Download Print this page

ZyXEL Communications ZyWALL 5 User Manual

ZyXEL Communications ZyWALL 5 User Manual

Hide thumbs Also See for ZyWALL 5:

User manual (553 pages)

,

Support notes (305 pages)

,

Quick start manual (139 pages)

Table Of Contents

Table of Contents

Advertisement

Quick Links

Download this manual

ZyWALL 5

Internet Security Appliance

User's Guide

Version 3.64

3/2005

Table of Contents

Advertisement

Table of Contents

Troubleshooting

Need help?

Need help?

Do you have a question about the ZyWALL 5 and is the answer not in the manual?

Questions and answers

Summary of Contents for ZyXEL Communications ZyWALL 5

Page 1 ZyWALL 5 Internet Security Appliance User’s Guide Version 3.64 3/2005...
Page 3: Copyright
ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation. All rights reserved.
Page 4: Federal Communications Commission (Fcc) Interference Statement
ZyWALL 5 User’s Guide Federal Communications Commission (FCC) Interference Statement This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations.
Page 5: Safety Warnings
ZyWALL 5 User’s Guide Safety Warnings For your safety, be sure to read and follow all warning notices and instructions. • To reduce the risk of fire, use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord.
Page 6: Zyxel Limited Warranty
ZyWALL 5 User’s Guide ZyXEL Limited Warranty ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or workmanship for a period of up to two years from the date of purchase. During...
Page 7: Customer Support
ZyWALL 5 User’s Guide Customer Support Please have the following information ready when you contact customer support. • Product model and serial number. • Warranty Information. • Date that you received your device. • Brief description of the problem and the steps you took to solve it.
Page 8 ZyWALL 5 User’s Guide METHOD SUPPORT E-MAIL TELEPHONE WEB SITE REGULAR MAIL SALES E-MAIL FTP SITE LOCATION technical@zyxel.co.uk +44 (0) 8702 909090 www.zyxel.co.uk ZyXEL Communications UK Ltd.,11, The Courtyard, sales@zyxel.co.uk +44 (0) 8702 909091 ftp.zyxel.co.uk UNITED KINGDOM Eastern Road, Bracknell,...
Page 9: Table Of Contents
Customer Support....................5 Preface ........................43 Chapter 1 Getting to Know Your ZyWALL ................45 1.1 ZyWALL 5 Internet Security Appliance Overview ..........45 1.2 ZyWALL Features ....................45 1.2.1 Physical Features ..................45 1.2.2 Non-Physical Features ................47 1.3 Applications for the ZyWALL ................51 1.3.1 Secure Broadband Internet Access via Cable or DSL Modem ....51...
Page 10 ZyWALL 5 User’s Guide Chapter 3 Wizard Setup ......................69 3.1 Wizard Setup Overview ..................69 3.2 Internet Access ....................69 3.2.1 ISP Parameters ..................69 3.2.1.1 Ethernet ...................69 3.2.1.2 PPPoE Encapsulation ..............71 3.2.1.3 PPTP Encapsulation ...............72 3.2.2 Internet Access Wizard Setup Complete ..........74 3.3 VPN Wizard ......................75...
Page 11 ZyWALL 5 User’s Guide Chapter 6 Wireless LAN ......................101 6.1 Introduction ......................101 6.1.1 Additional Installation Requirements for Using 802.1x ......101 6.2 Wireless Security .....................101 6.3 Security Parameters Summary ................102 6.4 WEP Encryption ....................103 6.5 802.1x Overview ....................103 6.5.1 Introduction to RADIUS ................103 6.5.1.1 Types of RADIUS Messages ............103...
Page 12 ZyWALL 5 User’s Guide 7.8 Advanced Modem Setup ..................139 7.8.1 AT Command Strings ................139 7.8.2 DTR Signal .....................139 7.8.3 Response Strings ..................139 7.9 Configuring Advanced Modem Setup ..............139 Chapter 8 DMZ Screens ......................143 8.1 DMZ Overview ....................143 8.2 Configuring DMZ ....................143 8.3 Configuring IP Alias ..................145...
Page 13 ZyWALL 5 User’s Guide Chapter 10 Firewall Screens....................163 10.1 Access Methods .....................163 10.2 Firewall Policies Overview ................163 10.3 Rule Logic Overview ..................164 10.3.1 Rule Checklist ..................164 10.3.2 Security Ramifications ................165 10.3.3 Key Fields For Configuring Rules ............165 10.3.3.1 Action ..................165 10.3.3.2 Service ..................165...
Page 14 ZyWALL 5 User’s Guide Chapter 12 Content Filtering Registration and Reports............201 12.1 Introduction to myZyXEL.com ................201 12.1.1 A Note on myZyXEL.com Numbers ............202 12.2 myZyXEL.com Account Registration ..............202 12.3 Registering Your ZyXEL Device ..............204 12.4 Content Filtering Registration .................207 12.5 Checking Content Filtering Activation ............209...
Page 15 ZyWALL 5 User’s Guide 14.5 Nailed Up .......................221 14.6 NAT Traversal ....................221 14.6.1 NAT Traversal Configuration ..............222 14.7 ID Type and Content ..................222 14.7.1 ID Type and Content Examples ............223 14.8 IKE Phases ....................224 14.8.1 Negotiation Mode ..................225 14.8.2 Pre-Shared Key ..................225 14.8.3 Diffie-Hellman (DH) Key Groups ............226...
Page 16 ZyWALL 5 User’s Guide 15.13 Verifying a Trusted Remote Host’s Certificate ..........269 15.13.1 Trusted Remote Host Certificate Fingerprints ........269 15.14 Importing a Trusted Remote Host’s Certificate ..........270 15.15 Trusted Remote Host Certificate Details ............271 15.16 Directory Servers ..................274 15.17 Add or Edit a Directory Server ..............275 Chapter 16 Authentication Server ..................
Page 17 ZyWALL 5 User’s Guide Chapter 19 Bandwidth Management ..................301 19.1 Bandwidth Management Overview ..............301 19.2 Bandwidth Classes and Filters ...............301 19.3 Proportional Bandwidth Allocation ..............302 19.4 Application-based Bandwidth Management ...........302 19.5 Subnet-based Bandwidth Management ............302 19.6 Application and Subnet-based Bandwidth Management .......302 19.7 Scheduler .......................303...
Page 18 ZyWALL 5 User’s Guide 20.11 Configuring Dynamic DNS ................326 Chapter 21 Remote Management ................... 329 21.1 Remote Management Overview ..............329 21.1.1 Remote Management Limitations ............329 21.1.2 Remote Management and NAT ............330 21.1.3 System Timeout ...................330 21.2 Introduction to HTTPS ..................330 21.3 Configuring WWW ..................331...
Page 19 ZyWALL 5 User’s Guide 22.5.1 Installing UPnP in Windows Me ............355 22.5.2 Installing UPnP in Windows XP ............356 22.6 Using UPnP in Windows XP Example ............356 22.6.1 Auto-discover Your UPnP-enabled Network Device ......357 22.6.2 Web Configurator Easy Access ............358 Chapter 23 Logs Screens......................
Page 20 ZyWALL 5 User’s Guide 25.2.2 Entering the Password ................390 25.3 Navigating the SMT Interface .................390 25.3.1 Main Menu ....................391 25.3.2 SMT Menus Overview ................393 25.4 Changing the System Password ..............395 25.5 Resetting the ZyWALL ...................396 Chapter 26 SMT Menu 1 - General Setup................397 26.1 Introduction to General Setup ................397...
Page 21 ZyWALL 5 User’s Guide 29.5 Basic Setup Complete ..................426 Chapter 30 DMZ Setup ......................427 30.1 Configuring DMZ Setup ..................427 30.2 DMZ Port Filter Setup ..................427 30.3 TCP/IP Setup ....................427 30.3.1 IP Address ....................428 30.3.2 IP Alias Setup ..................428 Chapter 31 Remote Node Setup .....................
Page 22 ZyWALL 5 User’s Guide 33.4.3 Example 3: Multiple Public IP Addresses With Inside Servers .....453 33.4.4 Example 4: NAT Unfriendly Application Programs .......457 33.5 Trigger Port Forwarding .................459 33.5.1 Two Points To Remember About Trigger Ports ........459 Chapter 34 Introducing the ZyWALL Firewall ............... 461 34.1 Using ZyWALL SMT Menus ................461...
Page 23 ZyWALL 5 User’s Guide 37.5.1 WAN DHCP ..................488 Chapter 38 Firmware and Configuration File Maintenance ..........491 38.1 Introduction ....................491 38.2 Filename Conventions ...................491 38.3 Backup Configuration ..................492 38.3.1 Backup Configuration ................492 38.3.2 Using the FTP Command from the Command Line ......493 38.3.3 Example of FTP Commands from the Command Line ......494...
Page 24 ZyWALL 5 User’s Guide Chapter 40 Remote Management ................... 515 40.1 Remote Management ..................515 40.1.1 Remote Management Limitations ............517 Chapter 41 Call Scheduling ....................519 41.1 Introduction to Call Scheduling ..............519 Chapter 42 Troubleshooting ....................523 42.1 Problems Starting Up the ZyWALL ..............523 42.2 Problems with the LAN Interface ..............523...
Page 25 ZyWALL 5 User’s Guide Appendix H SIP Passthrough ....................589 Appendix I VPN Setup......................595 Appendix J Importing Certificates ..................607 Appendix K Command Interpreter................... 619 Appendix L Firewall Commands ..................... 621 Appendix M NetBIOS Filter Commands .................. 627 Appendix N Certificates Commands ..................
Page 26 ZyWALL 5 User’s Guide...
Page 27 ZyWALL 5 User’s Guide List of Figures Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem ........ 52 Figure 2 VPN Application ....................53 Figure 3 ZyWALL Front Panel ..................... 53 Figure 4 Change Password Screen ..................56 Figure 5 Replace Certificate Screen ...................
Page 28 ZyWALL 5 User’s Guide Figure 37 Wireless: WPA ....................113 Figure 38 Wireless: 802.1x + Dynamic WEP ..............114 Figure 39 Wireless: 802.1x + Static WEP ................115 Figure 40 Wireless: 802.1x + No WEP ................117 Figure 41 Wireless: No Access 802.1x + Static WEP ............118 Figure 42 MAC Address Filter .....................
Page 29 ZyWALL 5 User’s Guide Figure 80 Content Filter : Customization ................196 Figure 81 Content Filter : Cache ..................199 Figure 82 myZyXEL.com Login Screen ................202 Figure 83 myZyXEL.com Account Registration ..............203 Figure 84 Account Registration Successful ................ 203 Figure 85 Account Confirmation E-Mail ................
Page 30 ZyWALL 5 User’s Guide Figure 123 Trusted CAs ...................... 262 Figure 124 Trusted CA Import ..................... 263 Figure 125 Trusted CA Details .................... 265 Figure 126 Trusted Remote Hosts ..................268 Figure 127 Remote Host Certificates .................. 269 Figure 128 Certificate Details ..................... 270 Figure 129 Trusted Remote Host Import ................
Page 31 ZyWALL 5 User’s Guide Figure 166 Security Certificate 2 (Netscape) ..............334 Figure 167 Login Screen (Internet Explorer) ............... 336 Figure 168 Login Screen (Netscape) .................. 336 Figure 169 Replace Certificate .................... 337 Figure 170 Device-specific Certificate ................. 337 Figure 171 Common ZyWALL Certificate ................338 Figure 172 SSH Communication Example ................
Page 32 ZyWALL 5 User’s Guide Figure 209 Reset Warning Message ................... 386 Figure 210 Restart Screen ....................387 Figure 211 Initial Screen ..................... 390 Figure 212 Password Screen ..................... 390 Figure 213 Main Menu (Router Mode) ................392 Figure 214 Main Menu (Bridge Mode) ................392 Figure 215 Menu 23: System Password ................
Page 33 ZyWALL 5 User’s Guide Figure 251 Menu 11.1.5: Traffic Redirect Setup ..............440 Figure 252 Menu 12: IP Static Route Setup ............... 441 Figure 253 Menu 12. 1: Edit IP Static Route ............... 442 Figure 254 Menu 4: Applying NAT for Internet Access ............444 Figure 255 Menu 11.1.2: Applying NAT to the Remote Node ..........
Page 34 ZyWALL 5 User’s Guide Figure 294 Menu 24: System Maintenance ................ 479 Figure 295 Menu 24.1: System Maintenance: Status ............480 Figure 296 Menu 24.2: System Information and Console Port Speed ........ 481 Figure 297 Menu 24.2.1: System Maintenance: Information ..........482 Figure 298 Menu 24.2.2: System Maintenance: Change Console Port Speed ....
Page 35 ZyWALL 5 User’s Guide Figure 337 Internet Options ....................528 Figure 338 Internet Options ....................529 Figure 339 Pop-up Blocker Settings ................... 530 Figure 340 Internet Options ....................531 Figure 341 Security Settings - Java Scripting ..............532 Figure 342 Security Settings - Java ..................533 Figure 343 Java (Sun) ......................
Page 36 ZyWALL 5 User’s Guide Figure 37 ZyWALL SIP ALG ....................593 Figure 38 VPN Rules ......................596 Figure 39 Headquarters Gateway Policy Edit ..............597 Figure 40 Branch Office Gateway Policy Edit ..............598 Figure 41 Headquarters VPN Rule ..................599 Figure 42 Branch Office VPN Rule ..................
Page 37 ZyWALL 5 User’s Guide List of Tables Table 1 Front Panel LEDs ....................53 Table 2 Web Configurator HOME Screen in Router Mode ..........59 Table 3 Web Configurator HOME Screen in Bridge Mode ..........61 Table 4 Bridge and Router Mode Features Comparison ............ 62 Table 5 Screens Summary ....................
Page 38 ZyWALL 5 User’s Guide Table 37 WAN: PPPoE Encapsulation ................129 Table 38 WAN: PPTP Encapsulation ................. 132 Table 39 Traffic Redirect ....................135 Table 40 Dial Backup Setup ....................137 Table 41 Advanced Setup ....................140 Table 42 DMZ ........................144 Table 43 IP Alias ........................
Page 39 ZyWALL 5 User’s Guide Table 80 My Certificate Details ................... 260 Table 81 Trusted CAs ......................262 Table 82 Trusted CA Import ....................264 Table 83 Trusted CA Details ....................265 Table 84 Trusted Remote Hosts ..................268 Table 85 Trusted Remote Host Import ................271 Table 86 Trusted Remote Host Details ................
Page 40 ZyWALL 5 User’s Guide Table 123 SNMP ........................ 348 Table 124 DNS ........................349 Table 125 Configuring UPnP ....................352 Table 126 UPnP Ports ......................353 Table 127 View Log ......................362 Table 128 Example Log Description ................... 363 Table 129 Log Settings ....................... 365 Table 130 Reports ......................
Page 41 ZyWALL 5 User’s Guide Table 166 New Fields in Menu 4 (PPTP) Screen ............... 425 Table 167 New Fields in Menu 4 (PPPoE) screen ............. 426 Table 168 Menu 11.1: Remote Node Profile for Ethernet Encapsulation ......432 Table 169 Fields in Menu 11.1 (PPPoE Encapsulation Specific) ........435 Table 170 Menu 11.1: Remote Node Profile for PPTP Encapsulation .......
Page 42 ZyWALL 5 User’s Guide Table 4 Feature Specifications ................... 537 Table 5 Compatible ZyXEL WLAN Cards and Security Features ........538 Table 6 Console/Dial Backup Port Pin Assignments ............540 Table 7 North American AC Power Adaptor Specifications ..........540 Table 8 European Union AC Power Adaptor Specifications ..........
Page 43 ZyWALL 5 User’s Guide Table 47 IPSec Logs ......................646 Table 48 IKE Logs ......................647 Table 49 PKI Logs ......................650 Table 50 Certificate Path Verification Failure Reason Codes ..........651 Table 51 802.1X Logs ......................651 Table 52 ACL Setting Notes ....................652 Table 53 ICMP Notes ......................
Page 44 ZyWALL 5 User’s Guide...
Page 45: Preface
Help us help you! E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 300, Taiwan. Thank you!
Page 46: Syntax Conventions
ZyWALL 5 User’s Guide Syntax Conventions • “Enter” means for you to type one or more characters. “Select” or “Choose” means for you to use one predefined choices. • The SMT menu titles and labels are in Bold Times New Roman font. Predefined field choices are in Bold Arial font.
Page 47: Getting To Know Your Zywall
This chapter introduces the main features and applications of the ZyWALL. ZyWALL 5 Internet Security Appliance Overview The ZyWALL 5 Internet security gateway is designed for medium sized business that need the increased reliability of dial backup and traffic redirect. The ZyWALL is loaded with security features including VPN, firewall, content filtering, and certificates.
Page 48: Reset Button
ZyWALL 5 User’s Guide DMZ Ports Public servers (Web, FTP, etc.) attached to a DeMilitarized Zone (DMZ) port are visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death) and can also be accessed from the secure LAN.
Page 49: Non-Physical Features
ZyWALL 5 User’s Guide 1.2.2 Non-Physical Features Transparent Firewall Transparent firewall is also known as a bridge firewall. The ZyWALL can act as a bridge and still have the capability of filtering and inspecting the packets between a router and the LAN, or two routers.
Page 50 ZyWALL 5 User’s Guide HTTPS HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL is a web protocol that encrypts and decrypts web sessions. Use HTTPS for secure web configurator access to the ZyWALL Firewall The ZyWALL is a stateful inspection firewall with DoS (Denial of Service) protection. By default, when the firewall is activated, all incoming traffic from the WAN to the LAN is blocked unless it is initiated from the LAN.
Page 51: Wep Encryption
ZyWALL 5 User’s Guide Wireless LAN MAC Address Filtering Your ZyWALL can check the MAC addresses of wireless stations against a list of allowed or denied MAC addresses. WEP Encryption WEP (Wired Equivalent Privacy) encrypts data frames before transmitting over the wireless network to help keep network communications private.
Page 52: Traffic Redirect
ZyWALL 5 User’s Guide IP Alias IP Alias allows you to partition a physical network into logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN and/or DMZ interfaces via its single physical Ethernet LAN and/or DMZ interface with the ZyWALL itself as the gateway for each network.
Page 53: Applications For The Zywall
ZyWALL 5 User’s Guide Full Network Management The embedded web configurator is an all-platform web-based utility that allows you to easily access the ZyWALL’s management settings and configure the firewall. Most functions of the ZyWALL are also software configurable via the SMT (System Management Terminal) interface.
Page 54: Vpn Application
ZyWALL 5 User’s Guide Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem 1.3.2 VPN Application ZyWALL VPN is an ideal cost-effective way to connect branch offices and business partners over the Internet without the need (and expense) for leased lines between sites.
Page 55: Front Panel Leds
ZyWALL 5 User’s Guide Figure 2 VPN Application 1.3.3 Front Panel LEDs Figure 3 ZyWALL Front Panel The following table describes the LEDs. Table 1 Front Panel LEDs COLOR STATUS DESCRIPTION The ZyWALL is turned off. Green The ZyWALL is turned on.
Page 56 ZyWALL 5 User’s Guide Table 1 Front Panel LEDs (continued) COLOR STATUS DESCRIPTION Green The ZyWALL is not ready or has failed. The ZyWALL is ready and running. Flashing The ZyWALL is restarting. Green The backup port is not connected.
Page 57: Introducing The Web Configurator
ZyWALL 5 User’s Guide H A P T E R Introducing the Web Configurator This chapter describes how to access the ZyWALL web configurator and provides an overview of its screens. 2.1 Web Configurator Overview The web configurator is an HTML-based management interface that allows easy ZyWALL setup and management via Internet browser.
Page 58: Resetting The Zywall
ZyWALL 5 User’s Guide Figure 4 Change Password Screen 6 Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Note: If you do not replace the default certificate here or in the CERTIFICATES screen, this screen displays every time you access the web configurator.
Page 59: Procedure To Use The Reset Button
ZyWALL 5 User’s Guide 2.3.1 Procedure To Use The Reset Button Make sure the SYS LED is on (not blinking) before you begin this procedure. 1 Press the RESET button for ten seconds, and then release it. If the SYS LED begins to blink, the defaults have been restored and the ZyWALL restarts.
Page 60: Navigating The Zywall Web Configurator
ZyWALL 5 User’s Guide 2.4 Navigating the ZyWALL Web Configurator The following summarizes how to navigate the web configurator from the HOME screen. Note: Follow the instructions you see in the HOME screen or click the icon (located in the top right corner of most screens) to view online help.
Page 61: Table 2 Web Configurator Home Screen In Router Mode
ZyWALL 5 User’s Guide Click MAINTENANCE to view information about your ZyWALL or upgrade configuration/ firmware files. Maintenance includes General, Password, Time and Date, Device Mode, F/ W (firmware) Upload, Configuration (Backup, Restore, Default), and Restart. The following table describes the labels in this screen.
Page 62: Bridge Mode
ZyWALL 5 User’s Guide Table 2 Web Configurator HOME Screen in Router Mode (continued) LABEL DESCRIPTION Subnet Mask This shows the port’s subnet mask. DHCP This shows the WAN port’s DHCP role - Client or None. This shows the LAN port’s DHCP role - Server, Relay or None.
Page 63: Figure 8 Web Configurator Home Screen In Bridge Mode
ZyWALL 5 User’s Guide Figure 8 Web Configurator HOME Screen in Bridge Mode The following table describes the labels not previously discussed (Table 2 on page 59). Table 3 Web Configurator HOME Screen in Bridge Mode LABEL DESCRIPTION Network Status IP Address This is the IP address of your ZyWALL in dotted decimal notation.
Page 64: Navigation Panel
ZyWALL 5 User’s Guide Table 3 Web Configurator HOME Screen in Bridge Mode (continued) LABEL DESCRIPTION Bridge Port This is the port type. Port types are: WAN, LAN, WLAN and DMZ. Port Status For the WAN, LAN, and DMZ ports, this displays the port speed and duplex setting.
Page 65: Table 5 Screens Summary
