Download Print this page

ZyXEL Communications ZyWall 35 User Manual

Internet security appliance

Hide thumbs Also See for ZyWall 35:

User manual (872 pages)

,

Support notes (335 pages)

,

Quick start manual (142 pages)

Table Of Contents

Table of Contents

Advertisement

Quick Links

Download this manual See also: User Manual

ZyWALL 35

Internet Security Appliance

User's Guide

Version 3.64

3/2005

Table of Contents

Advertisement

Table of Contents

Troubleshooting

Need help?

Need help?

Do you have a question about the ZyWall 35 and is the answer not in the manual?

Questions and answers

Summary of Contents for ZyXEL Communications ZyWall 35

Page 1 ZyWALL 35 Internet Security Appliance User’s Guide Version 3.64 3/2005...
Page 3: Copyright
ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Page 4: Federal Communications Commission (Fcc) Interference Statement
ZyWALL 35 User’s Guide Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations.
Page 5: Safety Warnings
ZyWALL 35 User’s Guide Safety Warnings For your safety, be sure to read and follow all warning notices and instructions. • To reduce the risk of fire, use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord.
Page 6: Zyxel Limited Warranty
ZyWALL 35 User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During...
Page 7: Customer Support
ZyWALL 35 User’s Guide Customer Support Please have the following information ready when you contact customer support. • Product model and serial number. • Warranty Information. • Date that you received your device. • Brief description of the problem and the steps you took to solve it.
Page 8 ZyWALL 35 User’s Guide Customer Support...
Page 9: Table Of Contents
Customer Support....................5 Preface ........................45 Chapter 1 Getting to Know Your ZyWALL ................47 1.1 ZyWALL 35 Internet Security Appliance Overview ..........47 1.2 ZyWALL Features ....................47 1.2.1 Physical Features ..................47 1.2.2 Non-Physical Features ................49 1.3 Applications for the ZyWALL ................54 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem ....54...
Page 10 ZyWALL 35 User’s Guide Chapter 3 Wizard Setup ......................73 3.1 Wizard Setup Overview ..................73 3.2 Internet Access ....................73 3.2.1 ISP Parameters ..................73 3.2.1.1 Ethernet ...................73 3.2.1.2 PPPoE Encapsulation ..............75 3.2.1.3 PPTP Encapsulation ...............76 3.2.2 Internet Access Wizard Setup Complete ..........78 3.3 VPN Wizard ......................79...
Page 11 ZyWALL 35 User’s Guide Chapter 6 Wireless LAN ......................105 6.1 Introduction ......................105 6.1.1 Additional Installation Requirements for Using 802.1x ......105 6.2 Wireless Security .....................105 6.3 Security Parameters Summary ................106 6.4 WEP Encryption ....................107 6.5 802.1x Overview ....................107 6.5.1 Introduction to RADIUS ................107 6.5.1.1 Types of RADIUS Messages ............107...
Page 12 ZyWALL 35 User’s Guide 7.5 TCP/IP Priority (Metric) ..................130 7.6 Configuring General ..................130 7.7 Configuring Load Balancing ................133 7.7.1 Least Load First ..................133 7.7.2 Weighted Round Robin ................134 7.7.3 Spillover ....................135 7.8 Configuring WAN Setup ...................136 7.8.1 Ethernet Encapsulation ................136 7.8.2 PPPoE Encapsulation ................139...
Page 13 ZyWALL 35 User’s Guide 9.5.1 Stateful Inspection Process ..............170 9.5.2 Stateful Inspection and the ZyWALL ............171 9.5.3 TCP Security ...................171 9.5.4 UDP/ICMP Security ................172 9.5.5 Upper Layer Protocols ................172 9.6 Guidelines For Enhancing Security With Your Firewall ........173 9.7 Packet Filtering Vs Firewall ................173 9.7.1 Packet Filtering: ..................173...
Page 14 ZyWALL 35 User’s Guide 11.1.1 Restrict Web Features ................197 11.1.2 Create a Filter List .................197 11.1.3 Customize Web Site Access ..............197 11.2 General Content Filter Configuration ..............197 11.3 Content Filtering with an External Database ..........200 11.4 Categories and Registering ................200 11.5 Customization ....................207...
Page 15 ZyWALL 35 User’s Guide 13.3.1 Transport Mode ..................228 13.3.2 Tunnel Mode ..................228 13.4 IPSec and NAT ....................228 Chapter 14 VPN Screens......................231 14.1 VPN/IPSec Overview ..................231 14.2 IPSec Algorithms ....................231 14.2.1 AH (Authentication Header) Protocol ............231 14.2.2 ESP (Encapsulating Security Payload) Protocol ........231 14.3 My ZyWALL ....................232...
Page 16 ZyWALL 35 User’s Guide Chapter 15 Certificates......................263 15.1 Certificates Overview ..................263 15.1.1 Advantages of Certificates ..............264 15.2 Self-signed Certificates ..................264 15.3 Configuration Summary .................264 15.4 My Certificates ....................265 15.5 Certificate File Formats ..................266 15.6 Importing a Certificate ..................267 15.7 Creating a Certificate ..................268 15.8 My Certificate Details ..................270...
Page 17 ZyWALL 35 User’s Guide 17.4.1 Address Mapping Edit ................301 17.5 Port Forwarding ....................302 17.5.1 Default Server IP Address ..............303 17.5.2 Port Forwarding: Services and Port Numbers ........303 17.5.3 Configuring Servers Behind Port Forwarding (Example) ......303 17.5.4 NAT and Multiple WAN .................304 17.5.5 Port Translation ..................304...
Page 18 ZyWALL 35 User’s Guide 20.9.2 Maximize Bandwidth Usage With Bandwidth Borrowing ......326 20.10 Configuring Summary ..................327 20.11 Configuring Class Setup ................328 20.11.1 Bandwidth Manager Class Configuration ..........330 20.11.2 Bandwidth Management Statistics ............333 20.12 Configuring Monitor ..................334 Chapter 21 DNS........................337 21.1 DNS Overview ....................337...
Page 19 ZyWALL 35 User’s Guide 22.7.1 Requirements for Using SSH ..............360 22.8 Configuring SSH ....................360 22.9 Secure Telnet Using SSH Examples ..............361 22.9.1 Example 1: Microsoft Windows .............361 22.9.2 Example 2: Linux ..................361 22.10 Secure FTP Using SSH Example ..............362 22.11 Telnet ......................363 22.12 Configuring TELNET ..................363...
Page 20 ZyWALL 35 User’s Guide Chapter 25 Maintenance ......................393 25.1 Maintenance Overview ...................393 25.2 General Setup ....................393 25.2.1 General Setup and System Name ............393 25.2.2 Domain Name ..................393 25.3 Configuring Password ..................394 25.4 Pre-defined NTP Time Servers List ..............395 25.5 Configuring Time and Date ................396 25.5.1 Resetting the Time ................398...
Page 21 ZyWALL 35 User’s Guide 28.2 WAN Setup .....................425 28.3 Dial Backup ....................426 28.4 Configuring Dial Backup in Menu 2 ..............426 28.5 Advanced WAN Setup ..................427 28.6 Remote Node Profile (Backup ISP) ..............429 28.7 Editing PPP Options ..................431 28.8 Editing TCP/IP Options ..................431 28.9 Editing Login Script ..................433...
Page 22 ZyWALL 35 User’s Guide Chapter 33 Remote Node Setup ..................... 457 33.1 Introduction to Remote Node Setup ...............457 33.2 Remote Node Setup ..................457 33.3 Remote Node Profile Setup ................457 33.3.1 Ethernet Encapsulation .................458 33.3.2 PPPoE Encapsulation ................459 33.3.2.1 Outgoing Authentication Protocol ..........460 33.3.2.2 Nailed-Up Connection ..............460...
Page 23 ZyWALL 35 User’s Guide Chapter 37 Filter Configuration ....................491 37.1 Introduction to Filters ..................491 37.1.1 The Filter Structure of the ZyWALL ............492 37.2 Configuring a Filter Set ..................494 37.2.1 Configuring a Filter Rule ...............495 37.2.2 Configuring a TCP/IP Filter Rule ............496 37.2.3 Configuring a Generic Filter Rule ............498...
Page 24 ZyWALL 35 User’s Guide 40.3.4 GUI-based FTP Clients .................522 40.3.5 File Maintenance Over WAN ..............522 40.3.6 Backup Configuration Using TFTP ............523 40.3.7 TFTP Command Example ..............523 40.3.8 GUI-based TFTP Clients ..............524 40.3.9 Backup Via Console Port ..............524 40.4 Restore Configuration ..................525 40.4.1 Restore Using FTP ................525...
Page 25 ZyWALL 35 User’s Guide 43.2.1 Applying Policy to Packets ..............550 43.3 IP Policy Routing Example ................551 Chapter 44 Call Scheduling ....................555 44.1 Introduction to Call Scheduling ..............555 Chapter 45 Troubleshooting ....................559 45.1 Problems Starting Up the ZyWALL ..............559 45.2 Problems with the LAN Interface ..............559...
Page 26 ZyWALL 35 User’s Guide Appendix J Importing Certificates ..................641 Appendix K Command Interpreter................... 653 Appendix L Firewall Commands ..................... 655 Appendix M NetBIOS Filter Commands .................. 661 Appendix N Certificates Commands ..................665 Appendix O Brute-Force Password Guessing Protection............. 669 Appendix P Boot Commands ....................
Page 27 ZyWALL 35 User’s Guide List of Figures Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem ........ 54 Figure 2 VPN Application ....................55 Figure 3 ZyWALL Front Panel ..................... 55 Figure 4 Change Password Screen ..................58 Figure 5 Replace Certificate Screen ...................
Page 28 ZyWALL 35 User’s Guide Figure 37 Wireless: WPA-PSK .................... 116 Figure 38 Wireless: WPA ....................117 Figure 39 Wireless: 802.1x + Dynamic WEP ..............118 Figure 40 Wireless: 802.1x + Static WEP ................119 Figure 41 Wireless: 802.1x + No WEP ................121 Figure 42 Wireless: No Access 802.1x + Static WEP ............
Page 29 ZyWALL 35 User’s Guide Figure 80 My Service Rule Configuration ................189 Figure 81 My Service Example Rule Summary ..............190 Figure 82 Anti-Probing ......................193 Figure 83 Firewall Threshold ....................195 Figure 84 Content Filter : General ..................198 Figure 85 Content Filtering Lookup Procedure ..............
Page 30 ZyWALL 35 User’s Guide Figure 123 Telecommuters Sharing One VPN Rule Example ..........260 Figure 124 Telecommuters Using Unique VPN Rules Example ......... 261 Figure 125 Certificate Configuration Overview ..............264 Figure 126 My Certificates ....................265 Figure 127 My Certificate Import ..................267 Figure 128 My Certificate Create ..................
Page 31 ZyWALL 35 User’s Guide Figure 166 System DNS: Add Address Record ..............341 Figure 167 System DNS: Insert Name Server Record ............342 Figure 168 DNS Cache ....................... 343 Figure 169 DNS LAN ......................345 Figure 170 DDNS ........................ 347 Figure 171 HTTPS Implementation ..................
Page 32 ZyWALL 35 User’s Guide Figure 209 Device Mode (Router Mode) ................401 Figure 210 Device Mode (Bridge Mode) ................402 Figure 211 Firmware Upload ....................404 Figure 212 Firmware Upload In Process ................404 Figure 213 Network Temporarily Disconnected ..............405 Figure 214 Firmware Upload Error ..................
Page 33 ZyWALL 35 User’s Guide Figure 252 Menu 5.2: TCP/IP Setup ................... 450 Figure 253 Menu 5.2.1: IP Alias Setup ................451 Figure 254 Menu 6: Route Setup ..................453 Figure 255 Menu 6.1: Route Assessment ................453 Figure 256 Menu 6.2: Traffic Redirect ................. 454 Figure 257 Menu 6.3: Route Failover ..................
Page 34 ZyWALL 35 User’s Guide Figure 294 Outgoing Packet Filtering Process ..............491 Figure 295 Filter Rule Process .................... 493 Figure 296 Menu 21: Filter and Firewall Setup ..............494 Figure 297 Menu 21.1: Filter Set Configuration ..............494 Figure 298 Menu 21.1.1.1: TCP/IP Filter Rule ..............496 Figure 299 Executing an IP Filter ..................
Page 35 ZyWALL 35 User’s Guide Figure 337 Menu 24.7.2 As Seen Using the Console Port ..........533 Figure 338 Example Xmodem Upload ................533 Figure 339 Command Mode in Menu 24 ................535 Figure 340 Valid Commands ....................536 Figure 341 Call Control ....................... 537 Figure 342 Budget Management ..................
Page 36 ZyWALL 35 User’s Guide Figure 16 Macintosh OS X: Apple Menu ................589 Figure 17 Macintosh OS X: Network ................... 590 Figure 18 Single-Computer per Router Hardware Configuration ........600 Figure 19 ZyWALL as a PPPoE Client ................600 Figure 20 Transport PPP frames over Ethernet ..............601 Figure 21 PPTP Protocol Overview ..................
Page 37 ZyWALL 35 User’s Guide Figure 59 CA Certificate Example ..................647 Figure 60 Personal Certificate Import Wizard 1 ..............648 Figure 61 Personal Certificate Import Wizard 2 ..............648 Figure 62 Personal Certificate Import Wizard 3 ..............649 Figure 63 Personal Certificate Import Wizard 4 ..............649 Figure 64 Personal Certificate Import Wizard 5 ..............
Page 38 ZyWALL 35 User’s Guide...
Page 39 ZyWALL 35 User’s Guide List of Tables Table 1 Front Panel LEDs ....................55 Table 2 Web Configurator HOME Screen in Router Mode ..........61 Table 3 Web Configurator HOME Screen in Bridge Mode ..........63 Table 4 Bridge and Router Mode Features Comparison ............ 64 Table 5 Screens Summary ....................
Page 40 ZyWALL 35 User’s Guide Table 37 Least Load First: Example 2 ................129 Table 38 General ........................ 132 Table 39 Load Balancing: Least Load First ................ 134 Table 40 Load Balancing: Weighted Round Robin ............. 135 Table 41 Load Balancing: Spillover ..................136 Table 42 WAN: Ethernet Encapsulation ................
Page 41 ZyWALL 35 User’s Guide Table 80 VPN: Global Setting ..................... 259 Table 81 Telecommuters Sharing One VPN Rule Example ..........260 Table 82 Telecommuters Using Unique VPN Rules Example ..........261 Table 83 My Certificates ..................... 265 Table 84 My Certificate Import ................... 268 Table 85 My Certificate Create ...................
Page 42 ZyWALL 35 User’s Guide Table 123 DNS Cache ......................344 Table 124 DNS LAN ......................345 Table 125 DDNS ........................ 347 Table 126 WWW ........................ 352 Table 127 SSH ........................360 Table 128 Telnet ......................... 364 Table 129 FTP ........................365 Table 130 SNMP Traps ......................
Page 43 ZyWALL 35 User’s Guide Table 166 Menu 11.3.1: Remote Node PPP Options ............431 Table 167 Menu 11.3.2: Remote Node Network Layer Options ......... 432 Table 168 Menu 11.3.3: Remote Node Script ..............435 Table 169 Menu 3.2: DHCP Ethernet Setup Fields ............439 Table 170 Menu 3.2: LAN TCP/IP Setup Fields ..............
Page 44 ZyWALL 35 User’s Guide Table 209 Menu 25: Sample IP Routing Policy Summary ..........547 Table 210 IP Routing Policy Setup ..................548 Table 211 Menu 25.1: IP Routing Policy Setup ..............549 Table 212 Menu 25.1.1: IP Routing Policy Setup ............... 551 Table 213 Schedule Set Setup ...................
Page 45 ZyWALL 35 User’s Guide Table 32 Certificates Commands ..................665 Table 33 Brute-Force Password Guessing Protection Commands ........669 Table 34 System Maintenance Logs .................. 673 Table 35 System Error Logs ....................674 Table 36 Access Control Logs .................... 675 Table 37 TCP Reset Logs ....................
Page 46 ZyWALL 35 User’s Guide...
Page 47: Preface
Help us help you! E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan. Thank you!
Page 48: Syntax Conventions
ZyWALL 35 User’s Guide Syntax Conventions • “Enter” means for you to type one or more characters. “Select” or “Choose” means for you to use one predefined choices. • The SMT menu titles and labels are in Bold Times New Roman font. Predefined field choices are in Bold Arial font.
Page 49: Getting To Know Your Zywall
This chapter introduces the main features and applications of the ZyWALL. ZyWALL 35 Internet Security Appliance Overview The ZyWALL 35 Internet security gateway is designed for medium sized business that need the increased throughput and reliability of dual WAN ports and load balancing. The ZyWALL is loaded with security features including VPN, firewall, content filtering, and certificates.
Page 50: Dial Backup Wan
ZyWALL 35 User’s Guide DMZ Ports Public servers (Web, FTP, etc.) attached to a DeMilitarized Zone (DMZ) port are visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death) and can also be accessed from the secure LAN.
Page 51: Load Balancing
ZyWALL 35 User’s Guide IEEE 802.11 b/g Wireless LAN The optional wireless LAN card provides mobility and a fast network environment for small and home offices. Users can connect to the local area network without any wiring efforts and enjoy reliable high-speed connectivity.
Page 52 ZyWALL 35 User’s Guide Certificates The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. Certificates provide a way to exchange public keys for use in authentication. The ZyWALL uses the SSH (Secure Shell) secure communication protocol to provide secure encrypted communication between two hosts over an unsecured network.
Page 53: Wireless Lan Mac Address Filtering
ZyWALL 35 User’s Guide IEEE 802.1x for Network Security The ZyWALL supports the IEEE 802.1x standard that works with the IEEE 802.11 to enhance user authentication. With the local user profile, the ZyWALL allows you to configure up 32 user profiles without a network authentication server. In addition, centralized user and accounting management is possible on an optional network authentication server.
Page 54: Dynamic Dns Support
ZyWALL 35 User’s Guide Dynamic DNS Support With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider.
Page 55: Full Network Management
ZyWALL 35 User’s Guide Traffic Redirect Traffic Redirect forwards WAN traffic to a backup gateway on the LAN when the ZyWALL cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails. Port Forwarding Use this feature to forward incoming service requests to a server on your local network.
Page 56: Applications For The Zywall
ZyWALL 35 User’s Guide Embedded FTP and TFTP Servers The ZyWALL’s embedded FTP and TFTP Servers enable fast firmware upgrades as well as configuration file backups and restoration. 1.3 Applications for the ZyWALL Here are some examples of what you can do with your ZyWALL.
Page 57: Front Panel Leds
ZyWALL 35 User’s Guide Figure 2 VPN Application 1.3.3 Front Panel LEDs Figure 3 ZyWALL Front Panel The following table describes the LEDs. Table 1 Front Panel LEDs COLOR STATUS DESCRIPTION The ZyWALL is turned off. Green The ZyWALL is turned on.
Page 58 ZyWALL 35 User’s Guide Table 1 Front Panel LEDs (continued) COLOR STATUS DESCRIPTION Green The ZyWALL is not ready or has failed. The ZyWALL is ready and running. Flashing The ZyWALL is restarting. Green The backup port is not connected.
Page 59: Introducing The Web Configurator
ZyWALL 35 User’s Guide H A P T E R Introducing the Web Configurator This chapter describes how to access the ZyWALL web configurator and provides an overview of its screens. 2.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy ZyWALL setup and management via Internet browser.
Page 60: Resetting The Zywall
ZyWALL 35 User’s Guide Figure 4 Change Password Screen 6 Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Note: If you do not replace the default certificate here or in the CERTIFICATES screen, this screen displays every time you access the web configurator.
Page 61: Procedure To Use The Reset Button
ZyWALL 35 User’s Guide 2.3.1 Procedure To Use The Reset Button Make sure the SYS LED is on (not blinking) before you begin this procedure. 1 Press the RESET button for ten seconds, and then release it. If the SYS LED begins to blink, the defaults have been restored and the ZyWALL restarts.
Page 62: Navigating The Zywall Web Configurator
ZyWALL 35 User’s Guide 2.4 Navigating the ZyWALL Web Configurator The following summarizes how to navigate the web configurator from the HOME screen. Note: Follow the instructions you see in the HOME screen or click the icon (located in the top right corner of most screens) to view online help.
Page 63: Table 2 Web Configurator Home Screen In Router Mode
ZyWALL 35 User’s Guide Click MAINTENANCE to view information about your ZyWALL or upgrade configuration/ firmware files. Maintenance includes General, Password, Time and Date, Device Mode, F/ W (firmware) Upload, Configuration (Backup, Restore, Default), and Restart. The following table describes the labels in this screen.
Page 64: Bridge Mode
ZyWALL 35 User’s Guide Table 2 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Interface This is the port type. Port types are: WAN1, WAN2, Dial Backup, LAN, WLAN and DMZ. Click "+" to expand or "-" to collapse the LAN and DMZ IP alias drop-down lists.
Page 65: Figure 8 Web Configurator Home Screen In Bridge Mode
ZyWALL 35 User’s Guide Figure 8 Web Configurator HOME Screen in Bridge Mode The following table describes the labels not previously discussed (Table 2 on page 61). Table 3 Web Configurator HOME Screen in Bridge Mode LABEL DESCRIPTION Network Status IP Address This is the IP address of your ZyWALL in dotted decimal notation.
Page 66: Navigation Panel
ZyWALL 35 User’s Guide Table 3 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION Bridge Port This is the port type. Port types are: WAN1, WAN2, LAN, WLAN and DMZ. Port Status For the WAN, LAN, and DMZ ports, this displays the port speed and duplex setting.
Page 67: Table 5 Screens Summary
ZyWALL 35 User’s Guide Table 4 Bridge and Router Mode Features Comparison FEATURE BRIDGE MODE ROUTER MODE Remote Management UPnP Logs Maintenance Table Key: An O in a mode’s column shows that the device mode has the specified feature. The information in this table was correct at the time of writing, although it may be subject to change.
Page 68 ZyWALL 35 User’s Guide Table 5 Screens Summary (continued) LINK FUNCTION Anti-Probing Use this screen to change your anti-probing settings. Threshold Use this screen to configure the threshold for DoS attacks. CONTENT General This screen allows you to enable content filtering and block certain FILTER web features.
Page 69: System Statistics
ZyWALL 35 User’s Guide Table 5 Screens Summary (continued) LINK FUNCTION REMOTE MGMT WWW Use this screen to configure through which interface(s) and from which IP address(es) users can use HTTPS or HTTP to manage the ZyWALL. Use this screen to configure through which interface(s) and from which IP address(es) users can use Secure Shell to manage the ZyWALL.
Page 70: Show Statistics: Line Chart
ZyWALL 35 User’s Guide Figure 9 Home : Show Statistics The following table describes the labels in this screen. Table 6 Home : Show Statistics LABEL DESCRIPTION Click the icon to display the chart of throughput statistics. Port This is the WAN1, WAN2, Dial Backup, LAN, DMZ or WLAN port.
Page 71: Dhcp Table Screen
ZyWALL 35 User’s Guide Figure 10 Home : Show Statistics: Line Chart The following table describes the labels in this screen. Table 7 Home : Show Statistics: Line Chart LABEL DESCRIPTION Click the icon to go back to the Show Statistics screen.
Page 72: Vpn Status
ZyWALL 35 User’s Guide Figure 11 Home : DHCP Table The following table describes the labels in this screen. Table 8 Home : DHCP Table LABEL DESCRIPTION This is the index number of the host computer. IP Address This field displays the IP address relative to the # field listed above.
Page 73: Figure 12 Home : Vpn Status
ZyWALL 35 User’s Guide Figure 12 Home : VPN Status The following table describes the labels in this screen. Table 9 Home : VPN Status LABEL DESCRIPTION This is the security association index number. Name This field displays the identification name for this VPN policy.
Page 74 ZyWALL 35 User’s Guide Chapter 2 Introducing the Web Configurator...
Page 75: Wizard Setup
ZyWALL 35 User’s Guide H A P T E R Wizard Setup This chapter provides information on the Wizard Setup screens in the web configurator. This chapter is only applicable when the ZyWALL is in router mode. 3.1 Wizard Setup Overview The web configurator's setup wizards help you configure WAN1 on the ZyWALL to access the Internet and edit VPN policies and configure IKE settings to establish a VPN tunnel.
Page 76: Figure 13 Isp Parameters : Ethernet Encapsulation
ZyWALL 35 User’s Guide Figure 13 ISP Parameters : Ethernet Encapsulation The following table describes the labels in this screen. Table 10 ISP Parameters : Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 77: Pppoe Encapsulation
