote Host Details (continued) LABEL DESCRIPTION Refresh Click Refresh to display the certification path. Certificate Information These read-only fields display detailed information about the certificate. Type This field displays general information about the certificate. With trusted remote host certificates, this field always displays CA-signed.
Page 290: Directory Servers
ZyWALL 35 User’s Guide Table 92 Trusted Remote Host Details (continued) LABEL DESCRIPTION Certificate in PEM This read-only text box displays the certificate or certification request in Privacy (Base-64) Encoded Enhanced Mail (PEM) format. PEM uses 64 ASCII characters to convert the Format binary certificate into a printable form.
Page 291: Add Or Edit A Directory Server
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 93 Directory Servers LABEL DESCRIPTION PKI Storage Space This bar displays the percentage of the ZyWALL’s PKI storage space that is in Use currently in use. The bar turns from green to red when the maximum is being approached.
Page 292: Table 94 Directory Server Add
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 94 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name Type up to 31 ASCII characters (spaces are not permitted) to identify this directory server. Access Protocol Use the drop-down list box to select the access protocol used by the directory server.
Page 293: Authentication Server
ZyWALL 35 User’s Guide H A P T E R Authentication Server This chapter discusses how to configure Authentication Server on the ZyWALL. 16.1 Authentication Server Overview A ZyWALL set to be a VPN extended authentication server can use either the local user database internal to the ZyWALL or an external RADIUS server for an unlimited number of users.
Page 294: Figure 140 Local User Database
ZyWALL 35 User’s Guide Figure 140 Local User Database Chapter 16 Authentication Server...
Page 295: Configuring Radius
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 95 Local User Database LABEL DESCRIPTION Active Select this check box to enable the user profile. User Name Enter the user name of the user profile.
Page 296: Table 96 Radius
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 96 RADIUS LABEL DESCRIPTION Authentication Server Active Select the check box to enable user authentication through an external authentication server. Clear the check box to enable user authentication using the local user profile on the ZyWALL.
Page 297: Network Address Translation (Nat)
ZyWALL 35 User’s Guide H A P T E R Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 17.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet.
Page 298: What Nat Does
ZyWALL 35 User’s Guide 17.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.
Page 299: Nat Application
ZyWALL 35 User’s Guide 17.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyWALL can communicate with three distinct WAN networks. More examples follow at the end of this chapter.
Page 300: Port Restricted Cone Nat
ZyWALL 35 User’s Guide 17.1.5 Port Restricted Cone NAT Port restricted cone NAT maps all outgoing packets from an internal IP address and port to a single IP address and port on the external network. In the following example, the ZyWALL maps the source address of all packets sent from internal IP address 1 and port A to IP address 2 and port B on the external network.
Page 301: Using Nat
ZyWALL 35 User’s Guide • Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world although, it is highly recommended that you use the DMZ port for these servers instead.
Page 302: Configuring Nat Overview
ZyWALL 35 User’s Guide 17.3 Configuring NAT Overview Click NAT to open the NAT Overview screen shown next. Figure 145 NAT Overview The following table describes the labels in this screen. Table 99 NAT Overview LABEL DESCRIPTION Global Settings Max. Concurrent...
Page 303: Configuring Address Mapping
ZyWALL 35 User’s Guide Table 99 NAT Overview (continued) LABEL DESCRIPTION Address Select SUA to have the ZyWALL use its permanent, pre-defined NAT address Mapping Rules mapping rules. Select Full Feature to have the ZyWALL use the address mapping rules that you configure.
Page 304: Figure 146 Address Mapping
ZyWALL 35 User’s Guide Figure 146 Address Mapping The following table describes the labels in this screen. Table 100 Address Mapping LABEL DESCRIPTION SUA Address This read-only table displays the default address mapping rules. Mapping Rules Full Feature Address Mapping Rules WAN Interface Select the WAN port for which you want to view or configure address mapping rules.
Page 305: Address Mapping Edit
ZyWALL 35 User’s Guide Table 100 Address Mapping (continued) LABEL DESCRIPTION Global End IP This is the ending Inside Global Address (IGA). This field is N/A for One-to-One, Many-to-One and Server mapping types. Type 1. One-to-One mode maps one local IP address to one global IP address. Note that port numbers do not change for the One-to-one NAT mapping type.
Page 306: Port Forwarding
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 101 Address Mapping Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. 1. One-to-One: One-to-one mode maps one local IP address to one global IP address.
Page 307: Default Server Ip Address
ZyWALL 35 User’s Guide 17.5.1 Default Server IP Address In addition to the servers for specified services, NAT supports a default server IP address. A default server receives packets from ports that are not specified in this screen. Note: If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup.
Page 308: Nat And Multiple Wan
ZyWALL 35 User’s Guide Figure 148 Multiple Servers Behind NAT Example 17.5.4 NAT and Multiple WAN The ZyWALL has two WAN ports. You can configure port forwarding and trigger port rule sets for the first WAN port and separate sets of rules for the second WAN port.
Page 309: Configuring Port Forwarding
ZyWALL 35 User’s Guide Figure 149 Port Translation Example 17.6 Configuring Port Forwarding Note: If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup.
Page 310: Figure 150 Port Forwarding
ZyWALL 35 User’s Guide Figure 150 Port Forwarding The following table describes the labels in this screen. Table 103 Port Forwarding LABEL DESCRIPTION WAN Interface Select the WAN port for which you want to view or configure address mapping rules.
Page 311: Configuring Trigger Port
ZyWALL 35 User’s Guide Table 103 Port Forwarding LABEL DESCRIPTION Server IP Enter the inside IP address of the server here. Address Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh.
Page 312: Figure 152 Port Triggering
ZyWALL 35 User’s Guide 4 The ZyWALL forwards the traffic to Jane’s computer IP address. 5 Only Jane can connect to the Real Audio server until the connection is closed or times out. The ZyWALL times out in three minutes with UDP (User Datagram Protocol) or two hours with TCP/IP (Transfer Control Protocol/Internet Protocol).
Page 313 ZyWALL 35 User’s Guide Table 104 Port Triggering LABEL DESCRIPTION Trigger The trigger port is a port (or a range of ports) that causes (or triggers) the ZyWALL to record the IP address of the LAN computer that sent the traffic to a server on the WAN.
Page 314 ZyWALL 35 User’s Guide Chapter 17 Network Address Translation (NAT)
Page 315: Chapter 18 Static Route
ZyWALL 35 User’s Guide H A P T E R Static Route This chapter shows you how to configure static routes for your ZyWALL. 18.1 Static Route Overview Each remote node specifies only the network to which the gateway is directly connected, and the ZyWALL has no knowledge of the networks beyond.
Page 316: Figure 154 Ip Static Route
ZyWALL 35 User’s Guide Figure 154 IP Static Route The following table describes the labels in this screen. Table 105 IP Static Route LABEL DESCRIPTION This is the number of an individual static route. Name This is the name that describes or identifies this route.
Page 317: Configuring A Static Route Entry
ZyWALL 35 User’s Guide 18.2.1 Configuring a Static Route Entry Select a static route index number and click Edit. The screen shown next appears. Fill in the required information for each static route. Figure 155 Edit IP Static Route The following table describes the labels in this screen.
Page 318 ZyWALL 35 User’s Guide Chapter 18 Static Route...
Page 319: Chapter 19 Policy Route
ZyWALL 35 User’s Guide H A P T E R Policy Route This chapter covers setting and applying policies used for IP routing. 19.1 Introduction to IP Policy Routing Traditionally, routing is based on the destination address only and the ZyWALL takes the shortest path to forward a packet.
Page 320: Ip Routing Policy Setup
ZyWALL 35 User’s Guide IPPR follows the existing packet filtering facility of RAS in style and in implementation. 19.4 IP Routing Policy Setup Click POLICY ROUTE to open the Policy Route Summary screen (some of the screen’s blank rows are not shown).
Page 321: Configuring The Ip Policy Route Entry
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 107 Policy Route Setup LABEL DESCRIPTION This is the number of an individual policy route. Active This field shows whether the policy is active or inactive.
Page 322: Figure 157 Edit Ip Policy Route
ZyWALL 35 User’s Guide Figure 157 Edit IP Policy Route The following table describes the labels in this screen. Table 108 Edit IP Policy Route LABEL DESCRIPTION Criteria Active Select the check box to activate the policy. Rule Index This is the index number of the policy route.
Page 323 ZyWALL 35 User’s Guide Table 108 Edit IP Policy Route (continued) LABEL DESCRIPTION Packet Length Type a length of packet (in bytes). The operators in the Len Compare field apply to incoming packets of this length. Length Choose from Equal, Not Equal, Less, Greater, Less or Equal or Greater or Comparison Equal.
Page 324 ZyWALL 35 User’s Guide Chapter 19 Policy Route...
Page 325: Chapter 20 Bandwidth Management
ZyWALL 35 User’s Guide H A P T E R Bandwidth Management This chapter describes the functions and configuration of bandwidth management with multiple levels of sub-classes. 20.1 Bandwidth Management Overview Bandwidth management allows you to allocate an interface’s outgoing capacity to specific types of traffic.
Page 326: Proportional Bandwidth Allocation
ZyWALL 35 User’s Guide 20.3 Proportional Bandwidth Allocation Bandwidth management allows you to define how much bandwidth each class gets; however, the actual bandwidth allotted to each class decreases or increases in proportion to actual available bandwidth. 20.4 Application-based Bandwidth Management You can create bandwidth classes based on individual applications (like VoIP, Web, FTP, E- mail and Video for example).
Page 327: Scheduler
ZyWALL 35 User’s Guide Table 109 Application and Subnet-based Bandwidth Management Example (continued) TRAFFIC TYPE FROM SUBNET A FROM SUBNET B 64 Kbps 64 Kbps E-mail 64 Kbps 64 Kbps Video 64 Kbps 64 Kbps 20.7 Scheduler The scheduler divides up an interface’s bandwidth among the bandwidth classes. The ZyWALL has two types of scheduler: fairness-based and priority-based.
Page 328: Reserving Bandwidth For Non-Bandwidth Class Traffic
ZyWALL 35 User’s Guide 20.8.1 Reserving Bandwidth for Non-Bandwidth Class Traffic Do the following three steps to configure the ZyWALL to allow bandwidth for traffic that is not defined in a bandwidth filter. 1 Leave some of the interface’s bandwidth unbudgeted.
Page 329: Fairness-Based Allotment Of Unused And Unbudgeted Bandwidth
ZyWALL 35 User’s Guide Suppose that all of the classes except for the administration class need more bandwidth. • Each class gets up to its budgeted bandwidth. The administration class only uses 1024 kbps of its budgeted 2048 kbps. • The sales and marketing are first to get extra bandwidth because they have the highest priority (6).
Page 330: Bandwidth Borrowing Example
ZyWALL 35 User’s Guide The total of the bandwidth allotments for sub-classes cannot exceed the bandwidth allotment of their parent class. The ZyWALL uses the scheduler to divide a parent class’s unused bandwidth among the sub-classes. 20.9.1 Bandwidth Borrowing Example Here is an example of bandwidth management with classes configured for bandwidth borrowing.
Page 331: Configuring Summary
ZyWALL 35 User’s Guide 2 The ZyWALL assigns a parent class’s unused bandwidth to its sub-classes that have more traffic than their budgets and have bandwidth borrowing enabled. The ZyWALL gives priority to sub-classes of higher priority and treats classes of the same priority equally.
Page 332: Configuring Class Setup
ZyWALL 35 User’s Guide Table 114 Bandwidth Manager: Summary (continued) LABEL DESCRIPTION Speed (kbps) Enter the amount of bandwidth for this interface that you want to allocate using bandwidth management. This appears as the bandwidth budget of the interface’s root class (see Section 20.11 on page...
Page 333: Figure 160 Bandwidth Manager: Class Setup
ZyWALL 35 User’s Guide Figure 160 Bandwidth Manager: Class Setup The following table describes the labels in this screen. Table 115 Bandwidth Manager: Class Setup LABEL DESCRIPTION Class Setup Interface Select an interface from the drop-down list box for which you wish to set up classes.
Page 334: Bandwidth Manager Class Configuration
ZyWALL 35 User’s Guide Table 115 Bandwidth Manager: Class Setup (continued) LABEL DESCRIPTION Destination IP This is the destination IP address for connections to which this bandwidth Address management filter applies. Destination Port This is the destination port for connections to which this bandwidth management filter applies.
Page 335: Figure 161 Bandwidth Manager: Edit Class
ZyWALL 35 User’s Guide Figure 161 Bandwidth Manager: Edit Class The following table describes the labels in this screen. Table 116 Bandwidth Manager: Edit Class LABEL DESCRIPTION Class Configuration Class Name Use the auto-generated name or enter a descriptive name of up to 20 alphanumeric characters, including spaces.
Page 336 ZyWALL 35 User’s Guide Table 116 Bandwidth Manager: Edit Class (continued) LABEL DESCRIPTION Enable Bandwidth Select Enable Bandwidth Filter to have the ZyWALL use this bandwidth filter Filter when it performs bandwidth management. You must enter a value in at least one of the following fields (other than the Subnet Mask fields which are only available when you enter the destination or source IP address).
Page 337: Bandwidth Management Statistics
ZyWALL 35 User’s Guide Table 116 Bandwidth Manager: Edit Class (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. Table 117 Services and Port Numbers SERVICES...
Page 338: Configuring Monitor
ZyWALL 35 User’s Guide Figure 162 Bandwidth Management Statistics The following table describes the labels in this screen. Table 118 Bandwidth Management Statistics LABEL DESCRIPTION Class Name This field displays the name of the class the statistics page is showing.
Page 339: Figure 163 Bandwidth Manager Monitor
ZyWALL 35 User’s Guide Figure 163 Bandwidth Manager Monitor The following table describes the labels in this screen. Table 119 Bandwidth Manager Monitor LABEL DESCRIPTION Interface Select an interface from the drop-down list box to view the bandwidth usage of its bandwidth classes.
Page 340 ZyWALL 35 User’s Guide Chapter 20 Bandwidth Management...