ZyWALL 5 User’s Guide Table 4 Bridge and Router Mode Features Comparison FEATURE BRIDGE MODE ROUTER MODE Remote Management UPnP Logs Maintenance Table Key: An O in a mode’s column shows that the device mode has the specified feature. The information in this table was correct at the time of writing, although it may be subject to change.
Page 66 ZyWALL 5 User’s Guide Table 5 Screens Summary (continued) LINK FUNCTION CONTENT General This screen allows you to enable content filtering and block certain FILTER web features. Categories Use this screen to select which categories of web pages to filter out, as well as to register for external database content filtering and view reports.
Page 67: System Statistics
ZyWALL 5 User’s Guide Table 5 Screens Summary (continued) LINK FUNCTION Use this screen to configure through which interface(s) and from which IP address(es) users can use Secure Shell to manage the ZyWALL. TELNET Use this screen to configure through which interface(s) and from which IP address(es) users can use Telnet to manage the ZyWALL.
Page 68: Dhcp Table Screen
ZyWALL 5 User’s Guide Figure 9 Home : Show Statistics The following table describes the labels in this screen. Table 6 Home : Show Statistics LABEL DESCRIPTION Port This is the WAN, Dial Backup, LAN, DMZ or WLAN port. Status This displays the port speed and duplex setting if you’re using Ethernet...
Page 69: Vpn Status
ZyWALL 5 User’s Guide Figure 10 Home : DHCP Table The following table describes the labels in this screen. Table 7 Home : DHCP Table LABEL DESCRIPTION This is the index number of the host computer. IP Address This field displays the IP address relative to the # field listed above.
Page 70: Figure 11 Home : Vpn Status
ZyWALL 5 User’s Guide Figure 11 Home : VPN Status The following table describes the labels in this screen. Table 8 Home : VPN Status LABEL DESCRIPTION This is the security association index number. Name This field displays the identification name for this VPN policy.
Page 71: Wizard Setup
ZyWALL 5 User’s Guide H A P T E R Wizard Setup This chapter provides information on the Wizard Setup screens in the web configurator. This chapter is only applicable when the ZyWALL is in router mode. 3.1 Wizard Setup Overview The web configurator's setup wizards help you configure the ZyWALL to access the Internet and edit VPN policies and configure IKE settings to establish a VPN tunnel.
Page 72: Figure 12 Isp Parameters : Ethernet Encapsulation
ZyWALL 5 User’s Guide Figure 12 ISP Parameters : Ethernet Encapsulation The following table describes the labels in this screen. Table 9 ISP Parameters : Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 73: Pppoe Encapsulation
ZyWALL 5 User’s Guide Table 9 ISP Parameters : Ethernet Encapsulation LABEL DESCRIPTION First DNS Server Enter the DNS server's IP address(es) in the field(s) to the right. Second DNS Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not...
Page 74: Pptp Encapsulation
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 10 ISP Parameters : PPPoE Encapsulation LABEL DESCRIPTION ISP Parameter for Internet Access Encapsulation Choose an encapsulation method from the pull-down list box. PPP over Ethernet forms a dial-up connection.
Page 75: Figure 14 Isp Parameters : Pptp Encapsulation
ZyWALL 5 User’s Guide Figure 14 ISP Parameters : PPTP Encapsulation The following table describes the labels in this screen. Table 11 ISP Parameters : PPTP Encapsulation ESCRIPTION LABEL ISP Parameters for Internet Access Encapsulation Select PPTP from the drop-down list box. To configure a PPTP client, you must configure the User Name and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 76: Internet Access Wizard Setup Complete
ZyWALL 5 User’s Guide Table 11 ISP Parameters : PPTP Encapsulation ESCRIPTION LABEL My IP Address Type the (static) IP address assigned to you by your ISP. My IP Subnet Mask Type the subnet mask assigned to you by your ISP (if given).
Page 77: Vpn Wizard
ZyWALL 5 User’s Guide 3.3 VPN Wizard Use the VPN wizard screens to configure a VPN rule that use a pre-shared key. If you want to set the rule to use a certificate, please go to the VPN screens for configuration.
Page 78: Network Setting
ZyWALL 5 User’s Guide 3.3.1 Network Setting Two active SAs cannot have the local and remote IP address(es) both the same. Two active SAs can have the same local or remote IP address, but not both. You can configure multiple SAs between the same local and remote IP addresses, as long as only one is active at any time.
Page 79 ZyWALL 5 User’s Guide Table 13 VPN Wizard : Network Setting LABEL DESCRIPTION Starting IP When the Local Network field is configured to Single, enter a (static) IP address on Address the LAN behind your ZyWALL. When the Local Network field is configured to Range IP, enter the beginning (static) IP address, in a range of computers on the LAN behind your ZyWALL.
Page 80: Ike Tunnel Setting (Ike Phase 1)
ZyWALL 5 User’s Guide 3.3.2 IKE Tunnel Setting (IKE Phase 1) Figure 18 VPN Wizard : IKE Tunnel Setting The following table describes the labels in this screen. Table 14 VPN Wizard : IKE Tunnel Setting LABEL DESCRIPTION Negotiation Mode Use the radio buttons to select Main Mode or Aggressive Mode.
Page 81: Ipsec Setting (Ike Phase 2)
ZyWALL 5 User’s Guide Table 14 VPN Wizard : IKE Tunnel Setting (continued) LABEL DESCRIPTION Pre-Shared Key Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared"...
Page 82: Vpn Status Summary
ZyWALL 5 User’s Guide Table 15 VPN Wizard : IPSec Setting (continued) LABEL DESCRIPTION Encryption Algorithm When DES is used for data communications, both sender and receiver must know the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code.
Page 83: Figure 20 Vpn Wizard : Vpn Status
ZyWALL 5 User’s Guide Figure 20 VPN Wizard : VPN Status The following table describes the labels in this screen. Table 16 VPN Wizard : VPN Status LABEL DESCRIPTION Gateway Policy Property Name This is the name of this VPN gateway policy.
Page 84 ZyWALL 5 User’s Guide Table 16 VPN Wizard : VPN Status (continued) LABEL DESCRIPTION Network Policy Property Active This displays whether this VPN network policy is enabled or not. Name This is the name of this VPN network policy. Network Policy...
Page 85: Vpn Wizard Setup Complete
ZyWALL 5 User’s Guide Table 16 VPN Wizard : VPN Status (continued) LABEL DESCRIPTION Back Click Back to return to the previous screen. Finish Click Finish to complete and save the wizard setup. 3.3.5 VPN Wizard Setup Complete Congratulations! You have successfully set up the VPN rule after any existing rule(s) for your ZyWALL.
Page 86 ZyWALL 5 User’s Guide Chapter 3 Wizard Setup...
Page 87: Chapter 4 Lan Screens
ZyWALL 5 User’s Guide H A P T E R LAN Screens This chapter describes how to configure LAN settings. This chapter is only applicable when the ZyWALL is in router mode. 4.1 LAN Overview Local Area Network (LAN) is a shared communication system to which many computers are attached.
Page 88: Ip Address And Subnet Mask
ZyWALL 5 User’s Guide These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), read the embedded web configurator help regarding what fields need to be configured. 4.3.2 IP Address and Subnet Mask Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.
Page 89: Multicast
ZyWALL 5 User’s Guide Both RIP-2B and RIP-2M send routing data in RIP-2 format; the difference being that RIP- 2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets.
Page 90: Figure 22 Lan
ZyWALL 5 User’s Guide Figure 22 LAN The following table describes the labels in this screen. Table 17 LAN LABEL DESCRIPTION LAN TCP/IP IP Address Type the IP address of your ZyWALL in dotted decimal notation. 192.168.1.1 is the factory default. Alternatively, click the right mouse button to copy and/or paste the IP address.
Page 91: Configuring Static Dhcp
ZyWALL 5 User’s Guide Table 17 LAN (continued) LABEL DESCRIPTION Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use.
Page 92: Configuring Ip Alias
ZyWALL 5 User’s Guide Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02. To change your ZyWALL’s static DHCP settings, click LAN, then the Static DHCP tab. The screen appears as shown (some of the screen’s blank rows are not shown).
Page 93: Figure 24 Physical Network & Partitioned Logical Networks
ZyWALL 5 User’s Guide When you use IP alias, you can also configure firewall rules to control access between the LAN's logical networks (subnets). Note: Make sure that the subnets of the logical networks do not overlap. The following figure shows a LAN divided into subnets A, B, and C.
Page 94: Configuring Port Roles
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 19 IP Alias LABEL DESCRIPTION Enable IP Alias 1, Select the check box to configure another LAN network for the ZyWALL. IP Address Enter the IP address of your ZyWALL' in dotted decimal notation.
Page 95: Figure 26 Port Roles
ZyWALL 5 User’s Guide Figure 26 Port Roles After you change the LAN/DMZ port roles and click Apply, please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen. Figure 27 Port Roles Change Complete...
Page 96 ZyWALL 5 User’s Guide Chapter 4 LAN Screens...
Page 97: Chapter 5 Bridge Screens
ZyWALL 5 User’s Guide H A P T E R Bridge Screens This chapter describes how to configure bridge settings. This chapter is only applicable when the ZyWALL is in bridge mode. 5.1 Bridge Loop The ZyWALL can act as a bridge between a switch and a wired LAN or between two routers.
Page 98: Rapid Stp
ZyWALL 5 User’s Guide 5.2.1 Rapid STP The ZyWALL uses IEEE 802.1w RSTP (Rapid Spanning Tree Protocol) that allow faster convergence of the spanning tree (while also being backwards compatible with STP-only aware bridges). Using RSTP topology change information does not have to propagate to the root bridge and unwanted learned addresses are flushed from the filtering database.
Page 99: Stp Port States
ZyWALL 5 User’s Guide Once a stable network topology has been established, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) transmitted from the root bridge. If a bridge does not get a Hello BPDU after a predefined interval (Max Age), the bridge assumes that the link to the root bridge is down.
Page 100: Figure 29 Bridge
ZyWALL 5 User’s Guide Figure 29 Bridge The following table describes the labels in this screen. Table 22 Bridge LABEL DESCRIPTION Bridge Setup IP Address Type the IP address of your ZyWALL in dotted decimal notation. IP Subnet Mask The subnet mask specifies the network number portion of an IP address.
Page 101: Configuring Port Roles
ZyWALL 5 User’s Guide Table 22 Bridge (continued) LABEL DESCRIPTION Rapid Spanning Tree Protocol Setup Enable Rapid Spanning Select the check box to activate RSTP on the ZyWALL. Tree Protocol Bridge Priority Enter a number between 0 and 61440 as bridge priority of the ZyWALL. 0 is the highest.
Page 102 ZyWALL 5 User’s Guide Chapter 5 Bridge Screens...
Page 103: Chapter 6 Wireless Lan
ZyWALL 5 User’s Guide H A P T E R Wireless LAN This chapter discusses how to configure Wireless LAN on the ZyWALL. 6.1 Introduction A wireless LAN can be as simple as two computers with wireless LAN adapters communicating in a peer-to-peer network or as complex as a number of computers with wireless LAN adapters communicating through access points which bridge network traffic to the wired LAN.
Page 104: Security Parameters Summary
ZyWALL 5 User’s Guide Figure 30 ZyWALL Wireless Security Levels If you do not enable any wireless security on your ZyWALL, your network is accessible to any wireless networking device that is within range. Use the ZyWALL web configurator to set up your wireless LAN security settings. Refer to the chapter on using the ZyWALL web configurator to see how to access the web configurator 6.3 Security Parameters Summary...
Page 105: Wep Encryption
ZyWALL 5 User’s Guide Table 23 Wireless Security Relational Matrix (continued) AUTHENTICATION ENCRYPTION ENTER METHOD/ KEY IEEE 802.1X METHOD MANUAL KEY MANAGEMENT PROTOCOL WPA-PSK Enable WPA-PSK TKIP Enable 6.4 WEP Encryption WEP (Wired Equivalent Privacy) as specified in the IEEE 802.11 standard provides methods for both data encryption and wireless station authentication.
Page 106: Eap Authentication Overview
ZyWALL 5 User’s Guide Sent by an access point requesting authentication. • Access-Reject Sent by a RADIUS server rejecting access. • Access-Accept Sent by a RADIUS server allowing access. • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message.
Page 107: Dynamic Wep Key Exchange
ZyWALL 5 User’s Guide Figure 31 EAP Authentication The details below provide a general description of how IEEE 802.1x EAP authentication works. • The wireless station sends a start message to the ZyWALL. • The ZyWALL sends a request identity message to the wireless station for identity information.
Page 108: User Authentication
ZyWALL 5 User’s Guide 6.7.1 User Authentication WPA applies IEEE 802.1x and Extensible Authentication Protocol (EAP) to authenticate wireless clients using an external RADIUS database. You can't use the ZyWALL's Local User Database for WPA authentication purposes since the Local User Database uses EAP-MD5 which cannot be used to generate keys.
Page 109: Wpa-Psk Application Example
ZyWALL 5 User’s Guide 6.8 WPA-PSK Application Example A WPA-PSK application looks as follows. 1 First enter identical passwords into the AP and all wireless clients. The Pre-Shared Key (PSK) must consist of between 8 and 63 ASCII characters (including spaces and symbols).
Page 110: Wireless Client Wpa Supplicants
ZyWALL 5 User’s Guide Figure 33 WPA with RADIUS Application Example 6.10 Wireless Client WPA Supplicants A wireless client supplicant is the software that runs on an operating system instructing the wireless client how to use WPA. At the time of writing, the most widely available supplicants are the WPA patch for Windows XP, Funk Software's Odyssey client, and Meetinghouse Data Communications' AEGIS client.
Page 111: Figure 34 Wireless: No Security
ZyWALL 5 User’s Guide Figure 34 Wireless: No Security The following table describes the labels in this screen. Table 24 Wireless: No Security LABEL DESCRIPTION Enable The wireless LAN is turned off by default, before you enable the wireless LAN you Wireless LAN should configure some security by setting MAC filters and/or 802.1x security;...
Page 112: Static Wep
ZyWALL 5 User’s Guide Table 24 Wireless: No Security (continued) LABEL DESCRIPTION Fragmentation This is the threshold (number of bytes) for the fragmentation boundary for directed Threshold messages. It is the maximum data fragment size that can be sent. Select the check box to change the default value and enter a value between 256 and 2432.
Page 113: Wpa-Psk
ZyWALL 5 User’s Guide Figure 35 Wireless: Static WEP The following table describes the wireless LAN security labels in this screen. Table 25 Wireless: Static WEP LABEL DESCRIPTION Security Select Static WEP from the drop-down list. WEP (Wired Equivalent Privacy) provides data encryption to prevent unauthorized Encryption wireless stations from accessing data transmitted over the wireless network.
Page 114: Figure 36 Wireless: Wpa-Psk
ZyWALL 5 User’s Guide Figure 36 Wireless: WPA-PSK The following wireless LAN security fields become available when you select WPA-PSK in the Security drop down list-box. Table 26 Wireless: WPA-PSK LABEL DESCRIPTION Security Select WPA-PSK from the drop-down list. Pre-Shared Key The encryption mechanisms used for WPA and WPA-PSK are the same.
Page 115: Wpa
ZyWALL 5 User’s Guide 6.11.3 WPA Select WPA from the Security list. Figure 37 Wireless: WPA The following wireless LAN security fields become available when you select WPA in the Security drop down list-box. Table 27 Wireless: WPA LABEL DESCRIPTION Security Select WPA from the drop-down list.
Page 116: Dynamic Wep
ZyWALL 5 User’s Guide Table 27 Wireless: WPA (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 6.11.4 802.1x + Dynamic WEP Select 802.1x + Dynamic WEP from the Security list.
Page 117: Static Wep
ZyWALL 5 User’s Guide Table 28 Wireless: 802.1x + Dynamic WEP LABEL DESCRIPTION Authentication Click Local User to go to the Local User Database screen where you can view Databases and/or edit the list of users and passwords. Click RADIUS to go to the RADIUS screen where you can configure the ZyWALL to check an external RADIUS server.
Page 118: No Wep
ZyWALL 5 User’s Guide The following wireless LAN security fields become available when you select 802.1x + Static WEP in the Security drop down list-box.. Table 29 Wireless: 802.1x + Static WEP LABEL DESCRIPTION Security Select 802.1x + Static WEP from the drop-down list.
Page 119: No Access 802.1X + Static Wep
ZyWALL 5 User’s Guide Figure 40 Wireless: 802.1x + No WEP The following table describes the wireless LAN security labels in this screen. Table 30 Wireless: 802.1x + No WEP LABEL DESCRIPTION Security Select 802.1x + No WEP from the drop-down list.
Page 120: Figure 41 Wireless: No Access 802.1X + Static Wep
ZyWALL 5 User’s Guide Figure 41 Wireless: No Access 802.1x + Static WEP The following wireless LAN security fields become available when you select No Access 802.1x + Static WEP in the Security drop down list-box. Table 31 Wireless: No Access 802.1x + Static WEP...
Page 121: No Access 802.1X + No Wep
ZyWALL 5 User’s Guide 6.11.8 No Access 802.1x + No WEP Select No Access 802.1x + No WEP to deny all wireless stations access to your wired network and block all wireless stations from communicating with the ZyWALL. 6.12 Configuring MAC Filter...
Page 122: Table 32 Mac Address Filter
ZyWALL 5 User’s Guide The following table describes the labels in this menu. Table 32 MAC Address Filter LABEL DESCRIPTION Active Select or clear the check box to enable or disable MAC address filtering. Enable MAC address filtering to have the router allow or deny access to wireless stations based on MAC addresses.
Page 123: Wan Screens
ZyWALL 5 User’s Guide H A P T E R WAN Screens This chapter describes how to configure WAN settings. 7.1 WAN Overview A WAN connection is an outside connection to another network or the Internet. 7.1.1 WAN IP Address Assignment Every computer on the Internet must have a unique IP address.
Page 124: Tcp/Ip Priority (Metric)
ZyWALL 5 User’s Guide You can configure the WAN port's MAC address by either using the factory default or cloning the MAC address from a computer on your LAN. Once it is successfully configured, the address will be copied to the "rom" file (ZyNOS configuration file). It will not change unless you change the setting or upload a different "rom"...
Page 125: Figure 43 Route
ZyWALL 5 User’s Guide Figure 43 Route The following table describes the labels in this screen. Table 35 General LABEL DESCRIPTION Route Priority The default WAN connection is "1' as your broadband connection via the WAN port should always be your preferred method of accessing the WAN. The default priority...
Page 126: Configuring Wan Setup
ZyWALL 5 User’s Guide 7.4 Configuring WAN Setup To change your ZyWALL's WAN ISP, IP and MAC settings, click WAN, then the WAN tab. The screen differs by the encapsulation. Note: The warning message "Warning! No NAT rule configured in system" appears in the status bar when NAT is set to use Full Feature address mapping rules, but there are no NAT address mapping rules configured.
Page 127: Table 36 Wan: Ethernet Encapsulation
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 36 WAN: Ethernet Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation You must choose the Ethernet option when the WAN port is used as a regular Ethernet.
Page 128 ZyWALL 5 User’s Guide Table 36 WAN: Ethernet Encapsulation (continued) LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets.
Page 129: Pppoe Encapsulation
ZyWALL 5 User’s Guide 7.4.2 PPPoE Encapsulation The ZyWALL supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection. The PPPoE option is for a dial-up connection using PPPoE.
Page 130: Figure 45 Wan: Pppoe Encapsulation
ZyWALL 5 User’s Guide Figure 45 WAN: PPPoE Encapsulation Chapter 7 WAN Screens...
Page 131: Table 37 Wan: Pppoe Encapsulation
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 37 WAN: PPPoE Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation The PPPoE choice is for a dial-up connection using PPPoE. The router supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (i.e.
Page 132 ZyWALL 5 User’s Guide Table 37 WAN: PPPoE Encapsulation LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Choose Both, None, In Only or Out Only.
Page 133: Pptp Encapsulation
ZyWALL 5 User’s Guide 7.4.3 PPTP Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet.
Page 134: Table 38 Wan: Pptp Encapsulation
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 38 WAN: PPTP Encapsulation LABEL DESCRIPTION ISP Parameters for Internet Access Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks.
Page 135 ZyWALL 5 User’s Guide Table 38 WAN: PPTP Encapsulation LABEL DESCRIPTION RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Choose Both, None, In Only or Out Only.
Page 136: Traffic Redirect
ZyWALL 5 User’s Guide 7.5 Traffic Redirect Traffic redirect forwards WAN traffic to a backup gateway when the ZyWALL cannot connect to the Internet through its normal gateway. Connect the backup gateway on the WAN so that the ZyWALL still provides firewall protection.
Page 137: Configuring Dial Backup
ZyWALL 5 User’s Guide Figure 49 Traffic Redirect The following table describes the labels in this screen. Table 39 Traffic Redirect LABEL DESCRIPTION Active Select this check box to have the ZyWALL use traffic redirect if the normal WAN connection goes down.
Page 138: Figure 50 Dial Backup Setup
ZyWALL 5 User’s Guide Figure 50 Dial Backup Setup Chapter 7 WAN Screens...
Page 139: Table 40 Dial Backup Setup
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 40 Dial Backup Setup LABEL DESCRIPTION Dial Backup Setup Enable Dial Backup Select this check box to turn on dial backup. Basic Settings Login Name Type the login name assigned by your ISP.
Page 140 ZyWALL 5 User’s Guide Table 40 Dial Backup Setup (continued) LABEL DESCRIPTION Enable RIP Select this check box to turn on RIP (Routing Information Protocol), which allows a router to exchange routing information with other routers. RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving).
Page 141: Advanced Modem Setup
ZyWALL 5 User’s Guide Table 40 Dial Backup Setup (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 7.8 Advanced Modem Setup 7.8.1 AT Command Strings For regular telephone lines, the default Dial string tells the modem that the line uses tone dialing.