ZyWALL 35 User’s Guide Table 10 ISP Parameters : Ethernet Encapsulation LABEL DESCRIPTION First DNS Server Enter the DNS server's IP address(es) in the field(s) to the right. Second DNS Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not...
Page 78: Pptp Encapsulation
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 11 ISP Parameters : PPPoE Encapsulation LABEL DESCRIPTION ISP Parameter for Internet Access Encapsulation Choose an encapsulation method from the pull-down list box. PPP over Ethernet forms a dial-up connection.
Page 79: Figure 15 Isp Parameters : Pptp Encapsulation
ZyWALL 35 User’s Guide Figure 15 ISP Parameters : PPTP Encapsulation The following table describes the labels in this screen. Table 12 ISP Parameters : PPTP Encapsulation ESCRIPTION LABEL ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down list box. To configure a PPTP client, you must configure the User Name and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 80: Internet Access Wizard Setup Complete
ZyWALL 35 User’s Guide Table 12 ISP Parameters : PPTP Encapsulation ESCRIPTION LABEL My IP Subnet Mask Type the subnet mask assigned to you by your ISP (if given). Server IP Address Type the IP address of the PPTP server.
Page 81: Vpn Wizard
ZyWALL 35 User’s Guide 3.3 VPN Wizard Use the VPN wizard screens to configure a VPN rule that use a pre-shared key. If you want to set the rule to use a certificate, please go to the VPN screens for configuration.
Page 82: Network Setting
ZyWALL 35 User’s Guide Table 13 VPN Wizard : Gateway Setting LABEL DESCRIPTION My ZyWALL Enter the WAN IP address or the domain name of your ZyWALL or leave the field set to 0.0.0.0. The following applies if the My ZyWALL field is configured as 0.0.0.0: •...
Page 83: Figure 18 Vpn Wizard : Network Setting
ZyWALL 35 User’s Guide Figure 18 VPN Wizard : Network Setting The following table describes the labels in this screen. Table 14 VPN Wizard : Network Setting LABEL DESCRIPTION Network Policy Property Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 84: Ike Tunnel Setting (Ike Phase 1)
ZyWALL 35 User’s Guide Table 14 VPN Wizard : Network Setting LABEL DESCRIPTION Ending IP When the Local Network field is configured to Single, this field is N/A. When the Address/ Local Network field is configured to Range IP, enter the end (static) IP address, in a Subnet Mask range of computers on the LAN behind your ZyWALL.
Page 85: Table 15 Vpn Wizard : Ike Tunnel Setting
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 15 VPN Wizard : IKE Tunnel Setting LABEL DESCRIPTION Negotiation Mode Use the radio buttons to select Main Mode or Aggressive Mode. Multiple SAs connecting through a secure gateway must have the same negotiation mode.
Page 86: Ipsec Setting (Ike Phase 2)
ZyWALL 35 User’s Guide 3.3.3 IPSec Setting (IKE Phase 2) Figure 20 VPN Wizard : IPSec Setting The following table describes the labels in this screen. Table 16 VPN Wizard : IPSec Setting LABEL DESCRIPTION Encapsulation Mode Select Tunnel mode or Transport mode.
Page 87: Vpn Status Summary
ZyWALL 35 User’s Guide Table 16 VPN Wizard : IPSec Setting (continued) LABEL DESCRIPTION Perfect Forward Perfect Forward Secret (PFS) is disabled (None) by default in phase 2 IPSec Secret (PFS) SA setup. This allows faster IPSec setup, but is not so secure.
Page 88: Table 17 Vpn Wizard : Vpn Status
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 17 VPN Wizard : VPN Status LABEL DESCRIPTION Gateway Policy Property Name This is the name of this VPN gateway policy. Gateway Policy Setting My ZyWALL This is the WAN IP address or the domain name of your ZyWALL.
Page 89: Vpn Wizard Setup Complete
ZyWALL 35 User’s Guide Table 17 VPN Wizard : VPN Status (continued) LABEL DESCRIPTION IPSec Protocol ESP or AH are the security protocols used for an SA. Encryption Algorithm This is the method of data encryption. Options can be DES, 3DES, AES or NULL.
Page 90 ZyWALL 35 User’s Guide Chapter 3 Wizard Setup...
Page 91: Chapter 4 Lan Screens
ZyWALL 35 User’s Guide H A P T E R LAN Screens This chapter describes how to configure LAN settings. This chapter is only applicable when the ZyWALL is in router mode. 4.1 LAN Overview Local Area Network (LAN) is a shared communication system to which many computers are attached.
Page 92: Ip Address And Subnet Mask
ZyWALL 35 User’s Guide These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), read the embedded web configurator help regarding what fields need to be configured. 4.3.2 IP Address and Subnet Mask Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.
Page 93: Multicast
ZyWALL 35 User’s Guide Both RIP-2B and RIP-2M send routing data in RIP-2 format; the difference being that RIP- 2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets.
Page 94: Figure 23 Lan
ZyWALL 35 User’s Guide Figure 23 LAN The following table describes the labels in this screen. Table 18 LAN LABEL DESCRIPTION LAN TCP/IP IP Address Type the IP address of your ZyWALL in dotted decimal notation. 192.168.1.1 is the factory default. Alternatively, click the right mouse button to copy and/or paste the IP address.
Page 95: Configuring Static Dhcp
ZyWALL 35 User’s Guide Table 18 LAN (continued) LABEL DESCRIPTION Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use.
Page 96: Configuring Ip Alias
ZyWALL 35 User’s Guide Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02. To change your ZyWALL’s static DHCP settings, click LAN, then the Static DHCP tab. The screen appears as shown (some of the screen’s blank rows are not shown).
Page 97: Figure 25 Physical Network & Partitioned Logical Networks
ZyWALL 35 User’s Guide When you use IP alias, you can also configure firewall rules to control access between the LAN's logical networks (subnets). Note: Make sure that the subnets of the logical networks do not overlap. The following figure shows a LAN divided into subnets A, B, and C.
Page 98: Configuring Port Roles
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 20 IP Alias LABEL DESCRIPTION Enable IP Alias 1, Select the check box to configure another LAN network for the ZyWALL. IP Address Enter the IP address of your ZyWALL' in dotted decimal notation.
Page 99: Figure 27 Port Roles
ZyWALL 35 User’s Guide Figure 27 Port Roles After you change the LAN/DMZ port roles and click Apply, please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen. Figure 28 Port Roles Change Complete...
Page 100 ZyWALL 35 User’s Guide Chapter 4 LAN Screens...
Page 101: Chapter 5 Bridge Screens
ZyWALL 35 User’s Guide H A P T E R Bridge Screens This chapter describes how to configure bridge settings. This chapter is only applicable when the ZyWALL is in bridge mode. 5.1 Bridge Loop The ZyWALL can act as a bridge between a switch and a wired LAN or between two routers.
Page 102: Rapid Stp
ZyWALL 35 User’s Guide 5.2.1 Rapid STP The ZyWALL uses IEEE 802.1w RSTP (Rapid Spanning Tree Protocol) that allow faster convergence of the spanning tree (while also being backwards compatible with STP-only aware bridges). Using RSTP topology change information does not have to propagate to the root bridge and unwanted learned addresses are flushed from the filtering database.
Page 103: Stp Port States
ZyWALL 35 User’s Guide Once a stable network topology has been established, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) transmitted from the root bridge. If a bridge does not get a Hello BPDU after a predefined interval (Max Age), the bridge assumes that the link to the root bridge is down.
Page 104: Figure 30 Bridge
ZyWALL 35 User’s Guide Figure 30 Bridge The following table describes the labels in this screen. Table 23 Bridge LABEL DESCRIPTION Bridge Setup IP Address Type the IP address of your ZyWALL in dotted decimal notation. IP Subnet Mask The subnet mask specifies the network number portion of an IP address.
Page 105: Configuring Port Roles
ZyWALL 35 User’s Guide Table 23 Bridge (continued) LABEL DESCRIPTION Rapid Spanning Tree Protocol Setup Enable Rapid Spanning Select the check box to activate RSTP on the ZyWALL. Tree Protocol Bridge Priority Enter a number between 0 and 61440 as bridge priority of the ZyWALL. 0 is the highest.
Page 106 ZyWALL 35 User’s Guide Chapter 5 Bridge Screens...
Page 107: Chapter 6 Wireless Lan
ZyWALL 35 User’s Guide H A P T E R Wireless LAN This chapter discusses how to configure Wireless LAN on the ZyWALL. 6.1 Introduction A wireless LAN can be as simple as two computers with wireless LAN adapters communicating in a peer-to-peer network or as complex as a number of computers with wireless LAN adapters communicating through access points which bridge network traffic to the wired LAN.
Page 108: Security Parameters Summary
ZyWALL 35 User’s Guide Figure 31 ZyWALL Wireless Security Levels If you do not enable any wireless security on your ZyWALL, your network is accessible to any wireless networking device that is within range. Use the ZyWALL web configurator to set up your wireless LAN security settings. Refer to the chapter on using the ZyWALL web configurator to see how to access the web configurator 6.3 Security Parameters Summary...
Page 109: Wep Encryption
ZyWALL 35 User’s Guide Table 24 Wireless Security Relational Matrix (continued) AUTHENTICATION ENCRYPTION ENTER METHOD/ KEY IEEE 802.1X METHOD MANUAL KEY MANAGEMENT PROTOCOL WPA-PSK Enable WPA-PSK TKIP Enable 6.4 WEP Encryption WEP (Wired Equivalent Privacy) as specified in the IEEE 802.11 standard provides methods for both data encryption and wireless station authentication.
Page 110: Eap Authentication Overview
ZyWALL 35 User’s Guide Sent by an access point requesting authentication. • Access-Reject Sent by a RADIUS server rejecting access. • Access-Accept Sent by a RADIUS server allowing access. • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message.
Page 111: Dynamic Wep Key Exchange
ZyWALL 35 User’s Guide Figure 32 EAP Authentication The details below provide a general description of how IEEE 802.1x EAP authentication works. • The wireless station sends a start message to the ZyWALL. • The ZyWALL sends a request identity message to the wireless station for identity information.
Page 112: User Authentication
ZyWALL 35 User’s Guide 6.7.1 User Authentication WPA applies IEEE 802.1x and Extensible Authentication Protocol (EAP) to authenticate wireless clients using an external RADIUS database. You can't use the ZyWALL's Local User Database for WPA authentication purposes since the Local User Database uses EAP-MD5 which cannot be used to generate keys.
Page 113: Wpa-Psk Application Example
ZyWALL 35 User’s Guide 6.8 WPA-PSK Application Example A WPA-PSK application looks as follows. 1 First enter identical passwords into the AP and all wireless clients. The Pre-Shared Key (PSK) must consist of between 8 and 63 ASCII characters (including spaces and symbols).
Page 114: Wireless Client Wpa Supplicants
ZyWALL 35 User’s Guide Figure 34 WPA with RADIUS Application Example 6.10 Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA. At the time of writing, the most widely available supplicants are the WPA patch for Windows XP, Funk Software's Odyssey client, and Meetinghouse Data Communications' AEGIS client.
Page 115: Figure 35 Wireless: No Security
ZyWALL 35 User’s Guide Figure 35 Wireless: No Security The following table describes the labels in this screen. Table 25 Wireless: No Security LABEL DESCRIPTION Enable The wireless LAN is turned off by default, before you enable the wireless LAN you Wireless LAN should configure some security by setting MAC filters and/or 802.1x security;...
Page 116: Static Wep
ZyWALL 35 User’s Guide Table 25 Wireless: No Security (continued) LABEL DESCRIPTION Fragmentation This is the threshold (number of bytes) for the fragmentation boundary for directed Threshold messages. It is the maximum data fragment size that can be sent. Select the check box to change the default value and enter a value between 256 and 2432.
Page 117: Wpa-Psk
ZyWALL 35 User’s Guide Figure 36 Wireless: Static WEP The following table describes the wireless LAN security labels in this screen. Table 26 Wireless: Static WEP LABEL DESCRIPTION Security Select Static WEP from the drop-down list. WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized Encryption wireless stations from accessing data transmitted over the wireless network.
Page 118: Figure 37 Wireless: Wpa-Psk
ZyWALL 35 User’s Guide Figure 37 Wireless: WPA-PSK The following wireless LAN security fields become available when you select WPA-PSK in the Security drop down list-box. Table 27 Wireless: WPA-PSK LABEL DESCRIPTION Security Select WPA-PSK from the drop-down list. Pre-Shared Key The encryption mechanisms used for WPA and WPA-PSK are the same.
Page 119: Wpa
ZyWALL 35 User’s Guide 6.11.3 WPA Select WPA from the Security list. Figure 38 Wireless: WPA The following wireless LAN security fields become available when you select WPA in the Security drop down list-box. Table 28 Wireless: WPA LABEL DESCRIPTION Security Select WPA from the drop-down list.
Page 120: Dynamic Wep
ZyWALL 35 User’s Guide Table 28 Wireless: WPA (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 6.11.4 802.1x + Dynamic WEP Select 802.1x + Dynamic WEP from the Security list.
Page 121: Static Wep
ZyWALL 35 User’s Guide Table 29 Wireless: 802.1x + Dynamic WEP LABEL DESCRIPTION Authentication Click Local User to go to the Local User Database screen where you can view Databases and/or edit the list of users and passwords. Click RADIUS to go to the RADIUS screen where you can configure the ZyWALL to check an external RADIUS server.
Page 122: No Wep
ZyWALL 35 User’s Guide The following wireless LAN security fields become available when you select 802.1x + Static WEP in the Security drop down list-box.. Table 30 Wireless: 802.1x + Static WEP LABEL DESCRIPTION Security Select 802.1x + Static WEP from the drop-down list.
Page 123: No Access 802.1X + Static Wep
ZyWALL 35 User’s Guide Figure 41 Wireless: 802.1x + No WEP The following table describes the wireless LAN security labels in this screen. Table 31 Wireless: 802.1x + No WEP LABEL DESCRIPTION Security Select 802.1x + No WEP from the drop-down list.
Page 124: Figure 42 Wireless: No Access 802.1X + Static Wep
ZyWALL 35 User’s Guide Figure 42 Wireless: No Access 802.1x + Static WEP The following wireless LAN security fields become available when you select No Access 802.1x + Static WEP in the Security drop down list-box. Table 32 Wireless: No Access 802.1x + Static WEP...
Page 125: No Access 802.1X + No Wep
ZyWALL 35 User’s Guide 6.11.8 No Access 802.1x + No WEP Select No Access 802.1x + No WEP to deny all wireless stations access to your wired network and block all wireless stations from communicating with the ZyWALL. 6.12 Configuring MAC Filter...
Page 126: Table 33 Mac Address Filter
ZyWALL 35 User’s Guide The following table describes the labels in this menu. Table 33 MAC Address Filter LABEL DESCRIPTION Active Select or clear the check box to enable or disable MAC address filtering. Enable MAC address filtering to have the router allow or deny access to wireless stations based on MAC addresses.
Page 127: Chapter 7 Wan Screens
ZyWALL 35 User’s Guide H A P T E R WAN Screens This chapter describes how to configure WAN settings. 7.1 WAN Overview A WAN connection is an outside connection to another network or the Internet. 7.1.1 WAN IP Address Assignment Every computer on the Internet must have a unique IP address.
Page 128: Wan Mac Address
ZyWALL 35 User’s Guide 1 The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server fields.
Page 129: Load Balancing Introduction
ZyWALL 35 User’s Guide You can use policy routing to specify the WAN port that specific services go through. An ISP may give traffic from certain (more expensive) connections priority over the traffic from other accounts. You could route delay intolerant traffic (like voice over IP calls) through this kind of connection.
Page 130: Least Load First
ZyWALL 35 User’s Guide 7.4.1 Least Load First The least load first algorithm uses the current (or recent) outbound and/or inbound bandwidth utilization of each WAN interface as the load balancing index(es) when making decisions about to which WAN interface a new LAN-originated session is to be distributed. The...
Page 131: Weighted Round Robin
ZyWALL 35 User’s Guide Since WAN 1 has a smaller load balancing index (meaning that it is less utilized than WAN 2), the ZyWALL will send the next new session traffic through WAN 1. Table 37 Least Load First: Example 2...
Page 132: Tcp/Ip Priority (Metric)
ZyWALL 35 User’s Guide In the following example figure, the upper threshold of the primary WAN interface is set to 800K. The ZyWALL sends network traffic of new sessions that exceeds this limit to the secondary WAN interface. Figure 46 Spillover Algorithm Example 7.5 TCP/IP Priority (Metric)
Page 133: Figure 47 General
ZyWALL 35 User’s Guide Figure 47 General Chapter 7 WAN Screens...
Page 134: Table 38 General
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 38 General LABEL DESCRIPTION Active/Passive Select the Active/Passive (fail over) operation mode to have the ZyWALL use the (Fail Over) Mode second highest priority WAN port as a back up. This means that the ZyWALL will normally use the highest priority (primary) WAN port (depending on the priorities you configure in the Route Priority fields).
Page 135: Configuring Load Balancing
ZyWALL 35 User’s Guide Table 38 General (continued) LABEL DESCRIPTION Check WAN1/2 Select the check box to have the ZyWALL periodically test the respective WAN Connectivity port's connection. Select Ping Default Gateway to have the ZyWALL ping the WAN port's default gateway IP address.
Page 136: Weighted Round Robin
ZyWALL 35 User’s Guide Figure 48 Load Balancing: Least Load First The following table describes the related fields in this screen. Table 39 Load Balancing: Least Load First LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on the Mode ZyWALL.
Page 137: Spillover
ZyWALL 35 User’s Guide Figure 49 Load Balancing: Weighted Round Robin The following table describes the related fields in this screen. Table 40 Load Balancing: Weighted Round Robin LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on the Mode ZyWALL.
Page 138: Configuring Wan Setup
ZyWALL 35 User’s Guide Figure 50 Load Balancing: Spillover The following table describes the related fields in this screen. Table 41 Load Balancing: Spillover LABEL DESCRIPTION Active/Active Select Active/Active Mode and set the related fields to enable load balancing on the Mode ZyWALL.
Page 139: Figure 51 Wan: Ethernet Encapsulation
ZyWALL 35 User’s Guide Figure 51 WAN: Ethernet Encapsulation The following table describes the labels in this screen. Table 42 WAN: Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 140 ZyWALL 35 User’s Guide Table 42 WAN: Ethernet Encapsulation (continued) LABEL DESCRIPTION Retype to Confirm Type your password again to make sure that you have entered is correctly. Login Server IP Type the authentication server IP address here if your ISP gave you one.
Page 141: Pppoe Encapsulation
ZyWALL 35 User’s Guide Table 42 WAN: Ethernet Encapsulation (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). Choose RIP-1, RIP-2B or RIP-2M.
Page 142: Figure 52 Wan: Pppoe Encapsulation
ZyWALL 35 User’s Guide create and offer new IP services for individuals. Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no specific configuration of the broadband modem at the customer site. By implementing PPPoE directly on the ZyWALL (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyWALL does that part of the task.
Page 143: Table 43 Wan: Pppoe Encapsulation
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 43 WAN: PPPoE Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation The PPPoE choice is for a dial-up connection using PPPoE. The router supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (i.e.
Page 144 ZyWALL 35 User’s Guide Table 43 WAN: PPPoE Encapsulation LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Choose Both, None, In Only or Out Only.
Page 145: Pptp Encapsulation
ZyWALL 35 User’s Guide 7.8.3 PPTP Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet.
Page 146: Table 44 Wan: Pptp Encapsulation
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 44 WAN: PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks.
Page 147 ZyWALL 35 User’s Guide Table 44 WAN: PPTP Encapsulation LABEL DESCRIPTION Enable NAT Network Address Translation (NAT) allows the translation of an Internet protocol (Network Address address used within one network (for example a private IP address used in a local...
Page 148: Traffic Redirect
ZyWALL 35 User’s Guide 7.9 Traffic Redirect Traffic redirect forwards WAN traffic to a backup gateway when the ZyWALL cannot connect to the Internet through its normal gateway. Connect the backup gateway on the WAN so that the ZyWALL still provides firewall protection.
Page 149: Configuring Dial Backup
ZyWALL 35 User’s Guide Figure 56 Traffic Redirect The following table describes the labels in this screen. Table 45 Traffic Redirect LABEL DESCRIPTION Active Select this check box to have the ZyWALL use traffic redirect if the normal WAN connection goes down.
Page 150: Figure 57 Dial Backup Setup
ZyWALL 35 User’s Guide Figure 57 Dial Backup Setup Chapter 7 WAN Screens...
Page 151: Table 46 Dial Backup Setup
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 46 Dial Backup Setup LABEL DESCRIPTION Dial Backup Setup Enable Dial Backup Select this check box to turn on dial backup. Basic Settings Login Name Type the login name assigned by your ISP.
Page 152 ZyWALL 35 User’s Guide Table 46 Dial Backup Setup (continued) LABEL DESCRIPTION Enable RIP Select this check box to turn on RIP (Routing Information Protocol), which allows a router to exchange routing information with other routers. RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving).
Page 153: Advanced Modem Setup
ZyWALL 35 User’s Guide Table 46 Dial Backup Setup (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 7.12 Advanced Modem Setup 7.12.1 AT Command Strings For regular telephone lines, the default Dial string tells the modem that the line uses tone dialing.
Page 154: Figure 58 Advanced Setup
ZyWALL 35 User’s Guide Figure 58 Advanced Setup The following table describes the labels in this screen. Table 47 Advanced Setup LABEL DESCRIPTION AT Command Strings Dial Type the AT Command string to make a call. Drop Type the AT Command string to drop a call. "~" represents a one second wait, for example, "~~~+++~~ath"...
Page 155 ZyWALL 35 User’s Guide Table 47 Advanced Setup (continued) LABEL DESCRIPTION Dial Timeout (sec) Type a number of seconds for the ZyWALL to try to set up an outgoing call before timing out (stopping). Retry Count Type a number of times for the ZyWALL to retry a busy or no-answer phone number before blacklisting the number.
Page 156 ZyWALL 35 User’s Guide Chapter 7 WAN Screens...
Page 157: Chapter 8 Dmz Screens
ZyWALL 35 User’s Guide H A P T E R DMZ Screens This chapter describes how to configure the ZyWALL’s DMZ. 8.1 DMZ Overview The DeMilitarized Zone (DMZ) auto-negotiating 10/100 Mbps Ethernet port provides a way for public servers (Web, e-mail, FTP, etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death).
Page 158: Figure 59 Dmz
ZyWALL 35 User’s Guide From the main menu, click DMZ. The screen appears as shown next. Figure 59 DMZ The following table describes the labels in this screen. Table 48 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address Type the IP address of your ZyWALL’s DMZ port in dotted decimal notation.
Page 159: Configuring Ip Alias
ZyWALL 35 User’s Guide Table 48 DMZ (continued) LABEL DESCRIPTION Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use.
Page 160: Figure 60 Ip Alias
ZyWALL 35 User’s Guide Figure 60 IP Alias The following table describes the labels in this screen. Table 49 IP Alias LABEL DESCRIPTION Enable IP Alias 1, Select the check box to configure another DMZ network for the ZyWALL. IP Address Enter the IP address of your ZyWALL in dotted decimal notation.
Page 161: Dmz Public Ip Address Example
ZyWALL 35 User’s Guide Table 49 IP Alias (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Page 162: Dmz Private And Public Ip Address Example
ZyWALL 35 User’s Guide 8.5 DMZ Private and Public IP Address Example The following figure shows a network setup with both private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected computers (A through C) use private IP addresses that are in one subnet.
Page 163: Figure 63 Port Roles
ZyWALL 35 User’s Guide Click DMZ, then Port Roles. The screen appears as shown. Figure 63 Port Roles After you change the LAN/DMZ port roles and click Apply, please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen.
Page 164 ZyWALL 35 User’s Guide Chapter 8 DMZ Screens...
Page 165: Chapter 9 Firewalls
ZyWALL 35 User’s Guide H A P T E R Firewalls This chapter gives some background information on firewalls and introduces the ZyWALL firewall. 9.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another.
Page 166: Stateful Inspection Firewalls
ZyWALL 35 User’s Guide 1 Information hiding prevents the names of internal systems from being made known via DNS to outside systems, since the application gateway is the only host whose name must be made known to outside systems. 2 Robust authentication and logging pre-authenticates application traffic before it reaches internal hosts and causes it to be logged more effectively than if it were logged with standard host logging.