Page 341: Chapter 21 Dns
ZyWALL 35 User’s Guide H A P T E R This chapter shows you how to configure the DNS screens. 21.1 DNS Overview DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.
Page 342: Address Record
ZyWALL 35 User’s Guide 21.4 Address Record An address record contains the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the top-level domain. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel”...
Page 343: The System Screen
ZyWALL 35 User’s Guide Figure 164 Private DNS Server Example Note: If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote private network.
Page 344: Adding An Address Record
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 120 System DNS LABEL DESCRIPTION Address Record An address record specifies the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the top-level domain.
Page 345: Inserting A Name Server Record
ZyWALL 35 User’s Guide Figure 166 System DNS: Add Address Record The following table describes the labels in this screen. Table 121 System DNS: Add Address Record LABEL DESCRIPTION FQDN Type a fully qualified domain name (FQDN) of a server. An FQDN starts with a host name and continues all the way up to the top-level domain name.
Page 346: Figure 167 System Dns: Insert Name Server Record
ZyWALL 35 User’s Guide Figure 167 System DNS: Insert Name Server Record The following table describes the labels in this screen. Table 122 System DNS: Insert Name Server Record LABEL DESCRIPTION Domain Zone This field is optional. A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain...
Page 347: Dns Cache
ZyWALL 35 User’s Guide 21.7 DNS Cache DNS cache is the temporary storage area where a router stores responses from DNS servers. When the ZyWALL receives a positive or negative response for a DNS query, it records the response in the DNS cache. A positive response means that the ZyWALL received the IP address for a domain name that it checked with a DNS server within the five second DNS timeout period.
Page 348: Configuring Dns Lan
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 123 DNS Cache LABEL DESCRIPTION DNS Cache Setup Cache Positive DNS Select the check box to record the positive DNS resolutions in the cache. Resolutions Caching positive DNS resolutions helps speed up the ZyWALL’s processing of commonly queried domain names and reduces the amount of traffic that the ZyWALL sends out to the WAN.
Page 349: Figure 169 Dns Lan
ZyWALL 35 User’s Guide Figure 169 DNS LAN The following table describes the labels in this screen. Table 124 DNS LAN LABEL DESCRIPTION DNS Servers The ZyWALL passes a DNS (Domain Name System) server IP address (in the Assigned by DHCP order you specify here) to the DHCP clients.
Page 350: Dynamic Dns
ZyWALL 35 User’s Guide 21.10 Dynamic DNS Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change...
Page 351: Figure 170 Ddns
ZyWALL 35 User’s Guide Figure 170 DDNS The following table describes the labels in this screen. Table 125 DDNS LABEL DESCRIPTION Account Setup Active Select this check box to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider.
Page 352 ZyWALL 35 User’s Guide Table 125 DDNS LABEL DESCRIPTION IP Address Update Select Use WAN IP Address to have the ZyWALL update the domain name Policy with the WAN port's IP address. Select Use User-Defined and enter the IP address if you have a static IP address.
Page 353: Chapter 22 Remote Management
ZyWALL 35 User’s Guide H A P T E R Remote Management This chapter provides information on the Remote Management screens. 22.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers.
Page 354: Remote Management And Nat
ZyWALL 35 User’s Guide 2 A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. 3 You have disabled that service in one of the remote management screens.
Page 355: Configuring Www
ZyWALL 35 User’s Guide 1 HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the ZyWALL’s WS (web server). 2 HTTP connection requests from a web browser go to port 80 (by default) on the ZyWALL’s WS (web server).
Page 356: Figure 172 Www
ZyWALL 35 User’s Guide Figure 172 WWW The following table describes the labels in this screen. Table 126 WWW LABEL DESCRIPTION HTTPS Server Select the Server Certificate that the ZyWALL will use to identify itself. The Certificate ZyWALL is the SSL server and must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the ZyWALL).
Page 357: Https Example
ZyWALL 35 User’s Guide Table 126 WWW (continued) LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 358: Netscape Navigator Warning Messages
ZyWALL 35 User’s Guide 22.4.2 Netscape Navigator Warning Messages When you attempt to access the ZyWALL HTTPS server, a Website Certified by an Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that the certificate is from the ZyWALL.
Page 359: Login Screen
ZyWALL 35 User’s Guide • The issuing certificate authority of the ZyWALL’s HTTPS server certificate is not one of the browser’s trusted certificate authorities. The issuing certificate authority of the ZyWALL's factory default certificate is the ZyWALL itself since the certificate is a self- signed certificate.
Page 360: Figure 176 Login Screen (Internet Explorer)
ZyWALL 35 User’s Guide Figure 176 Login Screen (Internet Explorer) Figure 177 Login Screen (Netscape) Click Login and you then see the next screen. The factory default certificate is a common default certificate for all ZyWALL models. Chapter 22 Remote Management...
Page 361: Figure 178 Replace Certificate
ZyWALL 35 User’s Guide Figure 178 Replace Certificate Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Click CERTIFICATES to open the My Certificates screen. You will see information similar to that shown in the following figure.
Page 362: Ssh Overview
ZyWALL 35 User’s Guide Figure 180 Common ZyWALL Certificate 22.5 SSH Overview Unlike Telnet or FTP, which transmit data in clear text, SSH (Secure Shell) is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network.
Page 363: Ssh Implementation On The Zywall
ZyWALL 35 User’s Guide Figure 182 How SSH Works 1 Host Identification The SSH client sends a connection request to the SSH server. The server identifies itself with a host key. The client encrypts a randomly generated session key with the host key and server key and sends the result back to the server.
Page 364: Requirements For Using Ssh
ZyWALL 35 User’s Guide 22.7.1 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the ZyWALL over SSH. 22.8 Configuring SSH To change your ZyWALL’s Secure Shell settings, click REMOTE MGMT, then the SSH tab.
Page 365: Secure Telnet Using Ssh Examples
ZyWALL 35 User’s Guide 22.9 Secure Telnet Using SSH Examples This section shows two examples using a command interface and a graphical interface SSH client program to remotely access the ZyWALL. The configuration and connection steps are similar for most SSH client programs. Refer to your SSH client program user’s guide.
Page 366: Secure Ftp Using Ssh Example
ZyWALL 35 User’s Guide Figure 185 SSH Example 2: Test $ telnet 192.168.1.1 22 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5-1.0.0 2 Enter “ssh –1 192.168.1.1”. This command forces your computer to connect to the ZyWALL using SSH version 1. If this is the first time you are connecting to the ZyWALL using SSH, a message displays prompting you to save the host information of the ZyWALL.
Page 367: Telnet
ZyWALL 35 User’s Guide Figure 187 Secure FTP: Firmware Upload Example $ sftp -1 192.168.1.1 Connecting to 192.168.1.1... The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established. RSA1 key fingerprint is 21:6c:07:25:7e:f4:75:80:ec:af:bd:d4:3d:80:53:d1. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.1' (RSA1) to the list of known...
Page 368: Configuring Ftp
ZyWALL 35 User’s Guide Figure 189 Telnet The following table describes the labels in this screen. Table 128 Telnet LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 369: Configuring Snmp
ZyWALL 35 User’s Guide Figure 190 FTP The following table describes the labels in this screen. Table 129 FTP LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 370: Figure 191 Snmp Management Model
ZyWALL 35 User’s Guide Figure 191 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyWALL). An agent translates the local management information from the managed device into a form compatible with SNMP.
Page 371: Supported Mibs
ZyWALL 35 User’s Guide 22.14.1 Supported MIBs The ZyWALL supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of the MIBs is to let administrators collect statistical data and monitor status and performance. 22.14.2 SNMP Traps The ZyWALL will send traps to the SNMP manager when any one of the following events...
Page 372 ZyWALL 35 User’s Guide Figure 192 SNMP The following table describes the labels in this screen. Table 131 SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests.
Page 373: Configuring Dns
ZyWALL 35 User’s Guide 22.15 Configuring DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to Chapter 7 on page 127 for more information. To change your ZyWALL’s DNS settings, click REMOTE MGMT, then the DNS tab. The screen appears as shown.
Page 374: Configuring Cnm
ZyWALL 35 User’s Guide If you allow your ZyWALL to be managed by the Vantage CNM server, then you should not do any configurations directly to the ZyWALL (using either the web configurator, SMT menus or commands) without notifying the Vantage CNM administrator.
Page 375 ZyWALL 35 User’s Guide Table 133 CNM (continued) LABEL DESCRIPTION Last Registration Time This field displays the last date (year-month-date) and time (hours-minutes- seconds) that the ZyWALL registered with the Vantage CNM server. It displays all zeroes if it has not yet registered with the Vantage CNM server.
Page 376 ZyWALL 35 User’s Guide Chapter 22 Remote Management...
Page 377: Chapter 23 Upnp
ZyWALL 35 User’s Guide H A P T E R UPnP This chapter introduces the Universal Plug and Play feature. This chapter is only applicable when the ZyWALL is in router mode. 23.1 Universal Plug and Play Overview Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices.
Page 378: Upnp And Zyxel
ZyWALL 35 User’s Guide All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. 23.2 UPnP and ZyXEL ZyXEL has achieved UPnP certification from the Universal Plug and Play Forum Creates UPnP™...
Page 379: Displaying Upnp Port Mapping
ZyWALL 35 User’s Guide Table 134 Configuring UPnP LABEL DESCRIPTION Enable the Universal Select this checkbox to activate UPnP. Be aware that anyone could use a Plug and Play (UPnP) UPnP application to open the web configurator's login screen without...
Page 380: Installing Upnp In Windows Example
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 135 UPnP Ports LABEL DESCRIPTION Reserve UPnP Select this checkbox to have the ZyWALL retain UPnP created NAT rules even NAT rules in flash after restarting. If you use UPnP and you set a port on your computer to be fixed for...
Page 381: Installing Upnp In Windows Me
ZyWALL 35 User’s Guide 23.5.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windows Me. 1 Click Start, Settings and Control Panel. Double-click Add/Remove Programs. 2 Click on the Windows Setup tab and select Communication in the Components selection box.
Page 382: Installing Upnp In Windows Xp
ZyWALL 35 User’s Guide 23.5.2 Installing UPnP in Windows XP Follow the steps below to install UPnP in Windows XP. 1 Click Start, Settings and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components ….
Page 383: Auto-Discover Your Upnp-Enabled Network Device
ZyWALL 35 User’s Guide 23.6.1 Auto-discover Your UPnP-enabled Network Device 1 Click Start and Control Panel. Double- click Network Connections. An icon displays under Internet Gateway. 2 Right-click the icon and select Properties. 3 In the Internet Connection Properties You may edit or delete the port mappings or click Add to manually add port mappings.
Page 384: Web Configurator Easy Access
ZyWALL 35 User’s Guide Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 4 Select the Show icon in notification area when connected check box and click OK. An icon displays in the system tray.
Page 385 ZyWALL 35 User’s Guide Follow the steps below to access the web configurator. 1 Click Start and then Control Panel. 2 Double-click Network Connections. 3 Select My Network Places under Other Places. 4 An icon with the description for each UPnP-enabled device displays under Local Network.
Page 386 ZyWALL 35 User’s Guide 6 Right-click the icon for your ZyXEL device and select Properties. A properties window displays with basic information about the ZyXEL device. Chapter 23 UPnP...
Page 387: Chapter 24 Logs Screens
ZyWALL 35 User’s Guide H A P T E R Logs Screens This chapter contains information about configuring general log settings and viewing the ZyWALL’s logs. Refer to Appendix Q on page 675 for example log message explanations. 24.1 Configuring View Log The web configurator allows you to look at all of the ZyWALL’s logs in one location.
Page 388: Log Description Example
ZyWALL 35 User’s Guide Figure 197 View Log The following table describes the labels in this screen. Table 136 View Log LABEL DESCRIPTION Display The categories that you select in the Log Settings page (see Section 24.3 on page 387) display in the drop-down list box.
Page 389: Configuring Log Settings
ZyWALL 35 User’s Guide The following is an example of how a log displays in the command line interpreter and a description of the sample log. Refer to the appendices for more log message descriptions and details on using the command line interpreter to display logs.
Page 390: Figure 198 Log Settings
ZyWALL 35 User’s Guide Figure 198 Log Settings Chapter 24 Logs Screens...
Page 391: Table 138 Log Settings
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 138 Log Settings LABEL DESCRIPTION E-mail Log Settings Mail Server Enter the server name or the IP address of the mail server for the e-mail addresses specified below. If this field is left blank, logs and alert messages will not be sent via e-mail.
Page 392: Configuring Reports
ZyWALL 35 User’s Guide Table 138 Log Settings (continued) LABEL DESCRIPTION Active Some logs (such as the Attacks logs) may be so numerous that it becomes easy to ignore other important log messages. Select this check box to merge logs with identical messages into one log.
Page 393: Figure 199 Reports
ZyWALL 35 User’s Guide Figure 199 Reports Note: Enabling the ZyWALL’s reporting function decreases the overall throughput by about 1 Mbps. The following table describes the labels in this screen. Table 139 Reports LABEL DESCRIPTION Collect Statistics Select the check box and click Apply to have the ZyWALL record report data.
Page 394: Viewing Web Site Hits
ZyWALL 35 User’s Guide 24.4.1 Viewing Web Site Hits In the Reports screen, select Web Site Hits from the Report Type drop-down list box to have the ZyWALL record and display which web sites have been visited the most often and how many times they have been visited.
Page 395: Viewing Lan Ip Address
ZyWALL 35 User’s Guide Figure 201 Protocol/Port Report Example The following table describes the labels in this screen. Table 141 Protocol/ Port Report LABEL DESCRIPTION Protocol/Port This column lists the protocols or service ports for which the most traffic has gone through the ZyWALL.
Page 396: Reports Specifications
ZyWALL 35 User’s Guide Figure 202 LAN IP Address Report Example The following table describes the labels in this screen. Table 142 LAN IP Address Report LABEL DESCRIPTION IP Address This column lists the LAN IP addresses to and/or from which the most traffic has been sent.
Page 397: Chapter 25 Maintenance
ZyWALL 35 User’s Guide H A P T E R Maintenance This chapter displays information on the maintenance screens. 25.1 Maintenance Overview The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your ZyWALL.