Page 142: Figure 51 Advanced Setup
ZyWALL 5 User’s Guide Figure 51 Advanced Setup The following table describes the labels in this screen. Table 41 Advanced Setup LABEL DESCRIPTION AT Command Strings Dial Type the AT Command string to make a call. Drop Type the AT Command string to drop a call. "~" represents a one second wait, for example, "~~~+++~~ath"...
Page 143 ZyWALL 5 User’s Guide Table 41 Advanced Setup (continued) LABEL DESCRIPTION Dial Timeout (sec) Type a number of seconds for the ZyWALL to try to set up an outgoing call before timing out (stopping). Retry Count Type a number of times for the ZyWALL to retry a busy or no-answer phone number before blacklisting the number.
Page 144 ZyWALL 5 User’s Guide Chapter 7 WAN Screens...
Page 145: Chapter 8 Dmz Screens
ZyWALL 5 User’s Guide H A P T E R DMZ Screens This chapter describes how to configure the ZyWALL’s DMZ. 8.1 DMZ Overview The DeMilitarized Zone (DMZ) auto-negotiating 10/100 Mbps Ethernet port provides a way for public servers (Web, e-mail, FTP, etc.) to be visible to the outside world (while still being protected from DoS (Denial of Service) attacks such as SYN flooding and Ping of Death).
Page 146: Figure 52 Dmz
ZyWALL 5 User’s Guide From the main menu, click DMZ. The screen appears as shown next. Figure 52 DMZ The following table describes the labels in this screen. Table 42 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address Type the IP address of your ZyWALL’s DMZ port in dotted decimal notation.
Page 147: Configuring Ip Alias
ZyWALL 5 User’s Guide Table 42 DMZ (continued) LABEL DESCRIPTION Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use.
Page 148: Figure 53 Ip Alias
ZyWALL 5 User’s Guide Figure 53 IP Alias The following table describes the labels in this screen. Table 43 IP Alias LABEL DESCRIPTION Enable IP Alias 1, Select the check box to configure another DMZ network for the ZyWALL. IP Address Enter the IP address of your ZyWALL in dotted decimal notation.
Page 149: Dmz Public Ip Address Example
ZyWALL 5 User’s Guide Table 43 IP Alias (continued) LABEL DESCRIPTION RIP Version The RIP Version field controls the format and the broadcasting method of the RIP packets that the ZyWALL sends (it recognizes both formats when receiving). RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Page 150: Dmz Private And Public Ip Address Example
ZyWALL 5 User’s Guide 8.5 DMZ Private and Public IP Address Example The following figure shows a network setup with both private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected computers (A through C) use private IP addresses that are in one subnet.
Page 151: Figure 56 Port Roles
ZyWALL 5 User’s Guide Click DMZ, then Port Roles. The screen appears as shown. Figure 56 Port Roles After you change the LAN/DMZ port roles and click Apply, please wait for few seconds until the following screen appears. Click Return to go back to the Port Roles screen.
Page 152 ZyWALL 5 User’s Guide Chapter 8 DMZ Screens...
Page 153: Chapter 9 Firewalls
ZyWALL 5 User’s Guide H A P T E R Firewalls This chapter gives some background information on firewalls and introduces the ZyWALL firewall. 9.1 Firewall Overview Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another.
Page 154: Stateful Inspection Firewalls
ZyWALL 5 User’s Guide 1 Information hiding prevents the names of internal systems from being made known via DNS to outside systems, since the application gateway is the only host whose name must be made known to outside systems. 2 Robust authentication and logging pre-authenticates application traffic before it reaches internal hosts and causes it to be logged more effectively than if it were logged with standard host logging.
Page 155: Denial Of Service
ZyWALL 5 User’s Guide Figure 58 ZyWALL Firewall Application 9.4 Denial of Service Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources.
Page 156: Types Of Dos Attacks
ZyWALL 5 User’s Guide 9.4.2 Types of DoS Attacks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data.
Page 157: Figure 60 Syn Flood
ZyWALL 5 User’s Guide response. While the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an internal timer (which is set at relatively long intervals) terminates the three-way handshake.
Page 158: Icmp Vulnerability
ZyWALL 5 User’s Guide Figure 61 Smurf Attack 9.4.2.1 ICMP Vulnerability ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert: Table 45 ICMP Commands That Trigger Alerts REDIRECT TIMESTAMP_REQUEST TIMESTAMP_REPLY ADDRESS_MASK_REQUEST ADDRESS_MASK_REPLY 9.4.2.2 Illegal Commands (NetBIOS and SMTP)
Page 159: Traceroute
ZyWALL 5 User’s Guide All SMTP commands are illegal except for those displayed in the following tables. Table 47 Legal SMTP Commands AUTH DATA EHLO ETRN EXPN HELO HELP MAIL NOOP QUIT RCPT RSET SAML SEND SOML TURN VRFY 9.4.2.3 Traceroute Traceroute is a utility used to determine the path a packet takes between two endpoints.
Page 160: Stateful Inspection Process
ZyWALL 5 User’s Guide Figure 62 Stateful Inspection The previous figure shows the ZyWALL’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the LAN and responses to this request are allowed. However other Telnet traffic initiated from the WAN is blocked.
Page 161: Stateful Inspection And The Zywall
ZyWALL 5 User’s Guide temporary entries might be modified, in order to permit only packets that are valid for the current state of the connection. 8 Any additional inbound or outbound packets that belong to the connection are inspected to update the state table entry and to modify the temporary inbound access list entries as required, and are forwarded through the interface.
Page 162: Udp/Icmp Security
ZyWALL 5 User’s Guide If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the Internet. Assuming that this is an acceptable part of the security policy (as is the case with the default policy), the connection will be allowed. A cache entry is added which includes connection information such as IP addresses, TCP ports, sequence numbers, etc.
Page 163: Guidelines For Enhancing Security With Your Firewall
ZyWALL 5 User’s Guide Any protocol that operates in this way must be supported on a case-by-case basis. You can use the web configurator’s Custom Services feature to do this. 9.6 Guidelines For Enhancing Security With Your Firewall 1 Change the default password via SMT or web configurator.
Page 164: Firewall
ZyWALL 5 User’s Guide 9.7.2 Firewall • The firewall inspects packet contents as well as their source and destination addresses. Firewalls of this type employ an inspection module, applicable to all protocols, that understands data in the packet is intended for other layers, from the network layer (IP headers) up to the application layer.
Page 165: Chapter 10 Firewall Screens
ZyWALL 5 User’s Guide H A P T E R Firewall Screens This chapter shows you how to configure your ZyWALL firewall. 10.1 Access Methods The web configurator is, by far, the most comprehensive firewall configuration tool your ZyWALL has to offer. For this reason, it is recommended that you configure your firewall using the web configurator.
Page 166: Rule Logic Overview
ZyWALL 5 User’s Guide This prevents computers on the WAN from using the ZyWALL as a gateway to communicate with other computers on the WAN and/or managing the ZyWALL. • DMZ to LAN • DMZ to DMZ/ZyWALL This prevents computers on the DMZ from communicating between networks or subnets connected to the DMZ interface and/or managing the ZyWALL.
Page 167: Security Ramifications
ZyWALL 5 User’s Guide 10.3.2 Security Ramifications Once the logic of the rule has been defined, it is critical to consider the security ramifications created by the rule: 1 Does this rule stop LAN users from accessing critical resources on the Internet? For...
Page 168: Lan To Wan Rules
ZyWALL 5 User’s Guide LAN to LAN/ZyWALL, WAN to WAN/ZyWALL and DMZ to DMZ/ZyWALL rules apply to packets coming in on the associated interface (LAN, WAN, or DMZ respectively). LAN to LAN/ZyWALL means policies for LAN-to-ZyWALL (the policies for managing the ZyWALL through the LAN interface) and policies for LAN-to-LAN (the policies that control routing between two subnets on the LAN).
Page 169: Alerts
ZyWALL 5 User’s Guide Figure 64 WAN to LAN Traffic 10.5 Alerts Alerts are reports on events, such as attacks, that you may want to know about right away. You can choose to generate an alert when a rule is matched in the Edit Rule screen (see...
Page 170: Figure 65 Default Rule (Router Mode)
ZyWALL 5 User’s Guide Figure 65 Default Rule (Router Mode) The following table describes the labels in this screen. Table 48 Default Rule (Router Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Page 171: Figure 66 Default Rule (Bridge Mode)
ZyWALL 5 User’s Guide Figure 66 Default Rule (Bridge Mode) The following table describes the labels in this screen. Table 49 Default Rule (Bridge Mode) LABEL DESCRIPTION Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.
Page 172: Rule Summary
ZyWALL 5 User’s Guide 10.6.1 Rule Summary Note: The ordering of your rules is very important as rules are applied in turn. Click FIREWALL, then the Rule Summary tab to open the screen. Figure 67 Rule Summary The following table describes the labels in this screen.
Page 173: Configuring Firewall Rules
ZyWALL 5 User’s Guide Table 50 Rule Summary LABEL DESCRIPTION Destination This drop-down list box displays the destination addresses or ranges of addresses to Address which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any.
Page 174: Figure 68 Creating/Editing A Firewall Rule
ZyWALL 5 User’s Guide Figure 68 Creating/Editing A Firewall Rule Chapter 10 Firewall Screens...
Page 175: Table 51 Creating/Editing A Firewall Rule
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 51 Creating/Editing A Firewall Rule LABEL DESCRIPTION Edit Source/ Destination Address Address Type Do you want your rule to apply to packets with a particular (single) IP, a range of IP addresses (e.g., 192.168.1.10 to 192.169.1.50), a subnet or any IP address?
Page 176: Configuring Custom Services
ZyWALL 5 User’s Guide Table 51 Creating/Editing A Firewall Rule LABEL DESCRIPTION Apply Click Apply to save your customized settings and exit this screen. Cancel Click Cancel to exit this screen without saving. 10.6.3 Configuring Custom Services Configure customized ports for services not predefined by the ZyWALL (see Section 10.8 on...
Page 177: Figure 70 Rule Summary
ZyWALL 5 User’s Guide 1 Click the FIREWALL link and then the Rule Summary tab. Select WAN to LAN from the Packet Direction drop-down list box. Figure 70 Rule Summary 2 In the Rule Summary screen, type the index number for where you want to put the rule.
Page 178: Figure 71 Rule Edit Example
ZyWALL 5 User’s Guide Figure 71 Rule Edit Example 6 In the Edit Rule screen, click Add under Custom Service to open the Edit Custom Service screen. Configure it as follows and click Apply. Figure 72 Edit Custom Service Example 7 In the Edit Rule screen, use the arrows between Available Services and Selected Service(s) to configure it as follows.
Page 179: Figure 73 My Service Rule Configuration
ZyWALL 5 User’s Guide Figure 73 My Service Rule Configuration Chapter 10 Firewall Screens...
Page 180: Predefined Services
ZyWALL 5 User’s Guide Figure 74 My Service Example Rule Summary Rule 1: Allows a My Service connection from the WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN. 10.8 Predefined Services The Available Services list box in the Edit Rule screen (see...
Page 181 ZyWALL 5 User’s Guide Table 53 Predefined Services (continued) SERVICE DESCRIPTION FINGER(TCP:79) Finger is a UNIX or Internet related command that can be used to find out if a user is logged on. FTP(TCP:20.21) File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail.
Page 182: Anti-Probing
ZyWALL 5 User’s Guide Table 53 Predefined Services (continued) SERVICE DESCRIPTION RTELNET(TCP:107) Remote Telnet. RTSP(TCP/UDP:554) The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet. SFTP(TCP:115) Simple File Transfer Protocol. SIP-V2(UDP:5060) The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet.
Page 183: Dos Thresholds
ZyWALL 5 User’s Guide Click FIREWALL, then the Anti-Probing tab to open the screen. Figure 75 Anti-Probing The following table describes the labels in this screen. Table 54 Anti-Probing LABEL DESCRIPTION Respond to PING The ZyWALL does not respond to any incoming Ping requests when Disable is selected.
Page 184: Threshold Values
ZyWALL 5 User’s Guide 10.10.1 Threshold Values Tune these parameters when something is not working and after you have checked the firewall counters. These default values should work fine for normal small offices with ADSL bandwidth. Factors influencing choices for threshold values are: 1 The maximum number of opened sessions.
Page 185: Figure 76 Firewall Threshold
ZyWALL 5 User’s Guide Whenever the number of half-open sessions with the same destination host address rises above a threshold (TCP Maximum Incomplete), the ZyWALL starts deleting half-open sessions according to one of the following methods: 1 If the Blocking Time timeout is 0 (the default), then the ZyWALL deletes the oldest existing half-open session for the host for every new connection request to the host.
Page 186 ZyWALL 5 User’s Guide Table 55 Firewall Threshold (continued) LABEL DESCRIPTION One Minute High This is the rate of new half-open sessions that causes the firewall to start deleting half-open sessions. When the rate of new connection attempts rises above this number, the ZyWALL deletes half-open sessions as required to accommodate new connection attempts.
Page 187: Content Filtering Screens
ZyWALL 5 User’s Guide H A P T E R Content Filtering Screens This chapter provides an overview of content filtering. 11.1 Content Filtering Overview Content filtering allows you to block certain web features, such as Cookies, and/or restrict specific websites. With content filtering, you can do the following: 11.1.1 Restrict Web Features...
Page 188: Figure 77 Content Filter : General
ZyWALL 5 User’s Guide Figure 77 Content Filter : General The following table describes the labels in this screen. Table 56 Content Filter : General LABEL DESCRIPTION General Setup Enable Content Filter Select this check box to enable the content filter.
Page 189 ZyWALL 5 User’s Guide Table 56 Content Filter : General LABEL DESCRIPTION Cookies Cookies are files stored on a computer’s hard drive. Some web servers use them to track usage and provide service based on ID. Web Proxy A server that acts as an intermediary between a user and the Internet to provide security, administrative control, and caching service.
Page 190: Content Filtering With An External Database
ZyWALL 5 User’s Guide 11.3 Content Filtering with an External Database When you register for and enable external database content filtering, your ZyWALL accesses an external database that has millions of web sites categorized based on content. You can have the ZyWALL block, block and/or log access to web sites based on these categories.
Page 191: Figure 79 Content Filter : Categories
ZyWALL 5 User’s Guide Figure 79 Content Filter : Categories The following table describes the labels in this screen. Table 57 Content Filter : Categories LABEL DESCRIPTION Auto Category Setup Enable External Database Enable external database content filtering to have the ZyWALL check an...
Page 192 ZyWALL 5 User’s Guide Table 57 Content Filter : Categories (continued) LABEL DESCRIPTION Unrated Web Pages Select Block to prevent users from accessing web pages that the external database content filtering has not categorized. When the external database content filtering blocks access to a web...
Page 193 ZyWALL 5 User’s Guide Table 57 Content Filter : Categories (continued) LABEL DESCRIPTION Alcohol/Tobacco Selecting this category excludes pages that promote or offer the sale alcohol/tobacco products, or provide the means to create them. It also includes pages that glorify, tout, or otherwise encourage the consumption of alcohol/tobacco.
Page 194 ZyWALL 5 User’s Guide Table 57 Content Filter : Categories (continued) LABEL DESCRIPTION Education Selecting this category excludes pages that offer educational information, distance learning and trade school information or programs. It also includes pages that are sponsored by schools, educational facilities, faculty, or alumni groups.
Page 195 ZyWALL 5 User’s Guide Table 57 Content Filter : Categories (continued) LABEL DESCRIPTION News/Media Selecting this category excludes pages that primarily report information or comments on current events or contemporary issues of the day. It also includes radio stations and magazines. It does not include pages that can be rated in other categories.
Page 196 ZyWALL 5 User’s Guide Table 57 Content Filter : Categories (continued) LABEL DESCRIPTION Humor/Jokes Selecting this category excludes pages that primarily focus on comedy, jokes, fun, etc. This may include pages containing jokes of adult or mature nature. Pages containing humorous Adult/Mature content also have an Adult/Mature category rating.
Page 197: Customization
ZyWALL 5 User’s Guide Table 57 Content Filter : Categories (continued) LABEL DESCRIPTION Register Click Register to go to a web site where you can register for category- based content filtering (using an external database). You can use a trial application or register your iCard’s PIN.
Page 198: Figure 80 Content Filter : Customization
ZyWALL 5 User’s Guide Figure 80 Content Filter : Customization The following table describes the labels in this screen. Table 58 Content Filter : Customization LABEL DESCRIPTION Web Site List Customization Enable Web site Select this check box to allow trusted web sites and block forbidden web customization sites.
Page 199 ZyWALL 5 User’s Guide Table 58 Content Filter : Customization (continued) LABEL DESCRIPTION Don't block Java/ActiveX/ When this box is selected, the ZyWALL will permit Java, ActiveX and Cookies/Web proxy to trusted Cookies from sites on the Trusted Web Site list to the LAN. In certain...
Page 200: Customizing Keyword Blocking Url Checking
ZyWALL 5 User’s Guide 11.6 Customizing Keyword Blocking URL Checking You can use commands to set how much of a website’s URL the content filter is to check for keyword blocking. See the appendices for information on how to access and use the command interpreter.
Page 201: Content Filtering Cache
ZyWALL 5 User’s Guide 11.7 Content Filtering Cache To view and configure your ZyWALL’s URL caching, click CONTENT FILTER, then the Cache tab. The screen appears as shown. You can use this screen to configure how long a categorized web site address remains in the cache as well as view those web site addresses to which access has been allowed or blocked based on the responses from the external content filtering server.
Page 202 ZyWALL 5 User’s Guide Table 59 Content Filter : Cache (continued) LABEL DESCRIPTION Flush Click this button to clear all web site addresses from the cache manually. Refresh Click this button to reload the cache. This is the index number of a categorized web site address record.
Page 203: Content Filtering Registration And Reports
ZyWALL 5 User’s Guide H A P T E R Content Filtering Registration and Reports This chapter describes how to register for content filtering and view content filtering reports. Before you activate content filtering, you must create an account at myZyXEL.com and register your device.
Page 204: A Note On Myzyxel.com Numbers
ZyWALL 5 User’s Guide 12.1.1 A Note on myZyXEL.com Numbers You need the following (unique) numbers to register and activate device-specific feature(s). Table 60 myZyXEL.com Numbers TYPES DESCRIPTION Serial Number You need the serial number to register your ZyXEL device. Locate the serial number on your ZyXEL device.
Page 205: Figure 83 Myzyxel.com Account Registration
ZyWALL 5 User’s Guide Figure 83 myZyXEL.com Account Registration 4 A screen appears indicating you have created an account at myZyXEL.com. Figure 84 Account Registration Successful 5 You will receive a confirmation e-mail. Click the URL in the e-mail to activate your account.
Page 206: Registering Your Zyxel Device
ZyWALL 5 User’s Guide Figure 85 Account Confirmation E-Mail 6 Click Continue to go to the myZyXEL.com login screen. Figure 86 myZyXEL.com Account Activation 12.3 Registering Your ZyXEL Device 1 After you have created a myZyXEL.com account, log in and register your ZyXEL device by clicking the hyperlink as shown in the next screen.
Page 207: Figure 87 Logged Into Myzyxel.com
ZyWALL 5 User’s Guide Figure 87 Logged Into myZyXEL.com Click here to register a new product. 2 Click Add in the next screen. Figure 88 Product Registration 3 The Add New Product screen displays. Enter the product serial number in the Serial Number field.
Page 208: Figure 89 Add New Product
ZyWALL 5 User’s Guide Figure 89 Add New Product Your ZyXEL device MAC address may already be entered here. 8 Specify the purchase information and click Continue. Figure 90 Product Survey 9 Click Continue again. 10After you have registered your ZyXEL device, you can view its registration details in the screen shown next.
Page 209: Content Filtering Registration
ZyWALL 5 User’s Guide Figure 91 Service Management 12.4 Content Filtering Registration 1 In your ZyXEL device’s web configurator, click CONTENT FILTER, Categories and then the Register button. The following screen opens. 2 Enter the user name and password from your myZyXEL.com account (se...
Page 210: Figure 93 Myzyxel.com: Service Management
ZyWALL 5 User’s Guide Figure 93 myZyXEL.com: Service Management. 6 Enter the PIN code exactly as shown on your iCard (you do not enter a PIN if you are registering for the trial period) in the License Key (PIN code) field.
Page 211: Checking Content Filtering Activation
ZyWALL 5 User’s Guide Figure 95 Service Registration: Successful Figure 96 Service Management: Service Registered 9 You can go on to update your product registration information, view content filtering reports or click LOGOUT at any time to exit myZyXEL.com. 12.5 Checking Content Filtering Activation After you register for content filtering, the web site displays a registration successful web page.
Page 212: Updating Product Registration Information
ZyWALL 5 User’s Guide 3 Enter a valid URL or IP address of a web site in the Test if Web site is blocked field and click the Test Against Internet Server button. When content filtering is active, you should see an access blocked or access forwarded message.