Page 167: Denial Of Service
ZyWALL 35 User’s Guide Figure 65 ZyWALL Firewall Application 9.4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources.
Page 168: Types Of Dos Attacks
ZyWALL 35 User’s Guide 9.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data.
Page 169: Figure 67 Syn Flood
ZyWALL 35 User’s Guide response. While the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an internal timer (which is set at relatively long intervals) terminates the three-way handshake.
Page 170: Icmp Vulnerability
ZyWALL 35 User’s Guide Figure 68 Smurf Attack 9.4.2.1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 51 ICMP Commands That Trigger Alerts REDIRECT TIMESTAMP_REQUEST TIMESTAMP_REPLY ADDRESS_MASK_REQUEST ADDRESS_MASK_REPLY 9.4.2.2 Illegal Commands (NetBIOS and SMTP)
Page 171: Traceroute
ZyWALL 35 User’s Guide All SMTP commands are illegal except for those displayed in the following tables. Table 53 Legal SMTP Commands AUTH DATA EHLO ETRN EXPN HELO HELP MAIL NOOP QUIT RCPT RSET SAML SEND SOML TURN VRFY 9.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints.
Page 172: Stateful Inspection Process
ZyWALL 35 User’s Guide Figure 69 Stateful Inspection The previous figure shows the ZyWALL’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated from the WAN is blocked.
Page 173: Stateful Inspection And The Zywall
ZyWALL 35 User’s Guide temporary entries might be modified, in order to permit only packets that are valid for the current state of the connection. 8 Any additional inbound or outbound packets that belong to the connection are inspected to update the state table entry and to modify the temporary inbound access list entries as required, and are forwarded through the interface.
Page 174: Udp/Icmp Security
ZyWALL 35 User’s Guide If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the Internet. Assuming that this is an acceptable part of the security policy (as is the case with the default policy), the connection will be allowed. A cache entry is added which includes connection information such as IP addresses, TCP ports, sequence numbers, etc.
Page 175: Guidelines For Enhancing Security With Your Firewall
ZyWALL 35 User’s Guide Any protocol that operates in this way must be supported on a case-by-case basis. You can use the web configurator’s Custom Services feature to do this. 9.6 Guidelines For Enhancing Security With Your Firewall 1 Change the default password via SMT or web configurator.
Page 176: Firewall
ZyWALL 35 User’s Guide 9.7.2 Firewall • The firewall inspects packet contents as well as their source and destination addresses. Firewalls of this type employ an inspection module, applicable to all protocols, that understands data in the packet is intended for other layers, from the network layer (IP headers) up to the application layer.
Page 177: Chapter 10 Firewall Screens
ZyWALL 35 User’s Guide H A P T E R Firewall Screens This chapter shows you how to configure your ZyWALL firewall. 10.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your ZyWALL has to offer. For this reason, it is recommended that you configure your firewall using the web configurator.
Page 178: Rule Logic Overview
ZyWALL 35 User’s Guide This prevents computers on the WAN from using the ZyWALL as a gateway to communicate with other computers on the WAN and/or managing the ZyWALL. • DMZ to LAN • DMZ to DMZ/ZyWALL This prevents computers on the DMZ from communicating between networks or subnets connected to the DMZ interface and/or managing the ZyWALL.
Page 179: Security Ramifications
ZyWALL 35 User’s Guide 10.3.2 Security Ramifications Once the logic of the rule has been defined, it is critical to consider the security ramifications created by the rule: 1 Does this rule stop LAN users from accessing critical resources on the Internet? For...
Page 180: Lan To Wan Rules
ZyWALL 35 User’s Guide LAN to LAN/ZyWALL, WAN to WAN/ZyWALL and DMZ to DMZ/ZyWALL rules apply to packets coming in on the associated interface (LAN, WAN, or DMZ respectively). LAN to LAN/ZyWALL means policies for LAN-to-ZyWALL (the policies for managing the ZyWALL through the LAN interface) and policies for LAN-to-LAN (the policies that control routing between two subnets on the LAN).
Page 181: Alerts
ZyWALL 35 User’s Guide Figure 71 WAN to LAN Traffic 10.5 Alerts Alerts are reports on events, such as attacks, that you may want to know about right away. You can choose to generate an alert when a rule is matched in the Edit Rule screen (see...
Page 182: Figure 72 Default Rule (Router Mode)
ZyWALL 35 User’s Guide Figure 72 Default Rule (Router Mode) The following table describes the labels in this screen. Table 54 Default Rule (Router Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Page 183: Figure 73 Default Rule (Bridge Mode)
ZyWALL 35 User’s Guide Figure 73 Default Rule (Bridge Mode) The following table describes the labels in this screen. Table 55 Default Rule (Bridge Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Page 184: Rule Summary
ZyWALL 35 User’s Guide 10.6.1 Rule Summary Note: The ordering of your rules is very important as rules are applied in turn. Click FIREWALL, then the Rule Summary tab to open the screen. Figure 74 Rule Summary The following table describes the labels in this screen.
Page 185: Configuring Firewall Rules
ZyWALL 35 User’s Guide Table 56 Rule Summary LABEL DESCRIPTION Destination This drop-down list box displays the destination addresses or ranges of addresses to Address which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any.
Page 186: Figure 75 Creating/Editing A Firewall Rule
ZyWALL 35 User’s Guide Figure 75 Creating/Editing A Firewall Rule Chapter 10 Firewall Screens...
Page 187: Table 57 Creating/Editing A Firewall Rule
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 57 Creating/Editing A Firewall Rule LABEL DESCRIPTION Edit Source/ Destination Address Address Type Do you want your rule to apply to packets with a particular (single) IP, a range of IP addresses (e.g., 192.168.1.10 to 192.169.1.50), a subnet or any IP address?
Page 188: Configuring Custom Services
ZyWALL 35 User’s Guide Table 57 Creating/Editing A Firewall Rule LABEL DESCRIPTION Apply Click Apply to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. 10.6.3 Configuring Custom Services Configure customized ports for services not predefined by the ZyWALL (see Section 10.8 on...
Page 189: Figure 77 Rule Summary
ZyWALL 35 User’s Guide 1 Click the FIREWALL link and then the Rule Summary tab. Select WAN to LAN from the Packet Direction drop-down list box. Figure 77 Rule Summary 2 In the Rule Summary screen, type the index number for where you want to put the rule.
Page 190: Figure 78 Rule Edit Example
ZyWALL 35 User’s Guide Figure 78 Rule Edit Example 6 In the Edit Rule screen, click Add under Custom Service to open the Edit Custom Service screen. Configure it as follows and click Apply. Figure 79 Edit Custom Service Example 7 In the Edit Rule screen, use the arrows between Available Services and Selected Service(s) to configure it as follows.
Page 191: Figure 80 My Service Rule Configuration
ZyWALL 35 User’s Guide Figure 80 My Service Rule Configuration Chapter 10 Firewall Screens...
Page 192: Predefined Services
ZyWALL 35 User’s Guide Figure 81 My Service Example Rule Summary Rule 1: Allows a My Service connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN. 10.8 Predefined Services The Available Services list box in the Edit Rule screen (see...
Page 193 ZyWALL 35 User’s Guide Table 59 Predefined Services (continued) SERVICE DESCRIPTION FINGER(TCP:79) Finger is a UNIX or Internet related command that can be used to find out if a user is logged on. FTP(TCP:20.21) File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail.
Page 194: Anti-Probing
ZyWALL 35 User’s Guide Table 59 Predefined Services (continued) SERVICE DESCRIPTION RTELNET(TCP:107) Remote Telnet. RTSP(TCP/UDP:554) The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet. SFTP(TCP:115) Simple File Transfer Protocol. SIP-V2(UDP:5060) The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet.
Page 195: Dos Thresholds
ZyWALL 35 User’s Guide Click FIREWALL, then the Anti-Probing tab to open the screen. Figure 82 Anti-Probing The following table describes the labels in this screen. Table 60 Anti-Probing LABEL DESCRIPTION Respond to PING The ZyWALL does not respond to any incoming Ping requests when Disable is selected.
Page 196: Threshold Values
ZyWALL 35 User’s Guide 10.10.1 Threshold Values Tune these parameters when something is not working and after you have checked the firewall counters. These default values should work fine for normal small offices with ADSL bandwidth. Factors influencing choices for threshold values are: 1 The maximum number of opened sessions.
Page 197: Figure 83 Firewall Threshold
ZyWALL 35 User’s Guide Whenever the number of half-open sessions with the same destination host address rises above a threshold (TCP Maximum Incomplete), the ZyWALL starts deleting half-open sessions according to one of the following methods: 1 If the Blocking Time timeout is 0 (the default), then the ZyWALL deletes the oldest existing half-open session for the host for every new connection request to the host.
Page 198 ZyWALL 35 User’s Guide Table 61 Firewall Threshold (continued) LABEL DESCRIPTION One Minute High This is the rate of new half-open sessions that causes the firewall to start deleting half-open sessions. When the rate of new connection attempts rises above this number, the ZyWALL deletes half-open sessions as required to accommodate new connection attempts.
Page 199: Content Filtering Screens
ZyWALL 35 User’s Guide H A P T E R Content Filtering Screens This chapter provides an overview of content filtering. 11.1 Content Filtering Overview Content filtering allows you to block certain web features, such as Cookies, and/or restrict specific websites. With content filtering, you can do the following: 11.1.1 Restrict Web Features...
Page 200: Figure 84 Content Filter : General
ZyWALL 35 User’s Guide Figure 84 Content Filter : General The following table describes the labels in this screen. Table 62 Content Filter : General LABEL DESCRIPTION General Setup Enable Content Filter Select this check box to enable the content filter.
Page 201 ZyWALL 35 User’s Guide Table 62 Content Filter : General LABEL DESCRIPTION Cookies Cookies are files stored on a computer’s hard drive. Some web servers use them to track usage and provide service based on ID. Web Proxy A server that acts as an intermediary between a user and the Internet to provide security, administrative control, and caching service.
Page 202: Content Filtering With An External Database
ZyWALL 35 User’s Guide 11.3 Content Filtering with an External Database When you register for and enable external database content filtering, your ZyWALL accesses an external database that has millions of web sites categorized based on content. You can have the ZyWALL block, block and/or log access to web sites based on these categories.
Page 203: Figure 86 Content Filter : Categories
ZyWALL 35 User’s Guide Figure 86 Content Filter : Categories The following table describes the labels in this screen. Table 63 Content Filter : Categories LABEL DESCRIPTION Auto Category Setup Enable External Database Enable external database content filtering to have the ZyWALL check an...
Page 204 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Unrated Web Pages Select Block to prevent users from accessing web pages that the external database content filtering has not categorized. When the external database content filtering blocks access to a web...
Page 205 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Alcohol/Tobacco Selecting this category excludes pages that promote or offer the sale alcohol/tobacco products, or provide the means to create them. It also includes pages that glorify, tout, or otherwise encourage the consumption of alcohol/tobacco.
Page 206 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Education Selecting this category excludes pages that offer educational information, distance learning and trade school information or programs. It also includes pages that are sponsored by schools, educational facilities, faculty, or alumni groups.
Page 207 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION News/Media Selecting this category excludes pages that primarily report information or comments on current events or contemporary issues of the day. It also includes radio stations and magazines. It does not include pages that can be rated in other categories.
Page 208 ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Humor/Jokes Selecting this category excludes pages that primarily focus on comedy, jokes, fun, etc. This may include pages containing jokes of adult or mature nature. Pages containing humorous Adult/Mature content also have an Adult/Mature category rating.
Page 209: Customization
ZyWALL 35 User’s Guide Table 63 Content Filter : Categories (continued) LABEL DESCRIPTION Register Click Register to go to a web site where you can register for category- based content filtering (using an external database). You can use a trial application or register your iCard’s PIN.
Page 210: Figure 87 Content Filter : Customization
ZyWALL 35 User’s Guide Figure 87 Content Filter : Customization The following table describes the labels in this screen. Table 64 Content Filter : Customization LABEL DESCRIPTION Web Site List Customization Enable Web site Select this check box to allow trusted web sites and block forbidden web customization sites.
Page 211 ZyWALL 35 User’s Guide Table 64 Content Filter : Customization (continued) LABEL DESCRIPTION Don't block Java/ActiveX/ When this box is selected, the ZyWALL will permit Java, ActiveX and Cookies/Web proxy to trusted Cookies from sites on the Trusted Web Site list to the LAN. In certain...
Page 212: Customizing Keyword Blocking Url Checking
ZyWALL 35 User’s Guide 11.6 Customizing Keyword Blocking URL Checking You can use commands to set how much of a website’s URL the content filter is to check for keyword blocking. See the appendices for information on how to access and use the command interpreter.
Page 213: Content Filtering Cache
ZyWALL 35 User’s Guide 11.7 Content Filtering Cache To view and configure your ZyWALL’s URL caching, click CONTENT FILTER, then the Cache tab. The screen appears as shown. You can use this screen to configure how long a categorized web site address remains in the cache as well as view those web site addresses to which access has been allowed or blocked based on the responses from the external content filtering server.
Page 214 ZyWALL 35 User’s Guide Table 65 Content Filter : Cache (continued) LABEL DESCRIPTION Flush Click this button to clear all web site addresses from the cache manually. Refresh Click this button to reload the cache. This is the index number of a categorized web site address record.
Page 215: Content Filtering Registration And Reports
ZyWALL 35 User’s Guide H A P T E R Content Filtering Registration and Reports This chapter describes how to register for content filtering and view content filtering reports. Before you activate content filtering, you must create an account at myZyXEL.com and register your device.
Page 216: A Note On Myzyxel.com Numbers
ZyWALL 35 User’s Guide 12.1.1 A Note on myZyXEL.com Numbers You need the following (unique) numbers to register and activate device-specific feature(s). Table 66 myZyXEL.com Numbers TYPES DESCRIPTION Serial Number You need the serial number to register your ZyXEL device. Locate the serial number on your ZyXEL device.
Page 217: Figure 90 Myzyxel.com Account Registration
ZyWALL 35 User’s Guide Figure 90 myZyXEL.com Account Registration 4 A screen appears indicating you have created an account at myZyXEL.com. Figure 91 Account Registration Successful 5 You will receive a confirmation e-mail. Click the URL in the e-mail to activate your account.
Page 218: Registering Your Zyxel Device
ZyWALL 35 User’s Guide Figure 92 Account Confirmation E-Mail 6 Click Continue to go to the myZyXEL.com login screen. Figure 93 myZyXEL.com Account Activation 12.3 Registering Your ZyXEL Device 1 After you have created a myZyXEL.com account, log in and register your ZyXEL device by clicking the hyperlink as shown in the next screen.
Page 219: Figure 94 Logged Into Myzyxel.com
ZyWALL 35 User’s Guide Figure 94 Logged Into myZyXEL.com Click here to register a new product. 2 Click Add in the next screen. Figure 95 Product Registration 3 The Add New Product screen displays. Enter the product serial number in the Serial Number field.
Page 220: Figure 96 Add New Product
ZyWALL 35 User’s Guide Figure 96 Add New Product Your ZyXEL device MAC address may already be entered here. 8 Specify the purchase information and click Continue. Figure 97 Product Survey 9 Click Continue again. 10After you have registered your ZyXEL device, you can view its registration details in the screen shown next.
Page 221: Content Filtering Registration
ZyWALL 35 User’s Guide Figure 98 Service Management 12.4 Content Filtering Registration 1 In your ZyXEL device’s web configurator, click CONTENT FILTER, Categories and then the Register button. The following screen opens. 2 Enter the user name and password from your myZyXEL.com account (see...
Page 222: Figure 100 Myzyxel.com: Service Management
ZyWALL 35 User’s Guide Figure 100 myZyXEL.com: Service Management. 6 Enter the PIN code exactly as shown on your iCard (you do not enter a PIN if you are registering for the trial period) in the License Key (PIN code) field.
Page 223: Checking Content Filtering Activation
ZyWALL 35 User’s Guide Figure 102 Service Registration: Successful Figure 103 Service Management: Service Registered 9 You can go on to update your product registration information, view content filtering reports or click LOGOUT at any time to exit myZyXEL.com. 12.5 Checking Content Filtering Activation After you register for content filtering, the web site displays a registration successful web page.
Page 224: Updating Product Registration Information
ZyWALL 35 User’s Guide 3 Enter a valid URL or IP address of a web site in the Test if Web site is blocked field and click the Test Against Internet Server button. When content filtering is active, you should see an access blocked or access forwarded message.
Page 225: Figure 104 Cerberian Login Screen
ZyWALL 35 User’s Guide Figure 104 Cerberian Login Screen 2 Enter your ZyXEL device's MAC address (in lower case) in the Name field. Type the password that you configured during account registration at myZyXEL.com. 3 Click Reports. Figure 105 Content Filtering Reports Main Screen Note: The ZyWALL does not support Single User Reports at the time of writing.
Page 226: Configuration File
ZyWALL 35 User’s Guide Figure 106 Global Report Screen Example 6 Click a category to see the URLs that were requested. Figure 107 Requested URLs Example 12.8 Configuration File If you restore the ZyWALL to the default rom file or upload a different rom file after you...
Page 227: Chapter 13 Introduction To Ipsec
ZyWALL 35 User’s Guide H A P T E R Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 13.1 VPN Overview A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication.
Page 228: Data Confidentiality
ZyWALL 35 User’s Guide Figure 108 Encryption and Decryption 13.1.3.2 Data Confidentiality The IPSec sender can encrypt packets before transmitting them across a network. 13.1.3.3 Data Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.
Page 229: Ipsec Architecture
ZyWALL 35 User’s Guide 13.2 IPSec Architecture The overall IPSec architecture is shown as follows. Figure 109 IPSec Architecture 13.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure (including implementation algorithms).
Page 230: Transport Mode
ZyWALL 35 User’s Guide Figure 110 Transport and Tunnel Mode IPSec Encapsulation 13.3.1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP).
Page 231: Table 67 Vpn And Nat
ZyWALL 35 User’s Guide NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet. When using AH protocol, packet contents (the data payload) are not encrypted.
Page 232 ZyWALL 35 User’s Guide Chapter 13 Introduction to IPSec...
Page 233: Chapter 14 Vpn Screens
ZyWALL 35 User’s Guide H A P T E R VPN Screens This chapter introduces the VPN Web Configurator. See Chapter 24 on page 383 information on viewing logs and Appendix Q on page 673 for IPSec log descriptions. 14.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN connections.
Page 234: My Zywall
ZyWALL 35 User’s Guide Table 68 ESP and AH Encryption DES (default) Data Encryption Standard (DES) is a widely used method of data encryption using a secret key. DES applies a 56-bit key to each 64-bit block of data. 3DES...
Page 235: Dynamic Remote Gateway Address
ZyWALL 35 User’s Guide You can also enter a remote secure gateway’s domain name in the Remote Gateway Address field if the remote secure gateway has a dynamic WAN IP address and is using DDNS. The ZyWALL has to rebuild the VPN tunnel each time the remote secure gateway’s WAN IP address changes (there may be a delay until the DDNS servers are updated with the remote gateway’s new WAN IP address).
Page 236: Nat Traversal Configuration
ZyWALL 35 User’s Guide Figure 111 NAT Router Between IPSec Routers Normally you cannot set up a VPN connection with a NAT router between the two IPSec routers because the NAT router changes the header of the IPSec packet. In the previous figure, IPSec router A sends an IPSec packet in an attempt to initiate a VPN.
Page 237: Id Type And Content Examples
ZyWALL 35 User’s Guide between three encryption algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN rule (see Section 14.12.2 on page 247). The ID type and content act as an extra level of identification for incoming SAs.
Page 238: Ike Phases
ZyWALL 35 User’s Guide Table 71 Matching ID Type and Content Configuration Example ZYWALL A ZYWALL B Peer ID type: IP Peer ID type: E-mail Peer ID content: 1.1.1.2 Peer ID content: tom@yourcompany.com The two ZyWALLs in this example cannot complete their negotiation because ZyWALL B’s Local ID type is IP, but ZyWALL A’s Peer ID type is set to E-mail.
Page 239: Negotiation Mode
ZyWALL 35 User’s Guide • Choose an authentication algorithm. • Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2). • Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out. An IKE SA times out when the IKE SA lifetime period expires.
Page 240: Diffie-Hellman (Dh) Key Groups
ZyWALL 35 User’s Guide 14.8.3 Diffie-Hellman (DH) Key Groups Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 - DH1) and 1024-bit (Group 2 –...
Page 241: Icons Key
Click this icon to delete a gateway or network policy. When you delete a gateway policy, the ZyWALL 35 automatically deletes the network policy(ies) associated to that gateway policy. Click this icon to establish a VPN connection to a remote network.
Page 242: Ike Vpn Rule Summary Screen
ZyWALL 35 User’s Guide Figure 113 Gateway and Network Policies This figure helps explain the main fields in the VPN setup. Figure 114 IPSec Summary Fields Note: Local and remote network IP addresses must be static. 14.12 IKE VPN Rule Summary Screen Click VPN to display the VPN Rules (IKE) screen.
Page 243: Configuring An Ike Gateway Policy
ZyWALL 35 User’s Guide Figure 115 VPN Rules (IKE) Note: The Recycle Bin gateway policy is a virtual placeholder for any network policy(ies) without an associated gateway policy. When there is a network policy in the Recycle Bin, the Recycle Bin gateway policy automatically displays in this screen.
Page 244: Figure 116 Vpn Rules (Ike): Gateway Policy: Edit
ZyWALL 35 User’s Guide Figure 116 VPN Rules (IKE): Gateway Policy: Edit Chapter 14 VPN Screens...
Page 245: Table 74 Vpn Rules (Ike): Gateway Policy: Edit
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 74 VPN Rules (IKE): Gateway Policy: Edit LABEL DESCRIPTION Property Name Type up to 32 characters to identify this VPN gateway policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 246 ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Pre-Shared Key Select the Pre-Shared Key radio button and type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation.
Page 247 ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Content The configuration of the peer content depends on the peer ID type. Do the following when you set Authentication Key to Pre-shared Key. •...
Page 248 ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION User Name Enter a user name for your ZyWALL to be authenticated by the VPN peer (in server mode). The user name can be up to 31 case-sensitive ASCII characters, but spaces are not allowed.
Page 249: Configuring An Ike Network Policy
ZyWALL 35 User’s Guide Table 74 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 14.12.2 Configuring an IKE Network Policy...
Page 250: Figure 117 Vpn Rules (Ike): Network Policy Edit
ZyWALL 35 User’s Guide Figure 117 VPN Rules (IKE): Network Policy Edit Chapter 14 VPN Screens...
Page 251: Table 75 Vpn Rules (Ike): Network Policy Edit