Page 398: Configuring Password
ZyWALL 35 User’s Guide Figure 203 General Setup The following table describes the labels in this screen. Table 144 General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name” in this field. This name can be up to 30 alphanumeric characters long.
Page 399: Pre-Defined Ntp Time Servers List
ZyWALL 35 User’s Guide Figure 204 Password Setup The following table describes the labels in this screen. Table 145 Password Setup LABEL DESCRIPTION Old Password Type the default password or the existing password you use to access the system in this field.
Page 400: Configuring Time And Date
ZyWALL 35 User’s Guide Table 146 Default Time Servers ntp.cs.strath.ac.uk ntp1.sp.se time1.stupi.se tick.stdtime.gov.tw tock.stdtime.gov.tw time.stdtime.gov.tw 25.5 Configuring Time and Date To change your ZyWALL’s time and date, click MAINTENANCE, then the Time and Date tab. The screen appears as shown. Use this screen to configure the ZyWALL’s time based on your local time zone.
Page 401: Table 147 Time And Date
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 147 Time and Date LABEL DESCRIPTION Current Time and Date Current Time This field displays the time of your ZyWALL. Each time you reload this page, the ZyWALL synchronizes the time with the time server.
Page 402: Resetting The Time
ZyWALL 35 User’s Guide Table 147 Time and Date (continued) LABEL DESCRIPTION Start Date Configure the day and time when Daylight Saving Time starts if you selected Enable Daylight Saving. The o'clock field uses the 24 hour format. Here are a...
Page 403: Introduction To Transparent Bridging
ZyWALL 35 User’s Guide Figure 206 Synchronization in Process Click the Return button to go back to the Time and Date screen after the time and date is updated successfully. Figure 207 Synchronization is Successful If the update was not successful, the following screen appears. Click Return to go back to the Time and Date screen.
Page 404: Transparent Firewalls
ZyWALL 35 User’s Guide The bridge gradually builds a host MAC-address-to-port mapping table such as in the following example, during the learning process. Table 148 MAC-address-to-port Mapping Table HOST MAC ADDRESS PORT 00a0c5123456 00a0c5123478 (host A) 1 00a0c512349a 00a0c51234bc 00a0c51234de For example, if a bridge receives a frame via port 1 from host A (MAC address 00a0c5123478), the bridge associates host A with port 1.
Page 405: Configuring Device Mode
ZyWALL 35 User’s Guide Bridging devices are most useful in complex environments that require a rapid or new firewall deployment. A transparent, bridging firewall can also be good for companies with several branch offices since the setups at these offices are often the same and it's likely that one design can be used for many of the networks.
Page 406: Figure 210 Device Mode (Bridge Mode)
ZyWALL 35 User’s Guide Table 149 Device Mode (Router Mode) (continued) LABEL DESCRIPTION Subnet Mask Enter the IP subnet mask of the ZyWALL. Gateway IP Enter the gateway IP address. Address Apply Click Apply to save your changes back to the ZyWALL. After you click Apply, please wait for one minute and use the IP address you configured in the IP Address field to access the ZyWALL again.
Page 407: F/W Upload Screen
ZyWALL 35 User’s Guide Table 150 Device Mode (Bridge Mode) (continued) LABEL DESCRIPTION DHCP Server DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients (computers) to obtain TCP/IP configuration at startup from a server. Unless you are instructed by your ISP, leave the DHCP Server check box selected.
Page 408: Figure 211 Firmware Upload
ZyWALL 35 User’s Guide Figure 211 Firmware Upload The following table describes the labels in this screen. Table 151 Firmware Upload LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse ... to find it.
Page 409: Configuration Screen
ZyWALL 35 User’s Guide Figure 213 Network Temporarily Disconnected After two minutes, log in again and check your new firmware version in the System Status screen. If the upload was not successful, the following screen will appear. Click Return to go back to the F/W Upload screen.
Page 410: Backup Configuration
ZyWALL 35 User’s Guide Figure 215 Configuration 25.10.1 Backup Configuration Backup Configuration allows you to back up (save) the ZyWALL’s current configuration to a file on your computer. Once your ZyWALL is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes.
Page 411: Figure 216 Configuration Upload Successful
ZyWALL 35 User’s Guide Note: Do not turn off the ZyWALL while configuration file upload is in progress. After you see a “restore configuration successful” screen, you must then wait one minute before logging into the ZyWALL again. Figure 216 Configuration Upload Successful The ZyWALL automatically restarts in this time causing a temporary network disconnect.
Page 412: Back To Factory Defaults
ZyWALL 35 User’s Guide Figure 218 Configuration Upload Error 25.10.3 Back to Factory Defaults Pressing the Reset button in this section clears all user-entered configuration information and returns the ZyWALL to its factory defaults as shown on the screen. The following warning screen will appear.
Page 413: Figure 220 Restart Screen
ZyWALL 35 User’s Guide Figure 220 Restart Screen Chapter 25 Maintenance...
Page 414 ZyWALL 35 User’s Guide Chapter 25 Maintenance...
Page 415: Chapter 26 Introducing The Smt
ZyWALL 35 User’s Guide H A P T E R Introducing the SMT This chapter explains how to access the System Management Terminal and gives an overview of its menus. 26.1 Introduction to the SMT The ZyWALL’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.
Page 416: Entering The Password
ZyWALL 35 User’s Guide Figure 221 Initial Screen Copyright (c) 1994 - 2005 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:A0:C5:01:23:45 initialize ch =1, ethernet address: 00:A0:C5:01:23:46 initialize ch =2, ethernet address: 00:A0:C5:01:23:47 initialize ch =3, ethernet address: 00:A0:C5:01:23:48 initialize ch =4, ethernet address: 00:00:00:00:00:00 AUX port init .
Page 417: Main Menu
ZyWALL 35 User’s Guide Table 153 Main Menu Commands OPERATION KEYSTROKES DESCRIPTION Move to a Press [SPACE Fields beginning with “Edit” lead to hidden menus and have a “hidden” BAR] to change No default setting of No. Press [SPACE BAR] to change No to Yes,...
Page 418: Figure 223 Main Menu (Router Mode)
ZyWALL 35 User’s Guide Figure 223 Main Menu (Router Mode) Copyright (c) 1994 - 2004 ZyXEL Communications Corp. ZyWALL 35 Main Menu Getting Started Advanced Management 1. General Setup 21. Filter and Firewall Setup 2. WAN Setup 22. SNMP Configuration 3.
Page 419: Smt Menus Overview
ZyWALL 35 User’s Guide Table 154 Main Menu Summary NO. MENU TITLE FUNCTION Internet Access Setup Configure your Internet Access setup (Internet address, gateway, login, etc.) with this menu. DMZ Setup Use this menu to configure your public servers connected to the DMZ port.
Page 420 ZyWALL 35 User’s Guide Table 155 SMT Menus Overview (continued) MENUS SUB MENUS 11 Remote Node Setup 11.1 Remote Node Profile 11.1.2 Remote Node Network Layer Options 11.1.4 Remote Node Filter 11.2 Remote Node Profile 11.2.2 Remote Node Network Layer Options 11.2.4 Remote Node Filter...
Page 421: Changing The System Password
ZyWALL 35 User’s Guide Table 155 SMT Menus Overview (continued) MENUS SUB MENUS 24 System Maintenance 24.1 System Status 24.2 System Information and 24.2.1 System Information Console Port Speed 24.2.2 Console Port Speed 24.3 Log and Trace 24.3.1 View Error Log 24.3.2 Syslog Logging...
Page 422: Resetting The Zywall
ZyWALL 35 User’s Guide Figure 225 Menu 23: System Password Menu 23 - System Password Old Password= ? New Password= ? Retype to confirm= ? Enter here to CONFIRM or ESC to CANCEL: 2 Type your existing password and press [ENTER].
Page 423: Smt Menu 1 - General Setup
ZyWALL 35 User’s Guide H A P T E R SMT Menu 1 - General Setup Menu 1 - General Setup contains administrative and system-related information. 27.1 Introduction to General Setup Menu 1 - General Setup contains administrative and system-related information.
Page 424: Figure 227 Menu 1: General Setup (Bridge Mode)
ZyWALL 35 User’s Guide Table 156 Menu 1: General Setup (Router Mode) (continued) FIELD DESCRIPTION Edit Dynamic Press [SPACE BAR] and then [ENTER] to select Yes or No (default). Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next.
Page 425: Configuring Dynamic Dns
ZyWALL 35 User’s Guide 27.2.1 Configuring Dynamic DNS To configure Dynamic DNS, set the ZyWALL to router mode in menu 1 or in the MAINTENANCE Device Mode screen and go to Menu 1 - General Setup and press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1 - Configure Dynamic DNS (shown next).
Page 426: Figure 229 Menu 1.1.1: Ddns Host Summary
ZyWALL 35 User’s Guide 4 Press [SPACE BAR] and then [ENTER] to select Yes in the Edit Host field. Press [ENTER] to display Menu 1.1.1 - DDNS Host Summary. Figure 229 Menu 1.1.1: DDNS Host Summary Menu 1.1.1 DDNS Host Summary...
Page 427: Figure 230 Menu 1.1.1: Ddns Edit Host
ZyWALL 35 User’s Guide Figure 230 Menu 1.1.1: DDNS Edit Host Menu 1.1.1 - DDNS Edit Host Hostname= ZyWALL DDNS Type= DynamicDNS Enable Wildcard Option= Yes Enable Off Line Option= N/A Bind WAN= 1 HA= Yes IP Address Update Policy:...
Page 428 ZyWALL 35 User’s Guide Table 160 Menu 1.1.1: DDNS Edit Host (continued) FIELD DESCRIPTION IP Address You can select Yes in either the DDNS Server Auto Detect IP Address field Update Policy: (recommended) or the Use Specified IP Address field, but not both.
Page 429: Wan And Dial Backup Setup
ZyWALL 35 User’s Guide H A P T E R WAN and Dial Backup Setup This chapter describes how to configure the WAN using menu 2 and dial-backup using menus 2.1 and 11.1. 28.1 Introduction to WAN and Dial Backup Setup This chapter explains how to configure settings for your WAN port and how to configure the ZyWALL for a dial backup connection.
Page 430: Dial Backup
ZyWALL 35 User’s Guide The following table describes the fields in this screen. Table 161 MAC Address Cloning in WAN Setup FIELD DESCRIPTION WAN 1/2 MAC Address Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods to assign a MAC Address.
Page 431: Advanced Wan Setup
ZyWALL 35 User’s Guide Figure 232 Menu 2: Dial Backup Setup Menu 2 - WAN Setup WAN 1 MAC Address: Assigned By= Factory default IP Address= N/A WAN 2 MAC Address: Assigned By= Factory default IP Address= N/A Dial-Backup: Active= No...
Page 432: Figure 233 Menu 2.1: Advanced Wan Setup
ZyWALL 35 User’s Guide To edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in Menu 2 - WAN Setup, press the [SPACE BAR] to select Yes and then press [ENTER].
Page 433: Remote Node Profile (Backup Isp)
ZyWALL 35 User’s Guide Table 164 Advanced WAN Port Setup: Call Control Parameters FIELD DESCRIPTION Call Control Dial Timeout (sec) Enter a number of seconds for the ZyWALL to keep trying to set up an outgoing call before timing out (stopping). The ZyWALL times out and stops if it cannot set up an outgoing call within the timeout value.
Page 434: Table 165 Menu 11.3: Remote Node Profile (Backup Isp)
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 165 Menu 11.3: Remote Node Profile (Backup ISP) FIELD DESCRIPTION Rem Node Enter a descriptive name for the remote node. This field can be up to eight characters.
Page 435: Editing Ppp Options
ZyWALL 35 User’s Guide Table 165 Menu 11.3: Remote Node Profile (Backup ISP) (continued) FIELD DESCRIPTION Idle Timeout Enter the number of seconds of idle time (when there is no traffic from the ZyWALL to the remote node) that can elapse before the ZyWALL automatically disconnects the PPP connection.
Page 436: Figure 236 Menu 11.3.2: Remote Node Network Layer Options
ZyWALL 35 User’s Guide Figure 236 Menu 11.3.2: Remote Node Network Layer Options Menu 11.3.2 - Remote Node Network Layer Options IP Address Assignment= Static Rem IP Addr= 0.0.0.0 Rem Subnet Mask= 0.0.0.0 My WAN Addr= 0.0.0.0 Network Address Translation= SUA Only...
Page 437: Editing Login Script
ZyWALL 35 User’s Guide Table 167 Menu 11.3.2: Remote Node Network Layer Options FIELD DESCRIPTION NAT Lookup If you select SUA Only in the Network Address Translation field, it displays 255 and indicates the SMT will use the pre-configured Set 255 (read only) in menu 15.1.
Page 438: Figure 237 Menu 11.3.3: Remote Node Script
ZyWALL 35 User’s Guide You can use two variables, $USERNAME and $PASSWORD (all UPPER case), to represent the actual user name and password in the script, so they will not show in the clear. They are replaced with the outgoing login name and password in the remote node when the ZyWALL sees them in a ‘Send’...
Page 439: Remote Node Filter
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 168 Menu 11.3.3: Remote Node Script FIELD DESCRIPTION Active Press [SPACE BAR] and then [ENTER] to select either Yes to enable the AT strings or No to disable them.
Page 440 ZyWALL 35 User’s Guide Chapter 28 WAN and Dial Backup Setup...
Page 441: Chapter 29 Lan Setup
ZyWALL 35 User’s Guide H A P T E R LAN Setup This chapter describes how to configure the LAN using Menu 3 - LAN Setup. 29.1 Introduction to LAN Setup This chapter describes how to configure the ZyWALL for LAN and wireless LAN connections.
Page 442: Tcp/Ip And Dhcp Ethernet Setup Menu
ZyWALL 35 User’s Guide Figure 240 Menu 3.1: LAN Port Filter Setup Menu 3.1 - LAN Port Filter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ESC to Cancel: 29.4 TCP/IP and DHCP Ethernet Setup Menu...