Page 213: Figure 97 Cerberian Login Screen
ZyWALL 5 User’s Guide Figure 97 Cerberian Login Screen 2 Enter your ZyXEL device's MAC address (in lower case) in the Name field. Type the password that you configured during account registration at myZyXEL.com. 3 Click Reports. Figure 98 Content Filtering Reports Main Screen Note: The ZyWALL does not support Single User Reports at the time of writing.
Page 214: Configuration File
ZyWALL 5 User’s Guide Figure 99 Global Report Screen Example 6 Click a category to see the URLs that were requested. Figure 100 Requested URLs Example 12.8 Configuration File If you restore the ZyWALL to the default rom file or upload a different rom file after you...
Page 215: Chapter 13 Introduction To Ipsec
ZyWALL 5 User’s Guide H A P T E R Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 13.1 VPN Overview A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication.
Page 216: Data Confidentiality
ZyWALL 5 User’s Guide Figure 101 Encryption and Decryption 13.1.3.2 Data Confidentiality The IPSec sender can encrypt packets before transmitting them across a network. 13.1.3.3 Data Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.
Page 217: Ipsec Architecture
ZyWALL 5 User’s Guide 13.2 IPSec Architecture The overall IPSec architecture is shown as follows. Figure 102 IPSec Architecture 13.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure (including implementation algorithms).
Page 218: Transport Mode
ZyWALL 5 User’s Guide Figure 103 Transport and Tunnel Mode IPSec Encapsulation 13.3.1 Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP).
Page 219: Table 61 Vpn And Nat
ZyWALL 5 User’s Guide NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet. When using AH protocol, packet contents (the data payload) are not encrypted.
Page 220 ZyWALL 5 User’s Guide Chapter 13 Introduction to IPSec...
Page 221: Chapter 14 Vpn Screens
ZyWALL 5 User’s Guide H A P T E R VPN Screens This chapter introduces the VPN Web Configurator. See Chapter 23 on page 361 information on viewing logs and Appendix Q on page 639 for IPSec log descriptions. 14.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN connections.
Page 222: My Zywall
ZyWALL 5 User’s Guide Table 62 ESP and AH Encryption DES (default) Data Encryption Standard (DES) is a widely used method of data encryption using a secret key. DES applies a 56-bit key to each 64-bit block of data. 3DES...
Page 223: Dynamic Remote Gateway Address
ZyWALL 5 User’s Guide You can also enter a remote secure gateway’s domain name in the Remote Gateway Address field if the remote secure gateway has a dynamic WAN IP address and is using DDNS. The ZyWALL has to rebuild the VPN tunnel each time the remote secure gateway’s WAN IP address changes (there may be a delay until the DDNS servers are updated with the remote gateway’s new WAN IP address).
Page 224: Nat Traversal Configuration
ZyWALL 5 User’s Guide Figure 104 NAT Router Between IPSec Routers Normally you cannot set up a VPN connection with a NAT router between the two IPSec routers because the NAT router changes the header of the IPSec packet. In the previous figure, IPSec router A sends an IPSec packet in an attempt to initiate a VPN.
Page 225: Id Type And Content Examples
ZyWALL 5 User’s Guide between three encryption algorithms (DES, 3DES and AES), two authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN rule (see Section 14.12.2 on page 235). The ID type and content act as an extra level of identification for incoming SAs.
Page 226: Ike Phases
ZyWALL 5 User’s Guide Table 65 Matching ID Type and Content Configuration Example ZYWALL A ZYWALL B Peer ID type: IP Peer ID type: E-mail Peer ID content: 1.1.1.2 Peer ID content: tom@yourcompany.com The two ZyWALLs in this example cannot complete their negotiation because ZyWALL B’s Local ID type is IP, but ZyWALL A’s Peer ID type is set to E-mail.
Page 227: Negotiation Mode
ZyWALL 5 User’s Guide • Choose an authentication algorithm. • Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2). • Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out. An IKE SA times out when the IKE SA lifetime period expires.
Page 228: Diffie-Hellman (Dh) Key Groups
ZyWALL 5 User’s Guide 14.8.3 Diffie-Hellman (DH) Key Groups Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 - DH1) and 1024-bit (Group 2 –...
Page 229: Icons Key
ZyWALL 5 User’s Guide 14.10 Icons Key The following table describes the icons used in the VPN screens. Table 67 VPN screen Icons Key ICON DESCRIPTION This represents your ZyWALL. This represents the remote secure gateway. This represents the local network.
Page 230: Ike Vpn Rule Summary Screen
ZyWALL 5 User’s Guide Figure 106 Gateway and Network Policies This figure helps explain the main fields in the VPN setup. Figure 107 IPSec Summary Fields Note: Local and remote network IP addresses must be static. 14.12 IKE VPN Rule Summary Screen Click VPN to display the VPN Rules (IKE) screen.
Page 231: Configuring An Ike Gateway Policy
ZyWALL 5 User’s Guide Figure 108 VPN Rules (IKE) Note: The Recycle Bin gateway policy is a virtual placeholder for any network policy(ies) without an associated gateway policy. When there is a network policy in the Recycle Bin, the Recycle Bin gateway policy automatically displays in this screen.
Page 232: Figure 109 Vpn Rules (Ike): Gateway Policy: Edit
ZyWALL 5 User’s Guide Figure 109 VPN Rules (IKE): Gateway Policy: Edit The following table describes the labels in this screen. Table 68 VPN Rules (IKE): Gateway Policy: Edit LABEL DESCRIPTION Property Name Type up to 32 characters to identify this VPN gateway policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 233 ZyWALL 5 User’s Guide Table 68 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION NAT Traversal Select this check box to enable NAT traversal. NAT traversal allows you to set up a VPN connection when there are NAT routers between the two IPSec routers.
Page 234 ZyWALL 5 User’s Guide Table 68 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Local ID Type Select IP to identify this ZyWALL by its IP address. Select DNS to identify this ZyWALL by a domain name. Select E-mail to identify this ZyWALL by an e-mail address.
Page 235 ZyWALL 5 User’s Guide Table 68 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Content The configuration of the peer content depends on the peer ID type. Do the following when you set Authentication Key to Pre-shared Key. •...
Page 236 ZyWALL 5 User’s Guide Table 68 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION User Name Enter a user name for your ZyWALL to be authenticated by the VPN peer (in server mode). The user name can be up to 31 case-sensitive ASCII characters, but spaces are not allowed.
Page 237: Configuring An Ike Network Policy
ZyWALL 5 User’s Guide Table 68 VPN Rules (IKE): Gateway Policy: Edit (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 14.12.2 Configuring an IKE Network Policy...
Page 238: Figure 110 Vpn Rules (Ike): Network Policy Edit
ZyWALL 5 User’s Guide Figure 110 VPN Rules (IKE): Network Policy Edit Chapter 14 VPN Screens...
Page 239: Table 69 Vpn Rules (Ike): Network Policy Edit
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 69 VPN Rules (IKE): Network Policy Edit LABEL DESCRIPTION Active If the Active check box is selected, packets for the tunnel trigger the ZyWALL to build the tunnel.
Page 240 ZyWALL 5 User’s Guide Table 69 VPN Rules (IKE): Network Policy Edit (continued) LABEL DESCRIPTION Starting IP Address When the Address Type field is configured to Single Address, enter a (static) IP address on the LAN behind your ZyWALL. When the Address Type field is configured to Range Address, enter the beginning (static) IP address, in a range of computers on the LAN behind your ZyWALL.
Page 241: Associating A Network Policy To A Gateway Policy
ZyWALL 5 User’s Guide Table 69 VPN Rules (IKE): Network Policy Edit (continued) LABEL DESCRIPTION Authentication MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash Algorithm algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for maximum security.
Page 242: Manual Vpn Rule Summary Screen
ZyWALL 5 User’s Guide Figure 111 VPN Rules (IKE): Network Policy Move The following table describes the labels in this screen. Table 70 VPN Rules (IKE): Network Policy Move LABEL DESCRIPTION Network Policy The following fields display the general network settings of this VPN policy.
Page 243: Figure 112 Vpn Rule (Manual)
ZyWALL 5 User’s Guide Refer to Table 67 on page 227 for descriptions of the icons used in this screen. Figure 112 VPN Rule (Manual) The following table describes the labels in this screen. Table 71 VPN Rules (Manual) LABEL DESCRIPTION This is the VPN policy index number.
Page 244: Security Parameter Index (Spi)
ZyWALL 5 User’s Guide Table 71 VPN Rules (Manual) (continued) LABEL DESCRIPTION Remote Gateway This is the static WAN IP address or domain name of the remote IPSec router. Address Modify Click the edit icon to edit the VPN policy.
Page 245: Figure 113 Vpn Rules (Manual): Edit
ZyWALL 5 User’s Guide Figure 113 VPN Rules (Manual): Edit The following table describes the labels in this screen. Table 72 VPN Rules (Manual) Edit LABEL DESCRIPTION Property Active Select this check box to activate this VPN policy. Name Type up to 32 characters to identify this VPN policy. You may use any character, including spaces, but the ZyWALL drops trailing spaces.
Page 246 ZyWALL 5 User’s Guide Table 72 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION Local Network Local IP addresses must be static and correspond to the remote IPSec router's configured remote IP addresses. Two active SAs cannot have the local and remote IP address(es) both the same.
Page 247 ZyWALL 5 User’s Guide Table 72 VPN Rules (Manual) Edit (continued) LABEL DESCRIPTION My ZyWALL Enter the WAN IP address or domain name of your ZyWALL or leave the field set to 0.0.0.0. The VPN tunnel has to be rebuilt if the My ZyWALL IP address changes after setup.
Page 248: Viewing Sa Monitor
ZyWALL 5 User’s Guide 14.14 Viewing SA Monitor In the web configurator, click VPN and the SA Monitor tab. Use this screen to display and manage active VPN connections. A Security Association (SA) is the group of security settings related to a specific VPN tunnel.
Page 249: Telecommuter Vpn/Ipsec Examples
ZyWALL 5 User’s Guide Figure 115 VPN: Global Setting The following table describes the labels in this screen. Table 74 VPN: Global Setting LABEL DESCRIPTION Output Idle Timer When traffic is sent to a remote IPSec router from which no reply is received after the specified time period, the ZyWALL checks the VPN connectivity.
Page 250: Telecommuters Sharing One Vpn Rule Example
ZyWALL 5 User’s Guide 14.16.1 Telecommuters Sharing One VPN Rule Example See the following figure and table for an example configuration that allows multiple telecommuters (A, B and C in the figure) to use one VPN rule to simultaneously access a ZyWALL at headquarters (HQ in the figure).
Page 251: Figure 117 Telecommuters Using Unique Vpn Rules Example
ZyWALL 5 User’s Guide With aggressive negotiation mode (see Section 14.8.1 on page 225), the ZyWALL can use the ID types and contents to distinguish between VPN rules. Telecommuters can each use a separate VPN rule to simultaneously access a ZyWALL at headquarters. They can use different IPSec parameters.
Page 252: Vpn And Remote Management
ZyWALL 5 User’s Guide Table 76 Telecommuters Using Unique VPN Rules Example TELECOMMUTERS HEADQUARTERS Telecommuter B (telecommuterb.dydns.org) Headquarters ZyWALL 5 Rule 2: Local ID Type: DNS Peer ID Type: DNS Local ID Content: telecommuterb.com Peer ID Content: telecommuterb.com Local IP Address: 192.168.3.2 Remote Gateway Address: telecommuterb.dydns.org...
Page 253: Chapter 15 Certificates
ZyWALL 5 User’s Guide H A P T E R Certificates This chapter gives background information about public-key certificates and explains how to use them. 15.1 Certificates Overview The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs.
Page 254: Advantages Of Certificates
ZyWALL 5 User’s Guide Certification authorities maintain directory servers with databases of valid and revoked certificates. A directory of certificates that have been revoked before the scheduled expiration is called a CRL (Certificate Revocation List). The ZyWALL can check a peer’s certificate against a directory server’s list of revoked certificates.
Page 255: My Certificates
ZyWALL 5 User’s Guide 15.4 My Certificates Click CERTIFICATES, My Certificates to open the ZyWALL’s summary list of certificates and certification requests. Certificates display in black and certification requests display in gray. See the following figure. Figure 119 My Certificates The following table describes the labels in this screen.
Page 256: Certificate File Formats
ZyWALL 5 User’s Guide Table 77 My Certificates (continued) LABEL DESCRIPTION Type This field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request.
Page 257: Importing A Certificate
ZyWALL 5 User’s Guide • Binary X.509: This is an ITU-T recommendation that defines the formats for X.509 certificates. • PEM (Base-64) encoded X.509: This Privacy Enhanced Mail format uses 64 ASCII characters to convert a binary X.509 certificate into a printable form.
Page 258: Creating A Certificate
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 78 My Certificate Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 259: Table 79 My Certificate Create
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 79 My Certificate Create LABEL DESCRIPTION Certificate Name Type up to 31 ASCII characters (not including spaces) to identify this certificate. Subject Information Use these fields to record information that identifies the owner of the certificate.
Page 260: My Certificate Details
ZyWALL 5 User’s Guide Table 79 My Certificate Create (continued) LABEL DESCRIPTION Enrollment Protocol Select the certification authority’s enrollment protocol from the drop-down list box. Simple Certificate Enrollment Protocol (SCEP) is a TCP-based enrollment protocol that was developed by VeriSign and Cisco.
Page 261: Figure 122 My Certificate Details
ZyWALL 5 User’s Guide Figure 122 My Certificate Details Chapter 15 Certificates...
Page 262: Table 80 My Certificate Details
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 80 My Certificate Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this certificate. You may use any character (not including spaces).
Page 263: Trusted Cas
ZyWALL 5 User’s Guide Table 80 My Certificate Details (continued) LABEL DESCRIPTION Subject Alternative This field displays the certificate owner‘s IP address (IP), domain name (DNS) or Name e-mail address (EMAIL). Key Usage This field displays for what functions the certificate’s key can be used. For example, “DigitalSignature”...
Page 264: Figure 123 Trusted Cas
ZyWALL 5 User’s Guide Figure 123 Trusted CAs The following table describes the labels in this screen. Table 81 Trusted CAs LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use.
Page 265: Importing A Trusted Ca's Certificate
ZyWALL 5 User’s Guide Table 81 Trusted CAs (continued) LABEL DESCRIPTION CRL Issuer This field displays Yes if the certification authority issues Certificate Revocation Lists for the certificates that it has issued and you have selected the Issues certificate revocation lists (CRL) check box in the certificate’s details screen to have the ZyWALL check the CRL before trusting any certificates issued by the certification authority.
Page 266: Trusted Ca Certificate Details
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 82 Trusted CA Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 267: Figure 125 Trusted Ca Details
ZyWALL 5 User’s Guide Figure 125 Trusted CA Details The following table describes the labels in this screen. Table 83 Trusted CA Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 268 ZyWALL 5 User’s Guide Table 83 Trusted CA Details (continued) LABEL DESCRIPTION Certification Path Click the Refresh button to have this read-only text box display the end entity’s certificate and a list of certification authority certificates that shows the hierarchy of certification authorities that validate the end entity’s certificate.
Page 269: Trusted Remote Hosts
ZyWALL 5 User’s Guide Table 83 Trusted CA Details (continued) LABEL DESCRIPTION CRL Distribution This field displays how many directory servers with Lists of revoked certificates Points the issuing certification authority of this certificate makes available. This field also displays the domain names or IP addresses of the servers.
Page 270: Figure 126 Trusted Remote Hosts
ZyWALL 5 User’s Guide Figure 126 Trusted Remote Hosts The following table describes the labels in this screen. Table 84 Trusted Remote Hosts LABEL DESCRIPTION PKI Storage This bar displays the percentage of the ZyWALL’s PKI storage space that is Space in Use currently in use.
Page 271: Verifying A Trusted Remote Host's Certificate
ZyWALL 5 User’s Guide Table 84 Trusted Remote Hosts (continued) LABEL DESCRIPTION Import Click Import to open a screen where you can save the certificate of a remote host (which you trust) from your computer to the ZyWALL. Refresh Click this button to display the current validity status of the certificates.
Page 272: Importing A Trusted Remote Host's Certificate
ZyWALL 5 User’s Guide Figure 128 Certificate Details Verify (over the phone for example) that the remote host has the same information in the Thumbprint Algorithm and Thumbprint fields. 15.14 Importing a Trusted Remote Host’s Certificate Click CERTIFICATES, Trusted Remote Hosts to open the Trusted Remote Hosts screen and then click Import to open the Trusted Remote Host Import screen.
Page 273: Trusted Remote Host Certificate Details
ZyWALL 5 User’s Guide Figure 129 Trusted Remote Host Import The following table describes the labels in this screen. Table 85 Trusted Remote Host Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it.
Page 274: Figure 130 Trusted Remote Host Details
ZyWALL 5 User’s Guide Figure 130 Trusted Remote Host Details The following table describes the labels in this screen. Table 86 Trusted Remote Host Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key certificate.
Page 275 ZyWALL 5 User’s Guide Table 86 Trusted Remote Host Details (continued) LABEL DESCRIPTION Refresh Click Refresh to display the certification path. Certificate Information These read-only fields display detailed information about the certificate. Type This field displays general information about the certificate. With trusted remote host certificates, this field always displays CA-signed.
Page 276: Directory Servers
ZyWALL 5 User’s Guide Table 86 Trusted Remote Host Details (continued) LABEL DESCRIPTION Certificate in PEM This read-only text box displays the certificate or certification request in Privacy (Base-64) Encoded Enhanced Mail (PEM) format. PEM uses 64 ASCII characters to convert the Format binary certificate into a printable form.
Page 277: Add Or Edit A Directory Server
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 87 Directory Servers LABEL DESCRIPTION PKI Storage Space This bar displays the percentage of the ZyWALL’s PKI storage space that is in Use currently in use. The bar turns from green to red when the maximum is being approached.
Page 278: Table 88 Directory Server Add
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 88 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name Type up to 31 ASCII characters (spaces are not permitted) to identify this directory server. Access Protocol Use the drop-down list box to select the access protocol used by the directory server.
Page 279: Authentication Server
ZyWALL 5 User’s Guide H A P T E R Authentication Server This chapter discusses how to configure Authentication Server on the ZyWALL. 16.1 Authentication Server Overview A ZyWALL set to be a VPN extended authentication server can use either the local user database internal to the ZyWALL or an external RADIUS server for an unlimited number of users.
Page 280: Figure 133 Local User Database
ZyWALL 5 User’s Guide Figure 133 Local User Database Chapter 16 Authentication Server...
Page 281: Configuring Radius
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 89 Local User Database LABEL DESCRIPTION Active Select this check box to enable the user profile. User Name Enter the user name of the user profile.
Page 282: Table 90 Radius
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 90 RADIUS LABEL DESCRIPTION Authentication Server Active Select the check box to enable user authentication through an external authentication server. Clear the check box to enable user authentication using the local user profile on the ZyWALL.
Page 283: Network Address Translation (Nat)
ZyWALL 5 User’s Guide H A P T E R Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 17.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet.
Page 284: What Nat Does
ZyWALL 5 User’s Guide 17.1.2 What NAT Does In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside local address) to another (the inside global address) before forwarding the packet to the WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.
Page 285: Nat Application
ZyWALL 5 User’s Guide 17.1.4 NAT Application The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using IP Alias) behind the ZyWALL can communicate with three distinct WAN networks. More examples follow at the end of this chapter.
Page 286: Port Restricted Cone Nat
ZyWALL 5 User’s Guide 17.1.5 Port Restricted Cone NAT Port restricted cone NAT maps all outgoing packets from an internal IP address and port to a single IP address and port on the external network. In the following example, the ZyWALL maps the source address of all packets sent from internal IP address 1 and port A to IP address 2 and port B on the external network.
Page 287: Using Nat
ZyWALL 5 User’s Guide • Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world although, it is highly recommended that you use the DMZ port for these servers instead.
Page 288: Configuring Nat Overview
ZyWALL 5 User’s Guide 17.3 Configuring NAT Overview Click NAT to open the NAT Overview screen shown next. Figure 138 NAT Overview The following table describes the labels in this screen. Table 93 NAT Overview LABEL DESCRIPTION NAT Setup Max. Concurrent...
Page 289: Configuring Address Mapping
ZyWALL 5 User’s Guide Table 93 NAT Overview (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 17.4 Configuring Address Mapping Ordering your rules is important because the ZyWALL applies the rules in the order that you specify.