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 75 VPN Rules (IKE): Network Policy Edit LABEL DESCRIPTION Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 252 ZyWALL 35 User’s Guide Table 75 VPN Rules (IKE): Network Policy Edit (continued) LABEL DESCRIPTION Starting IP Address When the Address Type field is configured to Single Address, enter a (static) IP address on the LAN behind your ZyWALL. When the Address Type field is configured to Range Address, enter the beginning (static) IP address, in a range of computers on the LAN behind your ZyWALL.
Page 253: Associating A Network Policy To A Gateway Policy
ZyWALL 35 User’s Guide Table 75 VPN Rules (IKE): Network Policy Edit (continued) LABEL DESCRIPTION Authentication MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash Algorithm algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for maximum security.
Page 254: Manual Vpn Rule Summary Screen
ZyWALL 35 User’s Guide Figure 118 VPN Rules (IKE): Network Policy Move The following table describes the labels in this screen. Table 76 VPN Rules (IKE): Network Policy Move LABEL DESCRIPTION Network Policy The following fields display the general network settings of this VPN policy.
Page 255: Figure 119 Vpn Rule (Manual)
ZyWALL 35 User’s Guide Refer to Table 73 on page 239 for descriptions of the icons used in this screen. Figure 119 VPN Rule (Manual) The following table describes the labels in this screen. Table 77 VPN Rules (Manual) LABEL DESCRIPTION This is the VPN policy index number.
Page 256: Editing Manual Vpn Rules
ZyWALL 35 User’s Guide Table 77 VPN Rules (Manual) (continued) LABEL DESCRIPTION Remote Gateway This is the static WAN IP address or domain name of the remote IPSec router. Address Modify Click the edit icon to edit the VPN policy.
Page 257: Figure 120 Vpn Rules (Manual): Edit
ZyWALL 35 User’s Guide Figure 120 VPN Rules (Manual): Edit The following table describes the labels in this screen. Table 78 VPN Rules (Manual) Edit LABEL DESCRIPTION Property Active Select this check box to activate this VPN policy. Name Type up to 32 characters to identify this VPN policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 258 ZyWALL 35 User’s Guide Table 78 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION Local Network Local IP addresses must be static and correspond to the remote IPSec router's configured remote IP addresses. Two active SAs cannot have the local and remote IP address(es) both the same.
Page 259 ZyWALL 35 User’s Guide Table 78 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION My ZyWALL Enter the WAN IP address or domain name of your ZyWALL or leave the field set to 0.0.0.0. The VPN tunnel has to be rebuilt if the My ZyWALL IP address changes after setup.
Page 260: Viewing Sa Monitor
ZyWALL 35 User’s Guide Table 78 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 14.14 Viewing SA Monitor In the web configurator, click VPN and the SA Monitor tab. Use this screen to display and manage active VPN connections.
Page 261: Configuring Global Setting
ZyWALL 35 User’s Guide 14.15 Configuring Global Setting To change your ZyWALL’s global settings, click VPN, then the Global Setting tab. The screen appears as shown. Figure 122 VPN: Global Setting The following table describes the labels in this screen. .
Page 262: Telecommuter Vpn/Ipsec Examples
ZyWALL 35 User’s Guide 14.16 Telecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyWALL at headquarters. The telecommuters use IPSec routers with dynamic WAN IP addresses. The ZyWALL at headquarters has a static public IP address.
Page 263: Figure 124 Telecommuters Using Unique Vpn Rules Example
ZyWALL 35 User’s Guide With aggressive negotiation mode (see Section 14.8.1 on page 237), the ZyWALL can use the ID types and contents to distinguish between VPN rules. Telecommuters can each use a separate VPN rule to simultaneously access a ZyWALL at headquarters. They can use different IPSec parameters.
Page 264: Vpn And Remote Management
ZyWALL 35 User’s Guide Table 82 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS HEADQUARTERS Telecommuter B (telecommuterb.dydns.org) Headquarters ZyWALL 35 Rule 2: Local ID Type: DNS Peer ID Type: DNS Local ID Content: telecommuterb.com Peer ID Content: telecommuterb.com Local IP Address: 192.168.3.2 Remote Gateway Address: telecommuterb.dydns.org...
Page 265: Chapter 15 Certificates
ZyWALL 35 User’s Guide H A P T E R Certificates This chapter gives background information about public-key certificates and explains how to use them. 15.1 Certificates Overview The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs.
Page 266: Advantages Of Certificates
ZyWALL 35 User’s Guide Certification authorities maintain directory servers with databases of valid and revoked certificates. A directory of certificates that have been revoked before the scheduled expiration is called a CRL (Certificate Revocation List). The ZyWALL can check a peer’s certificate against a directory server’s list of revoked certificates.
Page 267: My Certificates
ZyWALL 35 User’s Guide 15.4 My Certificates Click CERTIFICATES, My Certificates to open the ZyWALL’s summary list of certificates and certification requests. Certificates display in black and certification requests display in gray. See the following figure. Figure 126 My Certificates The following table describes the labels in this screen.
Page 268: Certificate File Formats
ZyWALL 35 User’s Guide Table 83 My Certificates (continued) LABEL DESCRIPTION Type This field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request.
Page 269: Importing A Certificate
ZyWALL 35 User’s Guide • Binary X.509: This is an ITU-T recommendation that defines the formats for X.509 certificates. • PEM (Base-64) encoded X.509: This Privacy Enhanced Mail format uses 64 ASCII characters to convert a binary X.509 certificate into a printable form.
Page 270: Creating A Certificate
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 84 My Certificate Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 271: Table 85 My Certificate Create
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 85 My Certificate Create LABEL DESCRIPTION Certificate Name Type up to 31 ASCII characters (not including spaces) to identify this certificate. Subject Information Use these fields to record information that identifies the owner of the certificate.
Page 272: My Certificate Details
ZyWALL 35 User’s Guide Table 85 My Certificate Create (continued) LABEL DESCRIPTION Enrollment Protocol Select the certification authority’s enrollment protocol from the drop-down list box. Simple Certificate Enrollment Protocol (SCEP) is a TCP-based enrollment protocol that was developed by VeriSign and Cisco.
Page 273: Figure 129 My Certificate Details
ZyWALL 35 User’s Guide Figure 129 My Certificate Details Chapter 15 Certificates...
Page 274: Table 86 My Certificate Details
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 86 My Certificate Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this certificate. You may use any character (not including spaces).
Page 275: Trusted Cas
ZyWALL 35 User’s Guide Table 86 My Certificate Details (continued) LABEL DESCRIPTION Subject Alternative This field displays the certificate owner‘s IP address (IP), domain name (DNS) or Name e-mail address (EMAIL). Key Usage This field displays for what functions the certificate’s key can be used. For example, “DigitalSignature”...
Page 276: Figure 130 Trusted Cas
ZyWALL 35 User’s Guide Figure 130 Trusted CAs The following table describes the labels in this screen. Table 87 Trusted CAs LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use.
Page 277: Importing A Trusted Ca's Certificate
ZyWALL 35 User’s Guide Table 87 Trusted CAs (continued) LABEL DESCRIPTION CRL Issuer This field displays Yes if the certification authority issues Certificate Revocation Lists for the certificates that it has issued and you have selected the Issues certificate revocation lists (CRL) check box in the certificate’s details screen to have the ZyWALL check the CRL before trusting any certificates issued by the certification authority.
Page 278: Trusted Ca Certificate Details
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 88 Trusted CA Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 279: Figure 132 Trusted Ca Details
ZyWALL 35 User’s Guide Figure 132 Trusted CA Details The following table describes the labels in this screen. Table 89 Trusted CA Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 280 ZyWALL 35 User’s Guide Table 89 Trusted CA Details (continued) LABEL DESCRIPTION Certification Path Click the Refresh button to have this read-only text box display the end entity’s certificate and a list of certification authority certificates that shows the hierarchy of certification authorities that validate the end entity’s certificate.
Page 281: Trusted Remote Hosts
ZyWALL 35 User’s Guide Table 89 Trusted CA Details (continued) LABEL DESCRIPTION CRL Distribution This field displays how many directory servers with Lists of revoked certificates Points the issuing certification authority of this certificate makes available. This field also displays the domain names or IP addresses of the servers.
Page 282: Figure 133 Trusted Remote Hosts
ZyWALL 35 User’s Guide Figure 133 Trusted Remote Hosts The following table describes the labels in this screen. Table 90 Trusted Remote Hosts LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use.
Page 283: Verifying A Trusted Remote Host's Certificate
ZyWALL 35 User’s Guide Table 90 Trusted Remote Hosts (continued) LABEL DESCRIPTION Import Click Import to open a screen where you can save the certificate of a remote host (which you trust) from your computer to the ZyWALL. Refresh Click this button to display the current validity status of the certificates.
Page 284: Importing A Trusted Remote Host's Certificate
ZyWALL 35 User’s Guide Figure 135 Certificate Details Verify (over the phone for example) that the remote host has the same information in the Thumbprint Algorithm and Thumbprint fields. 15.14 Importing a Trusted Remote Host’s Certificate Click CERTIFICATES, Trusted Remote Hosts to open the Trusted Remote Hosts screen and then click Import to open the Trusted Remote Host Import screen.
Page 285: Trusted Remote Host Certificate Details
ZyWALL 35 User’s Guide Figure 136 Trusted Remote Host Import The following table describes the labels in this screen. Table 91 Trusted Remote Host Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 286: Figure 137 Trusted Remote Host Details
ZyWALL 35 User’s Guide Figure 137 Trusted Remote Host Details The following table describes the labels in this screen. Table 92 Trusted Remote Host Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 287 ZyWALL 35 User’s Guide Table 92 Trusted Remote Host Details (continued) LABEL DESCRIPTION Refresh Click Refresh to display the certification path. Certificate Information These read-only fields display detailed information about the certificate. Type This field displays general information about the certificate. With trusted remote host certificates, this field always displays CA-signed.
Page 288: Directory Servers
ZyWALL 35 User’s Guide Table 92 Trusted Remote Host Details (continued) LABEL DESCRIPTION Certificate in PEM This read-only text box displays the certificate or certification request in Privacy (Base-64) Encoded Enhanced Mail (PEM) format. PEM uses 64 ASCII characters to convert the Format binary certificate into a printable form.
Page 289: Add Or Edit A Directory Server
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 93 Directory Servers LABEL DESCRIPTION PKI Storage Space This bar displays the percentage of the ZyWALL’s PKI storage space that is in Use currently in use. The bar turns from green to red when the maximum is being approached.
Page 290: Table 94 Directory Server Add
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 94 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name Type up to 31 ASCII characters (spaces are not permitted) to identify this directory server. Access Protocol Use the drop-down list box to select the access protocol used by the directory server.
Page 291: Authentication Server
ZyWALL 35 User’s Guide H A P T E R Authentication Server This chapter discusses how to configure Authentication Server on the ZyWALL. 16.1 Authentication Server Overview A ZyWALL set to be a VPN extended authentication server can use either the local user database internal to the ZyWALL or an external RADIUS server for an unlimited number of users.
Page 292: Figure 140 Local User Database
ZyWALL 35 User’s Guide Figure 140 Local User Database Chapter 16 Authentication Server...
Page 293: Configuring Radius
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 95 Local User Database LABEL DESCRIPTION Active Select this check box to enable the user profile. User Name Enter the user name of the user profile.
Page 294: Table 96 Radius
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 96 RADIUS LABEL DESCRIPTION Authentication Server Active Select the check box to enable user authentication through an external authentication server. Clear the check box to enable user authentication using the local user profile on the ZyWALL.
Page 295: Network Address Translation (Nat)
ZyWALL 35 User’s Guide H A P T E R Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 17.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet.
Page 296: What Nat Does
ZyWALL 35 User’s Guide 17.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.
Page 297: Nat Application
ZyWALL 35 User’s Guide 17.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyWALL can communicate with three distinct WAN networks. More examples follow at the end of this chapter.
Page 298: Port Restricted Cone Nat
ZyWALL 35 User’s Guide 17.1.5 Port Restricted Cone NAT Port restricted cone NAT maps all outgoing packets from an internal IP address and port to a single IP address and port on the external network. In the following example, the ZyWALL maps the source address of all packets sent from internal IP address 1 and port A to IP address 2 and port B on the external network.
Page 299: Using Nat
ZyWALL 35 User’s Guide • Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world although, it is highly recommended that you use the DMZ port for these servers instead.
Page 300: Configuring Nat Overview
ZyWALL 35 User’s Guide 17.3 Configuring NAT Overview Click NAT to open the NAT Overview screen shown next. Figure 145 NAT Overview The following table describes the labels in this screen. Table 99 NAT Overview LABEL DESCRIPTION Global Settings Max. Concurrent...
Page 301: Configuring Address Mapping
ZyWALL 35 User’s Guide Table 99 NAT Overview (continued) LABEL DESCRIPTION Address Select SUA to have the ZyWALL use its permanent, pre-defined NAT address Mapping Rules mapping rules. Select Full Feature to have the ZyWALL use the address mapping rules that you configure.
Page 302: Figure 146 Address Mapping
ZyWALL 35 User’s Guide Figure 146 Address Mapping The following table describes the labels in this screen. Table 100 Address Mapping LABEL DESCRIPTION SUA Address This read-only table displays the default address mapping rules. Mapping Rules Full Feature Address Mapping Rules WAN Interface Select the WAN port for which you want to view or configure address mapping rules.
Page 303: Address Mapping Edit
ZyWALL 35 User’s Guide Table 100 Address Mapping (continued) LABEL DESCRIPTION Global End IP This is the ending Inside Global Address (IGA). This field is N/A for One-to-One, Many-to-One and Server mapping types. Type 1. One-to-One mode maps one local IP address to one global IP address. Note that port numbers do not change for the One-to-one NAT mapping type.
Page 304: Port Forwarding
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 101 Address Mapping Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. 1. One-to-One: One-to-one mode maps one local IP address to one global IP address.
Page 305: Default Server Ip Address
ZyWALL 35 User’s Guide 17.5.1 Default Server IP Address In addition to the servers for specified services, NAT supports a default server IP address. A default server receives packets from ports that are not specified in this screen. Note: If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup.
Page 306: Nat And Multiple Wan
ZyWALL 35 User’s Guide Figure 148 Multiple Servers Behind NAT Example 17.5.4 NAT and Multiple WAN The ZyWALL has two WAN ports. You can configure port forwarding and trigger port rule sets for the first WAN port and separate sets of rules for the second WAN port.
Page 307: Configuring Port Forwarding
ZyWALL 35 User’s Guide Figure 149 Port Translation Example 17.6 Configuring Port Forwarding Note: If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup.
Page 308: Figure 150 Port Forwarding
ZyWALL 35 User’s Guide Figure 150 Port Forwarding The following table describes the labels in this screen. Table 103 Port Forwarding LABEL DESCRIPTION WAN Interface Select the WAN port for which you want to view or configure address mapping rules.
Page 309: Configuring Trigger Port
ZyWALL 35 User’s Guide Table 103 Port Forwarding LABEL DESCRIPTION Server IP Enter the inside IP address of the server here. Address Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh.
Page 310: Figure 152 Port Triggering
ZyWALL 35 User’s Guide 4 The ZyWALL forwards the traffic to Jane’s computer IP address. 5 Only Jane can connect to the Real Audio server until the connection is closed or times out. The ZyWALL times out in three minutes with UDP (User Datagram Protocol) or two hours with TCP/IP (Transfer Control Protocol/Internet Protocol).
Page 311 ZyWALL 35 User’s Guide Table 104 Port Triggering LABEL DESCRIPTION Trigger The trigger port is a port (or a range of ports) that causes (or triggers) the ZyWALL to record the IP address of the LAN computer that sent the traffic to a server on the WAN.
Page 312 ZyWALL 35 User’s Guide Chapter 17 Network Address Translation (NAT)
Page 313: Chapter 18 Static Route
ZyWALL 35 User’s Guide H A P T E R Static Route This chapter shows you how to configure static routes for your ZyWALL. 18.1 Static Route Overview Each remote node specifies only the network to which the gateway is directly connected, and the ZyWALL has no knowledge of the networks beyond.
Page 314: Figure 154 Ip Static Route
ZyWALL 35 User’s Guide Figure 154 IP Static Route The following table describes the labels in this screen. Table 105 IP Static Route LABEL DESCRIPTION This is the number of an individual static route. Name This is the name that describes or identifies this route.
Page 315: Configuring A Static Route Entry
ZyWALL 35 User’s Guide 18.2.1 Configuring a Static Route Entry Select a static route index number and click Edit. The screen shown next appears. Fill in the required information for each static route. Figure 155 Edit IP Static Route The following table describes the labels in this screen.
Page 316 ZyWALL 35 User’s Guide Chapter 18 Static Route...
Page 317: Chapter 19 Policy Route
ZyWALL 35 User’s Guide H A P T E R Policy Route This chapter covers setting and applying policies used for IP routing. 19.1 Introduction to IP Policy Routing Traditionally, routing is based on the destination address only and the ZyWALL takes the shortest path to forward a packet.
Page 318: Ip Routing Policy Setup
ZyWALL 35 User’s Guide IPPR follows the existing packet filtering facility of RAS in style and in implementation. 19.4 IP Routing Policy Setup Click POLICY ROUTE to open the Policy Route Summary screen (some of the screen’s blank rows are not shown).
Page 319: Configuring The Ip Policy Route Entry
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 107 Policy Route Setup LABEL DESCRIPTION This is the number of an individual policy route. Active This field shows whether the policy is active or inactive.
Page 320: Figure 157 Edit Ip Policy Route
ZyWALL 35 User’s Guide Figure 157 Edit IP Policy Route The following table describes the labels in this screen. Table 108 Edit IP Policy Route LABEL DESCRIPTION Criteria Active Select the check box to activate the policy. Rule Index This is the index number of the policy route.
Page 321 ZyWALL 35 User’s Guide Table 108 Edit IP Policy Route (continued) LABEL DESCRIPTION Packet Length Type a length of packet (in bytes). The operators in the Len Compare field apply to incoming packets of this length. Length Choose from Equal, Not Equal, Less, Greater, Less or Equal or Greater or Comparison Equal.
Page 322 ZyWALL 35 User’s Guide Chapter 19 Policy Route...
Page 323: Chapter 20 Bandwidth Management
ZyWALL 35 User’s Guide H A P T E R Bandwidth Management This chapter describes the functions and configuration of bandwidth management with multiple levels of sub-classes. 20.1 Bandwidth Management Overview Bandwidth management allows you to allocate an interface’s outgoing capacity to specific types of traffic.
Page 324: Proportional Bandwidth Allocation
ZyWALL 35 User’s Guide 20.3 Proportional Bandwidth Allocation Bandwidth management allows you to define how much bandwidth each class gets; however, the actual bandwidth allotted to each class decreases or increases in proportion to actual available bandwidth. 20.4 Application-based Bandwidth Management You can create bandwidth classes based on individual applications (like VoIP, Web, FTP, E- mail and Video for example).
Page 325: Scheduler
ZyWALL 35 User’s Guide Table 109 Application and Subnet-based Bandwidth Management Example (continued) TRAFFIC TYPE FROM SUBNET A FROM SUBNET B 64 Kbps 64 Kbps E-mail 64 Kbps 64 Kbps Video 64 Kbps 64 Kbps 20.7 Scheduler The scheduler divides up an interface’s bandwidth among the bandwidth classes. The ZyWALL has two types of scheduler: fairness-based and priority-based.
Page 326: Reserving Bandwidth For Non-Bandwidth Class Traffic
ZyWALL 35 User’s Guide 20.8.1 Reserving Bandwidth for Non-Bandwidth Class Traffic Do the following three steps to configure the ZyWALL to allow bandwidth for traffic that is not defined in a bandwidth filter. 1 Leave some of the interface’s bandwidth unbudgeted.
Page 327: Fairness-Based Allotment Of Unused And Unbudgeted Bandwidth
ZyWALL 35 User’s Guide Suppose that all of the classes except for the administration class need more bandwidth. • Each class gets up to its budgeted bandwidth. The administration class only uses 1024 kbps of its budgeted 2048 kbps. • The sales and marketing are first to get extra bandwidth because they have the highest priority (6).
Page 328: Bandwidth Borrowing Example
ZyWALL 35 User’s Guide The total of the bandwidth allotments for sub-classes cannot exceed the bandwidth allotment of their parent class. The ZyWALL uses the scheduler to divide a parent class’s unused bandwidth among the sub-classes. 20.9.1 Bandwidth Borrowing Example Here is an example of bandwidth management with classes configured for bandwidth borrowing.
Page 329: Configuring Summary
ZyWALL 35 User’s Guide 2 The ZyWALL assigns a parent class’s unused bandwidth to its sub-classes that have more traffic than their budgets and have bandwidth borrowing enabled. The ZyWALL gives priority to sub-classes of higher priority and treats classes of the same priority equally.
Page 330: Configuring Class Setup
ZyWALL 35 User’s Guide Table 114 Bandwidth Manager: Summary (continued) LABEL DESCRIPTION Speed (kbps) Enter the amount of bandwidth for this interface that you want to allocate using bandwidth management. This appears as the bandwidth budget of the interface’s root class (see Section 20.11 on page...
Page 331: Figure 160 Bandwidth Manager: Class Setup
ZyWALL 35 User’s Guide Figure 160 Bandwidth Manager: Class Setup The following table describes the labels in this screen. Table 115 Bandwidth Manager: Class Setup LABEL DESCRIPTION Class Setup Interface Select an interface from the drop-down list box for which you wish to set up classes.
Page 332: Bandwidth Manager Class Configuration
ZyWALL 35 User’s Guide Table 115 Bandwidth Manager: Class Setup (continued) LABEL DESCRIPTION Destination IP This is the destination IP address for connections to which this bandwidth Address management filter applies. Destination Port This is the destination port for connections to which this bandwidth management filter applies.
Page 333: Figure 161 Bandwidth Manager: Edit Class
ZyWALL 35 User’s Guide Figure 161 Bandwidth Manager: Edit Class The following table describes the labels in this screen. Table 116 Bandwidth Manager: Edit Class LABEL DESCRIPTION Class Configuration Class Name Use the auto-generated name or enter a descriptive name of up to 20 alphanumeric characters, including spaces.
Page 334 ZyWALL 35 User’s Guide Table 116 Bandwidth Manager: Edit Class (continued) LABEL DESCRIPTION Enable Bandwidth Select Enable Bandwidth Filter to have the ZyWALL use this bandwidth filter Filter when it performs bandwidth management. You must enter a value in at least one of the following fields (other than the Subnet Mask fields which are only available when you enter the destination or source IP address).
Page 335: Bandwidth Management Statistics
ZyWALL 35 User’s Guide Table 117 Services and Port Numbers SERVICES PORT NUMBER ECHO FTP (File Transfer Protocol) SMTP (Simple Mail Transfer Protocol) DNS (Domain Name System) Finger HTTP (Hyper Text Transfer protocol or WWW, Web) POP3 (Post Office Protocol)
Page 336: Configuring Monitor