Page 443: Figure 242 Menu 3.2: Tcp/Ip And Dhcp Ethernet Setup
ZyWALL 35 User’s Guide Figure 242 Menu 3.2: TCP/IP and DHCP Ethernet Setup Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server TCP/IP Setup: Client IP Pool: Starting Address= 192.168.1.33 IP Address= 192.168.1.1 Size of Client IP Pool= 128 IP Subnet Mask= 255.255.255.0...
Page 444: Ip Alias Setup
ZyWALL 35 User’s Guide Table 170 Menu 3.2: LAN TCP/IP Setup Fields (continued) FIELD DESCRIPTION RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction. Options are: Both, In Only, Out Only or None. Version Press [SPACE BAR] and then [ENTER] to select the RIP version. Options are: RIP-1, RIP-2B or RIP-2M.
Page 445: Wireless Lan Setup
ZyWALL 35 User’s Guide Figure 243 Menu 3.2.1: IP Alias Setup Menu 3.2.1 - IP Alias Setup IP Alias 1= Yes IP Address= 192.168.2.1 IP Subnet Mask= 255.255.255.0 RIP Direction= None Version= RIP-1 Incoming protocol filters= Outgoing protocol filters= IP Alias 2= No...
Page 446: Figure 244 Menu 3.5: Wireless Lan Setup
ZyWALL 35 User’s Guide Note: If you are configuring the ZyWALL from a computer connected to the wireless LAN and you change the ZyWALL’s ESSID or WEP settings, you will lose your wireless connection when you press [ENTER] to confirm. You must then change the wireless settings of your computer to match the ZyWALL’s new...
Page 447: Mac Address Filter Setup
ZyWALL 35 User’s Guide Table 172 Menu 3.5: Wireless LAN Setup FIELD DESCRIPTION (Request To Send) The threshold (number of bytes) for enabling RTS/CTS handshake. Threshold Data with its frame size larger than this value will perform the RTS/CTS handshake.
Page 448: Figure 245 Menu 3.5.1: Wlan Mac Address Filter
ZyWALL 35 User’s Guide Figure 245 Menu 3.5.1: WLAN MAC Address Filter Menu 3.5.1 - WLAN MAC Address Filter Active= No Filter Action= Allowed Association MAC Address Filter Address 1= 00:00:00:00:00:00 Address 2= 00:00:00:00:00:00 Address 3= 00:00:00:00:00:00 Address 4= 00:00:00:00:00:00...
Page 449: Chapter 30 Internet Access
ZyWALL 35 User’s Guide H A P T E R Internet Access This chapter shows you how to configure your ZyWALL for Internet access. 30.1 Introduction to Internet Access Setup Use information from your ISP along with the instructions in this chapter to set up your ZyWALL to access the Internet.
Page 450: Table 174 Menu 4: Internet Access Setup (Ethernet)
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 174 Menu 4: Internet Access Setup (Ethernet) FIELD DESCRIPTION ISP’s Name This is the descriptive name of your ISP for identification purposes. You can only configure the WAN 2 port in Menu 11.2 - Remote Node Profile or in the WAN WAN 2 screen via the web configurator.
Page 451: Configuring The Pptp Client
ZyWALL 35 User’s Guide 30.3 Configuring the PPTP Client Note: The ZyWALL supports only one PPTP server connection at any given time. To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 452: Basic Setup Complete
ZyWALL 35 User’s Guide Figure 248 Internet Access Setup (PPPoE) Menu 4 - Internet Access Setup ISP's Name= WAN_1 Encapsulation= PPPoE Service Type= N/A My Login= My Password= ******** Retype to Confirm= ******** Idle Timeout= 100 IP Address Assignment= Dynamic...
Page 453: Dmz Setup
ZyWALL 35 User’s Guide H A P T E R DMZ Setup This chapter describes how to configure the ZyWALL’s DMZ using Menu 5 - DMZ Setup. 31.1 Configuring DMZ Setup From the main menu, enter 5 to open Menu 5 – DMZ Setup.
Page 454: Ip Address
ZyWALL 35 User’s Guide 31.3.1 IP Address From the main menu, enter 5 to open Menu 5 - DMZ Setup to configure TCP/IP (RFC 1155). Figure 251 Menu 5: TCP/IP Setup Menu 5 - DMZ Setup 1. DMZ Port Filter Setup 2.
Page 455: Figure 253 Menu 5.2.1: Ip Alias Setup
ZyWALL 35 User’s Guide Figure 253 Menu 5.2.1: IP Alias Setup Menu 5.2.1 - IP Alias Setup IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A...
Page 456 ZyWALL 35 User’s Guide Chapter 31 DMZ Setup...
Page 457: Chapter 32 Route Setup
ZyWALL 35 User’s Guide H A P T E R Route Setup This chapter describes how to configure the ZyWALL's traffic redirect. 32.1 Configuring Route Setup From the main menu, enter 6 to open Menu 6 - Route Setup. Figure 254 Menu 6: Route Setup Menu 6 - Route Setup 1.
Page 458: Traffic Redirect
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 177 Menu 6.1: Route Assessment FIELD DESCRIPTION Probing WAN 1/2 Press [SPACE BAR] and then press [ENTER] to choose Yes to test your Check Point ZyWALL's WAN accessibility.
Page 459: Route Failover
ZyWALL 35 User’s Guide Table 178 Menu 6.2: Traffic Redirect FIELD DESCRIPTION Metric This field sets this route's priority among the routes the ZyWALL uses. Enter a number from 1 to 15 to set this route's priority among the ZyWALL's routes (see Section 7.5 on page 132...
Page 460 ZyWALL 35 User’s Guide Chapter 32 Route Setup...
Page 461: Chapter 33 Remote Node Setup
ZyWALL 35 User’s Guide H A P T E R Remote Node Setup This chapter shows you how to configure a remote node. 33.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection.
Page 462: Ethernet Encapsulation
ZyWALL 35 User’s Guide 33.3.1 Ethernet Encapsulation There are three variations of menu 11.x depending on whether you choose Ethernet Encapsulation, PPPoE Encapsulation or PPTP Encapsulation. You must choose the Ethernet option when the WAN port is used as a regular Ethernet. The first menu 11.x screen you see is for Ethernet encapsulation shown next.
Page 463: Pppoe Encapsulation
ZyWALL 35 User’s Guide Table 180 Menu 11.1: Remote Node Profile for Ethernet Encapsulation (continued) FIELD DESCRIPTION Retype to Type your password again to make sure that you have entered it correctly. Confirm Server This field is valid only when RoadRunner is selected in the Service Type field. The ZyWALL will find the RoadRunner Server IP automatically if this field is left blank.
Page 464: Outgoing Authentication Protocol
ZyWALL 35 User’s Guide Figure 260 Menu 11.1: Remote Node Profile for PPPoE Encapsulation Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPPoE Edit IP= No Service Type= Standard Telco Option: Service Name=...
Page 465: Pptp Encapsulation
ZyWALL 35 User’s Guide Table 181 Fields in Menu 11.1 (PPPoE Encapsulation Specific) FIELD DESCRIPTION Service Name If you are using PPPoE encapsulation, then type the name of your PPPoE service here. Only valid with PPPoE encapsulation. Authen This field sets the authentication protocol used for outgoing calls.
Page 466: Edit Ip
ZyWALL 35 User’s Guide Figure 261 Menu 11.1: Remote Node Profile for PPTP Encapsulation Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Allocated Budget(min)= 0...
Page 467: Figure 262 Menu 11.1.2: Remote Node Network Layer Options For Ethernet Encapsulation
ZyWALL 35 User’s Guide Figure 262 Menu 11.1.2: Remote Node Network Layer Options for Ethernet Encapsulation Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic Rem IP Addr= N/A Rem Subnet Mask= N/A My WAN Addr= N/A...
Page 468: Remote Node Filter
ZyWALL 35 User’s Guide Table 183 Remote Node Network Layer Options Menu Fields (continued) FIELD DESCRIPTION NAT Lookup If you select SUA Only in the Network Address Translation field, it displays 255 and indicates the SMT will use the pre-configured Set 255 (read only) in menu 15.1.
Page 469: Figure 263 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation)
ZyWALL 35 User’s Guide Figure 263 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 264 Menu 11.1.4: Remote Node Filter (PPPoE or PPTP Encapsulation)
Page 470 ZyWALL 35 User’s Guide Chapter 33 Remote Node Setup...
Page 471: Chapter 34 Ip Static Route Setup
ZyWALL 35 User’s Guide H A P T E R IP Static Route Setup This chapter shows you how to configure static routes with your ZyWALL. 34.1 IP Static Route Setup Enter 12 from the main menu. Select one of the IP static routes as shown next to configure IP static routes in menu 12.1.
Page 472: Figure 266 Menu 12. 1: Edit Ip Static Route
ZyWALL 35 User’s Guide Figure 266 Menu 12. 1: Edit IP Static Route Menu 12.1 - Edit IP Static Route Route #: 3 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ?
Page 473: Network Address Translation (Nat)
ZyWALL 35 User’s Guide H A P T E R Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 35.1 Using NAT Note: You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyWALL.
Page 474: Figure 267 Menu 4: Applying Nat For Internet Access
ZyWALL 35 User’s Guide Figure 267 Menu 4: Applying NAT for Internet Access Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A...
Page 475: Nat Setup
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 185 Applying NAT in Menus 4 & 11.1.2 FIELD DESCRIPTION OPTIONS Network When you select this option the SMT will use Address Mapping Set 1 Full Feature Address (menu 15.1 - see...
Page 476: Address Mapping Sets
ZyWALL 35 User’s Guide 35.2.1 Address Mapping Sets Enter 1 to bring up Menu 15.1 - Address Mapping Sets. Figure 270 Menu 15.1: Address Mapping Sets Menu 15.1 - Address Mapping Sets 1. NAT_SET 2. NAT_SET 255. SUA (read only) Enter Menu Selection Number: 35.2.1.1 SUA Address Mapping Set...
Page 477: User-Defined Address Mapping Sets
ZyWALL 35 User’s Guide Note: Menu 15.1.255 is read-only. Table 186 SUA Address Mapping Rules FIELD DESCRIPTION Set Name This is the name of the set you selected in menu 15.1 or enter the name of a new set you want to create.
Page 478: Ordering Your Rules
ZyWALL 35 User’s Guide Figure 272 Menu 15.1.1: First Set Menu 15.1.1 - Address Mapping Rules Set Name= NAT_SET Local Start IP Local End IP Global Start IP Global End IP Type --------------- ------------- --------------- ------------- ---- 0.0.0.0 255.255.255.255 0.0.0.0 0.0.0.0...
Page 479: Figure 273 Menu 15.1.1.1: Editing/Configuring An Individual Rule In A Set
ZyWALL 35 User’s Guide Table 187 Fields in Menu 15.1.1 (continued) FIELD DESCRIPTION Action The default is Edit. Edit means you want to edit a selected rule (see following field). Insert Before means to insert a rule before the rule selected. The rules after the selected rule will then be moved down by one rule.
Page 480: Configuring A Server Behind Nat
ZyWALL 35 User’s Guide Table 188 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set FIELD DESCRIPTION Global IP Start Enter the starting global IP address (IGA). If you have a dynamic IP, enter 0.0.0.0 as the Global IP Start. Note that Global IP Start can be set to 0.0.0.0 only if the types are Many- to-One or Server.
Page 481: Figure 275 Menu 15.2.1: Nat Server Setup
ZyWALL 35 User’s Guide Figure 275 Menu 15.2.1: NAT Server Setup Menu 15.2.1 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address ------------------------------------------------------ 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Select Command= None...
Page 482: Table 189 Menu 15.2.1.2: Nat Server Configuration
ZyWALL 35 User’s Guide The following table describes the fields in this screen. Table 189 Menu 15.2.1.2: NAT Server Configuration FIELD DESCRIPTION The ZyWALL has two WAN ports. You can configure port forwarding and trigger port rules for the first WAN port and separate sets of rules for the second WAN port.
Page 483: General Nat Examples
ZyWALL 35 User’s Guide Figure 277 Menu 15.2.1: NAT Server Setup Menu 15.2.1 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address ------------------------------------------------------ 0.0.0.0 192.168.1.33 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Select Command= None...
Page 484: Figure 279 Nat Example 1
ZyWALL 35 User’s Guide Figure 279 NAT Example 1 Figure 280 Menu 4: Internet Access & NAT Example Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A...
Page 485: Example 2: Internet Access With An Default Server
ZyWALL 35 User’s Guide 35.4.2 Example 2: Internet Access with an Default Server Figure 281 NAT Example 2 In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2.1 to specify the Default Server behind the NAT as shown in the next figure.
Page 486: Figure 283 Nat Example 3
ZyWALL 35 User’s Guide 1 Map the first IGA to the first inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses). 2 Map the second IGA to our second inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses).
Page 487: Figure 284 Example 3: Menu 11.1.2
ZyWALL 35 User’s Guide Figure 284 Example 3: Menu 11.1.2 Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= SUA Only Metric= 2...
Page 488: Figure 286 Example 3: Final Menu 15.1.1
ZyWALL 35 User’s Guide Figure 286 Example 3: Final Menu 15.1.1 Menu 15.1.1 - Address Mapping Rules Set Name= Example3 Local Start IP Local End IP Global Start IP Global End IP Type --------------- -------------- --------------- --------------- 1. 192.168.1.10 10.132.50.1 192.168.1.11...
Page 489: Example 4: Nat Unfriendly Application Programs
ZyWALL 35 User’s Guide Figure 287 Example 3: Menu 15.2.1 Menu 15.2.1 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address ------------------------------------------------------ 192.168.1.21 192.168.1.20 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Select Command= None...
Page 490: Figure 289 Example 4: Menu 15.1.1.1: Address Mapping Rule
ZyWALL 35 User’s Guide Figure 289 Example 4: Menu 15.1.1.1: Address Mapping Rule Menu 15.1.1.1 Address Mapping Rule Type= Many-One-to-One Local IP: Start= 192.168.1.10 = 192.168.1.12 Global IP: Start= 10.132.50.1 = 10.132.50.3 Press ENTER to Confirm or ESC to Cancel: After you’ve configured your rule, you should be able to check the settings in menu 15.1.1 as...