Page 290: Address Mapping Edit
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 94 Address Mapping LABEL DESCRIPTION SUA Address This read-only table displays the default address mapping rules. Mapping Rules Full Feature Address Mapping Rules This is the rule index number.
Page 291: Port Forwarding
ZyWALL 5 User’s Guide Figure 140 Address Mapping Edit The following table describes the labels in this screen. Table 95 Address Mapping Edit LABEL DESCRIPTION Type Choose the port mapping type from one of the following. 1. One-to-One: One-to-one mode maps one local IP address to one global IP address.
Page 292: Default Server Ip Address
ZyWALL 5 User’s Guide You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unknown services or where one server can support more than one service (for example both FTP and web service), it might be better to specify a range of port numbers.
Page 293: Configuring Servers Behind Port Forwarding (Example)
ZyWALL 5 User’s Guide Table 96 Services and Port Numbers SERVICES PORT NUMBER SNMP trap PPTP (Point-to-Point Tunneling Protocol) 1723 17.5.3 Configuring Servers Behind Port Forwarding (Example) Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the example), port 80 to another (B in the example) and assign a default server IP address of 192.168.1.35 to a third (C in the example).
Page 294: Configuring Port Forwarding
ZyWALL 5 User’s Guide Figure 142 Port Translation Example 17.6 Configuring Port Forwarding Note: If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup.
Page 295: Figure 143 Port Forwarding
ZyWALL 5 User’s Guide Figure 143 Port Forwarding The following table describes the labels in this screen. Table 97 Port Forwarding LABEL DESCRIPTION Default Server In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports that are not specified in this screen. If you do not assign a Default Server IP address, the ZyWALL discards all packets received for ports that are not specified here or in the remote management setup.
Page 296: Configuring Trigger Port
ZyWALL 5 User’s Guide Table 97 Port Forwarding LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh. 17.7 Configuring Trigger Port Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side.
Page 297: Figure 145 Port Triggering
ZyWALL 5 User’s Guide 5 Only Jane can connect to the Real Audio server until the connection is closed or times out. The ZyWALL times out in three minutes with UDP (User Datagram Protocol) or two hours with TCP/IP (Transfer Control Protocol/Internet Protocol).
Page 298 ZyWALL 5 User’s Guide Table 98 Port Triggering LABEL DESCRIPTION End Port Type a port number or the ending port number in a range of port numbers. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to begin configuring this screen afresh.
Page 299: Chapter 18 Static Route
ZyWALL 5 User’s Guide H A P T E R Static Route This chapter shows you how to configure static routes for your ZyWALL. 18.1 Static Route Overview Each remote node specifies only the network to which the gateway is directly connected, and the ZyWALL has no knowledge of the networks beyond.
Page 300: Figure 147 Ip Static Route
ZyWALL 5 User’s Guide Figure 147 IP Static Route The following table describes the labels in this screen. Table 99 IP Static Route LABEL DESCRIPTION This is the number of an individual static route. Name This is the name that describes or identifies this route.
Page 301: Configuring A Static Route Entry
ZyWALL 5 User’s Guide Table 99 IP Static Route LABEL DESCRIPTION Gateway This is the IP address of the gateway. The gateway is a router or switch on the same network segment as the device's LAN or WAN port. The gateway helps forward packets to their destinations.
Page 302 ZyWALL 5 User’s Guide Table 100 Edit IP Static Route LABEL DESCRIPTION Metric Metric represents the “cost” of transmission for routing purposes. IP routing uses hop count as the measurement of cost, with a minimum of 1 for directly connected networks.
Page 303: Chapter 19 Bandwidth Management
ZyWALL 5 User’s Guide H A P T E R Bandwidth Management This chapter describes the functions and configuration of bandwidth management. 19.1 Bandwidth Management Overview Bandwidth management allows you to allocate an interface’s outgoing capacity to specific types of traffic. It can also help you make sure that the ZyWALL forwards certain types of traffic (especially real-time applications) with minimum delay.
Page 304: Proportional Bandwidth Allocation
ZyWALL 5 User’s Guide 19.3 Proportional Bandwidth Allocation Bandwidth management allows you to define how much bandwidth each class gets; however, the actual bandwidth allotted to each class decreases or increases in proportion to actual available bandwidth. 19.4 Application-based Bandwidth Management You can create bandwidth classes based on individual applications (like VoIP, Web, FTP, E- mail and Video for example).
Page 305: Scheduler
ZyWALL 5 User’s Guide Table 101 Application and Subnet-based Bandwidth Management Example (continued) TRAFFIC TYPE FROM SUBNET A FROM SUBNET B 64 Kbps 64 Kbps E-mail 64 Kbps 64 Kbps Video 64 Kbps 64 Kbps 19.7 Scheduler The scheduler divides up an interface’s bandwidth among the bandwidth classes. The ZyWALL has two types of scheduler: fairness-based and priority-based.
Page 306: Reserving Bandwidth For Non-Bandwidth Class Traffic
ZyWALL 5 User’s Guide 19.8.1 Reserving Bandwidth for Non-Bandwidth Class Traffic Do the following three steps to configure the ZyWALL to allow bandwidth for traffic that is not defined in a bandwidth filter. 1 Leave some of the interface’s bandwidth unbudgeted.
Page 307: Fairness-Based Allotment Of Unused And Unbudgeted Bandwidth
ZyWALL 5 User’s Guide Suppose that all of the classes except for the administration class need more bandwidth. • Each class gets up to its budgeted bandwidth. The administration class only uses 1024 kbps of its budgeted 2048 kbps. • The sales and marketing are first to get extra bandwidth because they have the highest priority (6).
Page 308: Bandwidth Borrowing Example
ZyWALL 5 User’s Guide 19.9.1 Bandwidth Borrowing Example Here is an example of bandwidth management with classes configured for bandwidth borrowing. The classes are set up based on departments and individuals within certain departments. Table 105 Bandwidth Borrowing Example BANDWIDTH CLASSES AND BANDWIDTH BORROWING SETTINGS...
Page 309: Figure 150 Bandwidth Manager: Summary
ZyWALL 5 User’s Guide Figure 150 Bandwidth Manager: Summary The following table describes the labels in this screen. Table 106 Bandwidth Manager: Summary LABEL DESCRIPTION These read-only labels represent the physical interfaces. Select an interface’s check box to enable bandwidth management on that interface. Bandwidth management applies to all traffic flowing out of the router through the interface, regardless of the traffic’s source.
Page 310: Configuring Class Setup
ZyWALL 5 User’s Guide 19.11 Configuring Class Setup The class setup screen displays the configured bandwidth classes by individual interface. Select an interface and click the buttons to perform the actions described next. Click “+” to expand the class tree or click “-“ to collapse the class tree. Each interface has a permanent root class.
Page 311: Bandwidth Manager Class Configuration
ZyWALL 5 User’s Guide Table 107 Bandwidth Manager: Class Setup (continued) LABEL DESCRIPTION Statistics Click Statistics to display the status of the selected class. Filter List This list displays the bandwidth management filters that are configured for the classes on the selected interface. The ZyWALL applies the bandwidth management filters in the order that they appear here.
Page 312: Figure 152 Bandwidth Manager: Edit Class
ZyWALL 5 User’s Guide Figure 152 Bandwidth Manager: Edit Class The following table describes the labels in this screen. Table 108 Bandwidth Manager: Edit Class LABEL DESCRIPTION Class Configuration Class Name Use the auto-generated name or enter a descriptive name of up to 20 alphanumeric characters, including spaces.
Page 313 ZyWALL 5 User’s Guide Table 108 Bandwidth Manager: Edit Class (continued) LABEL DESCRIPTION Enable Bandwidth Select Enable Bandwidth Filter to have the ZyWALL use this bandwidth filter Filter when it performs bandwidth management. You must enter a value in at least one of the following fields (other than the Subnet Mask fields which are only available when you enter the destination or source IP address).
Page 314: Bandwidth Management Statistics
ZyWALL 5 User’s Guide Table 108 Bandwidth Manager: Edit Class (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. Table 109 Services and Port Numbers SERVICES...
Page 315: Configuring Monitor
ZyWALL 5 User’s Guide Figure 153 Bandwidth Management Statistics The following table describes the labels in this screen. Table 110 Bandwidth Management Statistics LABEL DESCRIPTION Class Name This field displays the name of the class the statistics page is showing.
Page 316: Figure 154 Bandwidth Manager Monitor
ZyWALL 5 User’s Guide Figure 154 Bandwidth Manager Monitor The following table describes the labels in this screen. Table 111 Bandwidth Manager Monitor LABEL DESCRIPTION Interface Select an interface from the drop-down list box to view the bandwidth usage of its bandwidth classes.
Page 317 ZyWALL 5 User’s Guide Chapter 19 Bandwidth Management...
Page 318 ZyWALL 5 User’s Guide Chapter 19 Bandwidth Management...
Page 319: Chapter 20 Dns
ZyWALL 5 User’s Guide H A P T E R This chapter shows you how to configure the DNS screens. 20.1 DNS Overview DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.
Page 320: Address Record
ZyWALL 5 User’s Guide 20.4 Address Record An address record contains the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the top-level domain. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel”...
Page 321: The System Screen
ZyWALL 5 User’s Guide Figure 155 Private DNS Server Example Note: If you do not specify an Intranet DNS server on the remote network, then the VPN host must use IP addresses to access the computers on the remote private network.
Page 322: Adding An Address Record
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 112 System DNS LABEL DESCRIPTION Address Record An address record specifies the mapping of a fully qualified domain name (FQDN) to an IP address. An FQDN consists of a host and domain name and includes the top-level domain.
Page 323: Inserting A Name Server Record
ZyWALL 5 User’s Guide Figure 157 System DNS: Add Address Record The following table describes the labels in this screen. Table 113 System DNS: Add Address Record LABEL DESCRIPTION FQDN Type a fully qualified domain name (FQDN) of a server. An FQDN starts with a host name and continues all the way up to the top-level domain name.
Page 324: Figure 158 System Dns: Insert Name Server Record
ZyWALL 5 User’s Guide Figure 158 System DNS: Insert Name Server Record The following table describes the labels in this screen. Table 114 System DNS: Insert Name Server Record LABEL DESCRIPTION Domain Zone This field is optional. A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain...
Page 325: Dns Cache
ZyWALL 5 User’s Guide 20.7 DNS Cache DNS cache is the temporary storage area where a router stores responses from DNS servers. When the ZyWALL receives a positive or negative response for a DNS query, it records the response in the DNS cache. A positive response means that the ZyWALL received the IP address for a domain name that it checked with a DNS server within the five second DNS timeout period.
Page 326: Configuring Dns Lan
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 115 DNS Cache LABEL DESCRIPTION DNS Cache Setup Cache Positive DNS Select the check box to record the positive DNS resolutions in the cache. Resolutions Caching positive DNS resolutions helps speed up the ZyWALL’s processing of commonly queried domain names and reduces the amount of traffic that the ZyWALL sends out to the WAN.
Page 327: Figure 160 Dns Lan
ZyWALL 5 User’s Guide Figure 160 DNS LAN The following table describes the labels in this screen. Table 116 DNS LAN LABEL DESCRIPTION DNS Servers The ZyWALL passes a DNS (Domain Name System) server IP address (in the Assigned by DHCP order you specify here) to the DHCP clients.
Page 328: Dynamic Dns
ZyWALL 5 User’s Guide 20.10 Dynamic DNS Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change...
Page 329: Figure 161 Ddns
ZyWALL 5 User’s Guide Figure 161 DDNS The following table describes the labels in this screen. Table 117 DDNS LABEL DESCRIPTION Account Setup Active Select this check box to use dynamic DNS. Service Provider This is the name of your Dynamic DNS service provider.
Page 330 ZyWALL 5 User’s Guide Table 117 DDNS LABEL DESCRIPTION IP Address Update Select Use WAN IP Address to have the ZyWALL update the domain name Policy with the WAN port's IP address. Select Use User-Defined and enter the IP address if you have a static IP address.
Page 331: Chapter 21 Remote Management
ZyWALL 5 User’s Guide H A P T E R Remote Management This chapter provides information on the Remote Management screens. 21.1 Remote Management Overview Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers.
Page 332: Remote Management And Nat
ZyWALL 5 User’s Guide 2 A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service. 3 You have disabled that service in one of the remote management screens.
Page 333: Configuring Www
ZyWALL 5 User’s Guide 1 HTTPS connection requests from an SSL-aware web browser go to port 443 (by default) on the ZyWALL’s WS (web server). 2 HTTP connection requests from a web browser go to port 80 (by default) on the ZyWALL’s WS (web server).
Page 334: Figure 163 Www
ZyWALL 5 User’s Guide Figure 163 WWW The following table describes the labels in this screen. Table 118 WWW LABEL DESCRIPTION HTTPS Server Select the Server Certificate that the ZyWALL will use to identify itself. The Certificate ZyWALL is the SSL server and must always authenticate itself to the SSL client (the computer which requests the HTTPS connection with the ZyWALL).
Page 335: Https Example
ZyWALL 5 User’s Guide Table 118 WWW (continued) LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 336: Netscape Navigator Warning Messages
ZyWALL 5 User’s Guide 21.4.2 Netscape Navigator Warning Messages When you attempt to access the ZyWALL HTTPS server, a Website Certified by an Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that the certificate is from the ZyWALL.
Page 337: Login Screen
ZyWALL 5 User’s Guide • The issuing certificate authority of the ZyWALL’s HTTPS server certificate is not one of the browser’s trusted certificate authorities. The issuing certificate authority of the ZyWALL's factory default certificate is the ZyWALL itself since the certificate is a self- signed certificate.
Page 338: Figure 167 Login Screen (Internet Explorer)
ZyWALL 5 User’s Guide Figure 167 Login Screen (Internet Explorer) Figure 168 Login Screen (Netscape) Click Login and you then see the next screen. The factory default certificate is a common default certificate for all ZyWALL models. Chapter 21 Remote Management...
Page 339: Figure 169 Replace Certificate
ZyWALL 5 User’s Guide Figure 169 Replace Certificate Click Apply in the Replace Certificate screen to create a certificate using your ZyWALL’s MAC address that will be specific to this device. Click CERTIFICATES to open the My Certificates screen. You will see information similar to that shown in the following figure.
Page 340: Ssh Overview
ZyWALL 5 User’s Guide Figure 171 Common ZyWALL Certificate 21.5 SSH Overview Unlike Telnet or FTP, which transmit data in clear text, SSH (Secure Shell) is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network.
Page 341: Ssh Implementation On The Zywall
ZyWALL 5 User’s Guide Figure 173 How SSH Works 1 Host Identification The SSH client sends a connection request to the SSH server. The server identifies itself with a host key. The client encrypts a randomly generated session key with the host key and server key and sends the result back to the server.
Page 342: Requirements For Using Ssh
ZyWALL 5 User’s Guide 21.7.1 Requirements for Using SSH You must install an SSH client program on a client computer (Windows or Linux operating system) that is used to connect to the ZyWALL over SSH. 21.8 Configuring SSH To change your ZyWALL’s Secure Shell settings, click REMOTE MGMT, then the SSH tab.
Page 343: Secure Telnet Using Ssh Examples
ZyWALL 5 User’s Guide 21.9 Secure Telnet Using SSH Examples This section shows two examples using a command interface and a graphical interface SSH client program to remotely access the ZyWALL. The configuration and connection steps are similar for most SSH client programs. Refer to your SSH client program user’s guide.
Page 344: Secure Ftp Using Ssh Example
ZyWALL 5 User’s Guide Figure 176 SSH Example 2: Test $ telnet 192.168.1.1 22 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. SSH-1.5-1.0.0 2 Enter “ssh –1 192.168.1.1”. This command forces your computer to connect to the ZyWALL using SSH version 1. If this is the first time you are connecting to the ZyWALL using SSH, a message displays prompting you to save the host information of the ZyWALL.
Page 345: Telnet
ZyWALL 5 User’s Guide Figure 178 Secure FTP: Firmware Upload Example $ sftp -1 192.168.1.1 Connecting to 192.168.1.1... The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established. RSA1 key fingerprint is 21:6c:07:25:7e:f4:75:80:ec:af:bd:d4:3d:80:53:d1. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.1.1' (RSA1) to the list of known...
Page 346: Configuring Ftp
ZyWALL 5 User’s Guide Figure 180 Telnet The following table describes the labels in this screen. Table 120 Telnet LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 347: Configuring Snmp
ZyWALL 5 User’s Guide Figure 181 FTP The following table describes the labels in this screen. Table 121 FTP LABEL DESCRIPTION Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.
Page 348: Figure 182 Snmp Management Model
ZyWALL 5 User’s Guide Figure 182 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyWALL). An agent translates the local management information from the managed device into a form compatible with SNMP.
Page 349: Supported Mibs
ZyWALL 5 User’s Guide 21.14.1 Supported MIBs The ZyWALL supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of the MIBs is to let administrators collect statistical data and monitor status and performance. 21.14.2 SNMP Traps The ZyWALL will send traps to the SNMP manager when any one of the following events...
Page 350 ZyWALL 5 User’s Guide Figure 183 SNMP The following table describes the labels in this screen. Table 123 SNMP LABEL DESCRIPTION SNMP Configuration Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests.
Page 351: Configuring Dns
ZyWALL 5 User’s Guide 21.15 Configuring DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to Chapter 7 on page 121 for more information. To change your ZyWALL’s DNS settings, click REMOTE MGMT, then the DNS tab. The screen appears as shown.
Page 352 ZyWALL 5 User’s Guide Chapter 21 Remote Management...
Page 353: Chapter 22 Upnp
ZyWALL 5 User’s Guide H A P T E R UPnP This chapter introduces the Universal Plug and Play feature. This chapter is only applicable when the ZyWALL is in router mode. 22.1 Universal Plug and Play Overview Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices.
Page 354: Upnp And Zyxel
ZyWALL 5 User’s Guide All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention. 22.2 UPnP and ZyXEL ZyXEL has achieved UPnP certification from the Universal Plug and Play Forum Creates UPnP™...
Page 355: Displaying Upnp Port Mapping
ZyWALL 5 User’s Guide Table 125 Configuring UPnP LABEL DESCRIPTION Enable the Universal Select this checkbox to activate UPnP. Be aware that anyone could use a Plug and Play UPnP application to open the web configurator's login screen without (UPnP) feature entering the ZyWALL's IP address (although you must still enter the password to access the web configurator).
Page 356: Installing Upnp In Windows Example
ZyWALL 5 User’s Guide Table 126 UPnP Ports (continued) LABEL DESCRIPTION Remote Host This field displays the source IP address (on the WAN) of inbound IP packets. Since this is often a wildcard, the field may be blank. When the field is blank, the ZyWALL forwards all traffic sent to the External Port on the WAN interface to the Internal Client on the Internal Port.
Page 357: Installing Upnp In Windows Me
ZyWALL 5 User’s Guide 22.5.1 Installing UPnP in Windows Me Follow the steps below to install UPnP in Windows Me. 1 Click Start, Settings and Control Panel. Double-click Add/Remove Programs. 2 Click on the Windows Setup tab and select Communication in the Components selection box.
Page 358: Installing Upnp In Windows Xp
ZyWALL 5 User’s Guide 22.5.2 Installing UPnP in Windows XP Follow the steps below to install UPnP in Windows XP. 1 Click Start, Settings and Control Panel. 2 Double-click Network Connections. 3 In the Network Connections window, click Advanced in the main menu and select Optional Networking Components ….
Page 359: Auto-Discover Your Upnp-Enabled Network Device
ZyWALL 5 User’s Guide 22.6.1 Auto-discover Your UPnP-enabled Network Device 1 Click Start and Control Panel. Double- click Network Connections. An icon displays under Internet Gateway. 2 Right-click the icon and select Properties. 3 In the Internet Connection Properties You may edit or delete the port mappings or click Add to manually add port mappings.
Page 360: Web Configurator Easy Access
ZyWALL 5 User’s Guide Note: When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically. 4 Select the Show icon in notification area when connected check box and click OK. An icon displays in the system tray.
Page 361 ZyWALL 5 User’s Guide Follow the steps below to access the web configurator. 1 Click Start and then Control Panel. 2 Double-click Network Connections. 3 Select My Network Places under Other Places. 4 An icon with the description for each UPnP-enabled device displays under Local Network.
Page 362 ZyWALL 5 User’s Guide 6 Right-click the icon for your ZyXEL device and select Properties. A properties window displays with basic information about the ZyXEL device. Chapter 22 UPnP...
Page 363: Chapter 23 Logs Screens
ZyWALL 5 User’s Guide H A P T E R Logs Screens This chapter contains information about configuring general log settings and viewing the ZyWALL’s logs. Refer to Appendix Q on page 639 for example log message explanations. 23.1 Configuring View Log The web configurator allows you to look at all of the ZyWALL’s logs in one location.