ZyWALL 35 User’s Guide Table 118 Bandwidth Management Statistics (continued) LABEL DESCRIPTION Dropped This field displays the total number of packets dropped. Packets Dropped Bytes This field displays the total number of bytes dropped. Bandwidth Statistics for the Past 8 Seconds (t-8 to t-1) This field displays the bandwidth statistics (in bps) for the past one to eight seconds.
Page 337: Table 119 Bandwidth Manager Monitor
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 119 Bandwidth Manager Monitor LABEL DESCRIPTION Interface Select an interface from the drop-down list box to view the bandwidth usage of its bandwidth classes. Class This field displays the name of the bandwidth class.
Page 338 ZyWALL 35 User’s Guide Chapter 20 Bandwidth Management...
Page 339: Chapter 21 Dns
ZyWALL 35 User’s Guide H A P T E R This chapter shows you how to configure the DNS screens. 21.1 DNS Overview DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.
Page 340: Address Record
ZyWALL 35 User’s Guide 21.4 Address Record An address record contains the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the top-level domain. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel”...
Page 341: The System Screen
ZyWALL 35 User’s Guide Figure 164 Private DNS Server Example Note: If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote private network.
Page 342: Adding An Address Record
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 120 System DNS LABEL DESCRIPTION Address Record An address record specifies the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the top-level domain.
Page 343: Inserting A Name Server Record
ZyWALL 35 User’s Guide Figure 166 System DNS: Add Address Record The following table describes the labels in this screen. Table 121 System DNS: Add Address Record LABEL DESCRIPTION FQDN Type a fully qualified domain name (FQDN) of a server. An FQDN starts with a host name and continues all the way up to the top-level domain name.
Page 344: Figure 167 System Dns: Insert Name Server Record
ZyWALL 35 User’s Guide Figure 167 System DNS: Insert Name Server Record The following table describes the labels in this screen. Table 122 System DNS: Insert Name Server Record LABEL DESCRIPTION Domain Zone This field is optional. A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain...
Page 345: Dns Cache
ZyWALL 35 User’s Guide 21.7 DNS Cache DNS cache is the temporary storage area where a router stores responses from DNS servers. When the ZyWALL receives a positive or negative response for a DNS query, it records the response in the DNS cache. A positive response means that the ZyWALL received the IP address for a domain name that it checked with a DNS server within the five second DNS timeout period.
Page 346: Configuring Dns Lan
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 123 DNS Cache LABEL DESCRIPTION DNS Cache Setup Cache Positive DNS Select the check box to record the positive DNS resolutions in the cache. Resolutions Caching positive DNS resolutions helps speed up the ZyWALL’s processing of commonly queried domain names and reduces the amount of traffic that the ZyWALL sends out to the WAN.
Page 347: Figure 169 Dns Lan
ZyWALL 35 User’s Guide Figure 169 DNS LAN The following table describes the labels in this screen. Table 124 DNS LAN LABEL DESCRIPTION DNS Servers The ZyWALL passes a DNS (Domain Name System) server IP address (in the Assigned by DHCP order you specify here) to the DHCP clients.
Page 348: Dynamic Dns
ZyWALL 35 User’s Guide 21.10 Dynamic DNS Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change...
Page 349: Figure 170 Ddns
ZyWALL 35 User’s Guide Figure 170 DDNS The following table describes the labels in this screen. Table 125 DDNS LABEL DESCRIPTION Account Setup Active Select this check box to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider.
Page 350 ZyWALL 35 User’s Guide Table 125 DDNS LABEL DESCRIPTION IP Address Update Select Use WAN IP Address to have the ZyWALL update the domain name Policy with the WAN port's IP address. Select Use User-Defined and enter the IP address if you have a static IP address.
Page 351: Chapter 22 Remote Management
ZyWALL 35 User’s Guide H A P T E R Remote Management This chapter provides information on the Remote Management screens. 22.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers.
Page 352: Remote Management And Nat
ZyWALL 35 User’s Guide 2 A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. 3 You have disabled that service in one of the remote management screens.
Page 353: Configuring Www
ZyWALL 35 User’s Guide 1 HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the ZyWALL’s WS (web server). 2 HTTP connection requests from a web browser go to port 80 (by default) on the ZyWALL’s WS (web server).
Page 354: Figure 172 Www
ZyWALL 35 User’s Guide Figure 172 WWW The following table describes the labels in this screen. Table 126 WWW LABEL DESCRIPTION HTTPS Server Select the Server Certificate that the ZyWALL will use to identify itself. The Certificate ZyWALL is the SSL server and must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the ZyWALL).
Page 355: Https Example
ZyWALL 35 User’s Guide Table 126 WWW (continued) LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 356: Netscape Navigator Warning Messages
ZyWALL 35 User’s Guide 22.4.2 Netscape Navigator Warning Messages When you attempt to access the ZyWALL HTTPS server, a Website Certified by an Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that the certificate is from the ZyWALL.
Page 357: Login Screen
ZyWALL 35 User’s Guide • The issuing certificate authority of the ZyWALL’s HTTPS server certificate is not one of the browser’s trusted certificate authorities. The issuing certificate authority of the ZyWALL's factory default certificate is the ZyWALL itself since the certificate is a self- signed certificate.
Page 358: Figure 176 Login Screen (Internet Explorer)
ZyWALL 35 User’s Guide Figure 176 Login Screen (Internet Explorer) Figure 177 Login Screen (Netscape) Click Login and you then see the next screen. The factory default certificate is a common default certificate for all ZyWALL models. Chapter 22 Remote Management...
Page 359: Figure 178 Replace Certificate
ZyWALL 35 User’s Guide Figure 178 Replace Certificate Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Click CERTIFICATES to open the My Certificates screen. You will see information similar to that shown in the following figure.
Page 360: Ssh Overview
ZyWALL 35 User’s Guide Figure 180 Common ZyWALL Certificate 22.5 SSH Overview Unlike Telnet or FTP, which transmit data in clear text, SSH (Secure Shell) is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network.
Page 361: Ssh Implementation On The Zywall
ZyWALL 35 User’s Guide Figure 182 How SSH Works 1 Host Identification The SSH client sends a connection request to the SSH server. The server identifies itself with a host key. The client encrypts a randomly generated session key with the host key and server key and sends the result back to the server.
Page 362: Requirements For Using Ssh
ZyWALL 35 User’s Guide 22.7.1 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the ZyWALL over SSH. 22.8 Configuring SSH To change your ZyWALL’s Secure Shell settings, click REMOTE MGMT, then the SSH tab.
Page 363: Secure Telnet Using Ssh Examples
ZyWALL 35 User’s Guide 22.9 Secure Telnet Using SSH Examples This section shows two examples using a command interface and a graphical interface SSH client program to remotely access the ZyWALL. The configuration and connection steps are similar for most SSH client programs. Refer to your SSH client program user’s guide.
Page 364: Secure Ftp Using Ssh Example
ZyWALL 35 User’s Guide Figure 185 SSH Example 2: Test $ telnet 192.168.1.1 22 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5-1.0.0 2 Enter “ssh –1 192.168.1.1”. This command forces your computer to connect to the ZyWALL using SSH version 1. If this is the first time you are connecting to the ZyWALL using SSH, a message displays prompting you to save the host information of the ZyWALL.
Page 365: Telnet
ZyWALL 35 User’s Guide Figure 187 Secure FTP: Firmware Upload Example $ sftp -1 192.168.1.1 Connecting to 192.168.1.1... The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established. RSA1 key fingerprint is 21:6c:07:25:7e:f4:75:80:ec:af:bd:d4:3d:80:53:d1. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.1' (RSA1) to the list of known...
Page 366: Configuring Ftp
ZyWALL 35 User’s Guide Figure 189 Telnet The following table describes the labels in this screen. Table 128 Telnet LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 367: Configuring Snmp
ZyWALL 35 User’s Guide Figure 190 FTP The following table describes the labels in this screen. Table 129 FTP LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 368: Figure 191 Snmp Management Model
ZyWALL 35 User’s Guide Figure 191 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyWALL). An agent translates the local management information from the managed device into a form compatible with SNMP.
Page 369: Supported Mibs
ZyWALL 35 User’s Guide 22.14.1 Supported MIBs The ZyWALL supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of the MIBs is to let administrators collect statistical data and monitor status and performance. 22.14.2 SNMP Traps The ZyWALL will send traps to the SNMP manager when any one of the following events...
Page 370 ZyWALL 35 User’s Guide Figure 192 SNMP The following table describes the labels in this screen. Table 131 SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests.
Page 371: Configuring Dns
ZyWALL 35 User’s Guide 22.15 Configuring DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to Chapter 7 on page 125 for more information. To change your ZyWALL’s DNS settings, click REMOTE MGMT, then the DNS tab. The screen appears as shown.
Page 372: Configuring Cnm
ZyWALL 35 User’s Guide If you allow your ZyWALL to be managed by the Vantage CNM server, then you should not do any configurations directly to the ZyWALL (using either the web configurator, SMT menus or commands) without notifying the Vantage CNM administrator.
Page 373 ZyWALL 35 User’s Guide Table 133 CNM (continued) LABEL DESCRIPTION Last Registration Time This field displays the last date (year-month-date) and time (hours-minutes- seconds) that the ZyWALL registered with the Vantage CNM server. It displays all zeroes if it has not yet registered with the Vantage CNM server.
Page 374 ZyWALL 35 User’s Guide Chapter 22 Remote Management...
Page 375: Chapter 23 Upnp
ZyWALL 35 User’s Guide H A P T E R UPnP This chapter introduces the Universal Plug and Play feature. This chapter is only applicable when the ZyWALL is in router mode. 23.1 Universal Plug and Play Overview Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices.
Page 376: Upnp And Zyxel
ZyWALL 35 User’s Guide All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. 23.2 UPnP and ZyXEL ZyXEL has achieved UPnP certification from the Universal Plug and Play Forum Creates UPnP™...
Page 377: Displaying Upnp Port Mapping
ZyWALL 35 User’s Guide Table 134 Configuring UPnP LABEL DESCRIPTION Enable the Universal Select this checkbox to activate UPnP. Be aware that anyone could use a Plug and Play (UPnP) UPnP application to open the web configurator's login screen without...
Page 378: Installing Upnp In Windows Example
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 135 UPnP Ports LABEL DESCRIPTION Reserve UPnP Select this checkbox to have the ZyWALL retain UPnP created NAT rules even NAT rules in flash after restarting. If you use UPnP and you set a port on your computer to be fixed for...
Page 379: Installing Upnp In Windows Me
ZyWALL 35 User’s Guide 23.5.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windows Me. 1 Click Start, Settings and Control Panel. Double-click Add/Remove Programs. 2 Click on the Windows Setup tab and select Communication in the Components selection box.
Page 380: Installing Upnp In Windows Xp
ZyWALL 35 User’s Guide 23.5.2 Installing UPnP in Windows XP Follow the steps below to install UPnP in Windows XP. 1 Click Start, Settings and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components ….
Page 381: Auto-Discover Your Upnp-Enabled Network Device
ZyWALL 35 User’s Guide 23.6.1 Auto-discover Your UPnP-enabled Network Device 1 Click Start and Control Panel. Double- click Network Connections. An icon displays under Internet Gateway. 2 Right-click the icon and select Properties. 3 In the Internet Connection Properties You may edit or delete the port mappings or click Add to manually add port mappings.
Page 382: Web Configurator Easy Access
ZyWALL 35 User’s Guide Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 4 Select the Show icon in notification area when connected check box and click OK. An icon displays in the system tray.
Page 383 ZyWALL 35 User’s Guide Follow the steps below to access the web configurator. 1 Click Start and then Control Panel. 2 Double-click Network Connections. 3 Select My Network Places under Other Places. 4 An icon with the description for each UPnP-enabled device displays under Local Network.
Page 384 ZyWALL 35 User’s Guide 6 Right-click the icon for your ZyXEL device and select Properties. A properties window displays with basic information about the ZyXEL device. Chapter 23 UPnP...
Page 385: Chapter 24 Logs Screens
ZyWALL 35 User’s Guide H A P T E R Logs Screens This chapter contains information about configuring general log settings and viewing the ZyWALL’s logs. Refer to Appendix Q on page 673 for example log message explanations. 24.1 Configuring View Log The web configurator allows you to look at all of the ZyWALL’s logs in one location.
Page 386: Log Description Example
ZyWALL 35 User’s Guide Figure 197 View Log The following table describes the labels in this screen. Table 136 View Log LABEL DESCRIPTION Display The categories that you select in the Log Settings page (see Section 24.3 on page 385) display in the drop-down list box.
Page 387: Configuring Log Settings
ZyWALL 35 User’s Guide The following is an example of how a log displays in the command line interpreter and a description of the sample log. Refer to the appendices for more log message descriptions and details on using the command line interpreter to display logs.
Page 388: Figure 198 Log Settings
ZyWALL 35 User’s Guide Figure 198 Log Settings Chapter 24 Logs Screens...
Page 389: Table 138 Log Settings
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 138 Log Settings LABEL DESCRIPTION E-mail Log Settings Mail Server Enter the server name or the IP address of the mail server for the e-mail addresses specified below. If this field is left blank, logs and alert messages will not be sent via e-mail.
Page 390: Configuring Reports
ZyWALL 35 User’s Guide Table 138 Log Settings (continued) LABEL DESCRIPTION Active Some logs (such as the Attacks logs) may be so numerous that it becomes easy to ignore other important log messages. Select this check box to merge logs with identical messages into one log.
Page 391: Figure 199 Reports
ZyWALL 35 User’s Guide Figure 199 Reports Note: Enabling the ZyWALL’s reporting function decreases the overall throughput by about 1 Mbps. The following table describes the labels in this screen. Table 139 Reports LABEL DESCRIPTION Collect Statistics Select the check box and click Apply to have the ZyWALL record report data.
Page 392: Viewing Web Site Hits
ZyWALL 35 User’s Guide 24.4.1 Viewing Web Site Hits In the Reports screen, select Web Site Hits from the Report Type drop-down list box to have the ZyWALL record and display which web sites have been visited the most often and how many times they have been visited.
Page 393: Viewing Lan Ip Address
ZyWALL 35 User’s Guide Figure 201 Protocol/Port Report Example The following table describes the labels in this screen. Table 141 Protocol/ Port Report LABEL DESCRIPTION Protocol/Port This column lists the protocols or service ports for which the most traffic has gone through the ZyWALL.
Page 394: Reports Specifications
ZyWALL 35 User’s Guide Figure 202 LAN IP Address Report Example The following table describes the labels in this screen. Table 142 LAN IP Address Report LABEL DESCRIPTION IP Address This column lists the LAN IP addresses to and/or from which the most traffic has been sent.
Page 395: Chapter 25 Maintenance
ZyWALL 35 User’s Guide H A P T E R Maintenance This chapter displays information on the maintenance screens. 25.1 Maintenance Overview The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your ZyWALL.
Page 396: Configuring Password
ZyWALL 35 User’s Guide Figure 203 General Setup The following table describes the labels in this screen. Table 144 General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name” in this field. This name can be up to 30 alphanumeric characters long.
Page 397: Pre-Defined Ntp Time Servers List
ZyWALL 35 User’s Guide Figure 204 Password Setup The following table describes the labels in this screen. Table 145 Password Setup LABEL DESCRIPTION Old Password Type the default password or the existing password you use to access the system in this field.
Page 398: Configuring Time And Date
ZyWALL 35 User’s Guide Table 146 Default Time Servers ntp.cs.strath.ac.uk ntp1.sp.se time1.stupi.se tick.stdtime.gov.tw tock.stdtime.gov.tw time.stdtime.gov.tw 25.5 Configuring Time and Date To change your ZyWALL’s time and date, click MAINTENANCE, then the Time and Date tab. The screen appears as shown. Use this screen to configure the ZyWALL’s time based on your local time zone.
Page 399: Table 147 Time And Date
ZyWALL 35 User’s Guide The following table describes the labels in this screen. Table 147 Time and Date LABEL DESCRIPTION Current Time and Date Current Time This field displays the time of your ZyWALL. Each time you reload this page, the ZyWALL synchronizes the time with the time server.
Page 400: Resetting The Time
ZyWALL 35 User’s Guide Table 147 Time and Date (continued) LABEL DESCRIPTION Start Date Configure the day and time when Daylight Saving Time starts if you selected Enable Daylight Saving. The o'clock field uses the 24 hour format. Here are a...
Page 401: Introduction To Transparent Bridging
ZyWALL 35 User’s Guide Figure 206 Synchronization in Process Click the Return button to go back to the Time and Date screen after the time and date is updated successfully. Figure 207 Synchronization is Successful If the update was not successful, the following screen appears. Click Return to go back to the Time and Date screen.
Page 402: Transparent Firewalls
ZyWALL 35 User’s Guide The bridge gradually builds a host MAC-address-to-port mapping table such as in the following example, during the learning process. Table 148 MAC-address-to-port Mapping Table HOST MAC ADDRESS PORT 00a0c5123456 00a0c5123478 (host A) 1 00a0c512349a 00a0c51234bc 00a0c51234de For example, if a bridge receives a frame via port 1 from host A (MAC address 00a0c5123478), the bridge associates host A with port 1.
Page 403: Configuring Device Mode
ZyWALL 35 User’s Guide Bridging devices are most useful in complex environments that require a rapid or new firewall deployment. A transparent, bridging firewall can also be good for companies with several branch offices since the setups at these offices are often the same and it's likely that one design can be used for many of the networks.
Page 404: Figure 210 Device Mode (Bridge Mode)
ZyWALL 35 User’s Guide Table 149 Device Mode (Router Mode) (continued) LABEL DESCRIPTION Subnet Mask Enter the IP subnet mask of the ZyWALL. Gateway IP Enter the gateway IP address. Address Apply Click Apply to save your changes back to the ZyWALL. After you click Apply, please wait for one minute and use the IP address you configured in the IP Address field to access the ZyWALL again.
Page 405: F/W Upload Screen
ZyWALL 35 User’s Guide Table 150 Device Mode (Bridge Mode) (continued) LABEL DESCRIPTION DHCP Server DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients (computers) to obtain TCP/IP configuration at startup from a server. Unless you are instructed by your ISP, leave the DHCP Server check box selected.
Page 406: Figure 211 Firmware Upload
ZyWALL 35 User’s Guide Figure 211 Firmware Upload The following table describes the labels in this screen. Table 151 Firmware Upload LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse ... to find it.
Page 407: Configuration Screen
ZyWALL 35 User’s Guide Figure 213 Network Temporarily Disconnected After two minutes, log in again and check your new firmware version in the System Status screen. If the upload was not successful, the following screen will appear. Click Return to go back to the F/W Upload screen.
Page 408: Backup Configuration
ZyWALL 35 User’s Guide Figure 215 Configuration 25.10.1 Backup Configuration Backup Configuration allows you to back up (save) the ZyWALL’s current configuration to a file on your computer. Once your ZyWALL is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes.
Page 409: Figure 216 Configuration Upload Successful
ZyWALL 35 User’s Guide Note: Do not turn off the ZyWALL while configuration file upload is in progress. After you see a “restore configuration successful” screen, you must then wait one minute before logging into the ZyWALL again. Figure 216 Configuration Upload Successful The ZyWALL automatically restarts in this time causing a temporary network disconnect.
Page 410: Back To Factory Defaults
ZyWALL 35 User’s Guide Figure 218 Configuration Upload Error 25.10.3 Back to Factory Defaults Pressing the Reset button in this section clears all user-entered configuration information and returns the ZyWALL to its factory defaults as shown on the screen. The following warning screen will appear.
Page 411: Figure 220 Restart Screen
ZyWALL 35 User’s Guide Figure 220 Restart Screen Chapter 25 Maintenance...
Page 412 ZyWALL 35 User’s Guide Chapter 25 Maintenance...
Page 413: Chapter 26 Introducing The Smt
ZyWALL 35 User’s Guide H A P T E R Introducing the SMT This chapter explains how to access the System Management Terminal and gives an overview of its menus. 26.1 Introduction to the SMT The ZyWALL’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.
Page 414: Entering The Password
ZyWALL 35 User’s Guide Figure 221 Initial Screen Copyright (c) 1994 - 2005 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:A0:C5:01:23:45 initialize ch =1, ethernet address: 00:A0:C5:01:23:46 initialize ch =2, ethernet address: 00:A0:C5:01:23:47 initialize ch =3, ethernet address: 00:A0:C5:01:23:48 initialize ch =4, ethernet address: 00:00:00:00:00:00 AUX port init .
Page 415: Main Menu
ZyWALL 35 User’s Guide Table 153 Main Menu Commands OPERATION KEYSTROKES DESCRIPTION Move to a Press [SPACE Fields beginning with “Edit” lead to hidden menus and have a “hidden” BAR] to change No default setting of No. Press [SPACE BAR] to change No to Yes,...
Page 416: Figure 223 Main Menu (Router Mode)
ZyWALL 35 User’s Guide Figure 223 Main Menu (Router Mode) Copyright (c) 1994 - 2004 ZyXEL Communications Corp. ZyWALL 35 Main Menu Getting Started Advanced Management 1. General Setup 21. Filter and Firewall Setup 2. WAN Setup 22. SNMP Configuration 3.
Page 417: Smt Menus Overview
ZyWALL 35 User’s Guide Table 154 Main Menu Summary NO. MENU TITLE FUNCTION Internet Access Setup Configure your Internet Access setup (Internet address, gateway, login, etc.) with this menu. DMZ Setup Use this menu to configure your public servers connected to the DMZ port.
Page 418 ZyWALL 35 User’s Guide Table 155 SMT Menus Overview (continued) MENUS SUB MENUS 11 Remote Node Setup 11.1 Remote Node Profile 11.1.2 Remote Node Network Layer Options 11.1.4 Remote Node Filter 11.2 Remote Node Profile 11.2.2 Remote Node Network Layer Options 11.2.4 Remote Node Filter...
Page 419: Changing The System Password
ZyWALL 35 User’s Guide Table 155 SMT Menus Overview (continued) MENUS SUB MENUS 24 System Maintenance 24.1 System Status 24.2 System Information and 24.2.1 System Information Console Port Speed 24.2.2 Console Port Speed 24.3 Log and Trace 24.3.1 View Error Log 24.3.2 Syslog Logging...
Page 420: Resetting The Zywall
ZyWALL 35 User’s Guide Figure 225 Menu 23: System Password Menu 23 - System Password Old Password= ? New Password= ? Retype to confirm= ? Enter here to CONFIRM or ESC to CANCEL: 2 Type your existing password and press [ENTER].
Page 421: Smt Menu 1 - General Setup
ZyWALL 35 User’s Guide H A P T E R SMT Menu 1 - General Setup Menu 1 - General Setup contains administrative and system-related information. 27.1 Introduction to General Setup Menu 1 - General Setup contains administrative and system-related information.
Page 422: Figure 227 Menu 1: General Setup (Bridge Mode)
ZyWALL 35 User’s Guide Table 156 Menu 1: General Setup (Router Mode) (continued) FIELD DESCRIPTION Edit Dynamic Press [SPACE BAR] and then [ENTER] to select Yes or No (default). Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next.
Page 423: Configuring Dynamic Dns
ZyWALL 35 User’s Guide 27.2.1 Configuring Dynamic DNS To configure Dynamic DNS, set the ZyWALL to router mode in menu 1 or in the MAINTENANCE Device Mode screen and go to Menu 1 - General Setup and press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1 - Configure Dynamic DNS (shown next).
Page 424: Figure 229 Menu 1.1.1: Ddns Host Summary