Page 491: Trigger Port Forwarding
ZyWALL 35 User’s Guide 35.5 Trigger Port Forwarding Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side. With regular port forwarding you set a forwarding port in NAT to forward a service (coming in from the server on the WAN) to the IP address of a computer on the client side (LAN).
Page 492: Figure 291 Menu 15.3.1: Trigger Port Setup
ZyWALL 35 User’s Guide Figure 291 Menu 15.3.1: Trigger Port Setup Menu 15.3.1 - Trigger Port Setup Incoming Trigger Rule Name Start Port End Port Start Port End Port -------------------------------------------------------------- Real Audio 6970 7170 7070 7070 Press ENTER to Confirm or ESC to Cancel:...
Page 493: Introducing The Zywall Firewall
ZyWALL 35 User’s Guide H A P T E R Introducing the ZyWALL Firewall This chapter shows you how to get started with the ZyWALL firewall. 36.1 Using ZyWALL SMT Menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown next.
Page 494: Figure 293 Menu 21.2: Firewall Setup
ZyWALL 35 User’s Guide Figure 293 Menu 21.2: Firewall Setup Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off.
Page 495: Filter Configuration
ZyWALL 35 User’s Guide H A P T E R Filter Configuration This chapter shows you how to create and apply filters. 37.1 Introduction to Filters Your ZyWALL uses filters to decide whether to allow passage of a data packet and/or to make a call.
Page 496: The Filter Structure Of The Zywall
ZyWALL 35 User’s Guide 37.1.1 The Filter Structure of the ZyWALL A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descriptive name. The ZyWALL allows you to configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system.
Page 497: Figure 295 Filter Rule Process
ZyWALL 35 User’s Guide Figure 295 Filter Rule Process You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.
Page 498: Configuring A Filter Set
ZyWALL 35 User’s Guide 37.2 Configuring a Filter Set The ZyWALL includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below. 1 Enter 21 in the main menu to open menu 21.
Page 499: Configuring A Filter Rule
ZyWALL 35 User’s Guide Table 191 Abbreviations Used in the Filter Rules Summary Menu FIELD DESCRIPTION Active: “Y” means the rule is active. “N” means the rule is inactive. Type The type of filter rule: “GEN” for Generic, “IP” for TCP/IP.
Page 500: Configuring A Tcp/Ip Filter Rule
ZyWALL 35 User’s Guide To speed up filtering, all rules in a filter set must be of the same class, i.e., protocol filters or generic filters. The class of a filter set is determined by the first rule that you create. When applying the filter sets to a port, separate menu fields are provided for protocol and device filter sets.
Page 501 ZyWALL 35 User’s Guide Table 193 Menu 21.1.1.1: TCP/IP Filter Rule FIELD DESCRIPTION Destination IP Addr Enter the destination IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0. IP Mask Enter the IP mask to apply to the Destination: IP Addr.
Page 502: Configuring A Generic Filter Rule
ZyWALL 35 User’s Guide Figure 299 Executing an IP Filter 37.2.3 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. The purpose of generic rules is Chapter 37 Filter Configuration...
Page 503: Figure 300 Menu 21.1.1.1: Generic Filter Rule
ZyWALL 35 User’s Guide to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly. For generic rules, the ZyWALL treats a packet as a byte stream as opposed to an IP or IPX packet.
Page 504: Example Filter
ZyWALL 35 User’s Guide Table 194 Generic Filter Rule Menu Fields FIELD DESCRIPTION More If Yes, a matching packet is passed to the next filter rule before an action is taken; else the packet is disposed of according to the action fields.
Page 505: Figure 302 Example Filter: Menu 21.1.3.1
ZyWALL 35 User’s Guide Figure 302 Example Filter: Menu 21.1.3.1 Menu 21.1.3.1 - TCP/IP Filter Rule Filter #: 3,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0...
Page 506: Filter Types And Nat
ZyWALL 35 User’s Guide M = N means an action can be taken immediately. The action is to drop the packet (m = D) if the action is matched and to forward the packet immediately (n = F) if the action is not matched no matter whether there are more rules to be checked (there aren’t in this example).
Page 507: Applying A Filter
ZyWALL 35 User’s Guide 37.6 Applying a Filter This section shows you where to apply the filter(s) after you design it (them). The ZyWALL already has filters to prevent NetBIOS traffic from triggering calls, and block incoming telnet, FTP and HTTP connections.
Page 508: Applying Remote Node Filters
ZyWALL 35 User’s Guide Figure 306 Filtering DMZ Traffic Menu 5.1 - DMZ Port Filter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ESC to Cancel: 37.6.3 Applying Remote Node Filters Go to menu 11.1.4 (shown below –...
Page 509: Chapter 38 Snmp Configuration
ZyWALL 35 User’s Guide H A P T E R SNMP Configuration This chapter explains SNMP configuration menu 22. 38.1 SNMP Configuration To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The “community” for Get, Set and Trap fields is SNMP terminology for password.
Page 510: Snmp Traps
ZyWALL 35 User’s Guide Table 195 SNMP Configuration Menu Fields (continued) FIELD DESCRIPTION Destination Type the IP address of the station to send your SNMP traps to. When you have completed this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel”...
Page 511: System Information & Diagnosis
ZyWALL 35 User’s Guide H A P T E R System Information & Diagnosis This chapter covers SMT menus 24.1 to 24.4. 39.1 Introduction to System Status This chapter covers the diagnostic tools that help you to maintain your ZyWALL. These tools include updates on system status, port status and log and trace capabilities.
Page 512: Figure 310 Menu 24.1: System Maintenance: Status
ZyWALL 35 User’s Guide 3 There are three commands in Menu 24.1 - System Maintenance - Status. Entering 1 drops the WAN connection, 9 resets the counters and [ESC] takes you back to the previous screen. Figure 310 Menu 24.1: System Maintenance: Status Menu 24.1 - System Maintenance - Status...
Page 513: System Information And Console Port Speed
ZyWALL 35 User’s Guide Table 197 System Maintenance: Status Menu Fields (continued) FIELD DESCRIPTION DHCP This is the DHCP setting of the port listed on the left. System up Time This is the total time the ZyWALL has been on.
Page 514: Console Port Speed
ZyWALL 35 User’s Guide Figure 312 Menu 24.2.1: System Maintenance: Information Menu 24.2.1 - System Maintenance - Information Name: Routing: IP ZyNOS F/W Version: V3.64(WZ.0)b4 | 02/24/2005 Country Code: 255 Ethernet Address: 00:A0:C5:70:F7:EB IP Address: 192.168.1.1 IP Mask: 255.255.255.0 DHCP: Server Press ESC or RETURN to Exit: The following table describes the fields in this screen.
Page 515: Log And Trace
ZyWALL 35 User’s Guide Figure 313 Menu 24.2.2: System Maintenance: Change Console Port Speed Menu 24.2.2 - System Maintenance - Change Console Port Speed Console Port Speed: 9600 Press ENTER to Confirm or ESC to Cancel:Press Space Bar to Toggle.
Page 516: Syslog Logging
ZyWALL 35 User’s Guide Figure 315 Examples of Error and Information Messages 52 Thu Jul 1 05:54:53 2004 PP05 ERROR Wireless LAN init fail, code=15 53 Thu Jul 1 05:54:53 2004 PINI INFO Channel 0 ok 54 Thu Jul 1 05:54:56 2004 PP05 -WARN...
Page 517 ZyWALL 35 User’s Guide Your ZyWALL sends five types of syslog messages. Some examples (not all ZyWALL specific) of these syslog messages with their message formats are shown next: 1 CDR CDR Message Format SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String ); String = board xx line xx channel xx, call xx, str...
Page 518 ZyWALL 35 User’s Guide Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D).
Page 519: Call-Triggering Packet
ZyWALL 35 User’s Guide 39.4.3 Call-Triggering Packet Call-Triggering Packet displays information about the packet that triggered a dial-out call in an easy readable format. Equivalent information is available in menu 24.1 in hex format. An example is shown next. Figure 317 Call-Triggering Packet Example IP Frame: ENET0-RECV Size: Time: 17:02:44.262...
Page 520: Wan Dhcp
ZyWALL 35 User’s Guide 1 From the main menu, select option 24 to open Menu 24 - System Maintenance. 2 From this menu, select option 4. Diagnostic. This will open Menu 24.4 - System Maintenance - Diagnostic. Figure 318 Menu 24.4: System Maintenance: Diagnostic Menu 24.4 - System Maintenance - Diagnostic...
Page 521: Table 200 System Maintenance Menu Diagnostic
ZyWALL 35 User’s Guide Table 200 System Maintenance Menu Diagnostic FIELD DESCRIPTION Ping Host Enter 1 to ping any machine (with an IP address) on your LAN or WAN. Enter its IP address in the Host IP Address field below.
Page 522 ZyWALL 35 User’s Guide Chapter 39 System Information & Diagnosis...
Page 523: Firmware And Configuration File Maintenance
ZyWALL 35 User’s Guide H A P T E R Firmware and Configuration File Maintenance This chapter tells you how to back up and restore your configuration file as well as upload new firmware and a new configuration file. 40.1 Introduction Use the instructions in this chapter to change the ZyWALL’s configuration file or upgrade its...
Page 524: Backup Configuration
ZyWALL 35 User’s Guide The following table is a summary. Please note that the internal filename refers to the filename on the ZyWALL and the external filename refers to the filename not on the ZyWALL, that is, on your computer, local network or FTP site and so the name (but not the extension) may vary.
Page 525: Using The Ftp Command From The Command Line
ZyWALL 35 User’s Guide Figure 320 Telnet into Menu 24.5 Menu 24.5 - Backup Configuration To transfer the configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your router. Then type "root"...
Page 526: Example Of Ftp Commands From The Command Line
ZyWALL 35 User’s Guide 40.3.3 Example of FTP Commands from the Command Line Figure 321 FTP Session Example 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay...
Page 527: Backup Configuration Using Tftp
ZyWALL 35 User’s Guide 4 The IP you entered in the Secured Client IP field in menu 24.11 does not match the client IP. If it does not match, the ZyWALL will disconnect the Telnet session immediately. 5 You have an SMT console session running.
Page 528: Gui-Based Tftp Clients
ZyWALL 35 User’s Guide 40.3.8 GUI-based TFTP Clients The following table describes some of the fields that you may see in GUI-based TFTP clients. Table 203 General Commands for GUI-based TFTP Clients COMMAND DESCRIPTION Host Enter the IP address of the ZyWALL. 192.168.1.1 is the ZyWALL’s default IP address when shipped.
Page 529: Restore Configuration
ZyWALL 35 User’s Guide Figure 324 Backup Configuration Example Type a location for storing the configuration file or click Browse to look for one. Choose the Xmodem protocol. Then click Receive. 4 After a successful backup you will see the following screen. Press any key to return to the SMT menu.
Page 530: Figure 326 Telnet Into Menu 24.6
ZyWALL 35 User’s Guide Figure 326 Telnet into Menu 24.6 Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation.
Page 531: Restore Using Ftp Session Example
ZyWALL 35 User’s Guide 40.4.2 Restore Using FTP Session Example Figure 327 Restore Using FTP Session Example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec.
Page 532: Uploading Firmware And Configuration Files
ZyWALL 35 User’s Guide Figure 330 Restore Configuration Example Type the configuration file’s location, or click Browse to search for it. Choose the Xmodem protocol. Then click Send. 4 After a successful restoration you will see the following screen. Press any key to restart the ZyWALL and return to the SMT menu.
Page 533: Configuration File Upload
ZyWALL 35 User’s Guide Figure 332 Telnet Into Menu 24.7.1: Upload System Firmware Menu 24.7.1 - System Maintenance - Upload System Firmware To upload the system firmware, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your system. Then type "root" and SMT password as requested.
Page 534: Ftp Session Example Of Firmware File Upload
ZyWALL 35 User’s Guide 2 Enter “open”, followed by a space and the IP address of your ZyWALL. 3 Press [ENTER] when prompted for a username. 4 Enter your password as requested (the default is “1234”). 5 Enter “bin” to set transfer mode to binary.
Page 535: Tftp Upload Command Example
ZyWALL 35 User’s Guide 2 Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 – System Maintenance. 3 Enter the command “sys stdio 0” to disable the console timeout, so the TFTP transfer will not be interrupted. Enter “command sys stdio 5” to restore the five-minute console timeout (default) when the file transfer is complete.
Page 536: Example Xmodem Firmware Upload Using Hyperterminal
ZyWALL 35 User’s Guide Figure 335 Menu 24.7.1 As Seen Using the Console Port Menu 24.7.1 - System Maintenance - Upload System Firmware To upload system firmware: 1. Enter "y" at the prompt below to go into debug mode. 2. Enter "atur" after "Enter Debug Mode" message.
Page 537: Example Xmodem Configuration Upload Using Hyperterminal
ZyWALL 35 User’s Guide Figure 337 Menu 24.7.2 As Seen Using the Console Port Menu 24.7.2 - System Maintenance - Upload System Configuration File To upload system configuration file: 1. Enter "y" at the prompt below to go into debug mode.
Page 538 ZyWALL 35 User’s Guide Chapter 40 Firmware and Configuration File Maintenance...
Page 539: System Maintenance Menus 8 To 10
ZyWALL 35 User’s Guide H A P T E R System Maintenance Menus 8 to This chapter leads you through SMT menus 24.8 to 24.10. 41.1 Command Interpreter Mode The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions.
Page 540: Command Usage
A list of commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished. Figure 340 Valid Commands Copyright (c) 1994 - 2005 ZyXEL Communications Corp. ras> ? Valid commands are:...
Page 541: Call Control Support
ZyWALL 35 User’s Guide 41.2 Call Control Support The ZyWALL provides two call control functions: budget management and call history. Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1.
Page 542: Call History
ZyWALL 35 User’s Guide Figure 342 Budget Management Menu 24.9.1 - Budget Management Remote Node Connection Time/Total Budget Elapsed Time/Total Period 1.WAN_1 No Budget No Budget 2.WAN_2 No Budget No Budget 3.Dial No Budget No Budget Reset Node (0 to update screen): The total budget is the time limit on the accumulated time for outgoing calls to a remote node.