Page 364: Log Description Example
ZyWALL 5 User’s Guide Figure 187 View Log The following table describes the labels in this screen. Table 127 View Log LABEL DESCRIPTION Display The categories that you select in the Log Settings page (see Section 23.3 on page 363) display in the drop-down list box.
Page 365: Configuring Log Settings
ZyWALL 5 User’s Guide The following is an example of how a log displays in the command line interpreter and a description of the sample log. Refer to the appendices for more log message descriptions and details on using the command line interpreter to display logs.
Page 366: Figure 188 Log Settings
ZyWALL 5 User’s Guide Figure 188 Log Settings Chapter 23 Logs Screens...
Page 367: Table 129 Log Settings
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 129 Log Settings LABEL DESCRIPTION E-mail Log Settings Mail Server Enter the server name or the IP address of the mail server for the e-mail addresses specified below. If this field is left blank, logs and alert messages will not be sent via e-mail.
Page 368: Configuring Reports
ZyWALL 5 User’s Guide Table 129 Log Settings (continued) LABEL DESCRIPTION Active Some logs (such as the Attacks logs) may be so numerous that it becomes easy to ignore other important log messages. Select this check box to merge logs with identical messages into one log.
Page 369: Figure 189 Reports
ZyWALL 5 User’s Guide Figure 189 Reports Note: Enabling the ZyWALL’s reporting function decreases the overall throughput by about 1 Mbps. The following table describes the labels in this screen. Table 130 Reports LABEL DESCRIPTION Collect Statistics Select the check box and click Apply to have the ZyWALL record report data.
Page 370: Viewing Web Site Hits
ZyWALL 5 User’s Guide 23.4.1 Viewing Web Site Hits In the Reports screen, select Web Site Hits from the Report Type drop-down list box to have the ZyWALL record and display which web sites have been visited the most often and how many times they have been visited.
Page 371: Viewing Lan Ip Address
ZyWALL 5 User’s Guide Figure 191 Protocol/Port Report Example The following table describes the labels in this screen. Table 132 Protocol/ Port Report LABEL DESCRIPTION Protocol/Port This column lists the protocols or service ports for which the most traffic has gone through the ZyWALL.
Page 372: Reports Specifications
ZyWALL 5 User’s Guide Figure 192 LAN IP Address Report Example The following table describes the labels in this screen. Table 133 LAN IP Address Report LABEL DESCRIPTION IP Address This column lists the LAN IP addresses to and/or from which the most traffic has been sent.
Page 373: Chapter 24 Maintenance
ZyWALL 5 User’s Guide H A P T E R Maintenance This chapter displays information on the maintenance screens. 24.1 Maintenance Overview The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your ZyWALL.
Page 374: Configuring Password
ZyWALL 5 User’s Guide Figure 193 General Setup The following table describes the labels in this screen. Table 135 General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name” in this field. This name can be up to 30 alphanumeric characters long.
Page 375: Pre-Defined Ntp Time Servers List
ZyWALL 5 User’s Guide Figure 194 Password Setup The following table describes the labels in this screen. Table 136 Password Setup LABEL DESCRIPTION Old Password Type the default password or the existing password you use to access the system in this field.
Page 376: Configuring Time And Date
ZyWALL 5 User’s Guide Table 137 Default Time Servers ntp.cs.strath.ac.uk ntp1.sp.se time1.stupi.se tick.stdtime.gov.tw tock.stdtime.gov.tw time.stdtime.gov.tw 24.5 Configuring Time and Date To change your ZyWALL’s time and date, click MAINTENANCE, then the Time and Date tab. The screen appears as shown. Use this screen to configure the ZyWALL’s time based on your local time zone.
Page 377: Table 138 Time And Date
ZyWALL 5 User’s Guide The following table describes the labels in this screen. Table 138 Time and Date LABEL DESCRIPTION Current Time and Date Current Time This field displays the time of your ZyWALL. Each time you reload this page, the ZyWALL synchronizes the time with the time server.
Page 378: Resetting The Time
ZyWALL 5 User’s Guide Table 138 Time and Date (continued) LABEL DESCRIPTION Start Date Configure the day and time when Daylight Saving Time starts if you selected Enable Daylight Saving. The o'clock field uses the 24 hour format. Here are a...
Page 379: Introduction To Transparent Bridging
ZyWALL 5 User’s Guide Figure 196 Synchronization in Process Click the Return button to go back to the Time and Date screen after the time and date is updated successfully. Figure 197 Synchronization is Successful If the update was not successful, the following screen appears. Click Return to go back to the Time and Date screen.
Page 380: Transparent Firewalls
ZyWALL 5 User’s Guide The bridge gradually builds a host MAC-address-to-port mapping table such as in the following example, during the learning process. Table 139 MAC-address-to-port Mapping Table HOST MAC ADDRESS PORT 00a0c5123456 00a0c5123478 (host A) 1 00a0c512349a 00a0c51234bc 00a0c51234de For example, if a bridge receives a frame via port 1 from host A (MAC address 00a0c5123478), the bridge associates host A with port 1.
Page 381: Configuring Device Mode
ZyWALL 5 User’s Guide Bridging devices are most useful in complex environments that require a rapid or new firewall deployment. A transparent, bridging firewall can also be good for companies with several branch offices since the setups at these offices are often the same and it's likely that one design can be used for many of the networks.
Page 382: Figure 200 Device Mode (Bridge Mode)
ZyWALL 5 User’s Guide Table 140 Device Mode (Router Mode) (continued) LABEL DESCRIPTION Subnet Mask Enter the IP subnet mask of the ZyWALL. Gateway IP Enter the gateway IP address. Address Apply Click Apply to save your changes back to the ZyWALL. After you click Apply, please wait for one minute and use the IP address you configured in the IP Address field to access the ZyWALL again.
Page 383: F/W Upload Screen
ZyWALL 5 User’s Guide Table 141 Device Mode (Bridge Mode) (continued) LABEL DESCRIPTION DHCP Server DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients (computers) to obtain TCP/IP configuration at startup from a server. Unless you are instructed by your ISP, leave the DHCP Server check box selected.
Page 384: Figure 201 Firmware Upload
ZyWALL 5 User’s Guide Figure 201 Firmware Upload The following table describes the labels in this screen. Table 142 Firmware Upload LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse ... to find it.
Page 385: Configuration Screen
ZyWALL 5 User’s Guide Figure 203 Network Temporarily Disconnected After two minutes, log in again and check your new firmware version in the System Status screen. If the upload was not successful, the following screen will appear. Click Return to go back to the F/W Upload screen.
Page 386: Backup Configuration
ZyWALL 5 User’s Guide Figure 205 Configuration 24.10.1 Backup Configuration Backup Configuration allows you to back up (save) the ZyWALL’s current configuration to a file on your computer. Once your ZyWALL is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes.
Page 387: Figure 206 Configuration Upload Successful
ZyWALL 5 User’s Guide Note: Do not turn off the ZyWALL while configuration file upload is in progress. After you see a “restore configuration successful” screen, you must then wait one minute before logging into the ZyWALL again. Figure 206 Configuration Upload Successful The ZyWALL automatically restarts in this time causing a temporary network disconnect.
Page 388: Back To Factory Defaults
ZyWALL 5 User’s Guide Figure 208 Configuration Upload Error 24.10.3 Back to Factory Defaults Pressing the Reset button in this section clears all user-entered configuration information and returns the ZyWALL to its factory defaults as shown on the screen. The following warning screen will appear.
Page 389: Figure 210 Restart Screen
ZyWALL 5 User’s Guide Figure 210 Restart Screen Chapter 24 Maintenance...
Page 390 ZyWALL 5 User’s Guide Chapter 24 Maintenance...
Page 391: Chapter 25 Introducing The Smt
ZyWALL 5 User’s Guide H A P T E R Introducing the SMT This chapter explains how to access the System Management Terminal and gives an overview of its menus. 25.1 Introduction to the SMT The ZyWALL’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.
Page 392: Entering The Password
ZyWALL 5 User’s Guide Figure 211 Initial Screen Copyright (c) 1994 - 2005 ZyXEL Communications Corp. initialize ch =0, ethernet address: 00:A0:C5:01:23:45 initialize ch =1, ethernet address: 00:A0:C5:01:23:46 initialize ch =2, ethernet address: 00:A0:C5:01:23:47 initialize ch =3, ethernet address: 00:A0:C5:01:23:48 initialize ch =4, ethernet address: 00:00:00:00:00:00 AUX port init .
Page 393: Main Menu
ZyWALL 5 User’s Guide Table 144 Main Menu Commands OPERATION KEYSTROKES DESCRIPTION Move to a Press [SPACE Fields beginning with “Edit” lead to hidden menus and have a “hidden” BAR] to change No default setting of No. Press [SPACE BAR] to change No to Yes,...
Page 394: Figure 213 Main Menu (Router Mode)
ZyWALL 5 User’s Guide Figure 213 Main Menu (Router Mode) Copyright (c) 1994 - 2005 ZyXEL Communications Corp. ZyWALL 5 Main Menu Getting Started Advanced Management 1. General Setup 21. Filter and Firewall Setup 2. WAN Setup 22. SNMP Configuration 3.
Page 395: Smt Menus Overview
ZyWALL 5 User’s Guide Table 145 Main Menu Summary NO. MENU TITLE FUNCTION LAN Setup Use this menu to apply LAN filters, configure LAN DHCP and TCP/IP settings and configure the wireless LAN port. Internet Access Setup Configure your Internet Access setup (Internet address, gateway, login, etc.) with this menu.
Page 396 ZyWALL 5 User’s Guide Table 146 SMT Menus Overview (continued) MENUS SUB MENUS 11 Remote Node Setup 11.1 Remote Node Profile 11.1.2 Remote Node Network Layer Options 11.1.4 Remote Node Filter 11.1.5 Traffic Redirect Setup 11.2 Remote Node Profile 11.2.1 Remote Node PPP...
Page 397: Changing The System Password
ZyWALL 5 User’s Guide Table 146 SMT Menus Overview (continued) MENUS SUB MENUS 24 System Maintenance 24.1 System Status 24.2 System Information and 24.2.1 System Information Console Port Speed 24.2.2 Console Port Speed 24.3 Log and Trace 24.3.1 View Error Log 24.3.2 Syslog Logging...
Page 398: Resetting The Zywall
ZyWALL 5 User’s Guide 3 Type your new system password and press [ENTER]. 4 Re-type your new system password for confirmation and press [ENTER]. Note that as you type a password, the screen displays an “x” for each character you type.
Page 399: Smt Menu 1 - General Setup
ZyWALL 5 User’s Guide H A P T E R SMT Menu 1 - General Setup Menu 1 - General Setup contains administrative and system-related information. 26.1 Introduction to General Setup Menu 1 - General Setup contains administrative and system-related information.
Page 400: Figure 217 Menu 1: General Setup (Bridge Mode)
ZyWALL 5 User’s Guide Table 147 Menu 1: General Setup (Router Mode) (continued) FIELD DESCRIPTION Edit Dynamic Press [SPACE BAR] and then [ENTER] to select Yes or No (default). Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next.
Page 401: Configuring Dynamic Dns
ZyWALL 5 User’s Guide 26.2.1 Configuring Dynamic DNS To configure Dynamic DNS, set the ZyWALL to router mode in menu 1 or in the MAINTENANCE Device Mode screen and go to Menu 1 - General Setup and press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1 - Configure Dynamic DNS (shown next).
Page 402: Figure 219 Menu 1.1.1: Ddns Host Summary
ZyWALL 5 User’s Guide 4 Press [SPACE BAR] and then [ENTER] to select Yes in the Edit Host field. Press [ENTER] to display Menu 1.1.1 - DDNS Host Summary. Figure 219 Menu 1.1.1: DDNS Host Summary Menu 1.1.1 DDNS Host Summary...
Page 403: Figure 220 Menu 1.1.1: Ddns Edit Host
ZyWALL 5 User’s Guide Figure 220 Menu 1.1.1: DDNS Edit Host Menu 1.1.1 - DDNS Edit Host Hostname= ZyWALL DDNS Type= DynamicDNS Enable Wildcard Option= Yes Enable Off Line Option= N/A IP Address Update Policy: Let DDNS Server Auto Detect= Yes...
Page 404 ZyWALL 5 User’s Guide Table 151 Menu 1.1.1: DDNS Edit Host (continued) FIELD DESCRIPTION Use WAN IP Enter the static public IP address if you select Yes in the Use User-Defined field. Address When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.
Page 405: Wan And Dial Backup Setup
ZyWALL 5 User’s Guide H A P T E R WAN and Dial Backup Setup This chapter describes how to configure the WAN using menu 2 and dial-backup using menus 2.1 and 11.1. 27.1 Introduction to WAN and Dial Backup Setup This chapter explains how to configure settings for your WAN port and how to configure the ZyWALL for a dial backup connection.
Page 406: Dial Backup
ZyWALL 5 User’s Guide The following table describes the fields in this screen. Table 152 MAC Address Cloning in WAN Setup FIELD DESCRIPTION MAC Address Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods to assign a MAC Address.
Page 407: Advanced Wan Setup
ZyWALL 5 User’s Guide Figure 222 Menu 2: Dial Backup Setup Menu 2 - WAN Setup MAC Address: Assigned By= Factory default IP Address= N/A Dial-Backup: Active= No Port Speed= 115200 AT Command String: Init= at&fs0=0 Edit Advanced Setup= No Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu.
Page 408: Figure 223 Menu 2.1: Advanced Wan Setup
ZyWALL 5 User’s Guide To edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in Menu 2 - WAN Setup, press the [SPACE BAR] to select Yes and then press [ENTER].
Page 409: Remote Node Profile (Backup Isp)
ZyWALL 5 User’s Guide Table 155 Advanced WAN Port Setup: Call Control Parameters FIELD DESCRIPTION Call Control Dial Timeout (sec) Enter a number of seconds for the ZyWALL to keep trying to set up an outgoing call before timing out (stopping). The ZyWALL times out and stops if it cannot set up an outgoing call within the timeout value.
Page 410: Table 156 Menu 11.3: Remote Node Profile (Backup Isp)
ZyWALL 5 User’s Guide The following table describes the fields in this menu. Table 156 Menu 11.3: Remote Node Profile (Backup ISP) FIELD DESCRIPTION Rem Node Enter a descriptive name for the remote node. This field can be up to eight characters.
Page 411: Editing Ppp Options
ZyWALL 5 User’s Guide Table 156 Menu 11.3: Remote Node Profile (Backup ISP) (continued) FIELD DESCRIPTION Idle Timeout Enter the number of seconds of idle time (when there is no traffic from the ZyWALL to the remote node) that can elapse before the ZyWALL automatically disconnects the PPP connection.
Page 412: Figure 226 Menu 11.2.2: Remote Node Network Layer Options
ZyWALL 5 User’s Guide Figure 226 Menu 11.2.2: Remote Node Network Layer Options Menu 11.2.2 - Remote Node Network Layer Options IP Address Assignment= Static Rem IP Addr= 0.0.0.0 Rem Subnet Mask= 0.0.0.0 My WAN Addr= 0.0.0.0 Network Address Translation= SUA Only...
Page 413: Editing Login Script
ZyWALL 5 User’s Guide Table 158 Menu 11.3.2: Remote Node Network Layer Options FIELD DESCRIPTION Private This parameter determines if the ZyWALL will include the route to this remote node in its RIP broadcasts. If set to Yes, this route is kept private and not included in RIP broadcasts.
Page 414: Figure 227 Menu 11.2.3: Remote Node Script
ZyWALL 5 User’s Guide Please note that the ordering of the sets is significant, i.e., starting from set 1, the ZyWALL will wait until the ‘Expect’ string is matched before it proceeds to set 2, and so on for the rest of the script.
Page 415: Remote Node Filter
ZyWALL 5 User’s Guide 27.10 Remote Node Filter Move the cursor to the field Edit Filter Sets in menu 11.2, and then press [SPACE BAR] to set the value to Yes. Press [ENTER] to open Menu 11.2.4 - Remote Node Filter Use menu 11.2.4 to specify the filter set(s) to apply to the incoming and outgoing traffic...
Page 416 ZyWALL 5 User’s Guide Chapter 27 WAN and Dial Backup Setup...
Page 417: Chapter 28 Lan Setup
ZyWALL 5 User’s Guide H A P T E R LAN Setup This chapter describes how to configure the LAN using Menu 3 - LAN Setup. 28.1 Introduction to LAN Setup This chapter describes how to configure the ZyWALL for LAN and wireless LAN connections.
Page 418: Tcp/Ip And Dhcp Ethernet Setup Menu
ZyWALL 5 User’s Guide Figure 230 Menu 3.1: LAN Port Filter Setup Menu 3.1 - LAN Port Filter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ESC to Cancel: 28.4 TCP/IP and DHCP Ethernet Setup Menu...
Page 419: Figure 232 Menu 3.2: Tcp/Ip And Dhcp Ethernet Setup
ZyWALL 5 User’s Guide Figure 232 Menu 3.2: TCP/IP and DHCP Ethernet Setup Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server TCP/IP Setup: Client IP Pool: Starting Address= 192.168.1.33 IP Address= 192.168.1.1 Size of Client IP Pool= 128 IP Subnet Mask= 255.255.255.0...
Page 420: Table 161 Menu 3.2: Lan Tcp/Ip Setup Fields
ZyWALL 5 User’s Guide Table 160 Menu 3.2: DHCP Ethernet Setup Fields FIELD DESCRIPTION First DNS Server The ZyWALL passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients. Second DNS...
Page 421: Ip Alias Setup
ZyWALL 5 User’s Guide 28.4.1 IP Alias Setup IP alias allows you to partition a physical network into different logical networks over the same Ethernet interface. The ZyWALL supports three logical LAN interfaces via its single physical Ethernet interface with the ZyWALL itself as the gateway for each LAN network.
Page 422: Wireless Lan Setup
ZyWALL 5 User’s Guide Table 162 Menu 3.2.1: IP Alias Setup (continued) FIELD DESCRIPTION Outgoing Enter the filter set(s) you wish to apply to the outgoing traffic between this node and Protocol Filters the ZyWALL. When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.
Page 423: Mac Address Filter Setup
ZyWALL 5 User’s Guide Follow the instructions in the next table on how to configure the wireless LAN parameters. Table 163 Menu 3.5: Wireless LAN Setup FIELD DESCRIPTION Enable Press [SPACE BAR] to select Yes to turn on the wireless LAN. The wireless LAN is off Wireless LAN by default.
Page 424: Figure 235 Menu 3.5.1: Wlan Mac Address Filter
ZyWALL 5 User’s Guide Follow the steps below to create the MAC address table on your ZyWALL. 1 From the main menu, enter 3 to open Menu 3 - LAN Setup. 2 Enter 5 to display Menu 3.5 - Wireless LAN Setup.
Page 425: Chapter 29 Internet Access
ZyWALL 5 User’s Guide H A P T E R Internet Access This chapter shows you how to configure your ZyWALL for Internet access. 29.1 Introduction to Internet Access Setup Use information from your ISP along with the instructions in this chapter to set up your ZyWALL to access the Internet.
Page 426: Table 165 Menu 4: Internet Access Setup (Ethernet)
ZyWALL 5 User’s Guide The following table describes the fields in this menu. Table 165 Menu 4: Internet Access Setup (Ethernet) FIELD DESCRIPTION ISP’s Name This is the descriptive name of your ISP for identification purposes. Encapsulation Press [SPACE BAR] and then press [ENTER] to choose Ethernet. The encapsulation method influences your choices for the IP Address field.
Page 427: Configuring The Pptp Client
ZyWALL 5 User’s Guide 29.3 Configuring the PPTP Client Note: The ZyWALL supports only one PPTP server connection at any given time. To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.
Page 428: Basic Setup Complete
ZyWALL 5 User’s Guide Figure 238 Internet Access Setup (PPPoE) Menu 4 - Internet Access Setup ISP's Name= WAN_1 Encapsulation= PPPoE Service Type= N/A My Login= My Password= ******** Retype to Confirm= ******** Idle Timeout= 100 IP Address Assignment= Dynamic...
Page 429: Dmz Setup
ZyWALL 5 User’s Guide H A P T E R DMZ Setup This chapter describes how to configure the ZyWALL’s DMZ using Menu 5 - DMZ Setup. 30.1 Configuring DMZ Setup From the main menu, enter 5 to open Menu 5 – DMZ Setup.
Page 430: Ip Address
ZyWALL 5 User’s Guide 30.3.1 IP Address From the main menu, enter 5 to open Menu 5 - DMZ Setup to configure TCP/IP (RFC 1155). Figure 241 Menu 5: TCP/IP Setup Menu 5 - DMZ Setup 1. DMZ Port Filter Setup 2.
Page 431: Figure 243 Menu 5.2.1: Ip Alias Setup
ZyWALL 5 User’s Guide Figure 243 Menu 5.2.1: IP Alias Setup Menu 5.2.1 - IP Alias Setup IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A...
Page 432 ZyWALL 5 User’s Guide Chapter 30 DMZ Setup...
Page 433: Chapter 31 Remote Node Setup
ZyWALL 5 User’s Guide H A P T E R Remote Node Setup This chapter shows you how to configure a remote node. 31.1 Introduction to Remote Node Setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection.
Page 434: Ethernet Encapsulation
ZyWALL 5 User’s Guide 31.3.1 Ethernet Encapsulation There are three variations of menu 11.1 depending on whether you choose Ethernet Encapsulation, PPPoE Encapsulation or PPTP Encapsulation. You must choose the Ethernet option when the WAN port is used as a regular Ethernet. The first menu 11.1 screen you see is for Ethernet encapsulation shown next.
Page 435: Pppoe Encapsulation
ZyWALL 5 User’s Guide Table 168 Menu 11.1: Remote Node Profile for Ethernet Encapsulation (continued) FIELD DESCRIPTION Server This field is valid only when RoadRunner is selected in the Service Type field. The ZyWALL will find the RoadRunner Server IP automatically if this field is left blank. If it does not, then you must enter the authentication server IP address here.
Page 436: Outgoing Authentication Protocol
ZyWALL 5 User’s Guide Figure 246 Menu 11.1: Remote Node Profile for PPPoE Encapsulation Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPPoE Edit IP= No Service Type= Standard Telco Option: Service Name=...
Page 437: Pptp Encapsulation
ZyWALL 5 User’s Guide Table 169 Fields in Menu 11.1 (PPPoE Encapsulation Specific) FIELD DESCRIPTION Service Name If you are using PPPoE encapsulation, then type the name of your PPPoE service here. Only valid with PPPoE encapsulation. Authen This field sets the authentication protocol used for outgoing calls.
Page 438: Edit Ip
ZyWALL 5 User’s Guide Figure 247 Menu 11.1: Remote Node Profile for PPTP Encapsulation Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Service Name= N/A...
Page 439: Figure 248 Menu 11.1.2: Remote Node Network Layer Options For Ethernet Encapsulation
ZyWALL 5 User’s Guide Figure 248 Menu 11.1.2: Remote Node Network Layer Options for Ethernet Encapsulation Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= SUA Only...
Page 440: Remote Node Filter