ZyWALL 35 User’s Guide 4 Press [SPACE BAR] and then [ENTER] to select Yes in the Edit Host field. Press [ENTER] to display Menu 1.1.1 - DDNS Host Summary. Figure 229 Menu 1.1.1: DDNS Host Summary Menu 1.1.1 DDNS Host Summary...
Page 425: Figure 230 Menu 1.1.1: Ddns Edit Host
ZyWALL 35 User’s Guide Figure 230 Menu 1.1.1: DDNS Edit Host Menu 1.1.1 - DDNS Edit Host Hostname= ZyWALL DDNS Type= DynamicDNS Enable Wildcard Option= Yes Enable Off Line Option= N/A Bind WAN= 1 HA= Yes IP Address Update Policy:...
Page 426 ZyWALL 35 User’s Guide Table 160 Menu 1.1.1: DDNS Edit Host (continued) FIELD DESCRIPTION IP Address You can select Yes in either the DDNS Server Auto Detect IP Address field Update Policy: (recommended) or the Use Specified IP Address field, but not both.
Page 427: Wan And Dial Backup Setup
ZyWALL 35 User’s Guide H A P T E R WAN and Dial Backup Setup This chapter describes how to configure the WAN using menu 2 and dial-backup using menus 2.1 and 11.1. 28.1 Introduction to WAN and Dial Backup Setup This chapter explains how to configure settings for your WAN port and how to configure the ZyWALL for a dial backup connection.
Page 428: Dial Backup
ZyWALL 35 User’s Guide The following table describes the fields in this screen. Table 161 MAC Address Cloning in WAN Setup FIELD DESCRIPTION WAN 1/2 MAC Address Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods to assign a MAC Address.
Page 429: Advanced Wan Setup
ZyWALL 35 User’s Guide Figure 232 Menu 2: Dial Backup Setup Menu 2 - WAN Setup WAN 1 MAC Address: Assigned By= Factory default IP Address= N/A WAN 2 MAC Address: Assigned By= Factory default IP Address= N/A Dial-Backup: Active= No...
Page 430: Figure 233 Menu 2.1: Advanced Wan Setup
ZyWALL 35 User’s Guide To edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in Menu 2 - WAN Setup, press the [SPACE BAR] to select Yes and then press [ENTER].
Page 431: Remote Node Profile (Backup Isp)
ZyWALL 35 User’s Guide Table 164 Advanced WAN Port Setup: Call Control Parameters FIELD DESCRIPTION Call Control Dial Timeout (sec) Enter a number of seconds for the ZyWALL to keep trying to set up an outgoing call before timing out (stopping). The ZyWALL times out and stops if it cannot set up an outgoing call within the timeout value.
Page 432: Table 165 Menu 11.3: Remote Node Profile (Backup Isp)
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 165 Menu 11.3: Remote Node Profile (Backup ISP) FIELD DESCRIPTION Rem Node Enter a descriptive name for the remote node. This field can be up to eight characters.
Page 433: Editing Ppp Options
ZyWALL 35 User’s Guide Table 165 Menu 11.3: Remote Node Profile (Backup ISP) (continued) FIELD DESCRIPTION Idle Timeout Enter the number of seconds of idle time (when there is no traffic from the ZyWALL to the remote node) that can elapse before the ZyWALL automatically disconnects the PPP connection.
Page 434: Figure 236 Menu 11.3.2: Remote Node Network Layer Options
ZyWALL 35 User’s Guide Figure 236 Menu 11.3.2: Remote Node Network Layer Options Menu 11.3.2 - Remote Node Network Layer Options IP Address Assignment= Static Rem IP Addr= 0.0.0.0 Rem Subnet Mask= 0.0.0.0 My WAN Addr= 0.0.0.0 Network Address Translation= SUA Only...
Page 435: Editing Login Script
ZyWALL 35 User’s Guide Table 167 Menu 11.3.2: Remote Node Network Layer Options FIELD DESCRIPTION NAT Lookup If you select SUA Only in the Network Address Translation field, it displays 255 and indicates the SMT will use the pre-configured Set 255 (read only) in menu 15.1.
Page 436: Figure 237 Menu 11.3.3: Remote Node Script
ZyWALL 35 User’s Guide You can use two variables, $USERNAME and $PASSWORD (all UPPER case), to represent the actual user name and password in the script, so they will not show in the clear. They are replaced with the outgoing login name and password in the remote node when the ZyWALL sees them in a ‘Send’...
Page 437: Remote Node Filter
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 168 Menu 11.3.3: Remote Node Script FIELD DESCRIPTION Active Press [SPACE BAR] and then [ENTER] to select either Yes to enable the AT strings or No to disable them.
Page 438 ZyWALL 35 User’s Guide Chapter 28 WAN and Dial Backup Setup...
Page 439: Chapter 29 Lan Setup
ZyWALL 35 User’s Guide H A P T E R LAN Setup This chapter describes how to configure the LAN using Menu 3 - LAN Setup. 29.1 Introduction to LAN Setup This chapter describes how to configure the ZyWALL for LAN and wireless LAN connections.
Page 440: Tcp/Ip And Dhcp Ethernet Setup Menu
ZyWALL 35 User’s Guide Figure 240 Menu 3.1: LAN Port Filter Setup Menu 3.1 - LAN Port Filter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ESC to Cancel: 29.4 TCP/IP and DHCP Ethernet Setup Menu...
Page 441: Figure 242 Menu 3.2: Tcp/Ip And Dhcp Ethernet Setup
ZyWALL 35 User’s Guide Figure 242 Menu 3.2: TCP/IP and DHCP Ethernet Setup Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server TCP/IP Setup: Client IP Pool: Starting Address= 192.168.1.33 IP Address= 192.168.1.1 Size of Client IP Pool= 128 IP Subnet Mask= 255.255.255.0...
Page 442: Ip Alias Setup
ZyWALL 35 User’s Guide Table 170 Menu 3.2: LAN TCP/IP Setup Fields (continued) FIELD DESCRIPTION RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction. Options are: Both, In Only, Out Only or None. Version Press [SPACE BAR] and then [ENTER] to select the RIP version. Options are: RIP-1, RIP-2B or RIP-2M.
Page 443: Wireless Lan Setup
ZyWALL 35 User’s Guide Figure 243 Menu 3.2.1: IP Alias Setup Menu 3.2.1 - IP Alias Setup IP Alias 1= Yes IP Address= 192.168.2.1 IP Subnet Mask= 255.255.255.0 RIP Direction= None Version= RIP-1 Incoming protocol filters= Outgoing protocol filters= IP Alias 2= No...
Page 444: Figure 244 Menu 3.5: Wireless Lan Setup
ZyWALL 35 User’s Guide Note: If you are configuring the ZyWALL from a computer connected to the wireless LAN and you change the ZyWALL’s ESSID or WEP settings, you will lose your wireless connection when you press [ENTER] to confirm. You must then change the wireless settings of your computer to match the ZyWALL’s new...
Page 445: Mac Address Filter Setup
ZyWALL 35 User’s Guide Table 172 Menu 3.5: Wireless LAN Setup FIELD DESCRIPTION (Request To Send) The threshold (number of bytes) for enabling RTS/CTS handshake. Threshold Data with its frame size larger than this value will perform the RTS/CTS handshake.
Page 446: Figure 245 Menu 3.5.1: Wlan Mac Address Filter
ZyWALL 35 User’s Guide Figure 245 Menu 3.5.1: WLAN MAC Address Filter Menu 3.5.1 - WLAN MAC Address Filter Active= No Filter Action= Allowed Association MAC Address Filter Address 1= 00:00:00:00:00:00 Address 2= 00:00:00:00:00:00 Address 3= 00:00:00:00:00:00 Address 4= 00:00:00:00:00:00...
Page 447: Chapter 30 Internet Access
ZyWALL 35 User’s Guide H A P T E R Internet Access This chapter shows you how to configure your ZyWALL for Internet access. 30.1 Introduction to Internet Access Setup Use information from your ISP along with the instructions in this chapter to set up your ZyWALL to access the Internet.
Page 448: Table 174 Menu 4: Internet Access Setup (Ethernet)
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 174 Menu 4: Internet Access Setup (Ethernet) FIELD DESCRIPTION ISP’s Name This is the descriptive name of your ISP for identification purposes. You can only configure the WAN 2 port in Menu 11.2 - Remote Node Profile or in the WAN WAN 2 screen via the web configurator.
Page 449: Configuring The Pptp Client
ZyWALL 35 User’s Guide 30.3 Configuring the PPTP Client Note: The ZyWALL supports only one PPTP server connection at any given time. To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 450: Basic Setup Complete
ZyWALL 35 User’s Guide Figure 248 Internet Access Setup (PPPoE) Menu 4 - Internet Access Setup ISP's Name= WAN_1 Encapsulation= PPPoE Service Type= N/A My Login= My Password= ******** Retype to Confirm= ******** Idle Timeout= 100 IP Address Assignment= Dynamic...
Page 451: Dmz Setup
ZyWALL 35 User’s Guide H A P T E R DMZ Setup This chapter describes how to configure the ZyWALL’s DMZ using Menu 5 - DMZ Setup. 31.1 Configuring DMZ Setup From the main menu, enter 5 to open Menu 5 – DMZ Setup.
Page 452: Ip Address
ZyWALL 35 User’s Guide 31.3.1 IP Address From the main menu, enter 5 to open Menu 5 - DMZ Setup to configure TCP/IP (RFC 1155). Figure 251 Menu 5: TCP/IP Setup Menu 5 - DMZ Setup 1. DMZ Port Filter Setup 2.
Page 453: Figure 253 Menu 5.2.1: Ip Alias Setup
ZyWALL 35 User’s Guide Figure 253 Menu 5.2.1: IP Alias Setup Menu 5.2.1 - IP Alias Setup IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A...
Page 454 ZyWALL 35 User’s Guide Chapter 31 DMZ Setup...
Page 455: Chapter 32 Route Setup
ZyWALL 35 User’s Guide H A P T E R Route Setup This chapter describes how to configure the ZyWALL's traffic redirect. 32.1 Configuring Route Setup From the main menu, enter 6 to open Menu 6 - Route Setup. Figure 254 Menu 6: Route Setup Menu 6 - Route Setup 1.
Page 456: Traffic Redirect
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 177 Menu 6.1: Route Assessment FIELD DESCRIPTION Probing WAN 1/2 Press [SPACE BAR] and then press [ENTER] to choose Yes to test your Check Point ZyWALL's WAN accessibility.
Page 457: Route Failover
ZyWALL 35 User’s Guide Table 178 Menu 6.2: Traffic Redirect FIELD DESCRIPTION Metric This field sets this route's priority among the routes the ZyWALL uses. Enter a number from 1 to 15 to set this route's priority among the ZyWALL's routes (see Section 7.5 on page 130...
Page 458 ZyWALL 35 User’s Guide Chapter 32 Route Setup...
Page 459: Chapter 33 Remote Node Setup
ZyWALL 35 User’s Guide H A P T E R Remote Node Setup This chapter shows you how to configure a remote node. 33.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection.
Page 460: Ethernet Encapsulation
ZyWALL 35 User’s Guide 33.3.1 Ethernet Encapsulation There are three variations of menu 11.x depending on whether you choose Ethernet Encapsulation, PPPoE Encapsulation or PPTP Encapsulation. You must choose the Ethernet option when the WAN port is used as a regular Ethernet. The first menu 11.x screen you see is for Ethernet encapsulation shown next.
Page 461: Pppoe Encapsulation
ZyWALL 35 User’s Guide Table 180 Menu 11.1: Remote Node Profile for Ethernet Encapsulation (continued) FIELD DESCRIPTION Retype to Type your password again to make sure that you have entered it correctly. Confirm Server This field is valid only when RoadRunner is selected in the Service Type field. The ZyWALL will find the RoadRunner Server IP automatically if this field is left blank.
Page 462: Outgoing Authentication Protocol
ZyWALL 35 User’s Guide Figure 260 Menu 11.1: Remote Node Profile for PPPoE Encapsulation Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPPoE Edit IP= No Service Type= Standard Telco Option: Service Name=...
Page 463: Pptp Encapsulation
ZyWALL 35 User’s Guide Table 181 Fields in Menu 11.1 (PPPoE Encapsulation Specific) FIELD DESCRIPTION Service Name If you are using PPPoE encapsulation, then type the name of your PPPoE service here. Only valid with PPPoE encapsulation. Authen This field sets the authentication protocol used for outgoing calls.
Page 464: Edit Ip
ZyWALL 35 User’s Guide Figure 261 Menu 11.1: Remote Node Profile for PPTP Encapsulation Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Allocated Budget(min)= 0...
Page 465: Figure 262 Menu 11.1.2: Remote Node Network Layer Options For Ethernet Encapsulation
ZyWALL 35 User’s Guide Figure 262 Menu 11.1.2: Remote Node Network Layer Options for Ethernet Encapsulation Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic Rem IP Addr= N/A Rem Subnet Mask= N/A My WAN Addr= N/A...
Page 466: Remote Node Filter
ZyWALL 35 User’s Guide Table 183 Remote Node Network Layer Options Menu Fields (continued) FIELD DESCRIPTION NAT Lookup If you select SUA Only in the Network Address Translation field, it displays 255 and indicates the SMT will use the pre-configured Set 255 (read only) in menu 15.1.
Page 467: Figure 263 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation)
ZyWALL 35 User’s Guide Figure 263 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 264 Menu 11.1.4: Remote Node Filter (PPPoE or PPTP Encapsulation)
Page 468 ZyWALL 35 User’s Guide Chapter 33 Remote Node Setup...
Page 469: Chapter 34 Ip Static Route Setup
ZyWALL 35 User’s Guide H A P T E R IP Static Route Setup This chapter shows you how to configure static routes with your ZyWALL. 34.1 IP Static Route Setup Enter 12 from the main menu. Select one of the IP static routes as shown next to configure IP static routes in menu 12.1.
Page 470: Figure 266 Menu 12. 1: Edit Ip Static Route
ZyWALL 35 User’s Guide Figure 266 Menu 12. 1: Edit IP Static Route Menu 12.1 - Edit IP Static Route Route #: 3 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ?
Page 471: Network Address Translation (Nat)
ZyWALL 35 User’s Guide H A P T E R Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 35.1 Using NAT Note: You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyWALL.
Page 472: Figure 267 Menu 4: Applying Nat For Internet Access
ZyWALL 35 User’s Guide Figure 267 Menu 4: Applying NAT for Internet Access Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A...
Page 473: Nat Setup
ZyWALL 35 User’s Guide The following table describes the fields in this menu. Table 185 Applying NAT in Menus 4 & 11.1.2 FIELD DESCRIPTION OPTIONS Network When you select this option the SMT will use Address Mapping Set 1 Full Feature Address (menu 15.1 - see...
Page 474: Address Mapping Sets
ZyWALL 35 User’s Guide 35.2.1 Address Mapping Sets Enter 1 to bring up Menu 15.1 - Address Mapping Sets. Figure 270 Menu 15.1: Address Mapping Sets Menu 15.1 - Address Mapping Sets 1. NAT_SET 2. NAT_SET 255. SUA (read only) Enter Menu Selection Number: 35.2.1.1 SUA Address Mapping Set...
Page 475: User-Defined Address Mapping Sets
ZyWALL 35 User’s Guide Note: Menu 15.1.255 is read-only. Table 186 SUA Address Mapping Rules FIELD DESCRIPTION Set Name This is the name of the set you selected in menu 15.1 or enter the name of a new set you want to create.
Page 476: Ordering Your Rules
ZyWALL 35 User’s Guide Figure 272 Menu 15.1.1: First Set Menu 15.1.1 - Address Mapping Rules Set Name= NAT_SET Local Start IP Local End IP Global Start IP Global End IP Type --------------- ------------- --------------- ------------- ---- 0.0.0.0 255.255.255.255 0.0.0.0 0.0.0.0...
Page 477: Figure 273 Menu 15.1.1.1: Editing/Configuring An Individual Rule In A Set
ZyWALL 35 User’s Guide Table 187 Fields in Menu 15.1.1 (continued) FIELD DESCRIPTION Action The default is Edit. Edit means you want to edit a selected rule (see following field). Insert Before means to insert a rule before the rule selected. The rules after the selected rule will then be moved down by one rule.
Page 478: Configuring A Server Behind Nat
ZyWALL 35 User’s Guide Table 188 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set FIELD DESCRIPTION Global IP Start Enter the starting global IP address (IGA). If you have a dynamic IP, enter 0.0.0.0 as the Global IP Start. Note that Global IP Start can be set to 0.0.0.0 only if the types are Many- to-One or Server.
Page 479: Figure 275 Menu 15.2.1: Nat Server Setup
ZyWALL 35 User’s Guide Figure 275 Menu 15.2.1: NAT Server Setup Menu 15.2.1 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address ------------------------------------------------------ 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Select Command= None...
Page 480: Table 189 Menu 15.2.1.2: Nat Server Configuration
ZyWALL 35 User’s Guide The following table describes the fields in this screen. Table 189 Menu 15.2.1.2: NAT Server Configuration FIELD DESCRIPTION The ZyWALL has two WAN ports. You can configure port forwarding and trigger port rules for the first WAN port and separate sets of rules for the second WAN port.
Page 481: General Nat Examples
ZyWALL 35 User’s Guide Figure 277 Menu 15.2.1: NAT Server Setup Menu 15.2.1 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address ------------------------------------------------------ 0.0.0.0 192.168.1.33 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Select Command= None...
Page 482: Figure 279 Nat Example 1
ZyWALL 35 User’s Guide Figure 279 NAT Example 1 Figure 280 Menu 4: Internet Access & NAT Example Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A...
Page 483: Example 2: Internet Access With An Default Server
ZyWALL 35 User’s Guide 35.4.2 Example 2: Internet Access with an Default Server Figure 281 NAT Example 2 In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2.1 to specify the Default Server behind the NAT as shown in the next figure.
Page 484: Figure 283 Nat Example 3
ZyWALL 35 User’s Guide 1 Map the first IGA to the first inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses). 2 Map the second IGA to our second inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses).
Page 485: Figure 284 Example 3: Menu 11.1.2
ZyWALL 35 User’s Guide Figure 284 Example 3: Menu 11.1.2 Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= SUA Only Metric= 2...
Page 486: Figure 286 Example 3: Final Menu 15.1.1
ZyWALL 35 User’s Guide Figure 286 Example 3: Final Menu 15.1.1 Menu 15.1.1 - Address Mapping Rules Set Name= Example3 Local Start IP Local End IP Global Start IP Global End IP Type --------------- -------------- --------------- --------------- 1. 192.168.1.10 10.132.50.1 192.168.1.11...
Page 487: Example 4: Nat Unfriendly Application Programs
ZyWALL 35 User’s Guide Figure 287 Example 3: Menu 15.2.1 Menu 15.2.1 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address ------------------------------------------------------ 192.168.1.21 192.168.1.20 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Select Command= None...
Page 488: Figure 289 Example 4: Menu 15.1.1.1: Address Mapping Rule
ZyWALL 35 User’s Guide Figure 289 Example 4: Menu 15.1.1.1: Address Mapping Rule Menu 15.1.1.1 Address Mapping Rule Type= Many-One-to-One Local IP: Start= 192.168.1.10 = 192.168.1.12 Global IP: Start= 10.132.50.1 = 10.132.50.3 Press ENTER to Confirm or ESC to Cancel: After you’ve configured your rule, you should be able to check the settings in menu 15.1.1 as...
Page 489: Trigger Port Forwarding
ZyWALL 35 User’s Guide 35.5 Trigger Port Forwarding Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side. With regular port forwarding you set a forwarding port in NAT to forward a service (coming in from the server on the WAN) to the IP address of a computer on the client side (LAN).
Page 490: Figure 291 Menu 15.3.1: Trigger Port Setup
ZyWALL 35 User’s Guide Figure 291 Menu 15.3.1: Trigger Port Setup Menu 15.3.1 - Trigger Port Setup Incoming Trigger Rule Name Start Port End Port Start Port End Port -------------------------------------------------------------- Real Audio 6970 7170 7070 7070 Press ENTER to Confirm or ESC to Cancel:...
Page 491: Introducing The Zywall Firewall
ZyWALL 35 User’s Guide H A P T E R Introducing the ZyWALL Firewall This chapter shows you how to get started with the ZyWALL firewall. 36.1 Using ZyWALL SMT Menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown next.
Page 492: Figure 293 Menu 21.2: Firewall Setup
ZyWALL 35 User’s Guide Figure 293 Menu 21.2: Firewall Setup Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off.
Page 493: Filter Configuration
ZyWALL 35 User’s Guide H A P T E R Filter Configuration This chapter shows you how to create and apply filters. 37.1 Introduction to Filters Your ZyWALL uses filters to decide whether to allow passage of a data packet and/or to make a call.
Page 494: The Filter Structure Of The Zywall
ZyWALL 35 User’s Guide 37.1.1 The Filter Structure of the ZyWALL A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descriptive name. The ZyWALL allows you to configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system.
Page 495: Figure 295 Filter Rule Process
ZyWALL 35 User’s Guide Figure 295 Filter Rule Process You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.
Page 496: Configuring A Filter Set
ZyWALL 35 User’s Guide 37.2 Configuring a Filter Set The ZyWALL includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below. 1 Enter 21 in the main menu to open menu 21.
Page 497: Configuring A Filter Rule
ZyWALL 35 User’s Guide Table 191 Abbreviations Used in the Filter Rules Summary Menu FIELD DESCRIPTION Active: “Y” means the rule is active. “N” means the rule is inactive. Type The type of filter rule: “GEN” for Generic, “IP” for TCP/IP.
Page 498: Configuring A Tcp/Ip Filter Rule
ZyWALL 35 User’s Guide To speed up filtering, all rules in a filter set must be of the same class, i.e., protocol filters or generic filters. The class of a filter set is determined by the first rule that you create. When applying the filter sets to a port, separate menu fields are provided for protocol and device filter sets.
Page 499 ZyWALL 35 User’s Guide Table 193 Menu 21.1.1.1: TCP/IP Filter Rule FIELD DESCRIPTION Destination IP Addr Enter the destination IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0. IP Mask Enter the IP mask to apply to the Destination: IP Addr.
Page 500: Configuring A Generic Filter Rule
ZyWALL 35 User’s Guide Figure 299 Executing an IP Filter 37.2.3 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. The purpose of generic rules is Chapter 37 Filter Configuration...
Page 501: Figure 300 Menu 21.1.1.1: Generic Filter Rule
ZyWALL 35 User’s Guide to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly. For generic rules, the ZyWALL treats a packet as a byte stream as opposed to an IP or IPX packet.
Page 502: Example Filter
ZyWALL 35 User’s Guide Table 194 Generic Filter Rule Menu Fields FIELD DESCRIPTION More If Yes, a matching packet is passed to the next filter rule before an action is taken; else the packet is disposed of according to the action fields.
Page 503: Figure 302 Example Filter: Menu 21.1.3.1
ZyWALL 35 User’s Guide Figure 302 Example Filter: Menu 21.1.3.1 Menu 21.1.3.1 - TCP/IP Filter Rule Filter #: 3,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0...
Page 504: Filter Types And Nat
ZyWALL 35 User’s Guide M = N means an action can be taken immediately. The action is to drop the packet (m = D) if the action is matched and to forward the packet immediately (n = F) if the action is not matched no matter whether there are more rules to be checked (there aren’t in this example).
Page 505: Applying A Filter
ZyWALL 35 User’s Guide 37.6 Applying a Filter This section shows you where to apply the filter(s) after you design it (them). The ZyWALL already has filters to prevent NetBIOS traffic from triggering calls, and block incoming telnet, FTP and HTTP connections.
Page 506: Applying Remote Node Filters
ZyWALL 35 User’s Guide Figure 306 Filtering DMZ Traffic Menu 5.1 - DMZ Port Filter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ESC to Cancel: 37.6.3 Applying Remote Node Filters Go to menu 11.1.4 (shown below –...
Page 507: Chapter 38 Snmp Configuration
ZyWALL 35 User’s Guide H A P T E R SNMP Configuration This chapter explains SNMP configuration menu 22. 38.1 SNMP Configuration To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The “community” for Get, Set and Trap fields is SNMP terminology for password.
Page 508: Snmp Traps
ZyWALL 35 User’s Guide Table 195 SNMP Configuration Menu Fields (continued) FIELD DESCRIPTION Destination Type the IP address of the station to send your SNMP traps to. When you have completed this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel”...
Page 509: System Information & Diagnosis
ZyWALL 35 User’s Guide H A P T E R System Information & Diagnosis This chapter covers SMT menus 24.1 to 24.4. 39.1 Introduction to System Status This chapter covers the diagnostic tools that help you to maintain your ZyWALL. These tools include updates on system status, port status and log and trace capabilities.
Page 510: Figure 310 Menu 24.1: System Maintenance: Status
ZyWALL 35 User’s Guide 3 There are three commands in Menu 24.1 - System Maintenance - Status. Entering 1 drops the WAN connection, 9 resets the counters and [ESC] takes you back to the previous screen. Figure 310 Menu 24.1: System Maintenance: Status Menu 24.1 - System Maintenance - Status...
Page 511: System Information And Console Port Speed
ZyWALL 35 User’s Guide Table 197 System Maintenance: Status Menu Fields (continued) FIELD DESCRIPTION DHCP This is the DHCP setting of the port listed on the left. System up Time This is the total time the ZyWALL has been on.
Page 512: Console Port Speed
ZyWALL 35 User’s Guide Figure 312 Menu 24.2.1: System Maintenance: Information Menu 24.2.1 - System Maintenance - Information Name: Routing: IP ZyNOS F/W Version: V3.64(WZ.0)b4 | 02/24/2005 Country Code: 255 Ethernet Address: 00:A0:C5:70:F7:EB IP Address: 192.168.1.1 IP Mask: 255.255.255.0 DHCP: Server Press ESC or RETURN to Exit: The following table describes the fields in this screen.
Page 513: Log And Trace
ZyWALL 35 User’s Guide Figure 313 Menu 24.2.2: System Maintenance: Change Console Port Speed Menu 24.2.2 - System Maintenance - Change Console Port Speed Console Port Speed: 9600 Press ENTER to Confirm or ESC to Cancel:Press Space Bar to Toggle.
Page 514: Syslog Logging
ZyWALL 35 User’s Guide Figure 315 Examples of Error and Information Messages 52 Thu Jul 1 05:54:53 2004 PP05 ERROR Wireless LAN init fail, code=15 53 Thu Jul 1 05:54:53 2004 PINI INFO Channel 0 ok 54 Thu Jul 1 05:54:56 2004 PP05 -WARN...