Page 543: Time And Date Setting
ZyWALL 35 User’s Guide Figure 343 Call History Menu 24.9.2 - Call History Phone Number Rate #call Total Enter Entry to Delete(0 to exit): The following table describes the fields in this screen. Table 206 Call History FIELD DESCRIPTION Phone Number The PPPoE service names are shown here.
Page 544: Figure 344 Menu 24: System Maintenance
ZyWALL 35 User’s Guide Figure 344 Menu 24: System Maintenance Menu 24 - System Maintenance System Status System Information and Console Port Speed Log and Trace Diagnostic Backup Configuration Restore Configuration Upload Firmware Command Interpreter Mode Call Control 10. Time and Date Setting 11.
Page 545: Table 207 Menu 24.10 System Maintenance: Time And Date Setting
ZyWALL 35 User’s Guide Table 207 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION Time Protocol Enter the time service protocol that your timeserver uses. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works.
Page 546: Resetting The Time
ZyWALL 35 User’s Guide Table 207 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION End Date (mm- Configure the day and time when Daylight Saving Time ends if you selected Yes in nth-week-hr) the Daylight Saving field. The hr field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time ends in the United States on the last Sunday of October.
Page 547: Chapter 42 Remote Management
ZyWALL 35 User’s Guide H A P T E R Remote Management This chapter covers remote management found in SMT menu 24.11. 42.1 Remote Management Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers.
Page 548: Figure 346 Menu 24.11 - Remote Management Control
ZyWALL 35 User’s Guide Figure 346 Menu 24.11 – Remote Management Control Menu 24.11 - Remote Management Control TELNET Server: Port = 23 Access = ALL Secure Client IP = 0.0.0.0 FTP Server: Port = 21 Access = ALL Secure Client IP = 0.0.0.0...
Page 549: Remote Management Limitations
ZyWALL 35 User’s Guide 42.1.1 Remote Management Limitations Remote management over LAN or WAN will not work when: 1 A filter in menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service.
Page 550 ZyWALL 35 User’s Guide Chapter 42 Remote Management...
Page 551: Chapter 43 Ip Policy Routing
ZyWALL 35 User’s Guide H A P T E R IP Policy Routing This chapter covers setting and applying policies used for IP routing. 43.1 IP Routing Policy Summary Menu 25 shows the summary of a policy rule, including the criteria and the action of a single policy, and whether a policy is active or not.
Page 552: Ip Routing Policy Setup
ZyWALL 35 User’s Guide Table 209 Menu 25: Sample IP Routing Policy Summary (continued) FIELD DESCRIPTION Criteria/Action This displays the details about to which packets the policy applies and how the policy has the ZyWALL handle those packets. Refer to Table 210 on page 550 detailed information.
Page 553: Figure 348 Menu 25.1: Ip Routing Policy Setup
ZyWALL 35 User’s Guide 1 Type 25 in the main menu to open Menu 25 - IP Routing Policy Summary. 2 Select Edit in the Select Command field; type the index number of the rule you want to configure in the Select Rule field and press [ENTER] to open Menu 25.1 - IP Routing Policy Setup (see the next figure).
Page 554: Applying Policy To Packets
ZyWALL 35 User’s Guide Table 211 Menu 25.1: IP Routing Policy Setup FIELD DESCRIPTION port start / end Source port number range from start to end; applicable only for TCP/UDP. Destination addr start / end Destination IP address range from start to end.
Page 555: Ip Policy Routing Example
ZyWALL 35 User’s Guide Figure 349 Menu 25.1.1: IP Routing Policy Setup Menu 25.1.1 - IP Routing Policy Setup Apply policy to packets received from: LAN= No DMZ= No ALL WAN= Yes Selected Remote Node index= N/A Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this screen.
Page 556: Figure 350 Example Of Ip Policy Routing
ZyWALL 35 User’s Guide Figure 350 Example of IP Policy Routing To force Web packets coming from clients with IP addresses of 192.168.1.33 to 192.168.1.64 to be routed to the Internet via the WAN port of the ZyWALL, follow the steps as shown next.
Page 557: Figure 352 Ip Routing Policy Example 2
ZyWALL 35 User’s Guide 4 Create another rule in menu 25.1 for this rule to route packets from any host (IP=0.0.0.0 means any host) with protocol TCP and port FTP access through another gateway (192.168.1.100). Figure 352 IP Routing Policy Example 2 Menu 25.1 - IP Routing Policy Setup...
Page 558 ZyWALL 35 User’s Guide Chapter 43 IP Policy Routing...
Page 559: Chapter 44 Call Scheduling
ZyWALL 35 User’s Guide H A P T E R Call Scheduling Call scheduling allows you to dictate when a remote node should be called and for how long. 44.1 Introduction to Call Scheduling The call scheduling feature allows the ZyWALL to manage a remote node and dictate when a remote node should be called and for how long.
Page 560: Figure 354 Schedule Set Setup
ZyWALL 35 User’s Guide To set up a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press [ENTER] to see Menu 26.1 - Schedule Set Setup as shown next. Figure 354 Schedule Set Setup Menu 26.1 - Schedule Set Setup...
Page 561: Figure 355 Applying Schedule Set(S) To A Remote Node (Pppoe)
ZyWALL 35 User’s Guide Table 213 Schedule Set Setup (continued) FIELD DESCRIPTION Action Forced On means that the connection is maintained whether or not there is a demand call on the line and will persist for the time period specified in the Duration field.
Page 562: Figure 356 Applying Schedule Set(S) To A Remote Node (Pptp)
ZyWALL 35 User’s Guide Figure 356 Applying Schedule Set(s) to a Remote Node (PPTP) Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Allocated Budget(min)= 0...
Page 563: Chapter 45 Troubleshooting
ZyWALL 35 User’s Guide H A P T E R Troubleshooting This chapter covers potential problems and possible remedies. After each problem description, some instructions are provided to help you to diagnose and to solve the problem. Please see our included disk for further information.
Page 564: Problems With The Dmz Interface
ZyWALL 35 User’s Guide 45.3 Problems with the DMZ Interface Table 216 Troubleshooting the DMZ Interface PROBLEM CORRECTIVE ACTION Cannot access Check your Ethernet cable type and connections. Refer to the Quick Start Guide servers on the DMZ for DMZ connection instructions.
Page 565: Problems With Internet Access
ZyWALL 35 User’s Guide 45.5 Problems with Internet Access Table 218 Troubleshooting Internet Access PROBLEM CORRECTIVE ACTION Cannot access the Connect your cable/DSL modem with the ZyWALL using the appropriate cable. Internet. Check with the manufacturer of your cable/DSL device about your cable requirement because some devices may require crossover cable and others a regular straight-through cable.
Page 566: Pop-Up Windows, Javascripts And Java Permissions
ZyWALL 35 User’s Guide Table 220 Troubleshooting Accessing the ZyWALL PROBLEM CORRECTIVE ACTION Cannot access the 1. Check to see if the ZyWALL is connected to your computer's console port. ZyWALL via the 2. Check to see if the communications program is configured correctly. The console port.
Page 567: Internet Explorer Pop-Up Blockers
ZyWALL 35 User’s Guide 45.7.1.1 Internet Explorer Pop-up Blockers You may have to disable pop-up blocking to log into your device. Either disable pop-up blocking (enabled by default in Windows XP SP (Service Pack) 2) or allow pop-up blocking and create an exception for your device’s IP address.
Page 568: Figure 358 Internet Options
ZyWALL 35 User’s Guide Figure 358 Internet Options 3 Click Apply to save this setting. 45.7.1.1.2 Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab.
Page 569: Figure 359 Internet Options
ZyWALL 35 User’s Guide Figure 359 Internet Options 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites.
Page 570: Javascripts
ZyWALL 35 User’s Guide Figure 360 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. 45.7.1.2 JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed.
Page 571: Figure 361 Internet Options
ZyWALL 35 User’s Guide Figure 361 Internet Options 2 Click the Custom Level... button. 3 Scroll down to Scripting. 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is selected (the default).
Page 572: Java Permissions
ZyWALL 35 User’s Guide Figure 362 Security Settings - Java Scripting 45.7.1.3 Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is selected.
Page 573: Figure 363 Security Settings - Java
ZyWALL 35 User’s Guide Figure 363 Security Settings - Java 45.7.1.3.1 JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 make sure that Use Java 2 for <applet> under Java (Sun) is selected.
Page 574: Figure 364 Java (Sun)
ZyWALL 35 User’s Guide Figure 364 Java (Sun) Chapter 45 Troubleshooting...
Page 575: Product Specifications
ZyWALL 35 User’s Guide P P E N D I X Product Specifications See also the Introduction chapter for a general overview of the key features. Specification Tables Table 1 Device Specifications Default IP Address 192.168.1.1 Default Subnet Mask 255.255.255.0 (24 bits)
Page 576: Table 3 Firmware Features
ZyWALL 35 User’s Guide Table 2 Performance User Licenses Unlimited Concurrent Sessions 10,000 Simultaneous IPSec VPN Connections Table 3 Firmware Features Modes of Operation Routing/NAT/SUA Mode Transparent Mode Firewall (ICSA Certified) IP Protocol/Packet Filter DoS and DDoS protections Stateful Packet Inspection...
Page 577: Table 4 Feature Specifications
ZyWALL 35 User’s Guide Table 3 Firmware Features (continued) Wireless IEEE 802.11b Compliant IEEE 802.11g Compliant Frequency Range: 2.4 GHz Advanced Orthogonal Frequency Division Multiplexing (OFDM) IEEE 802.1x Authentication (Internal Database and External RADIUS) Store up to 32 built-in user profiles using EAP-MD5 (Internal Database)
Page 578: Table 5 Compatible Zyxel Wlan Cards And Security Features
ZyWALL 35 User’s Guide Table 4 Feature Specifications (continued) FEATURE SPECIFICATION Number of DNS Address Record Entries Number of DNS Name Server Record Entries Compatible ZyXEL WLAN Cards The following table lists the ZyXEL WLAN cards that you can use in the ZyWALL at the time of writing.
Page 579: Figure 1 Wlan Card Installation
ZyWALL 35 User’s Guide Figure 1 WLAN Card Installation Cable Pin Assignments In a serial communications connection, generally a computer is DTE (Data Terminal Equipment) and a modem is DCE (Data Circuit-terminating Equipment). The ZyWALL is DCE when you connect a computer to the console port. The ZyWALL is DTE when you connect a modem to the dial backup port.
Page 580: Figure 3 Ethernet Cable Pin Assignments
ZyWALL 35 User’s Guide Table 6 Console/Dial Backup Port Pin Assignments CONSOLE Port RS – 232 (Female) DB-9F DIAL BACKUP RS – 232 (Male) DB-9M (Not on all models) Pin 1 = NON Pin 1 = NON Pin 2 = DCE-TXD Pin 2 = DTE-RXD Pin 3 = DCE –RXD...
Page 581: Table 8 European Union Ac Power Adaptor Specifications
ZyWALL 35 User’s Guide Table 8 European Union AC Power Adaptor Specifications AC Power Adapter model AD-1201200DV Input power: AC230Volts/50Hz/0.2A Output power: DC12Volts/1.2A Power consumption: 10 W Plug: European Union standards Safety standards: TUV, CE (EN 60950) AC Power Adapter model JAD-121200E Input power: AC230Volts/50Hz, Output power: DC12Volts/1.2A...
Page 582 ZyWALL 35 User’s Guide Table 11 Australia and New Zealand AC Power Adaptor Specification (continued) Power consumption: 10 W Plug: Australia and New Zealand standards Safety standards: NATA (AS 3260) Appendix A Product Specifications...
Page 583: Setting Up Your Computer's Ip Address
ZyWALL 35 User’s Guide P P E N D I X Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/ IP on your computer.
Page 584: Figure 4 Windows 95/98/Me: Network: Configuration
ZyWALL 35 User’s Guide Figure 4 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add.
Page 585: Figure 5 Windows 95/98/Me: Tcp/Ip Properties: Ip Address
ZyWALL 35 User’s Guide 3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click 5 Restart your computer so the changes you made take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab.
Page 586: Figure 6 Windows 95/98/Me: Tcp/Ip Properties: Dns Configuration
ZyWALL 35 User’s Guide Figure 6 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab. • If you do not know your gateway’s IP address, remove previously installed gateways. • If you have a gateway IP address, type it in the New gateway field and click Add.
Page 587: Figure 7 Windows Xp: Start Menu
ZyWALL 35 User’s Guide Figure 7 Windows XP: Start Menu 2 In the Control Panel, double-click Network Connections (Network and Dial-up Connections in Windows 2000/NT). Figure 8 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties.
Page 588: Figure 9 Windows Xp: Control Panel: Network Connections: Properties
ZyWALL 35 User’s Guide Figure 9 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties. Figure 10 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP).
Page 589: Figure 11 Windows Xp: Internet Protocol (Tcp/Ip) Properties
ZyWALL 35 User’s Guide • If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. • Click Advanced. Figure 11 Windows XP: Internet Protocol (TCP/IP) Properties 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK.
Page 590: Figure 12 Windows Xp: Advanced Tcp/Ip Properties
ZyWALL 35 User’s Guide Figure 12 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es).
Page 591: Figure 13 Windows Xp: Internet Protocol (Tcp/Ip) Properties
ZyWALL 35 User’s Guide Figure 13 Windows XP: Internet Protocol (TCP/IP) Properties 8 Click OK to close the Internet Protocol (TCP/IP) Properties window. 9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 10 Close the Network Connections window (Network and Dial-up Connections in Windows 2000/NT).
Page 592: Figure 14 Macintosh Os 8/9: Apple Menu
ZyWALL 35 User’s Guide Figure 14 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 15 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. Appendix B Setting up Your Computer’s IP Address...
Page 593: Figure 16 Macintosh Os X: Apple Menu
ZyWALL 35 User’s Guide 4 For statically assigned settings, do the following: • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box. •...