ZyWALL 5 User’s Guide Table 171 Remote Node Network Layer Options Menu Fields (continued) FIELD DESCRIPTION Metric Enter a number from 1 to 15 to set this route’s priority among the ZyWALL’s routes (see Section 7.2 on page 122 Chapter 7 on page 121) The smaller the number, the higher priority the route has.
Page 441: Traffic Redirect
ZyWALL 5 User’s Guide Figure 249 Menu 11.1.4: Remote Node Filter (Ethernet Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 250 Menu 11.1.4: Remote Node Filter (PPPoE or PPTP Encapsulation)
Page 442: Figure 251 Menu 11.1.5: Traffic Redirect Setup
ZyWALL 5 User’s Guide Figure 251 Menu 11.1.5: Traffic Redirect Setup Menu 11.1.5 - Traffic Redirect Setup Active= Yes Configuration: Backup Gateway IP Address= 0.0.0.0 Metric= 14 Check WAN IP Address= 0.0.0.0 Fail Tolerance= 10 Period(sec)= 300 Timeout(sec)= 8 Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu.
Page 443: Chapter 32 Ip Static Route Setup
ZyWALL 5 User’s Guide H A P T E R IP Static Route Setup This chapter shows you how to configure static routes with your ZyWALL. 32.1 IP Static Route Setup Enter 12 from the main menu. Select one of the IP static routes as shown next to configure IP static routes in menu 12.1.
Page 444: Figure 253 Menu 12. 1: Edit Ip Static Route
ZyWALL 5 User’s Guide Figure 253 Menu 12. 1: Edit IP Static Route Menu 12.1 - Edit IP Static Route Route #: 3 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ?
Page 445: Network Address Translation (Nat)
ZyWALL 5 User’s Guide H A P T E R Network Address Translation (NAT) This chapter discusses how to configure NAT on the ZyWALL. 33.1 Using NAT Note: You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the ZyWALL.
Page 446: Figure 254 Menu 4: Applying Nat For Internet Access
ZyWALL 5 User’s Guide Figure 254 Menu 4: Applying NAT for Internet Access Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A...
Page 447: Nat Setup
ZyWALL 5 User’s Guide The following table describes the fields in this menu. Table 174 Applying NAT in Menus 4 & 11.1.2 FIELD DESCRIPTION OPTIONS Network When you select this option the SMT will use Address Mapping Set 1 Full Feature Address (menu 15.1 - see...
Page 448: Sua Address Mapping Set
ZyWALL 5 User’s Guide Figure 257 Menu 15.1: Address Mapping Sets Menu 15.1 - Address Mapping Sets 1. NAT_SET 255. SUA (read only) Enter Menu Selection Number: 33.2.1.1 SUA Address Mapping Set Enter 255 to display the next screen (see also Section 33.1.1 on page...
Page 449: User-Defined Address Mapping Sets
ZyWALL 5 User’s Guide Table 175 SUA Address Mapping Rules FIELD DESCRIPTION Local End IP Local End IP is the ending local IP address (ILA). If the rule is for all local IPs, then the start IP is 0.0.0.0 and the end IP is 255.255.255.255.
Page 450: Ordering Your Rules
ZyWALL 5 User’s Guide 33.2.1.3 Ordering Your Rules Ordering your rules is important because the ZyWALL applies the rules in the order that you specify. When a rule matches the current packet, the ZyWALL takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty rules.
Page 451: Configuring A Server Behind Nat
ZyWALL 5 User’s Guide Figure 260 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= = N/A Global IP: Start= = N/A Server Mapping Set = N/A Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this menu.
Page 452: Figure 261 Menu 15.2.X: Nat Server Configuration
ZyWALL 5 User’s Guide Follow these steps to configure a server behind NAT: 1 Enter 15 in the main menu to go to Menu 15 - NAT Setup. 2 Enter 2 to go to Menu 15.2 - NAT Server Setup and configure the address mapping rules for the WAN port.
Page 453: Figure 262 Menu 15.2: Nat Server Setup
ZyWALL 5 User’s Guide 5 Enter the inside IP address of the server in the IP Address field. In the following figure, you have a computer acting as an FTP, Telnet and SMTP server (ports 21, 23 and 25) at 192.168.1.33.
Page 454: General Nat Examples
ZyWALL 5 User’s Guide 33.4 General NAT Examples The following are some examples of NAT configuration. 33.4.1 Internet Access Only In the following Internet access example, you only need one rule where all your ILAs (Inside Local addresses) map to one dynamic IGA (Inside Global Address) assigned by your ISP.
Page 455: Example 2: Internet Access With An Default Server
ZyWALL 5 User’s Guide 33.4.2 Example 2: Internet Access with an Default Server Figure 266 NAT Example 2 In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2 to specify the Default Server behind the NAT as shown in the next figure.
Page 456: Figure 268 Nat Example 3
ZyWALL 5 User’s Guide 1 Map the first IGA to the first inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses). 2 Map the second IGA to our second inside FTP server for FTP traffic in both directions (1 : 1 mapping, giving both local and global IP addresses).
Page 457: Figure 269 Example 3: Menu 11.1.2
ZyWALL 5 User’s Guide Figure 269 Example 3: Menu 11.1.2 Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= SUA Only Metric= 2...
Page 458: Figure 271 Example 3: Final Menu 15.1.1
ZyWALL 5 User’s Guide Figure 271 Example 3: Final Menu 15.1.1 Menu 15.1.1 - Address Mapping Rules Set Name= Example3 Local Start IP Local End IP Global Start IP Global End IP Type --------------- -------------- --------------- --------------- 1. 192.168.1.10 10.132.50.1 192.168.1.11...
Page 459: Example 4: Nat Unfriendly Application Programs
ZyWALL 5 User’s Guide Figure 272 Example 3: Menu 15.2 Menu 15.2 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address ------------------------------------------------------ 192.168.1.21 192.168.1.20 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 Select Command= None...
Page 460: Figure 274 Example 4: Menu 15.1.1.1: Address Mapping Rule
ZyWALL 5 User’s Guide Figure 274 Example 4: Menu 15.1.1.1: Address Mapping Rule Menu 15.1.1.1 Address Mapping Rule Type= Many-One-to-One Local IP: Start= 192.168.1.10 = 192.168.1.12 Global IP: Start= 10.132.50.1 = 10.132.50.3 Press ENTER to Confirm or ESC to Cancel: After you’ve configured your rule, you should be able to check the settings in menu 15.1.1 as...
Page 461: Trigger Port Forwarding
ZyWALL 5 User’s Guide 33.5 Trigger Port Forwarding Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side. With regular port forwarding you set a forwarding port in NAT to forward a service (coming in from the server on the WAN) to the IP address of a computer on the client side (LAN).
Page 462: Figure 276 Menu 15.3: Trigger Port Setup
ZyWALL 5 User’s Guide Figure 276 Menu 15.3: Trigger Port Setup Menu 15.3 - Trigger Port Setup Incoming Trigger Rule Name Start Port End Port Start Port End Port ----------------------------------------------------------------- Real Audio 6970 7170 7070 7070 Press ENTER to Confirm or ESC to Cancel:...
Page 463: Introducing The Zywall Firewall
ZyWALL 5 User’s Guide H A P T E R Introducing the ZyWALL Firewall This chapter shows you how to get started with the ZyWALL firewall. 34.1 Using ZyWALL SMT Menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown next.
Page 464: Figure 278 Menu 21.2: Firewall Setup
ZyWALL 5 User’s Guide Figure 278 Menu 21.2: Firewall Setup Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off.
Page 465: Filter Configuration
ZyWALL 5 User’s Guide H A P T E R Filter Configuration This chapter shows you how to create and apply filters. 35.1 Introduction to Filters Your ZyWALL uses filters to decide whether to allow passage of a data packet and/or to make a call.
Page 466: The Filter Structure Of The Zywall
ZyWALL 5 User’s Guide 35.1.1 The Filter Structure of the ZyWALL A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descriptive name. The ZyWALL allows you to configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system.
Page 467: Figure 280 Filter Rule Process
ZyWALL 5 User’s Guide Figure 280 Filter Rule Process You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.
Page 468: Configuring A Filter Set
ZyWALL 5 User’s Guide 35.2 Configuring a Filter Set The ZyWALL includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below. 1 Enter 21 in the main menu to open menu 21.
Page 469: Configuring A Filter Rule
ZyWALL 5 User’s Guide Table 180 Abbreviations Used in the Filter Rules Summary Menu FIELD DESCRIPTION Active: “Y” means the rule is active. “N” means the rule is inactive. Type The type of filter rule: “GEN” for Generic, “IP” for TCP/IP.
Page 470: Configuring A Tcp/Ip Filter Rule
ZyWALL 5 User’s Guide To speed up filtering, all rules in a filter set must be of the same class, i.e., protocol filters or generic filters. The class of a filter set is determined by the first rule that you create. When applying the filter sets to a port, separate menu fields are provided for protocol and device filter sets.
Page 471 ZyWALL 5 User’s Guide Table 182 Menu 21.1.1.1: TCP/IP Filter Rule FIELD DESCRIPTION Destination IP Addr Enter the destination IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0. IP Mask Enter the IP mask to apply to the Destination: IP Addr.
Page 472: Configuring A Generic Filter Rule
ZyWALL 5 User’s Guide Figure 284 Executing an IP Filter 35.2.3 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. The purpose of generic rules is Chapter 35 Filter Configuration...
Page 473: Figure 285 Menu 21.1.1.1: Generic Filter Rule
ZyWALL 5 User’s Guide to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly. For generic rules, the ZyWALL treats a packet as a byte stream as opposed to an IP or IPX packet.
Page 474: Example Filter
ZyWALL 5 User’s Guide Table 183 Generic Filter Rule Menu Fields FIELD DESCRIPTION More If Yes, a matching packet is passed to the next filter rule before an action is taken; else the packet is disposed of according to the action fields.
Page 475: Figure 287 Example Filter: Menu 21.1.3.1
ZyWALL 5 User’s Guide Figure 287 Example Filter: Menu 21.1.3.1 Menu 21.1.3.1 - TCP/IP Filter Rule Filter #: 3,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0...
Page 476: Filter Types And Nat
ZyWALL 5 User’s Guide M = N means an action can be taken immediately. The action is to drop the packet (m = D) if the action is matched and to forward the packet immediately (n = F) if the action is not matched no matter whether there are more rules to be checked (there aren’t in this example).
Page 477: Applying A Filter
ZyWALL 5 User’s Guide 35.6 Applying a Filter This section shows you where to apply the filter(s) after you design it (them). The ZyWALL already has filters to prevent NetBIOS traffic from triggering calls, and block incoming telnet, FTP and HTTP connections.
Page 478: Applying Remote Node Filters
ZyWALL 5 User’s Guide Figure 291 Filtering DMZ Traffic Menu 5.1 - DMZ Port Filter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ESC to Cancel: 35.6.3 Applying Remote Node Filters Go to menu 11.1.4 (shown below –...
Page 479: Chapter 36 Snmp Configuration
ZyWALL 5 User’s Guide H A P T E R SNMP Configuration This chapter explains SNMP configuration menu 22. 36.1 SNMP Configuration To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The “community” for Get, Set and Trap fields is SNMP terminology for password.
Page 480: Snmp Traps
ZyWALL 5 User’s Guide Table 184 SNMP Configuration Menu Fields (continued) FIELD DESCRIPTION Destination Type the IP address of the station to send your SNMP traps to. When you have completed this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel”...
Page 481: System Information & Diagnosis
ZyWALL 5 User’s Guide H A P T E R System Information & Diagnosis This chapter covers SMT menus 24.1 to 24.4. 37.1 Introduction to System Status This chapter covers the diagnostic tools that help you to maintain your ZyWALL. These tools include updates on system status, port status and log and trace capabilities.
Page 482: Figure 295 Menu 24.1: System Maintenance: Status
ZyWALL 5 User’s Guide 3 There are three commands in Menu 24.1 - System Maintenance - Status. Entering 1 drops the WAN connection, 9 resets the counters and [ESC] takes you back to the previous screen. Figure 295 Menu 24.1: System Maintenance: Status Menu 24.1 - System Maintenance - Status...
Page 483: System Information And Console Port Speed
ZyWALL 5 User’s Guide Table 186 System Maintenance: Status Menu Fields (continued) FIELD DESCRIPTION System up Time This is the total time the ZyWALL has been on. You may enter 1 to drop the WAN connection, 9 to reset the counters or [ESC] to return to menu 24.
Page 484: Console Port Speed
ZyWALL 5 User’s Guide Figure 297 Menu 24.2.1: System Maintenance: Information Menu 24.2.1 - System Maintenance - Information Name: Routing: IP ZyNOS F/W Version: V3.64(XD.0)b4 | 02/24/2005 Country Code: 255 Ethernet Address: 00:A0:C5:7A:86:D5 IP Address: 192.168.1.1 IP Mask: 255.255.255.0 DHCP: Server Press ESC or RETURN to Exit: The following table describes the fields in this screen.
Page 485: Log And Trace
ZyWALL 5 User’s Guide Figure 298 Menu 24.2.2: System Maintenance: Change Console Port Speed Menu 24.2.2 - System Maintenance - Change Console Port Speed Console Port Speed: 9600 Press ENTER to Confirm or ESC to Cancel:Press Space Bar to Toggle.
Page 486: Syslog Logging
ZyWALL 5 User’s Guide Figure 300 Examples of Error and Information Messages 52 Thu Jul 1 05:54:53 2004 PP05 ERROR Wireless LAN init fail, code=15 53 Thu Jul 1 05:54:53 2004 PINI INFO Channel 0 ok 54 Thu Jul 1 05:54:56 2004 PP05 -WARN...
Page 487 ZyWALL 5 User’s Guide Your ZyWALL sends five types of syslog messages. Some examples (not all ZyWALL specific) of these syslog messages with their message formats are shown next: 1 CDR CDR Message Format SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String ); String = board xx line xx channel xx, call xx, str...
Page 488 ZyWALL 5 User’s Guide Filter log Message Format SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String ); String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D).
Page 489: Call-Triggering Packet
ZyWALL 5 User’s Guide 37.4.3 Call-Triggering Packet Call-Triggering Packet displays information about the packet that triggered a dial-out call in an easy readable format. Equivalent information is available in menu 24.1 in hex format. An example is shown next. Figure 302 Call-Triggering Packet Example IP Frame: ENET0-RECV Size: Time: 17:02:44.262...
Page 490: Wan Dhcp
ZyWALL 5 User’s Guide 1 From the main menu, select option 24 to open Menu 24 - System Maintenance. 2 From this menu, select option 4. Diagnostic. This will open Menu 24.4 - System Maintenance - Diagnostic. Figure 303 Menu 24.4: System Maintenance: Diagnostic Menu 24.4 - System Maintenance - Diagnostic...
Page 491: Table 189 System Maintenance Menu Diagnostic
ZyWALL 5 User’s Guide Table 189 System Maintenance Menu Diagnostic FIELD DESCRIPTION Ping Host Enter 1 to ping any machine (with an IP address) on your LAN or WAN. Enter its IP address in the Host IP Address field below.
Page 492 ZyWALL 5 User’s Guide Chapter 37 System Information & Diagnosis...
Page 493: Firmware And Configuration File Maintenance
ZyWALL 5 User’s Guide H A P T E R Firmware and Configuration File Maintenance This chapter tells you how to back up and restore your configuration file as well as upload new firmware and a new configuration file. 38.1 Introduction Use the instructions in this chapter to change the ZyWALL’s configuration file or upgrade its...
Page 494: Backup Configuration
ZyWALL 5 User’s Guide The following table is a summary. Please note that the internal filename refers to the filename on the ZyWALL and the external filename refers to the filename not on the ZyWALL, that is, on your computer, local network or FTP site and so the name (but not the extension) may vary.
Page 495: Using The Ftp Command From The Command Line
ZyWALL 5 User’s Guide Figure 305 Telnet into Menu 24.5 Menu 24.5 - Backup Configuration To transfer the configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your router. Then type "root"...
Page 496: Example Of Ftp Commands From The Command Line
ZyWALL 5 User’s Guide 38.3.3 Example of FTP Commands from the Command Line Figure 306 FTP Session Example 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 zyxel.rom 200 Port command okay...
Page 497: Backup Configuration Using Tftp
ZyWALL 5 User’s Guide 4 The IP you entered in the Secured Client IP field in menu 24.11 does not match the client IP. If it does not match, the ZyWALL will disconnect the Telnet session immediately. 5 You have an SMT console session running.
Page 498: Gui-Based Tftp Clients
ZyWALL 5 User’s Guide 38.3.8 GUI-based TFTP Clients The following table describes some of the fields that you may see in GUI-based TFTP clients. Table 192 General Commands for GUI-based TFTP Clients COMMAND DESCRIPTION Host Enter the IP address of the ZyWALL. 192.168.1.1 is the ZyWALL’s default IP address when shipped.
Page 499: Restore Configuration
ZyWALL 5 User’s Guide Figure 309 Backup Configuration Example Type a location for storing the configuration file or click Browse to look for one. Choose the Xmodem protocol. Then click Receive. 4 After a successful backup you will see the following screen. Press any key to return to the SMT menu.
Page 500: Figure 311 Telnet Into Menu 24.6
ZyWALL 5 User’s Guide Figure 311 Telnet into Menu 24.6 Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation.
Page 501: Restore Using Ftp Session Example
ZyWALL 5 User’s Guide 38.4.2 Restore Using FTP Session Example Figure 312 Restore Using FTP Session Example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec.
Page 502: Uploading Firmware And Configuration Files
ZyWALL 5 User’s Guide Figure 315 Restore Configuration Example Type the configuration file’s location, or click Browse to search for it. Choose the Xmodem protocol. Then click Send. 4 After a successful restoration you will see the following screen. Press any key to restart the ZyWALL and return to the SMT menu.
Page 503: Configuration File Upload
ZyWALL 5 User’s Guide Figure 317 Telnet Into Menu 24.7.1: Upload System Firmware Menu 24.7.1 - System Maintenance - Upload System Firmware To upload the system firmware, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your system. Then type "root" and SMT password as requested.
Page 504: Ftp Session Example Of Firmware File Upload
ZyWALL 5 User’s Guide 2 Enter “open”, followed by a space and the IP address of your ZyWALL. 3 Press [ENTER] when prompted for a username. 4 Enter your password as requested (the default is “1234”). 5 Enter “bin” to set transfer mode to binary.
Page 505: Tftp Upload Command Example
ZyWALL 5 User’s Guide 2 Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 – System Maintenance. 3 Enter the command “sys stdio 0” to disable the console timeout, so the TFTP transfer will not be interrupted. Enter “command sys stdio 5” to restore the five-minute console timeout (default) when the file transfer is complete.
Page 506: Example Xmodem Firmware Upload Using Hyperterminal
ZyWALL 5 User’s Guide Figure 320 Menu 24.7.1 As Seen Using the Console Port Menu 24.7.1 - System Maintenance - Upload System Firmware To upload system firmware: 1. Enter "y" at the prompt below to go into debug mode. 2. Enter "atur" after "Enter Debug Mode" message.
Page 507: Example Xmodem Configuration Upload Using Hyperterminal
ZyWALL 5 User’s Guide Figure 322 Menu 24.7.2 As Seen Using the Console Port Menu 24.7.2 - System Maintenance - Upload System Configuration File To upload system configuration file: 1. Enter "y" at the prompt below to go into debug mode.
Page 508 ZyWALL 5 User’s Guide Chapter 38 Firmware and Configuration File Maintenance...
Page 509: System Maintenance Menus 8 To 10
ZyWALL 5 User’s Guide H A P T E R System Maintenance Menus 8 to This chapter leads you through SMT menus 24.8 to 24.10. 39.1 Command Interpreter Mode The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions.
Page 510: Command Usage
A list of commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished. Figure 325 Valid Commands Copyright (c) 1994 - 2005 ZyXEL Communications Corp. ras> ? Valid commands are:...
Page 511: Call Control Support
ZyWALL 5 User’s Guide 39.2 Call Control Support The ZyWALL provides two call control functions: budget management and call history. Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1.
Page 512: Call History
ZyWALL 5 User’s Guide Figure 327 Budget Management Menu 24.9.1 - Budget Management Remote Node Connection Time/Total Budget Elapsed Time/Total Period 1.ChangeMe No Budget No Budget 2.Dial No Budget No Budget Reset Node (0 to update screen): The total budget is the time limit on the accumulated time for outgoing calls to a remote node.
Page 513: Time And Date Setting
ZyWALL 5 User’s Guide Figure 328 Call History Menu 24.9.2 - Call History Phone Number Rate #call Total Enter Entry to Delete(0 to exit): The following table describes the fields in this screen. Table 195 Call History FIELD DESCRIPTION Phone Number The PPPoE service names are shown here.
Page 514: Figure 329 Menu 24: System Maintenance
ZyWALL 5 User’s Guide Figure 329 Menu 24: System Maintenance Menu 24 - System Maintenance System Status System Information and Console Port Speed Log and Trace Diagnostic Backup Configuration Restore Configuration Upload Firmware Command Interpreter Mode Call Control 10. Time and Date Setting 11.
Page 515: Table 196 Menu 24.10 System Maintenance: Time And Date Setting
ZyWALL 5 User’s Guide Table 196 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION Time Protocol Enter the time service protocol that your timeserver uses. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works.
Page 516: Resetting The Time
ZyWALL 5 User’s Guide Table 196 Menu 24.10 System Maintenance: Time and Date Setting FIELD DESCRIPTION End Date (mm- Configure the day and time when Daylight Saving Time ends if you selected Yes in nth-week-hr) the Daylight Saving field. The hr field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time ends in the United States on the last Sunday of October.
Page 517: Chapter 40 Remote Management
ZyWALL 5 User’s Guide H A P T E R Remote Management This chapter covers remote management found in SMT menu 24.11. 40.1 Remote Management Remote management allows you to determine which services/protocols can access which ZyWALL interface (if any) from which computers.
Page 518: Figure 331 Menu 24.11 - Remote Management Control
ZyWALL 5 User’s Guide Figure 331 Menu 24.11 – Remote Management Control Menu 24.11 - Remote Management Control TELNET Server: Port = 23 Access = ALL Secure Client IP = 0.0.0.0 FTP Server: Port = 21 Access = ALL Secure Client IP = 0.0.0.0...
Page 519: Remote Management Limitations