Page 515 ZyWALL 35 User’s Guide Your ZyWALL sends five types of syslog messages. Some examples (not all ZyWALL specific) of these syslog messages with their message formats are shown next: 1 CDR CDR Message Format SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String ); String = board xx line xx channel xx, call xx, str...
Page 516 ZyWALL 35 User’s Guide Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D).
Page 517: Call-Triggering Packet
ZyWALL 35 User’s Guide 39.4.3 Call-Triggering Packet Call-Triggering Packet displays information about the packet that triggered a dial-out call in an easy readable format. Equivalent information is available in menu 24.1 in hex format. An example is shown next. Figure 317 Call-Triggering Packet Example IP Frame: ENET0-RECV Size: Time: 17:02:44.262...
Page 518: Wan Dhcp
ZyWALL 35 User’s Guide 1 From the main menu, select option 24 to open Menu 24 - System Maintenance. 2 From this menu, select option 4. Diagnostic. This will open Menu 24.4 - System Maintenance - Diagnostic. Figure 318 Menu 24.4: System Maintenance: Diagnostic Menu 24.4 - System Maintenance - Diagnostic...
Page 519: Table 200 System Maintenance Menu Diagnostic
ZyWALL 35 User’s Guide Table 200 System Maintenance Menu Diagnostic FIELD DESCRIPTION Ping Host Enter 1 to ping any machine (with an IP address) on your LAN or WAN. Enter its IP address in the Host IP Address field below.
Page 520 ZyWALL 35 User’s Guide Chapter 39 System Information & Diagnosis...
Page 521: Firmware And Configuration File Maintenance
ZyWALL 35 User’s Guide H A P T E R Firmware and Configuration File Maintenance This chapter tells you how to back up and restore your configuration file as well as upload new firmware and a new configuration file. 40.1 Introduction Use the instructions in this chapter to change the ZyWALL’s configuration file or upgrade its...
Page 522: Backup Configuration
ZyWALL 35 User’s Guide The following table is a summary. Please note that the internal filename refers to the filename on the ZyWALL and the external filename refers to the filename not on the ZyWALL, that is, on your computer, local network or FTP site and so the name (but not the extension) may vary.
Page 523: Using The Ftp Command From The Command Line
ZyWALL 35 User’s Guide Figure 320 Telnet into Menu 24.5 Menu 24.5 - Backup Configuration To transfer the configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your router. Then type "root"...
Page 524: Example Of Ftp Commands From The Command Line
ZyWALL 35 User’s Guide 40.3.3 Example of FTP Commands from the Command Line Figure 321 FTP Session Example 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay...
Page 525: Backup Configuration Using Tftp
ZyWALL 35 User’s Guide 4 The IP you entered in the Secured Client IP field in menu 24.11 does not match the client IP. If it does not match, the ZyWALL will disconnect the Telnet session immediately. 5 You have an SMT console session running.
Page 526: Gui-Based Tftp Clients
ZyWALL 35 User’s Guide 40.3.8 GUI-based TFTP Clients The following table describes some of the fields that you may see in GUI-based TFTP clients. Table 203 General Commands for GUI-based TFTP Clients COMMAND DESCRIPTION Host Enter the IP address of the ZyWALL. 192.168.1.1 is the ZyWALL’s default IP address when shipped.
Page 527: Restore Configuration
ZyWALL 35 User’s Guide Figure 324 Backup Configuration Example Type a location for storing the configuration file or click Browse to look for one. Choose the Xmodem protocol. Then click Receive. 4 After a successful backup you will see the following screen. Press any key to return to the SMT menu.
Page 528: Figure 326 Telnet Into Menu 24.6
ZyWALL 35 User’s Guide Figure 326 Telnet into Menu 24.6 Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation.
Page 529: Restore Using Ftp Session Example
ZyWALL 35 User’s Guide 40.4.2 Restore Using FTP Session Example Figure 327 Restore Using FTP Session Example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec.
Page 530: Uploading Firmware And Configuration Files
ZyWALL 35 User’s Guide Figure 330 Restore Configuration Example Type the configuration file’s location, or click Browse to search for it. Choose the Xmodem protocol. Then click Send. 4 After a successful restoration you will see the following screen. Press any key to restart the ZyWALL and return to the SMT menu.
Page 531: Configuration File Upload
ZyWALL 35 User’s Guide Figure 332 Telnet Into Menu 24.7.1: Upload System Firmware Menu 24.7.1 - System Maintenance - Upload System Firmware To upload the system firmware, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your system. Then type "root" and SMT password as requested.
Page 532: Ftp Session Example Of Firmware File Upload
ZyWALL 35 User’s Guide 2 Enter “open”, followed by a space and the IP address of your ZyWALL. 3 Press [ENTER] when prompted for a username. 4 Enter your password as requested (the default is “1234”). 5 Enter “bin” to set transfer mode to binary.
Page 533: Tftp Upload Command Example
ZyWALL 35 User’s Guide 2 Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 – System Maintenance. 3 Enter the command “sys stdio 0” to disable the console timeout, so the TFTP transfer will not be interrupted. Enter “command sys stdio 5” to restore the five-minute console timeout (default) when the file transfer is complete.
Page 534: Example Xmodem Firmware Upload Using Hyperterminal
ZyWALL 35 User’s Guide Figure 335 Menu 24.7.1 As Seen Using the Console Port Menu 24.7.1 - System Maintenance - Upload System Firmware To upload system firmware: 1. Enter "y" at the prompt below to go into debug mode. 2. Enter "atur" after "Enter Debug Mode" message.
Page 535: Example Xmodem Configuration Upload Using Hyperterminal
ZyWALL 35 User’s Guide Figure 337 Menu 24.7.2 As Seen Using the Console Port Menu 24.7.2 - System Maintenance - Upload System Configuration File To upload system configuration file: 1. Enter "y" at the prompt below to go into debug mode.
Page 536 ZyWALL 35 User’s Guide Chapter 40 Firmware and Configuration File Maintenance...
Page 537: System Maintenance Menus 8 To 10
ZyWALL 35 User’s Guide H A P T E R System Maintenance Menus 8 to This chapter leads you through SMT menus 24.8 to 24.10. 41.1 Command Interpreter Mode The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions.
Page 538: Command Usage
A list of commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished. Figure 340 Valid Commands Copyright (c) 1994 - 2005 ZyXEL Communications Corp. ras> ? Valid commands are:...
Page 539: Call Control Support
ZyWALL 35 User’s Guide 41.2 Call Control Support The ZyWALL provides two call control functions: budget management and call history. Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1.
Page 540: Call History
ZyWALL 35 User’s Guide Figure 342 Budget Management Menu 24.9.1 - Budget Management Remote Node Connection Time/Total Budget Elapsed Time/Total Period 1.WAN_1 No Budget No Budget 2.WAN_2 No Budget No Budget 3.Dial No Budget No Budget Reset Node (0 to update screen): The total budget is the time limit on the accumulated time for outgoing calls to a remote node.
Page 541: Time And Date Setting
ZyWALL 35 User’s Guide Figure 343 Call History Menu 24.9.2 - Call History Phone Number Rate #call Total Enter Entry to Delete(0 to exit): The following table describes the fields in this screen. Table 206 Call History FIELD DESCRIPTION Phone Number The PPPoE service names are shown here.
Page 542: Figure 344 Menu 24: System Maintenance
ZyWALL 35 User’s Guide Figure 344 Menu 24: System Maintenance Menu 24 - System Maintenance System Status System Information and Console Port Speed Log and Trace Diagnostic Backup Configuration Restore Configuration Upload Firmware Command Interpreter Mode Call Control 10. Time and Date Setting 11.
Page 543: Table 207 Menu 24.10 System Maintenance: Time And Date Setting
ZyWALL 35 User’s Guide Table 207 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION Time Protocol Enter the time service protocol that your timeserver uses. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works.
Page 544: Resetting The Time
ZyWALL 35 User’s Guide Table 207 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION End Date (mm- Configure the day and time when Daylight Saving Time ends if you selected Yes in nth-week-hr) the Daylight Saving field. The hr field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time ends in the United States on the last Sunday of October.
Page 545: Chapter 42 Remote Management
ZyWALL 35 User’s Guide H A P T E R Remote Management This chapter covers remote management found in SMT menu 24.11. 42.1 Remote Management Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers.
Page 546: Figure 346 Menu 24.11 - Remote Management Control
ZyWALL 35 User’s Guide Figure 346 Menu 24.11 – Remote Management Control Menu 24.11 - Remote Management Control TELNET Server: Port = 23 Access = ALL Secure Client IP = 0.0.0.0 FTP Server: Port = 21 Access = ALL Secure Client IP = 0.0.0.0...
Page 547: Remote Management Limitations
ZyWALL 35 User’s Guide 42.1.1 Remote Management Limitations Remote management over LAN or WAN will not work when: 1 A filter in menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service.
Page 548 ZyWALL 35 User’s Guide Chapter 42 Remote Management...
Page 549: Chapter 43 Ip Policy Routing
ZyWALL 35 User’s Guide H A P T E R IP Policy Routing This chapter covers setting and applying policies used for IP routing. 43.1 IP Routing Policy Summary Menu 25 shows the summary of a policy rule, including the criteria and the action of a single policy, and whether a policy is active or not.
Page 550: Ip Routing Policy Setup
ZyWALL 35 User’s Guide Table 209 Menu 25: Sample IP Routing Policy Summary (continued) FIELD DESCRIPTION Criteria/Action This displays the details about to which packets the policy applies and how the policy has the ZyWALL handle those packets. Refer to Table 210 on page 548 detailed information.
Page 551: Figure 348 Menu 25.1: Ip Routing Policy Setup
ZyWALL 35 User’s Guide 1 Type 25 in the main menu to open Menu 25 - IP Routing Policy Summary. 2 Select Edit in the Select Command field; type the index number of the rule you want to configure in the Select Rule field and press [ENTER] to open Menu 25.1 - IP Routing Policy Setup (see the next figure).
Page 552: Applying Policy To Packets
ZyWALL 35 User’s Guide Table 211 Menu 25.1: IP Routing Policy Setup FIELD DESCRIPTION port start / end Source port number range from start to end; applicable only for TCP/UDP. Destination addr start / end Destination IP address range from start to end.
Page 553: Ip Policy Routing Example
ZyWALL 35 User’s Guide Figure 349 Menu 25.1.1: IP Routing Policy Setup Menu 25.1.1 - IP Routing Policy Setup Apply policy to packets received from: LAN= No DMZ= No ALL WAN= Yes Selected Remote Node index= N/A Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this screen.
Page 554: Figure 350 Example Of Ip Policy Routing
ZyWALL 35 User’s Guide Figure 350 Example of IP Policy Routing To force Web packets coming from clients with IP addresses of 192.168.1.33 to 192.168.1.64 to be routed to the Internet via the WAN port of the ZyWALL, follow the steps as shown next.
Page 555: Figure 352 Ip Routing Policy Example 2
ZyWALL 35 User’s Guide 4 Create another rule in menu 25.1 for this rule to route packets from any host (IP=0.0.0.0 means any host) with protocol TCP and port FTP access through another gateway (192.168.1.100). Figure 352 IP Routing Policy Example 2 Menu 25.1 - IP Routing Policy Setup...
Page 556 ZyWALL 35 User’s Guide Chapter 43 IP Policy Routing...
Page 557: Chapter 44 Call Scheduling
ZyWALL 35 User’s Guide H A P T E R Call Scheduling Call scheduling allows you to dictate when a remote node should be called and for how long. 44.1 Introduction to Call Scheduling The call scheduling feature allows the ZyWALL to manage a remote node and dictate when a remote node should be called and for how long.
Page 558: Figure 354 Schedule Set Setup
ZyWALL 35 User’s Guide To set up a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press [ENTER] to see Menu 26.1 - Schedule Set Setup as shown next. Figure 354 Schedule Set Setup Menu 26.1 - Schedule Set Setup...
Page 559: Figure 355 Applying Schedule Set(S) To A Remote Node (Pppoe)
ZyWALL 35 User’s Guide Table 213 Schedule Set Setup (continued) FIELD DESCRIPTION Action Forced On means that the connection is maintained whether or not there is a demand call on the line and will persist for the time period specified in the Duration field.
Page 560: Figure 356 Applying Schedule Set(S) To A Remote Node (Pptp)
ZyWALL 35 User’s Guide Figure 356 Applying Schedule Set(s) to a Remote Node (PPTP) Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Allocated Budget(min)= 0...
Page 561: Chapter 45 Troubleshooting
ZyWALL 35 User’s Guide H A P T E R Troubleshooting This chapter covers potential problems and possible remedies. After each problem description, some instructions are provided to help you to diagnose and to solve the problem. Please see our included disk for further information.
Page 562: Problems With The Dmz Interface
ZyWALL 35 User’s Guide 45.3 Problems with the DMZ Interface Table 216 Troubleshooting the DMZ Interface PROBLEM CORRECTIVE ACTION Cannot access Check your Ethernet cable type and connections. Refer to the Quick Start Guide servers on the DMZ for DMZ connection instructions.
Page 563: Problems With Internet Access
ZyWALL 35 User’s Guide 45.5 Problems with Internet Access Table 218 Troubleshooting Internet Access PROBLEM CORRECTIVE ACTION Cannot access the Connect your cable/DSL modem with the ZyWALL using the appropriate cable. Internet. Check with the manufacturer of your cable/DSL device about your cable requirement because some devices may require crossover cable and others a regular straight-through cable.
Page 564: Pop-Up Windows, Javascripts And Java Permissions
ZyWALL 35 User’s Guide Table 220 Troubleshooting Accessing the ZyWALL PROBLEM CORRECTIVE ACTION Cannot access the 1. Check to see if the ZyWALL is connected to your computer's console port. ZyWALL via the 2. Check to see if the communications program is configured correctly. The console port.
Page 565: Internet Explorer Pop-Up Blockers
ZyWALL 35 User’s Guide 45.7.1.1 Internet Explorer Pop-up Blockers You may have to disable pop-up blocking to log into your device. Either disable pop-up blocking (enabled by default in Windows XP SP (Service Pack) 2) or allow pop-up blocking and create an exception for your device’s IP address.
Page 566: Figure 358 Internet Options
ZyWALL 35 User’s Guide Figure 358 Internet Options 3 Click Apply to save this setting. 45.7.1.1.2 Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab.
Page 567: Figure 359 Internet Options
ZyWALL 35 User’s Guide Figure 359 Internet Options 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites.
Page 568: Javascripts
ZyWALL 35 User’s Guide Figure 360 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. 45.7.1.2 JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed.
Page 569: Figure 361 Internet Options
ZyWALL 35 User’s Guide Figure 361 Internet Options 2 Click the Custom Level... button. 3 Scroll down to Scripting. 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is selected (the default).
Page 570: Java Permissions
ZyWALL 35 User’s Guide Figure 362 Security Settings - Java Scripting 45.7.1.3 Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is selected.
Page 571: Figure 363 Security Settings - Java
ZyWALL 35 User’s Guide Figure 363 Security Settings - Java 45.7.1.3.1 JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 make sure that Use Java 2 for <applet> under Java (Sun) is selected.
Page 572: Figure 364 Java (Sun)
ZyWALL 35 User’s Guide Figure 364 Java (Sun) Chapter 45 Troubleshooting...
Page 573: Product Specifications
ZyWALL 35 User’s Guide P P E N D I X Product Specifications See also the Introduction chapter for a general overview of the key features. Specification Tables Table 1 Device Specifications Default IP Address 192.168.1.1 Default Subnet Mask 255.255.255.0 (24 bits)
Page 574: Table 3 Firmware Features
ZyWALL 35 User’s Guide Table 2 Performance User Licenses Unlimited Concurrent Sessions 10,000 Simultaneous IPSec VPN Connections Table 3 Firmware Features Modes of Operation Routing/NAT/SUA Mode Transparent Mode Firewall (ICSA Certified) IP Protocol/Packet Filter DoS and DDoS protections Stateful Packet Inspection...
Page 575: Table 4 Feature Specifications
ZyWALL 35 User’s Guide Table 3 Firmware Features (continued) Wireless IEEE 802.11b Compliant IEEE 802.11g Compliant Frequency Range: 2.4 GHz Advanced Orthogonal Frequency Division Multiplexing (OFDM) IEEE 802.1x Authentication (Internal Database and External RADIUS) Store up to 32 built-in user profiles using EAP-MD5 (Internal Database)
Page 576: Table 5 Compatible Zyxel Wlan Cards And Security Features
ZyWALL 35 User’s Guide Table 4 Feature Specifications (continued) FEATURE SPECIFICATION Number of DNS Address Record Entries Number of DNS Name Server Record Entries Compatible ZyXEL WLAN Cards The following table lists the ZyXEL WLAN cards that you can use in the ZyWALL at the time of writing.
Page 577: Figure 1 Wlan Card Installation
ZyWALL 35 User’s Guide Figure 1 WLAN Card Installation Cable Pin Assignments In a serial communications connection, generally a computer is DTE (Data Terminal Equipment) and a modem is DCE (Data Circuit-terminating Equipment). The ZyWALL is DCE when you connect a computer to the console port. The ZyWALL is DTE when you connect a modem to the dial backup port.
Page 578: Figure 3 Ethernet Cable Pin Assignments
ZyWALL 35 User’s Guide Table 6 Console/Dial Backup Port Pin Assignments CONSOLE Port RS – 232 (Female) DB-9F DIAL BACKUP RS – 232 (Male) DB-9M (Not on all models) Pin 1 = NON Pin 1 = NON Pin 2 = DCE-TXD Pin 2 = DTE-RXD Pin 3 = DCE –RXD...
Page 579: Table 8 European Union Ac Power Adaptor Specifications
ZyWALL 35 User’s Guide Table 8 European Union AC Power Adaptor Specifications AC Power Adapter model AD-1201200DV Input power: AC230Volts/50Hz/0.2A Output power: DC12Volts/1.2A Power consumption: 10 W Plug: European Union standards Safety standards: TUV, CE (EN 60950) AC Power Adapter model JAD-121200E Input power: AC230Volts/50Hz, Output power: DC12Volts/1.2A...
Page 580 ZyWALL 35 User’s Guide Table 11 Australia and New Zealand AC Power Adaptor Specification (continued) Power consumption: 10 W Plug: Australia and New Zealand standards Safety standards: NATA (AS 3260) Appendix A Product Specifications...
Page 581: Setting Up Your Computer's Ip Address
ZyWALL 35 User’s Guide P P E N D I X Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/ IP on your computer.
Page 582: Figure 4 Windows 95/98/Me: Network: Configuration
ZyWALL 35 User’s Guide Figure 4 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add.
Page 583: Figure 5 Windows 95/98/Me: Tcp/Ip Properties: Ip Address
ZyWALL 35 User’s Guide 3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click 5 Restart your computer so the changes you made take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab.
Page 584: Figure 6 Windows 95/98/Me: Tcp/Ip Properties: Dns Configuration
ZyWALL 35 User’s Guide Figure 6 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab. • If you do not know your gateway’s IP address, remove previously installed gateways. • If you have a gateway IP address, type it in the New gateway field and click Add.
Page 585: Figure 7 Windows Xp: Start Menu
ZyWALL 35 User’s Guide Figure 7 Windows XP: Start Menu 2 In the Control Panel, double-click Network Connections (Network and Dial-up Connections in Windows 2000/NT). Figure 8 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties.
Page 586: Figure 9 Windows Xp: Control Panel: Network Connections: Properties
ZyWALL 35 User’s Guide Figure 9 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties. Figure 10 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP).
Page 587: Figure 11 Windows Xp: Internet Protocol (Tcp/Ip) Properties
ZyWALL 35 User’s Guide • If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. • Click Advanced. Figure 11 Windows XP: Internet Protocol (TCP/IP) Properties 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK.
Page 588: Figure 12 Windows Xp: Advanced Tcp/Ip Properties
ZyWALL 35 User’s Guide Figure 12 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es).
Page 589: Figure 13 Windows Xp: Internet Protocol (Tcp/Ip) Properties
ZyWALL 35 User’s Guide Figure 13 Windows XP: Internet Protocol (TCP/IP) Properties 8 Click OK to close the Internet Protocol (TCP/IP) Properties window. 9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 10 Close the Network Connections window (Network and Dial-up Connections in Windows 2000/NT).
Page 590: Figure 14 Macintosh Os 8/9: Apple Menu
ZyWALL 35 User’s Guide Figure 14 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 15 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. Appendix B Setting up Your Computer’s IP Address...
Page 591: Figure 16 Macintosh Os X: Apple Menu
ZyWALL 35 User’s Guide 4 For statically assigned settings, do the following: • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box. •...
Page 592: Figure 17 Macintosh Os X: Network
ZyWALL 35 User’s Guide Figure 17 Macintosh OS X: Network 4 For statically assigned settings, do the following: • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box.
Page 593: Appendix Cip Subnetting
ZyWALL 35 User’s Guide P P E N D I X IP Subnetting IP Addressing Routers “route” based on the network number. The router that delivers the data packet to the correct destination host uses the host ID. IP Classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1.
Page 594: Table 13 Allowed Ip Address Range By Class
ZyWALL 35 User’s Guide Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127. Similarly the first octet of a class “B” must begin with “10”, therefore the first octet of a class “B”...
Page 595: Table 15 Alternative Subnet Mask Notation
ZyWALL 35 User’s Guide For example, 192.1.1.0 /25 is equivalent to saying 192.1.1.0 with mask 255.255.255.128. The following table shows all possible subnet masks for a class “C” address using both notations. Table 15 Alternative Subnet Mask Notation SUBNET MASK IP ADDRESS SUBNET MASK “1”...
Page 596: Table 17 Subnet 1
ZyWALL 35 User’s Guide Note: In the following charts, shaded/bolded last octet bit values indicate host ID bits “borrowed” to form network ID bits. The number of “borrowed” host ID bits determines the number of subnets you can have. The remaining number of host ID bits (after “borrowing”) determines the number of hosts you can have...
Page 597: Table 19 Subnet 1
ZyWALL 35 User’s Guide Example: Four Subnets The above example illustrated using a 25-bit subnet mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits (11111111.11111111.11111111.11000000) or 255.255.255.192.
Page 598: Table 22 Subnet 4
ZyWALL 35 User’s Guide Table 22 Subnet 4 NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. IP Address (Binary) 11000000.10101000.00000001. 11000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: Lowest Host ID: 192.168.1.193 192.168.1.192 Broadcast Address: Highest Host ID: 192.168.1.254 192.168.1.255...
Page 599: Table 25 Class B Subnet Planning
ZyWALL 35 User’s Guide Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID.
Page 600 ZyWALL 35 User’s Guide Appendix C IP Subnetting...
Page 601: Appendix Dpppoe
ZyWALL 35 User’s Guide P P E N D I X PPPoE PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your computer to an ATM PVC (Permanent Virtual Circuit) which connects to a DSL Access...
Page 602: Figure 18 Single-Computer Per Router Hardware Configuration
ZyWALL 35 User’s Guide Figure 18 Single-Computer per Router Hardware Configuration How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the computer and the computer runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC).
Page 603: Appendix Epptp
ZyWALL 35 User’s Guide P P E N D I X PPTP What is PPTP? PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames. How can we transport PPP frames from a computer to a broadband...
Page 604: Figure 21 Pptp Protocol Overview
ZyWALL 35 User’s Guide PPTP Protocol Overview PPTP is very similar to L2TP, since L2TP is based on both PPTP and L2F (Cisco’s Layer 2 Forwarding). Conceptually, there are three parties in PPTP, namely the PNS (PPTP Network Server), the PAC (PPTP Access Concentrator) and the PPTP user. The PNS is the box that hosts both the PPP and the PPTP stacks and forms one end of the PPTP tunnel.
Page 605: Figure 22 Example Message Exchange Between Computer And An Ant
ZyWALL 35 User’s Guide Figure 22 Example Message Exchange between Computer and an ANT PPP Data Connection The PPP frames are tunneled between the PNS and PAC over GRE (General Routing Encapsulation, RFC 1701, 1702). The individual calls within a tunnel are distinguished using the Call ID field in the GRE header.
Page 606 ZyWALL 35 User’s Guide Appendix E PPTP...
Page 607: Appendix F Wireless Lans
ZyWALL 35 User’s Guide P P E N D I X Wireless LANs Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless stations (A, B, C).
Page 608: Figure 24 Basic Service Set
ZyWALL 35 User’s Guide Figure 24 Basic Service Set An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS).
Page 609: Figure 25 Infrastructure Wlan