Page 594: Figure 17 Macintosh Os X: Network
ZyWALL 35 User’s Guide Figure 17 Macintosh OS X: Network 4 For statically assigned settings, do the following: • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box.
Page 595: Appendix Cip Subnetting
ZyWALL 35 User’s Guide P P E N D I X IP Subnetting IP Addressing Routers “route” based on the network number. The router that delivers the data packet to the correct destination host uses the host ID. IP Classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1.
Page 596: Table 13 Allowed Ip Address Range By Class
ZyWALL 35 User’s Guide Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127. Similarly the first octet of a class “B” must begin with “10”, therefore the first octet of a class “B”...
Page 597: Table 15 Alternative Subnet Mask Notation
ZyWALL 35 User’s Guide For example, 192.1.1.0 /25 is equivalent to saying 192.1.1.0 with mask 255.255.255.128. The following table shows all possible subnet masks for a class “C” address using both notations. Table 15 Alternative Subnet Mask Notation SUBNET MASK IP ADDRESS SUBNET MASK “1”...
Page 598: Table 17 Subnet 1
ZyWALL 35 User’s Guide Note: In the following charts, shaded/bolded last octet bit values indicate host ID bits “borrowed” to form network ID bits. The number of “borrowed” host ID bits determines the number of subnets you can have. The remaining number of host ID bits (after “borrowing”) determines the number of hosts you can have...
Page 599: Table 19 Subnet 1
ZyWALL 35 User’s Guide Example: Four Subnets The above example illustrated using a 25-bit subnet mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits (11111111.11111111.11111111.11000000) or 255.255.255.192.
Page 600: Table 22 Subnet 4
ZyWALL 35 User’s Guide Table 22 Subnet 4 NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. IP Address (Binary) 11000000.10101000.00000001. 11000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: Lowest Host ID: 192.168.1.193 192.168.1.192 Broadcast Address: Highest Host ID: 192.168.1.254 192.168.1.255...
Page 601: Table 25 Class B Subnet Planning
ZyWALL 35 User’s Guide Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID.
Page 602 ZyWALL 35 User’s Guide Appendix C IP Subnetting...
Page 603: Appendix Dpppoe
ZyWALL 35 User’s Guide P P E N D I X PPPoE PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your computer to an ATM PVC (Permanent Virtual Circuit) which connects to a DSL Access...
Page 604: Figure 18 Single-Computer Per Router Hardware Configuration
ZyWALL 35 User’s Guide Figure 18 Single-Computer per Router Hardware Configuration How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the computer and the computer runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC).
Page 605: Appendix Epptp
ZyWALL 35 User’s Guide P P E N D I X PPTP What is PPTP? PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames. How can we transport PPP frames from a computer to a broadband...
Page 606: Figure 21 Pptp Protocol Overview
ZyWALL 35 User’s Guide PPTP Protocol Overview PPTP is very similar to L2TP, since L2TP is based on both PPTP and L2F (Cisco’s Layer 2 Forwarding). Conceptually, there are three parties in PPTP, namely the PNS (PPTP Network Server), the PAC (PPTP Access Concentrator) and the PPTP user. The PNS is the box that hosts both the PPP and the PPTP stacks and forms one end of the PPTP tunnel.
Page 607: Figure 22 Example Message Exchange Between Computer And An Ant
ZyWALL 35 User’s Guide Figure 22 Example Message Exchange between Computer and an ANT PPP Data Connection The PPP frames are tunneled between the PNS and PAC over GRE (General Routing Encapsulation, RFC 1701, 1702). The individual calls within a tunnel are distinguished using the Call ID field in the GRE header.
Page 608 ZyWALL 35 User’s Guide Appendix E PPTP...
Page 609: Appendix F Wireless Lans
ZyWALL 35 User’s Guide P P E N D I X Wireless LANs Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless stations (A, B, C).
Page 610: Figure 24 Basic Service Set
ZyWALL 35 User’s Guide Figure 24 Basic Service Set An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS).
Page 611: Figure 25 Infrastructure Wlan
ZyWALL 35 User’s Guide Figure 25 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.11a/b/g wireless devices. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a different channel than an adjacent AP (access point) to reduce interference.
Page 612: Figure 26 Rts/Cts
ZyWALL 35 User’s Guide Figure 26 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations.
Page 613: Table 26 Ieee802.11G
ZyWALL 35 User’s Guide A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size.
Page 614 ZyWALL 35 User’s Guide IEEE 802.1x In June 2001, the IEEE 802.1x standard was designed to extend the features of IEEE 802.11 to support extended authentication as well as providing additional accounting and control features. It is supported by Windows XP and a number of network devices. Some advantages of IEEE 802.1x are:...
Page 615: Figure 27 Eap Authentication
ZyWALL 35 User’s Guide • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: •...
Page 616: Types Of Authentication
ZyWALL 35 User’s Guide 3 The wireless station replies with identity information, including username and password. 4 The RADIUS server checks the user information against its user profile database and determines whether or not to authenticate the wireless station. Types of Authentication This section discusses some popular authentication types: EAP-MD5, EAP-TLS, EAP- TTLS, PEAP and LEAP.
Page 617: Wep Authentication Steps
ZyWALL 35 User’s Guide PEAP (Protected EAP) Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use simple username and password methods through the secured connection to authenticate the clients, thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication.
Page 618: Figure 28 Wep Authentication Steps
ZyWALL 35 User’s Guide Figure 28 WEP Authentication Steps Open system authentication involves an unencrypted two-message procedure. A wireless station sends an open system authentication request to the AP, which will then automatically accept and connect the wireless station to the network. In effect, open system is not authentication at all as any station can gain access to the network.
Page 619: Table 27 Comparison Of Eap Authentication Types
ZyWALL 35 User’s Guide Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are often deployed in corporate environments, but for public deployment, a simple user name and password pair is more practical. The following table is a comparison of the features of authentication types.
Page 620: Table 28 Wireless Security Relational Matrix
ZyWALL 35 User’s Guide The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data packets, altering them and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match, it is assumed that the data has been tampered with and the packet is dropped.
Page 621: Figure 29 Roaming Example
ZyWALL 35 User’s Guide In a network environment with multiple access points, wireless stations are able to switch from one access point to another as they move between the coverage areas. This is roaming. As the wireless station moves from place to place, it is responsible for choosing the most appropriate access point depending on the signal strength, network utilization or other factors.
Page 622: Requirements For Roaming
ZyWALL 35 User’s Guide Requirements for Roaming The following requirements must be met in order for wireless stations to roam between the coverage areas. 1 All the access points must be on the same subnet and configured with the same ESSID.
Page 623: Appendix G Triangle Route
ZyWALL 35 User’s Guide P P E N D I X Triangle Route The Ideal Setup When the firewall is on, your ZyWALL acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the ZyWALL to protect your LAN against attacks.
Page 624: Figure 31 "Triangle Route" Problem
ZyWALL 35 User’s Guide Figure 31 “Triangle Route” Problem The “Triangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface.
Page 625: Figure 32 Ip Alias
ZyWALL 35 User’s Guide Figure 32 IP Alias Gateways on the WAN Side A second solution to the “triangle route” problem is to put all of your network gateways on the WAN side as the following figure shows. This ensures that all incoming network traffic passes through your ZyWALL to your LAN.
Page 626 ZyWALL 35 User’s Guide Appendix G Triangle Route...
Page 627: Sip Passthrough
ZyWALL 35 User’s Guide P P E N D I X SIP Passthrough The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet.
Page 628: Figure 34 Sip User Agent Server
ZyWALL 35 User’s Guide Table 29 SIP Call Progression (continued) 3. OK 4. ACK 5.Dialogue (voice traffic) 6. BYE 7. OK 1 A sends a SIP INVITE request to B. This message is an invitation for B to participate in a SIP telephone call.
Page 629: Figure 35 Sip Proxy Server
ZyWALL 35 User’s Guide In the following example, you want to use client device A to call someone who is using client device C. 1 The client device (A in the figure) sends a call invitation to the SIP proxy server (B).
Page 630: Figure 36 Sip Redirect Server
ZyWALL 35 User’s Guide Figure 36 SIP Redirect Server SIP Register Server A SIP register server maintains a database of SIP identity-to-IP address (or domain name) mapping. The register server checks your user name and password when you register. When you make a VoIP call using SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer.
Page 631: Figure 37 Zywall Sip Alg
ZyWALL 35 User’s Guide ZyXEL SIP ALG • SIP clients can be connected to the LAN, WLAN or DMZ. A SIP server must be on the WAN. The WLAN and DMZ are not available on all models. • You can make and receive calls between the LAN and the WAN, between the WLAN and the WAN and/or between the DMZ and the WAN.
Page 632: Signaling Session Timeout
ZyWALL 35 User’s Guide If the primary WAN connection fails, the SIP client needs to re-register with the SIP server through the secondary WAN port to have the SIP connection go through the secondary WAN port. When the ZyWALL uses both of the WAN ports at the same time, you can configure a routing policy to have the voice traffic from any IP address with UDP port 5060 and the RTP ports go over a specified WAN port.
Page 633: Appendix Ivpn Setup
ZyWALL 35 User’s Guide P P E N D I X VPN Setup This appendix will help you to quickly create a IPSec/VPN connection between two ZyXEL IPSec routers. It should be considered a quick reference for experienced users. General Notes •...
Page 634: Figure 38 Vpn Rules
ZyWALL 35 User’s Guide The following pages show a typical configuration that builds a tunnel between two private networks. One network is the headquarters (HQ) and the other is a branch office. Both sites have static (fixed) public addresses. Replace the Remote Gateway Address and Local/ Remote Starting IP Address settings with your own values.
Page 635: Figure 39 Headquarters Gateway Policy Edit
ZyWALL 35 User’s Guide Figure 39 Headquarters Gateway Policy Edit The IP address of the branch office IPSec router. Appendix I VPN Setup...
Page 636: Figure 40 Branch Office Gateway Policy Edit
ZyWALL 35 User’s Guide Figure 40 Branch Office Gateway Policy Edit The IP address of the headquarters IPSec router. 3 Click the add network policy ( ) icon next to the BRANCH gateway policy to configure a VPN policy. Appendix I VPN Setup...
Page 637: Figure 41 Headquarters Vpn Rule
ZyWALL 35 User’s Guide Figure 41 Headquarters VPN Rule Figure 42 Branch Office VPN Rule 4 Configure the screens in the headquarters and the branch office as follows and click Apply. Appendix I VPN Setup...
Page 638: Figure 43 Headquarters Network Policy Edit
ZyWALL 35 User’s Guide Figure 43 Headquarters Network Policy Edit Activate the network policy. IP addresses on different subnets. Appendix I VPN Setup...
Page 639: Figure 44 Branch Office Network Policy Edit
ZyWALL 35 User’s Guide Figure 44 Branch Office Network Policy Edit Activate the network policy. IP addresses on different subnets. Dialing the VPN Tunnel via Web Configurator To test whether the IPSec routers can build the VPN tunnel, click the dial ( ) icon in the VPN Rules (IKE) screen to have the IPSec routers set up the tunnel.
Page 640: Figure 45 Vpn Rule Configured
ZyWALL 35 User’s Guide Figure 45 VPN Rule Configured The following screen displays. Figure 46 VPN Dial This screen displays later if the IPSec routers can build the VPN tunnel. Figure 47 VPN Tunnel Established Appendix I VPN Setup...
Page 641: Vpn Troubleshooting
ZyWALL 35 User’s Guide VPN Troubleshooting If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into the web configurators of both ZyXEL IPSec routers. Check the settings in each field methodically and slowly.
Page 642: Figure 48 Vpn Log Example
ZyWALL 35 User’s Guide Figure 48 VPN Log Example ras> sys log disp ike ipsec .time source destination notes message 0|01/11/2001 18:47:22 |5.6.7.8 |5.1.2.3 |IKE Rule [ex-1] Tunnel built successfully 1|01/11/2001 18:47:22 |5.6.7.8 |5.1.2.3 |IKE The cookie pair is : 0xDAC0B43FBDE154F5 / 0xC5156C099C3F7DCA 2|01/11/2001 18:47:22 |5.6.7.8...
Page 643: Figure 49 Ike/Ipsec Debug Example
ZyWALL 35 User’s Guide IPSec Debug If you are having difficulty building an IPSec tunnel to a non-ZyXEL IPSec router, advanced users may wish to examine the IPSec debug feature (Menu 24.8). Note: If any of your VPN rules have an active network policy set to nailed-up, using the IPSec debug feature may cause the ZyWALL to continuously display new information.
Page 644: Use A Vpn Tunnel
ZyWALL 35 User’s Guide Use a VPN Tunnel A VPN tunnel gives you a secure connection to another computer or network. The VPN Status screen displays whether or not your VPN tunnel is connected. Example VPN tunnel uses are securely sending and retrieving files, and accessing corporate network drives, web servers and email.
Page 645: Importing Certificates
ZyWALL 35 User’s Guide P P E N D I X Importing Certificates This appendix shows importing certificates examples using Internet Explorer 5. Import ZyWALL Certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the ZyWALL’s server certificate by importing it into your operating system as a trusted certification authority.
Page 646: Figure 51 Login Screen
ZyWALL 35 User’s Guide Figure 51 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 52 Certificate General Information before Import 3 Click Next to begin the Install Certificate wizard. Appendix J Importing Certificates...
Page 647: Figure 53 Certificate Import Wizard 1
ZyWALL 35 User’s Guide Figure 53 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next. Figure 54 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard. Appendix J Importing Certificates...
Page 648: Figure 55 Certificate Import Wizard 3
ZyWALL 35 User’s Guide Figure 55 Certificate Import Wizard 3 6 Click Yes to add the ZyWALL certificate to the root store. Figure 56 Root Certificate Store Appendix J Importing Certificates...
Page 649: Figure 57 Certificate General Information After Import
ZyWALL 35 User’s Guide Figure 57 Certificate General Information after Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyWALL. You must have imported at least one trusted CA to the ZyWALL in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details).
Page 650: Figure 58 Zywall Trusted Ca Screen
ZyWALL 35 User’s Guide Figure 58 ZyWALL Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). Installing the CA’s Certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown next.
Page 651: Figure 59 Ca Certificate Example
ZyWALL 35 User’s Guide Figure 59 CA Certificate Example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment.
Page 652: Figure 60 Personal Certificate Import Wizard 1
ZyWALL 35 User’s Guide Figure 60 Personal Certificate Import Wizard 1 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate.
Page 653: Figure 62 Personal Certificate Import Wizard 3
ZyWALL 35 User’s Guide Figure 62 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 63 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process.
Page 654: Figure 64 Personal Certificate Import Wizard 5
ZyWALL 35 User’s Guide Figure 64 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 65 Personal Certificate Import Wizard 6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS.
Page 655: Figure 67 Ssl Client Authentication
ZyWALL 35 User’s Guide Figure 67 SSL Client Authentication 3 You next see the ZyWALL login screen. Figure 68 ZyWALL Secure Login Screen Appendix J Importing Certificates...
Page 656 ZyWALL 35 User’s Guide Appendix J Importing Certificates...
Page 657: Appendix K Command Interpreter
ZyWALL 35 User’s Guide P P E N D I X Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 - Command Interpreter Mode.
Page 658 ZyWALL 35 User’s Guide Appendix K Command Interpreter...
Page 659: Appendix L Firewall Commands
ZyWALL 35 User’s Guide P P E N D I X Firewall Commands The following describes the firewall commands. See Appendix K on page 655 for information on the command structure. Table 30 Firewall Commands FUNCTION COMMAND DESCRIPTION Firewall Set-Up This command turns the firewall on or off.
Page 660 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION E-mail This command sets the IP address to which config edit firewall e-mail the e-mail messages are sent. mail-server <ip address of mail server> This command sets the source e-mail address config edit firewall e-mail of the firewall e-mails.
Page 661 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets the threshold rate of new config edit firewall attack half-open sessions per minute where the minute-high <0-255> ZyWALL starts deleting old half-opened sessions until it gets them down to the minute- low threshold.
Page 662 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets how long ZyWALL lets an Config edit firewall set <set inactive TCP connection remain open before #> tcp-idle-timeout <seconds> considering it closed. This command sets whether or not the Config edit firewall set <set...
Page 663 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets a rule to have the config edit firewall set <set ZyWALL check for traffic with a particular #> rule <rule #> destaddr- subnet destination (defined by IP address and subnet <ip address>...
Page 664 ZyWALL 35 User’s Guide Appendix L Firewall Commands...
Page 665: Netbios Filter Commands
ZyWALL 35 User’s Guide P P E N D I X NetBIOS Filter Commands The following describes the NetBIOS packet filter commands. See Appendix K on page 655 for information on the command structure. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN.
Page 666: Table 31 Netbios Filter Default Settings
ZyWALL 35 User’s Guide The filter types and their default settings are as follows. Table 31 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN This field displays whether NetBIOS packets are blocked or forwarded Block and WAN between the LAN and the WAN.
Page 667 ZyWALL 35 User’s Guide This command blocks IPSec NetBIOS packets. sys filter netbios config 3 on This command stops NetBIOS commands from initiating calls. sys filter netbios config 4 off Appendix M NetBIOS Filter Commands...
Page 668 ZyWALL 35 User’s Guide Appendix M NetBIOS Filter Commands...
Page 669: Certificates Commands
ZyWALL 35 User’s Guide P P E N D I X Certificates Commands The following describes the certificate commands. See Appendix K on page 655 information on the command structure. All of these commands start with certificates. Table 32 Certificates Commands...
Page 670 ZyWALL 35 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Create a certificate request and enroll for a create cmp_enroll certificate immediately online using CMP <name> <CA protocol. <name> specifies a descriptive name addr> <CA for the enrolled certificate. <CA addr> specifies cert>...
Page 671 ZyWALL 35 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Create a certificate using your device MAC replace_fact address that will be specific to this device. The factory default certificate is a common default certificate for all ZyWALL models.
Page 672 ZyWALL 35 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Delete the specified trusted remote host delete <name> certificate. <name> specifies the name of the certificate to be deleted. List all trusted remote host certificate names and list basic information.
Page 673: Brute-Force Password Guessing Protection
ZyWALL 35 User’s Guide P P E N D I X Brute-Force Password Guessing Protection Brute-force password guessing protection allows you to specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered.
Page 674 ZyWALL 35 User’s Guide Appendix O Brute-Force Password Guessing Protection...
Page 675: Appendix P Boot Commands
ZyWALL 35 User’s Guide P P E N D I X Boot Commands The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your ZyWALL, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen.
Page 676: Figure 70 Boot Module Commands
ZyWALL 35 User’s Guide Figure 70 Boot Module Commands just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time...
Page 677: Appendix Q Log Descriptions
ZyWALL 35 User’s Guide P P E N D I X Log Descriptions This appendix provides descriptions of example log messages. Table 34 System Maintenance Logs LOG MESSAGE DESCRIPTION The router has adjusted its time based on information from the Time calibration is time server.
Page 678: Table 35 System Error Logs
ZyWALL 35 User’s Guide Table 34 System Maintenance Logs (continued) LOG MESSAGE DESCRIPTION The router is saving configuration changes. Configuration Change: PC = 0x%x, Task ID = 0x%x Someone has logged on to the router’s SSH server. Successful SSH login Someone has failed to log on to the router’s SSH server.
Page 679: Table 36 Access Control Logs
ZyWALL 35 User’s Guide Table 36 Access Control Logs LOG MESSAGE DESCRIPTION Attempted TCP/UDP/IGMP/ESP/GRE/OSPF access Firewall default policy: [ TCP | matched the default policy and was blocked or forwarded UDP | IGMP | ESP | GRE | OSPF ] according to the default policy’s setting.
Page 680: Table 38 Packet Filter Logs
ZyWALL 35 User’s Guide Table 37 TCP Reset Logs (continued) LOG MESSAGE DESCRIPTION The router sent a TCP reset packet when the number of Exceed MAX incomplete, incomplete connections (TCP and UDP) exceeded the user- sent TCP RST configured threshold. (Incomplete count is for all TCP and UDP connections through the firewall.)Note: When the number of...
Page 681: Table 40 Cdr Logs
ZyWALL 35 User’s Guide Table 40 CDR Logs LOG MESSAGE DESCRIPTION The router received the setup requirements for a call. “call” is board %d line %d channel %d, the reference (count) number of the call. “dev” is the device call %d, %s C01 Outgoing Call type (3 is for dial-up, 6 is for PPPoE, 10 is for PPTP).
Page 682: Table 44 Attack Logs
ZyWALL 35 User’s Guide Table 43 Content Filtering Logs (continued) LOG MESSAGE DESCRIPTION %s: Forbidden Web site The web site is in the forbidden web site list. The web site contains ActiveX. %s: Contains ActiveX The web site contains a Java applet.
Page 683: Table 45 Remote Management Logs
ZyWALL 35 User’s Guide Table 44 Attack Logs (continued) LOG MESSAGE DESCRIPTION The firewall detected an ICMP IP spoofing attack on the WAN port. ip spoofing - WAN ICMP (type:%d, code:%d) The firewall detected an ICMP echo attack. icmp echo : ICMP (type:%d, code:%d) The firewall detected a TCP syn flood attack.
Page 684: Table 46 Wireless Logs
ZyWALL 35 User’s Guide Table 45 Remote Management Logs LOG MESSAGE DESCRIPTION Remote Management: WWW denied Attempted use of WWW service was blocked according to remote management settings. Remote Management: HTTPS denied Attempted use of HTTPS service was blocked according to remote management settings.
Page 685: Table 48 Ike Logs
ZyWALL 35 User’s Guide Table 47 IPSec Logs (continued) LOG MESSAGE DESCRIPTION Cannot find outbound SA for A packet matches a rule, but there is no phase 2 SA for outbound traffic. rule <%d> Rule [%s] sends an echo The device sent a ping packet to check the specified VPN tunnel's connectivity.
Page 686 ZyWALL 35 User’s Guide Table 48 IKE Logs (continued) LOG MESSAGE DESCRIPTION IKE uses ISAKMP to transmit data. Each ISAKMP packet Recv <packet> contains many different types of payloads. All of them show in the LOG. Refer to RFC2408 – ISAKMP for a list of all ISAKMP payload types.
Page 687 ZyWALL 35 User’s Guide Table 48 IKE Logs (continued) LOG MESSAGE DESCRIPTION The listed rule’s IKE phase 1 authentication method did not Rule [%d] Phase 1 match between the router and the peer. authentication method mismatch The listed rule’s IKE phase 1 key group did not match Rule [%d] Phase 1 key group between the router and the peer.
Page 688: Table 49 Pki Logs
ZyWALL 35 User’s Guide Table 49 PKI Logs LOG MESSAGE DESCRIPTION The SCEP online certificate enrollment was successful. The Enrollment successful Destination field records the certification authority server IP address and port. The SCEP online certificate enrollment failed. The Destination field Enrollment failed records the certification authority server’s IP address and port.
Page 689: Table 50 Certificate Path Verification Failure Reason Codes
ZyWALL 35 User’s Guide Table 50 Certificate Path Verification Failure Reason Codes CODE DESCRIPTION Algorithm mismatch between the certificate and the search constraints. Key usage mismatch between the certificate and the search constraints. Certificate was not valid in the time interval.
Page 690: Table 52 Acl Setting Notes
ZyWALL 35 User’s Guide Table 51 802.1X Logs (continued) LOG MESSAGE DESCRIPTION A user was not authenticated by the local user database Local User Database does not because the user is not listed in the local user database. find user`s credential.
Page 691: Table 53 Icmp Notes
ZyWALL 35 User’s Guide Table 52 ACL Setting Notes (continued) PACKET DIRECTION DIRECTION DESCRIPTION (L to L/ZW) LAN to LAN/ ACL set for packets traveling from the LAN to the LAN or ZyWALL the ZyWALL. (W to W/ZW) WAN to WAN/...
Page 692: Table 54 Syslog Logs
ZyWALL 35 User’s Guide Table 53 ICMP Notes (continued) TYPE CODE DESCRIPTION Timestamp reply message Information Request Information request message Information Reply Information reply message Syslog Logs There are two types of syslog: event logs and traffic logs. The device generates an event log when a system event occurs, for example, when a user logs in or the device is under attack.
Page 693: Figure 71 Displaying Log Categories Example
ZyWALL 35 User’s Guide Table 55 RFC-2408 ISAKMP Payload Types (continued) LOG DISPLAY PAYLOAD TYPE Key Exchange Identification Certificate Certificate Request CER_REQ Hash HASH Signature Nonce NONCE Notification NOTFY Delete Vendor ID Log Commands Go to the command interpreter interface.
Page 694: Figure 72 Displaying Log Parameters Example
ZyWALL 35 User’s Guide Figure 72 Displaying Log Parameters Example ras> sys logs category access Usage: [0:none/1:log/2:alert/3:both] [0:don't show debug type/ 1:show debug type] 4 Use followed by a log category and a parameter to decide what to sys logs category record.
Page 695: Log Command Example
ZyWALL 35 User’s Guide Log Command Example This example shows how to set the ZyWALL to record the access logs and alerts and then view the results. ras> sys logs load ras> sys logs category access 3 ras> sys logs save ras>...
Page 696 ZyWALL 35 User’s Guide Appendix Q Log Descriptions...
Page 697: Index
ZyWALL 35 User’s Guide Index Numerics 10/100 Mbps Ethernet WAN Backup 408, 522 110V AC Backup WAN 230V AC Bandwidth Borrowing Bandwidth Class Bandwidth Filter 323, 334 Bandwidth Management 49, 323 Bandwidth Management Statistics Bandwidth Manager Class Configuration Bandwidth Manager Class Setup...
Page 698 ZyWALL 35 User’s Guide Client-server Protocol Diffie-Hellman Key Groups Command Interpreter Mode IP Alias Command Line IP Alias Setup Community Port Filter Setup Configuration 69, 89 Setup 451, 452 Configuration File TCP/IP Setup Backup Connecting Cables DNS Server Connection ID/Name...
Page 699 ZyWALL 35 User’s Guide Full Network Management Factory Default Factory LAN Defaults Fairness-based Scheduler Gas Pipes Filename Conventions Gateway IP Addr Filter 437, 466, 493 Gateway IP Address 448, 470 Applying General Setup 395, 421 Configuration Germany, Contact Information Configuring...
Page 700 ZyWALL 35 User’s Guide Interactive Applications Internet Access ISP's Name LAN IP Address 391, 393 Internet Access Setup 447, 448, 471 LAN Port Filter Setup Internet Control Message Protocol (ICMP) LAN Setup 439, 440 Internet Protocol Security (IPSec) LAN TCP/IP...
Page 701 ZyWALL 35 User’s Guide My Server IP Addr My WAN Address myZyXEL.com Packet Filtering 51, 175 device registration Packet Filtering Firewalls Pairwise Master Key (PMK) 432, 463 Password 396, 414, 419, 448, 507 Path cost PCMCIA Port Nailed-Up Connection 432, 463...
Page 702 ZyWALL 35 User’s Guide Roaming Example Requirements Qualified Service Personnel Root bridge Quality of Service Root Class Quick Start Guide Route Routing Policy RTCSee Real Time Chip RTS (Request To Send) RADIUS 50, 108, 612 RTS (Request To Send) threshold...
Page 703 ZyWALL 35 User’s Guide SIP Client System Maintenance 509, 510, 511, 512, 513, 514, 517, 518, 519, 522, 525, 533, 534, 537, 539, 540, 542, 543 SIP INVITE Request System Management Terminal SIP Redirect Server System Name 396, 421 SIP Register Server...
Page 704 ZyWALL 35 User’s Guide WEP Encryption 51, 116, 121, 123 WEP encryption Wet Basement UDP/ICMP Security Wireless LAN Uniform Resource Identifier Wireless LAN MAC Address Filtering Universal Plug and Play (UPnP) 375, 377 Wireless LAN Setup UNIX Syslog Wizard Setup...