ZyWALL 35 User’s Guide Figure 25 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.11a/b/g wireless devices. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a different channel than an adjacent AP (access point) to reduce interference.
Page 610: Figure 26 Rts/Cts
ZyWALL 35 User’s Guide Figure 26 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations.
Page 611: Table 26 Ieee802.11G
ZyWALL 35 User’s Guide A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size.
Page 612 ZyWALL 35 User’s Guide IEEE 802.1x In June 2001, the IEEE 802.1x standard was designed to extend the features of IEEE 802.11 to support extended authentication as well as providing additional accounting and control features. It is supported by Windows XP and a number of network devices. Some advantages of IEEE 802.1x are:...
Page 613: Figure 27 Eap Authentication
ZyWALL 35 User’s Guide • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: •...
Page 614: Types Of Authentication
ZyWALL 35 User’s Guide 3 The wireless station replies with identity information, including username and password. 4 The RADIUS server checks the user information against its user profile database and determines whether or not to authenticate the wireless station. Types of Authentication This section discusses some popular authentication types: EAP-MD5, EAP-TLS, EAP- TTLS, PEAP and LEAP.
Page 615: Wep Authentication Steps
ZyWALL 35 User’s Guide PEAP (Protected EAP) Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use simple username and password methods through the secured connection to authenticate the clients, thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication.
Page 616: Figure 28 Wep Authentication Steps
ZyWALL 35 User’s Guide Figure 28 WEP Authentication Steps Open system authentication involves an unencrypted two-message procedure. A wireless station sends an open system authentication request to the AP, which will then automatically accept and connect the wireless station to the network. In effect, open system is not authentication at all as any station can gain access to the network.
Page 617: Table 27 Comparison Of Eap Authentication Types
ZyWALL 35 User’s Guide Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are often deployed in corporate environments, but for public deployment, a simple user name and password pair is more practical. The following table is a comparison of the features of authentication types.
Page 618: Table 28 Wireless Security Relational Matrix
ZyWALL 35 User’s Guide The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data packets, altering them and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match, it is assumed that the data has been tampered with and the packet is dropped.
Page 619: Figure 29 Roaming Example
ZyWALL 35 User’s Guide In a network environment with multiple access points, wireless stations are able to switch from one access point to another as they move between the coverage areas. This is roaming. As the wireless station moves from place to place, it is responsible for choosing the most appropriate access point depending on the signal strength, network utilization or other factors.
Page 620: Requirements For Roaming
ZyWALL 35 User’s Guide Requirements for Roaming The following requirements must be met in order for wireless stations to roam between the coverage areas. 1 All the access points must be on the same subnet and configured with the same ESSID.
Page 621: Appendix G Triangle Route
ZyWALL 35 User’s Guide P P E N D I X Triangle Route The Ideal Setup When the firewall is on, your ZyWALL acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the ZyWALL to protect your LAN against attacks.
Page 622: Figure 31 "Triangle Route" Problem
ZyWALL 35 User’s Guide Figure 31 “Triangle Route” Problem The “Triangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface.
Page 623: Figure 32 Ip Alias
ZyWALL 35 User’s Guide Figure 32 IP Alias Gateways on the WAN Side A second solution to the “triangle route” problem is to put all of your network gateways on the WAN side as the following figure shows. This ensures that all incoming network traffic passes through your ZyWALL to your LAN.
Page 624 ZyWALL 35 User’s Guide Appendix G Triangle Route...
Page 625: Sip Passthrough
ZyWALL 35 User’s Guide P P E N D I X SIP Passthrough The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet.
Page 626: Sip Servers
ZyWALL 35 User’s Guide Table 29 SIP Call Progression (continued) 3. OK 4. ACK 5.Dialogue (voice traffic) 6. BYE 7. OK 1 A sends a SIP INVITE request to B. This message is an invitation for B to participate in a SIP telephone call.
Page 627: Figure 35 Sip Proxy Server
ZyWALL 35 User’s Guide In the following example, you want to use client device A to call someone who is using client device C. 1 The client device (A in the figure) sends a call invitation to the SIP proxy server (B).
Page 628: Figure 36 Sip Redirect Server
ZyWALL 35 User’s Guide Figure 36 SIP Redirect Server SIP Register Server A SIP register server maintains a database of SIP identity-to-IP address (or domain name) mapping. The register server checks your user name and password when you register. When you make a VoIP call using SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer.
Page 629: Figure 37 Zywall Sip Alg
ZyWALL 35 User’s Guide ZyXEL SIP ALG • SIP clients can be connected to the LAN, WLAN or DMZ. A SIP server must be on the WAN. The WLAN and DMZ are not available on all models. • You can make and receive calls between the LAN and the WAN, between the WLAN and the WAN and/or between the DMZ and the WAN.
Page 630: Signaling Session Timeout
ZyWALL 35 User’s Guide If the primary WAN connection fails, the SIP client needs to re-register with the SIP server through the secondary WAN port to have the SIP connection go through the secondary WAN port. When the ZyWALL uses both of the WAN ports at the same time, you can configure a routing policy to have the voice traffic from any IP address with UDP port 5060 and the RTP ports go over a specified WAN port.
Page 631: Appendix Ivpn Setup
ZyWALL 35 User’s Guide P P E N D I X VPN Setup This appendix will help you to quickly create a IPSec/VPN connection between two ZyXEL IPSec routers. It should be considered a quick reference for experienced users. General Notes •...
Page 632: Figure 38 Vpn Rules
ZyWALL 35 User’s Guide The following pages show a typical configuration that builds a tunnel between two private networks. One network is the headquarters (HQ) and the other is a branch office. Both sites have static (fixed) public addresses. Replace the Remote Gateway Address and Local/ Remote Starting IP Address settings with your own values.
Page 633: Figure 39 Headquarters Gateway Policy Edit
ZyWALL 35 User’s Guide Figure 39 Headquarters Gateway Policy Edit The IP address of the branch office IPSec router. Appendix I VPN Setup...
Page 634: Figure 40 Branch Office Gateway Policy Edit
ZyWALL 35 User’s Guide Figure 40 Branch Office Gateway Policy Edit The IP address of the headquarters IPSec router. 3 Click the add network policy ( ) icon next to the BRANCH gateway policy to configure a VPN policy. Appendix I VPN Setup...
Page 635: Figure 41 Headquarters Vpn Rule
ZyWALL 35 User’s Guide Figure 41 Headquarters VPN Rule Figure 42 Branch Office VPN Rule 4 Configure the screens in the headquarters and the branch office as follows and click Apply. Appendix I VPN Setup...
Page 636: Figure 43 Headquarters Network Policy Edit
ZyWALL 35 User’s Guide Figure 43 Headquarters Network Policy Edit Activate the network policy. IP addresses on different subnets. Appendix I VPN Setup...
Page 637: Figure 44 Branch Office Network Policy Edit
ZyWALL 35 User’s Guide Figure 44 Branch Office Network Policy Edit Activate the network policy. IP addresses on different subnets. Dialing the VPN Tunnel via Web Configurator To test whether the IPSec routers can build the VPN tunnel, click the dial ( ) icon in the VPN Rules (IKE) screen to have the IPSec routers set up the tunnel.
Page 638: Figure 45 Vpn Rule Configured
ZyWALL 35 User’s Guide Figure 45 VPN Rule Configured The following screen displays. Figure 46 VPN Dial This screen displays later if the IPSec routers can build the VPN tunnel. Figure 47 VPN Tunnel Established Appendix I VPN Setup...
Page 639: Vpn Troubleshooting
ZyWALL 35 User’s Guide VPN Troubleshooting If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into the web configurators of both ZyXEL IPSec routers. Check the settings in each field methodically and slowly.
Page 640: Figure 48 Vpn Log Example
ZyWALL 35 User’s Guide Figure 48 VPN Log Example ras> sys log disp ike ipsec .time source destination notes message 0|01/11/2001 18:47:22 |5.6.7.8 |5.1.2.3 |IKE Rule [ex-1] Tunnel built successfully 1|01/11/2001 18:47:22 |5.6.7.8 |5.1.2.3 |IKE The cookie pair is : 0xDAC0B43FBDE154F5 / 0xC5156C099C3F7DCA 2|01/11/2001 18:47:22 |5.6.7.8...
Page 641: Figure 49 Ike/Ipsec Debug Example
ZyWALL 35 User’s Guide IPSec Debug If you are having difficulty building an IPSec tunnel to a non-ZyXEL IPSec router, advanced users may wish to examine the IPSec debug feature (Menu 24.8). Note: If any of your VPN rules have an active network policy set to nailed-up, using the IPSec debug feature may cause the ZyWALL to continuously display new information.
Page 642: Use A Vpn Tunnel
ZyWALL 35 User’s Guide Use a VPN Tunnel A VPN tunnel gives you a secure connection to another computer or network. The VPN Status screen displays whether or not your VPN tunnel is connected. Example VPN tunnel uses are securely sending and retrieving files, and accessing corporate network drives, web servers and email.
Page 643: Importing Certificates
ZyWALL 35 User’s Guide P P E N D I X Importing Certificates This appendix shows importing certificates examples using Internet Explorer 5. Import ZyWALL Certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the ZyWALL’s server certificate by importing it into your operating system as a trusted certification authority.
Page 644: Figure 51 Login Screen
ZyWALL 35 User’s Guide Figure 51 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 52 Certificate General Information before Import 3 Click Next to begin the Install Certificate wizard. Appendix J Importing Certificates...
Page 645: Figure 53 Certificate Import Wizard 1
ZyWALL 35 User’s Guide Figure 53 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next. Figure 54 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard. Appendix J Importing Certificates...
Page 646: Figure 55 Certificate Import Wizard 3
ZyWALL 35 User’s Guide Figure 55 Certificate Import Wizard 3 6 Click Yes to add the ZyWALL certificate to the root store. Figure 56 Root Certificate Store Appendix J Importing Certificates...
Page 647: Figure 57 Certificate General Information After Import
ZyWALL 35 User’s Guide Figure 57 Certificate General Information after Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyWALL. You must have imported at least one trusted CA to the ZyWALL in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details).
Page 648: Figure 58 Zywall Trusted Ca Screen
ZyWALL 35 User’s Guide Figure 58 ZyWALL Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). Installing the CA’s Certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown next.
Page 649: Figure 59 Ca Certificate Example
ZyWALL 35 User’s Guide Figure 59 CA Certificate Example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment.
Page 650: Figure 60 Personal Certificate Import Wizard 1
ZyWALL 35 User’s Guide Figure 60 Personal Certificate Import Wizard 1 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate.
Page 651: Figure 62 Personal Certificate Import Wizard 3
ZyWALL 35 User’s Guide Figure 62 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 63 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process.
Page 652: Figure 64 Personal Certificate Import Wizard 5
ZyWALL 35 User’s Guide Figure 64 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 65 Personal Certificate Import Wizard 6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS.
Page 653: Figure 67 Ssl Client Authentication
ZyWALL 35 User’s Guide Figure 67 SSL Client Authentication 3 You next see the ZyWALL login screen. Figure 68 ZyWALL Secure Login Screen Appendix J Importing Certificates...
Page 654 ZyWALL 35 User’s Guide Appendix J Importing Certificates...
Page 655: Appendix K Command Interpreter
ZyWALL 35 User’s Guide P P E N D I X Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 - Command Interpreter Mode.
Page 656 ZyWALL 35 User’s Guide Appendix K Command Interpreter...
Page 657: Appendix L Firewall Commands
ZyWALL 35 User’s Guide P P E N D I X Firewall Commands The following describes the firewall commands. See Appendix K on page 653 for information on the command structure. Table 30 Firewall Commands FUNCTION COMMAND DESCRIPTION Firewall Set-Up This command turns the firewall on or off.
Page 658 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION E-mail This command sets the IP address to which config edit firewall e-mail the e-mail messages are sent. mail-server <ip address of mail server> This command sets the source e-mail address config edit firewall e-mail of the firewall e-mails.
Page 659 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets the threshold rate of new config edit firewall attack half-open sessions per minute where the minute-high <0-255> ZyWALL starts deleting old half-opened sessions until it gets them down to the minute- low threshold.
Page 660 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets how long ZyWALL lets an Config edit firewall set <set inactive TCP connection remain open before #> tcp-idle-timeout <seconds> considering it closed. This command sets whether or not the Config edit firewall set <set...
Page 661 ZyWALL 35 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets a rule to have the config edit firewall set <set ZyWALL check for traffic with a particular #> rule <rule #> destaddr- subnet destination (defined by IP address and subnet <ip address>...
Page 662 ZyWALL 35 User’s Guide Appendix L Firewall Commands...
Page 663: Netbios Filter Commands
ZyWALL 35 User’s Guide P P E N D I X NetBIOS Filter Commands The following describes the NetBIOS packet filter commands. See Appendix K on page 653 for information on the command structure. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN.
Page 664: Table 31 Netbios Filter Default Settings
ZyWALL 35 User’s Guide The filter types and their default settings are as follows. Table 31 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN This field displays whether NetBIOS packets are blocked or forwarded Block and WAN between the LAN and the WAN.
Page 665 ZyWALL 35 User’s Guide This command blocks IPSec NetBIOS packets. sys filter netbios config 3 on This command stops NetBIOS commands from initiating calls. sys filter netbios config 4 off Appendix M NetBIOS Filter Commands...
Page 666 ZyWALL 35 User’s Guide Appendix M NetBIOS Filter Commands...
Page 667: Certificates Commands
ZyWALL 35 User’s Guide P P E N D I X Certificates Commands The following describes the certificate commands. See Appendix K on page 653 information on the command structure. All of these commands start with certificates. Table 32 Certificates Commands...
Page 668 ZyWALL 35 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Create a certificate request and enroll for a create cmp_enroll certificate immediately online using CMP <name> <CA protocol. <name> specifies a descriptive name addr> <CA for the enrolled certificate. <CA addr> specifies cert>...
Page 669 ZyWALL 35 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Create a certificate using your device MAC replace_fact address that will be specific to this device. The factory default certificate is a common default certificate for all ZyWALL models.
Page 670 ZyWALL 35 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Delete the specified trusted remote host delete <name> certificate. <name> specifies the name of the certificate to be deleted. List all trusted remote host certificate names and list basic information.
Page 671: Brute-Force Password Guessing Protection
ZyWALL 35 User’s Guide P P E N D I X Brute-Force Password Guessing Protection Brute-force password guessing protection allows you to specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered.
Page 672 ZyWALL 35 User’s Guide Appendix O Brute-Force Password Guessing Protection...
Page 673: Appendix P Boot Commands
ZyWALL 35 User’s Guide P P E N D I X Boot Commands The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your ZyWALL, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen.
Page 674: Figure 70 Boot Module Commands
ZyWALL 35 User’s Guide Figure 70 Boot Module Commands just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time...
Page 675: Appendix Q Log Descriptions
ZyWALL 35 User’s Guide P P E N D I X Log Descriptions This appendix provides descriptions of example log messages. Table 34 System Maintenance Logs LOG MESSAGE DESCRIPTION The router has adjusted its time based on information from the Time calibration is time server.
Page 676: Table 35 System Error Logs
ZyWALL 35 User’s Guide Table 34 System Maintenance Logs (continued) LOG MESSAGE DESCRIPTION The router is saving configuration changes. Configuration Change: PC = 0x%x, Task ID = 0x%x Someone has logged on to the router’s SSH server. Successful SSH login Someone has failed to log on to the router’s SSH server.
Page 677: Table 36 Access Control Logs
ZyWALL 35 User’s Guide Table 36 Access Control Logs LOG MESSAGE DESCRIPTION Attempted TCP/UDP/IGMP/ESP/GRE/OSPF access Firewall default policy: [ TCP | matched the default policy and was blocked or forwarded UDP | IGMP | ESP | GRE | OSPF ] according to the default policy’s setting.
Page 678: Table 38 Packet Filter Logs
ZyWALL 35 User’s Guide Table 37 TCP Reset Logs (continued) LOG MESSAGE DESCRIPTION The router sent a TCP reset packet when the number of Exceed MAX incomplete, incomplete connections (TCP and UDP) exceeded the user- sent TCP RST configured threshold. (Incomplete count is for all TCP and UDP connections through the firewall.)Note: When the number of...
Page 679: Table 40 Cdr Logs
ZyWALL 35 User’s Guide Table 40 CDR Logs LOG MESSAGE DESCRIPTION The router received the setup requirements for a call. “call” is board %d line %d channel %d, the reference (count) number of the call. “dev” is the device call %d, %s C01 Outgoing Call type (3 is for dial-up, 6 is for PPPoE, 10 is for PPTP).
Page 680: Table 44 Attack Logs
ZyWALL 35 User’s Guide Table 43 Content Filtering Logs (continued) LOG MESSAGE DESCRIPTION %s: Forbidden Web site The web site is in the forbidden web site list. The web site contains ActiveX. %s: Contains ActiveX The web site contains a Java applet.
Page 681: Table 45 Remote Management Logs
ZyWALL 35 User’s Guide Table 44 Attack Logs (continued) LOG MESSAGE DESCRIPTION The firewall detected an ICMP IP spoofing attack on the WAN port. ip spoofing - WAN ICMP (type:%d, code:%d) The firewall detected an ICMP echo attack. icmp echo : ICMP (type:%d, code:%d) The firewall detected a TCP syn flood attack.
Page 682: Table 46 Wireless Logs
ZyWALL 35 User’s Guide Table 45 Remote Management Logs LOG MESSAGE DESCRIPTION Remote Management: WWW denied Attempted use of WWW service was blocked according to remote management settings. Remote Management: HTTPS denied Attempted use of HTTPS service was blocked according to remote management settings.
Page 683: Table 48 Ike Logs
ZyWALL 35 User’s Guide Table 47 IPSec Logs (continued) LOG MESSAGE DESCRIPTION Cannot find outbound SA for A packet matches a rule, but there is no phase 2 SA for outbound traffic. rule <%d> Rule [%s] sends an echo The device sent a ping packet to check the specified VPN tunnel's connectivity.
Page 684 ZyWALL 35 User’s Guide Table 48 IKE Logs (continued) LOG MESSAGE DESCRIPTION IKE uses ISAKMP to transmit data. Each ISAKMP packet Recv <packet> contains many different types of payloads. All of them show in the LOG. Refer to RFC2408 – ISAKMP for a list of all ISAKMP payload types.
Page 685 ZyWALL 35 User’s Guide Table 48 IKE Logs (continued) LOG MESSAGE DESCRIPTION The listed rule’s IKE phase 1 authentication method did not Rule [%d] Phase 1 match between the router and the peer. authentication method mismatch The listed rule’s IKE phase 1 key group did not match Rule [%d] Phase 1 key group between the router and the peer.
Page 686: Table 49 Pki Logs
ZyWALL 35 User’s Guide Table 49 PKI Logs LOG MESSAGE DESCRIPTION The SCEP online certificate enrollment was successful. The Enrollment successful Destination field records the certification authority server IP address and port. The SCEP online certificate enrollment failed. The Destination field Enrollment failed records the certification authority server’s IP address and port.
Page 687: Table 50 Certificate Path Verification Failure Reason Codes
ZyWALL 35 User’s Guide Table 50 Certificate Path Verification Failure Reason Codes CODE DESCRIPTION Algorithm mismatch between the certificate and the search constraints. Key usage mismatch between the certificate and the search constraints. Certificate was not valid in the time interval.
Page 688: Table 52 Acl Setting Notes
ZyWALL 35 User’s Guide Table 51 802.1X Logs (continued) LOG MESSAGE DESCRIPTION A user was not authenticated by the local user database Local User Database does not because the user is not listed in the local user database. find user`s credential.
Page 689: Table 53 Icmp Notes
ZyWALL 35 User’s Guide Table 52 ACL Setting Notes (continued) PACKET DIRECTION DIRECTION DESCRIPTION (L to L/ZW) LAN to LAN/ ACL set for packets traveling from the LAN to the LAN or ZyWALL the ZyWALL. (W to W/ZW) WAN to WAN/...
Page 690: Table 54 Syslog Logs
ZyWALL 35 User’s Guide Table 53 ICMP Notes (continued) TYPE CODE DESCRIPTION Timestamp reply message Information Request Information request message Information Reply Information reply message Syslog Logs There are two types of syslog: event logs and traffic logs. The device generates an event log when a system event occurs, for example, when a user logs in or the device is under attack.
Page 691: Figure 71 Displaying Log Categories Example
ZyWALL 35 User’s Guide Table 55 RFC-2408 ISAKMP Payload Types (continued) LOG DISPLAY PAYLOAD TYPE Key Exchange Identification Certificate Certificate Request CER_REQ Hash HASH Signature Nonce NONCE Notification NOTFY Delete Vendor ID Log Commands Go to the command interpreter interface.
Page 692: Figure 72 Displaying Log Parameters Example
ZyWALL 35 User’s Guide Figure 72 Displaying Log Parameters Example ras> sys logs category access Usage: [0:none/1:log/2:alert/3:both] [0:don't show debug type/ 1:show debug type] 4 Use followed by a log category and a parameter to decide what to sys logs category record.
Page 693: Log Command Example
ZyWALL 35 User’s Guide Log Command Example This example shows how to set the ZyWALL to record the access logs and alerts and then view the results. ras> sys logs load ras> sys logs category access 3 ras> sys logs save ras>...
Page 694 ZyWALL 35 User’s Guide Appendix Q Log Descriptions...
Page 695: Index
ZyWALL 35 User’s Guide Index Numerics 10/100 Mbps Ethernet WAN Backup 406, 520 110V AC Backup WAN 230V AC Bandwidth Borrowing Bandwidth Class Bandwidth Filter 321, 332 Bandwidth Management 49, 321 Bandwidth Management Statistics Bandwidth Manager Class Configuration Bandwidth Manager Class Setup...
Page 696 ZyWALL 35 User’s Guide Client-server Protocol IP Alias Command Interpreter Mode IP Alias Setup Command Line Port Filter Setup Community Setup 449, 450 Configuration 69, 89 TCP/IP Setup Configuration File Backup DNS Server Connecting Cables For VPN Host Connection ID/Name...
Page 697 ZyWALL 35 User’s Guide Factory Default Gas Pipes Factory LAN Defaults Gateway IP Addr Fairness-based Scheduler Gateway IP Address 446, 468 General Setup 393, 419 Filename Conventions Global Filter 435, 464, 491 Applying Configuration Configuring Example Half-Open Sessions Generic Filter Rule...
Page 698 ZyWALL 35 User’s Guide Internet Protocol Security (IPSec) LAN TCP/IP Introduction to Filters LAN to WAN Rules IP Address 69, 90, 92, 102, 125, 303, 305, 306, 439, LAND 166, 167 441, 446, 463, 476 Lightning Remote Link type 62, 64, 103...
Page 699 ZyWALL 35 User’s Guide Password 394, 412, 417, 446, 505 Path cost PCMCIA Port Nailed-Up Connection 430, 461 Perfect Forward Secrecy Nailed-up Connection Period(hr) 430, 461 Nailed-Up Connections Ping 90, 303, 304, 432, 433, 463, 464, 502 Ping of Death...
Page 700 ZyWALL 35 User’s Guide RTS (Request To Send) RTS (Request To Send) threshold RADIUS 50, 107, 610 RTS Threshold 607, 608 Shared Secret Key 108, 611 RTS/CTS handshake RADIUS Message Types 107, 610 Rules 175, 178 RADIUS Messages Checklist Rapid STP...
Page 701 ZyWALL 35 User’s Guide SMTP TCP Security Smurf 167, 168 TCP/IP 165, 166, 363, 431, 438, 439, 450, 462, 496, 497, 499, 502 SNMP 52, 303, 365 Setup Community Configuration TCP/IP and DHCP Setup TCP/IP filter rule Manager Teardrop MIBs Telecommunication Line Cord.
Page 702 ZyWALL 35 User’s Guide Use Server Detected IP User Authentication User Name Xmodem User Profiles File Upload User Specified IP Addr XMODEM Protocol Vendor ZyNOS 510, 520 Ventilation Slots ZyNOS F/W Version 510, 520 Virtual Private Network ZyXEL Limited Warranty...