ZyWALL 5 User’s Guide 40.1.1 Remote Management Limitations Remote management over LAN or WAN will not work when: 1 A filter in menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service.
Page 520 ZyWALL 5 User’s Guide Chapter 40 Remote Management...
Page 521: Chapter 41 Call Scheduling
ZyWALL 5 User’s Guide H A P T E R Call Scheduling Call scheduling allows you to dictate when a remote node should be called and for how long. 41.1 Introduction to Call Scheduling The call scheduling feature allows the ZyWALL to manage a remote node and dictate when a remote node should be called and for how long.
Page 522: Figure 333 Schedule Set Setup
ZyWALL 5 User’s Guide To set up a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press [ENTER] to see Menu 26.1 - Schedule Set Setup as shown next. Figure 333 Schedule Set Setup Menu 26.1 - Schedule Set Setup...
Page 523: Figure 334 Applying Schedule Set(S) To A Remote Node (Pppoe)
ZyWALL 5 User’s Guide Table 198 Schedule Set Setup (continued) FIELD DESCRIPTION Action Forced On means that the connection is maintained whether or not there is a demand call on the line and will persist for the time period specified in the Duration field.
Page 524: Figure 335 Applying Schedule Set(S) To A Remote Node (Pptp)
ZyWALL 5 User’s Guide Figure 335 Applying Schedule Set(s) to a Remote Node (PPTP) Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Route= IP Active= Yes Encapsulation= PPTP Edit IP= No Service Type= Standard Telco Option: Allocated Budget(min)= 0...
Page 525: Chapter 42 Troubleshooting
ZyWALL 5 User’s Guide H A P T E R Troubleshooting This chapter covers potential problems and possible remedies. After each problem description, some instructions are provided to help you to diagnose and to solve the problem. Please see our included disk for further information.
Page 526: Problems With The Dmz Interface
ZyWALL 5 User’s Guide 42.3 Problems with the DMZ Interface Table 201 Troubleshooting the DMZ Interface PROBLEM CORRECTIVE ACTION Cannot access Check your Ethernet cable type and connections. Refer to the Quick Start Guide servers on the DMZ for DMZ connection instructions.
Page 527: Problems With Internet Access
ZyWALL 5 User’s Guide 42.5 Problems with Internet Access Table 203 Troubleshooting Internet Access PROBLEM CORRECTIVE ACTION Cannot access the Connect your cable/DSL modem with the ZyWALL using the appropriate cable. Internet. Check with the manufacturer of your cable/DSL device about your cable requirement because some devices may require crossover cable and others a regular straight-through cable.
Page 528: Pop-Up Windows, Javascripts And Java Permissions
ZyWALL 5 User’s Guide Table 205 Troubleshooting Accessing the ZyWALL PROBLEM CORRECTIVE ACTION Cannot access the 1. Check to see if the ZyWALL is connected to your computer's console port. ZyWALL via the 2. Check to see if the communications program is configured correctly. The console port.
Page 529: Internet Explorer Pop-Up Blockers
ZyWALL 5 User’s Guide 42.7.1.1 Internet Explorer Pop-up Blockers You may have to disable pop-up blocking to log into your device. Either disable pop-up blocking (enabled by default in Windows XP SP (Service Pack) 2) or allow pop-up blocking and create an exception for your device’s IP address.
Page 530: Figure 337 Internet Options
ZyWALL 5 User’s Guide Figure 337 Internet Options 3 Click Apply to save this setting. 42.7.1.1.2 Enable pop-up Blockers with Exceptions Alternatively, if you only want to allow pop-up windows from your device, see the following steps. 1 In Internet Explorer, select Tools, Internet Options and then the Privacy tab.
Page 531: Figure 338 Internet Options
ZyWALL 5 User’s Guide Figure 338 Internet Options 3 Type the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites.
Page 532: Javascripts
ZyWALL 5 User’s Guide Figure 339 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. 42.7.1.2 JavaScripts If pages of the web configurator do not display properly in Internet Explorer, check that JavaScripts are allowed.
Page 533: Figure 340 Internet Options
ZyWALL 5 User’s Guide Figure 340 Internet Options 2 Click the Custom Level... button. 3 Scroll down to Scripting. 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is selected (the default).
Page 534: Java Permissions
ZyWALL 5 User’s Guide Figure 341 Security Settings - Java Scripting 42.7.1.3 Java Permissions 1 From Internet Explorer, click Tools, Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM. 4 Under Java permissions make sure that a safety level is selected.
Page 535: Figure 342 Security Settings - Java
ZyWALL 5 User’s Guide Figure 342 Security Settings - Java 42.7.1.3.1 JAVA (Sun) 1 From Internet Explorer, click Tools, Internet Options and then the Advanced tab. 2 make sure that Use Java 2 for <applet> under Java (Sun) is selected.
Page 536: Figure 343 Java (Sun)
ZyWALL 5 User’s Guide Figure 343 Java (Sun) Chapter 42 Troubleshooting...
Page 537: Product Specifications
ZyWALL 5 User’s Guide P P E N D I X Product Specifications See also the Introduction chapter for a general overview of the key features. Specification Tables Table 1 Device Specifications Default IP Address 192.168.1.1 Default Subnet Mask 255.255.255.0 (24 bits)
Page 538: Table 3 Firmware Features
ZyWALL 5 User’s Guide Table 2 Performance User Licenses Unlimited Concurrent Sessions 6000 Simultaneous IPSec VPN Connections Table 3 Firmware Features Modes of Operation Routing/NAT/SUA Mode Transparent Mode Firewall (ICSA Certified) IP Protocol/Packet Filter DoS and DDoS protections Stateful Packet Inspection...
Page 539: Table 4 Feature Specifications
ZyWALL 5 User’s Guide Table 3 Firmware Features (continued) Wireless IEEE 802.11b Compliant IEEE 802.11g Compliant Frequency Range: 2.4 GHz Advanced Orthogonal Frequency Division Multiplexing (OFDM) IEEE 802.1x Authentication (Internal Database and External RADIUS) Store up to 32 built-in user profiles using EAP-MD5 (Internal Database)
Page 540: Table 5 Compatible Zyxel Wlan Cards And Security Features
ZyWALL 5 User’s Guide Compatible ZyXEL WLAN Cards The following table lists the ZyXEL WLAN cards that you can use in the ZyWALL at the time of writing. It also shows the security features that each card supports. Note: Check the product page on the www.zyxel.com website for updates on ZyXEL WLAN cards that you can use in the ZyWALL.
Page 541: Figure 1 Wlan Card Installation
ZyWALL 5 User’s Guide Figure 1 WLAN Card Installation Cable Pin Assignments In a serial communications connection, generally a computer is DTE (Data Terminal Equipment) and a modem is DCE (Data Circuit-terminating Equipment). The ZyWALL is DCE when you connect a computer to the console port. The ZyWALL is DTE when you connect a modem to the dial backup port.
Page 542: Figure 3 Ethernet Cable Pin Assignments
ZyWALL 5 User’s Guide Table 6 Console/Dial Backup Port Pin Assignments CONSOLE Port RS – 232 (Female) DB-9F DIAL BACKUP RS – 232 (Male) DB-9M (Not on all models) Pin 1 = NON Pin 1 = NON Pin 2 = DCE-TXD Pin 2 = DTE-RXD Pin 3 = DCE –RXD...
Page 543: Table 8 European Union Ac Power Adaptor Specifications
ZyWALL 5 User’s Guide Table 8 European Union AC Power Adaptor Specifications AC Power Adapter model AD-1201200DV Input power: AC230Volts/50Hz/0.2A Output power: DC12Volts/1.2A Power consumption: 10 W Plug: European Union standards Safety standards: TUV, CE (EN 60950) AC Power Adapter model JAD-121200E Input power: AC230Volts/50Hz, Output power: DC12Volts/1.2A...
Page 544: Table 11 Australia And New Zealand Ac Power Adaptor Specification
ZyWALL 5 User’s Guide Table 11 Australia and New Zealand AC Power Adaptor Specification AC Power Adapter model AD-1201200Ds or AD-121200DS Input power: AC240Volts/50Hz/0.2A Output power: DC12Volts/1.2A Power consumption: 10 W Plug: Australia and New Zealand standards Safety standards: NATA (AS 3260)
Page 545: Setting Up Your Computer's Ip Address
ZyWALL 5 User’s Guide P P E N D I X Setting up Your Computer’s IP Address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/ IP on your computer.
Page 546: Figure 4 Windows 95/98/Me: Network: Configuration
ZyWALL 5 User’s Guide Figure 4 WIndows 95/98/Me: Network: Configuration Installing Components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: 1 In the Network window, click Add.
Page 547: Figure 5 Windows 95/98/Me: Tcp/Ip Properties: Ip Address
ZyWALL 5 User’s Guide 3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click 5 Restart your computer so the changes you made take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab.
Page 548: Figure 6 Windows 95/98/Me: Tcp/Ip Properties: Dns Configuration
ZyWALL 5 User’s Guide Figure 6 Windows 95/98/Me: TCP/IP Properties: DNS Configuration 4 Click the Gateway tab. • If you do not know your gateway’s IP address, remove previously installed gateways. • If you have a gateway IP address, type it in the New gateway field and click Add.
Page 549: Figure 7 Windows Xp: Start Menu
ZyWALL 5 User’s Guide Figure 7 Windows XP: Start Menu 2 In the Control Panel, double-click Network Connections (Network and Dial-up Connections in Windows 2000/NT). Figure 8 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Properties.
Page 550: Figure 9 Windows Xp: Control Panel: Network Connections: Properties
ZyWALL 5 User’s Guide Figure 9 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and then click Properties. Figure 10 Windows XP: Local Area Connection Properties 5 The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP).
Page 551: Figure 11 Windows Xp: Internet Protocol (Tcp/Ip) Properties
ZyWALL 5 User’s Guide • If you have a static IP address click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. • Click Advanced. Figure 11 Windows XP: Internet Protocol (TCP/IP) Properties 6 If you do not know your gateway's IP address, remove any previously installed gateways in the IP Settings tab and click OK.
Page 552: Figure 12 Windows Xp: Advanced Tcp/Ip Properties
ZyWALL 5 User’s Guide Figure 12 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP): • Click Obtain DNS server address automatically if you do not know your DNS server IP address(es).
Page 553: Figure 13 Windows Xp: Internet Protocol (Tcp/Ip) Properties
ZyWALL 5 User’s Guide Figure 13 Windows XP: Internet Protocol (TCP/IP) Properties 8 Click OK to close the Internet Protocol (TCP/IP) Properties window. 9 Click Close (OK in Windows 2000/NT) to close the Local Area Connection Properties window. 10 Close the Network Connections window (Network and Dial-up Connections in Windows 2000/NT).
Page 554: Figure 14 Macintosh Os 8/9: Apple Menu
ZyWALL 5 User’s Guide Figure 14 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 15 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. Appendix B Setting up Your Computer’s IP Address...
Page 555: Figure 16 Macintosh Os X: Apple Menu
ZyWALL 5 User’s Guide 4 For statically assigned settings, do the following: • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box. •...
Page 556: Figure 17 Macintosh Os X: Network
ZyWALL 5 User’s Guide Figure 17 Macintosh OS X: Network 4 For statically assigned settings, do the following: • From the Configure box, select Manually. • Type your IP address in the IP Address box. • Type your subnet mask in the Subnet mask box.
Page 557: Appendix Cip Subnetting
ZyWALL 5 User’s Guide P P E N D I X IP Subnetting IP Addressing Routers “route” based on the network number. The router that delivers the data packet to the correct destination host uses the host ID. IP Classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1.
Page 558: Table 13 Allowed Ip Address Range By Class
ZyWALL 5 User’s Guide Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127. Similarly the first octet of a class “B” must begin with “10”, therefore the first octet of a class “B”...
Page 559: Table 15 Alternative Subnet Mask Notation
ZyWALL 5 User’s Guide For example, 192.1.1.0 /25 is equivalent to saying 192.1.1.0 with mask 255.255.255.128. The following table shows all possible subnet masks for a class “C” address using both notations. Table 15 Alternative Subnet Mask Notation SUBNET MASK IP ADDRESS SUBNET MASK “1”...
Page 560: Table 17 Subnet 1
ZyWALL 5 User’s Guide Note: In the following charts, shaded/bolded last octet bit values indicate host ID bits “borrowed” to form network ID bits. The number of “borrowed” host ID bits determines the number of subnets you can have. The remaining number of host ID bits (after “borrowing”) determines the number of hosts you can have...
Page 561: Table 19 Subnet 1
ZyWALL 5 User’s Guide Example: Four Subnets The above example illustrated using a 25-bit subnet mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits (11111111.11111111.11111111.11000000) or 255.255.255.192.
Page 562: Table 22 Subnet 4
ZyWALL 5 User’s Guide Table 22 Subnet 4 NETWORK NUMBER LAST OCTET BIT VALUE IP Address 192.168.1. IP Address (Binary) 11000000.10101000.00000001. 11000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: Lowest Host ID: 192.168.1.193 192.168.1.192 Broadcast Address: Highest Host ID: 192.168.1.254 192.168.1.255...
Page 563: Table 25 Class B Subnet Planning
ZyWALL 5 User’s Guide Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID.
Page 564 ZyWALL 5 User’s Guide Appendix C IP Subnetting...
Page 565: Appendix Dpppoe
ZyWALL 5 User’s Guide P P E N D I X PPPoE PPPoE in Action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your computer to an ATM PVC (Permanent Virtual Circuit) which connects to a DSL Access...
Page 566: Figure 18 Single-Computer Per Router Hardware Configuration
ZyWALL 5 User’s Guide Figure 18 Single-Computer per Router Hardware Configuration How PPPoE Works The PPPoE driver makes the Ethernet appear as a serial link to the computer and the computer runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC).
Page 567: Appendix Epptp
ZyWALL 5 User’s Guide P P E N D I X PPTP What is PPTP? PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames. How can we transport PPP frames from a computer to a broadband...
Page 568: Figure 21 Pptp Protocol Overview
ZyWALL 5 User’s Guide PPTP Protocol Overview PPTP is very similar to L2TP, since L2TP is based on both PPTP and L2F (Cisco’s Layer 2 Forwarding). Conceptually, there are three parties in PPTP, namely the PNS (PPTP Network Server), the PAC (PPTP Access Concentrator) and the PPTP user. The PNS is the box that hosts both the PPP and the PPTP stacks and forms one end of the PPTP tunnel.
Page 569: Figure 22 Example Message Exchange Between Computer And An Ant
ZyWALL 5 User’s Guide Figure 22 Example Message Exchange between Computer and an ANT PPP Data Connection The PPP frames are tunneled between the PNS and PAC over GRE (General Routing Encapsulation, RFC 1701, 1702). The individual calls within a tunnel are distinguished using the Call ID field in the GRE header.
Page 570 ZyWALL 5 User’s Guide Appendix E PPTP...
Page 571 ZyWALL 5 User’s Guide...
Page 572 ZyWALL 5 User’s Guide...
Page 573: Wireless Lans
ZyWALL 5 User’s Guide P P E N D I X Wireless LANs Wireless LAN Topologies This section discusses ad-hoc and infrastructure wireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an independent (Ad-hoc) WLAN that connects a set of computers with wireless stations (A, B, C).
Page 574: Figure 24 Basic Service Set
ZyWALL 5 User’s Guide Figure 24 Basic Service Set An Extended Service Set (ESS) consists of a series of overlapping BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS).
Page 575: Figure 25 Infrastructure Wlan
ZyWALL 5 User’s Guide Figure 25 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.11a/b/g wireless devices. Channels available depend on your geographical area. You may have a choice of channels (for your region) so you should use a different channel than an adjacent AP (access point) to reduce interference.
Page 576: Figure 26 Rts/Cts
ZyWALL 5 User’s Guide Figure 26 RTS/CTS When station A sends data to the AP, it might not know that the station B is already using the channel. If these two stations send data at the same time, collisions may occur when both sets of data arrive at the AP at the same time, resulting in a loss of messages for both stations.
Page 577: Table 26 Ieee802.11G
ZyWALL 5 User’s Guide A large Fragmentation Threshold is recommended for networks not prone to interference while you should set a smaller threshold for busy networks or networks that are prone to interference. If the Fragmentation Threshold value is smaller than the RTS/CTS value (see previously) you set then the RTS (Request To Send)/CTS (Clear to Send) handshake will never occur as data frames will be fragmented before they reach RTS/CTS size.
Page 578 ZyWALL 5 User’s Guide IEEE 802.1x In June 2001, the IEEE 802.1x standard was designed to extend the features of IEEE 802.11 to support extended authentication as well as providing additional accounting and control features. It is supported by Windows XP and a number of network devices. Some advantages of IEEE 802.1x are:...
Page 579: Figure 27 Eap Authentication
ZyWALL 5 User’s Guide • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the access point and the RADIUS server for user accounting: •...
Page 580: Types Of Authentication
ZyWALL 5 User’s Guide 3 The wireless station replies with identity information, including username and password. 4 The RADIUS server checks the user information against its user profile database and determines whether or not to authenticate the wireless station. Types of Authentication This section discusses some popular authentication types: EAP-MD5, EAP-TLS, EAP- TTLS, PEAP and LEAP.
Page 581 ZyWALL 5 User’s Guide PEAP (Protected EAP) Like EAP-TTLS, server-side certificate authentication is used to establish a secure connection, then use simple username and password methods through the secured connection to authenticate the clients, thus hiding client identity. However, PEAP only supports EAP methods, such as EAP-MD5, EAP-MSCHAPv2 and EAP-GTC (EAP-Generic Token Card), for client authentication.
Page 582: Figure 28 Wep Authentication Steps
ZyWALL 5 User’s Guide Figure 28 WEP Authentication Steps Open system authentication involves an unencrypted two-message procedure. A wireless station sends an open system authentication request to the AP, which will then automatically accept and connect the wireless station to the network. In effect, open system is not authentication at all as any station can gain access to the network.
Page 583: Table 27 Comparison Of Eap Authentication Types
ZyWALL 5 User’s Guide Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange For added security, certificate-based authentications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are often deployed in corporate environments, but for public deployment, a simple user name and password pair is more practical. The following table is a comparison of the features of authentication types.
Page 584: Table 28 Wireless Security Relational Matrix
ZyWALL 5 User’s Guide The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data packets, altering them and resending them. The MIC provides a strong mathematical function in which the receiver and the transmitter each compute and then compare the MIC. If they do not match, it is assumed that the data has been tampered with and the packet is dropped.
Page 585: Figure 29 Roaming Example
ZyWALL 5 User’s Guide In a network environment with multiple access points, wireless stations are able to switch from one access point to another as they move between the coverage areas. This is roaming. As the wireless station moves from place to place, it is responsible for choosing the most appropriate access point depending on the signal strength, network utilization or other factors.
Page 586 ZyWALL 5 User’s Guide Requirements for Roaming The following requirements must be met in order for wireless stations to roam between the coverage areas. 1 All the access points must be on the same subnet and configured with the same ESSID.
Page 587: Appendix G Triangle Route
ZyWALL 5 User’s Guide P P E N D I X Triangle Route The Ideal Setup When the firewall is on, your ZyWALL acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the ZyWALL to protect your LAN against attacks.
Page 588: Figure 31 "Triangle Route" Problem
ZyWALL 5 User’s Guide Figure 31 “Triangle Route” Problem The “Triangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface.
Page 589: Figure 32 Ip Alias
ZyWALL 5 User’s Guide Figure 32 IP Alias Gateways on the WAN Side A second solution to the “triangle route” problem is to put all of your network gateways on the WAN side as the following figure shows. This ensures that all incoming network traffic passes through your ZyWALL to your LAN.
Page 590 ZyWALL 5 User’s Guide Appendix G Triangle Route...
Page 591: Sip Passthrough
ZyWALL 5 User’s Guide P P E N D I X SIP Passthrough The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering and tearing down of voice and multimedia sessions over the Internet.
Page 592: Figure 34 Sip User Agent Server
ZyWALL 5 User’s Guide Table 29 SIP Call Progression (continued) 3. OK 4. ACK 5.Dialogue (voice traffic) 6. BYE 7. OK 1 A sends a SIP INVITE request to B. This message is an invitation for B to participate in a SIP telephone call.
Page 593: Figure 35 Sip Proxy Server
ZyWALL 5 User’s Guide In the following example, you want to use client device A to call someone who is using client device C. 1 The client device (A in the figure) sends a call invitation to the SIP proxy server (B).
Page 594: Figure 36 Sip Redirect Server
ZyWALL 5 User’s Guide Figure 36 SIP Redirect Server SIP Register Server A SIP register server maintains a database of SIP identity-to-IP address (or domain name) mapping. The register server checks your user name and password when you register. When you make a VoIP call using SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer.
Page 595: Figure 37 Zywall Sip Alg
ZyWALL 5 User’s Guide ZyXEL SIP ALG • SIP clients can be connected to the LAN, WLAN or DMZ. A SIP server must be on the WAN. The WLAN and DMZ are not available on all models. • You can make and receive calls between the LAN and the WAN, between the WLAN and the WAN and/or between the DMZ and the WAN.
Page 596 ZyWALL 5 User’s Guide If the primary WAN connection fails, the SIP client needs to re-register with the SIP server through the secondary WAN port to have the SIP connection go through the secondary WAN port. When the ZyWALL uses both of the WAN ports at the same time, you can configure a routing policy to have the voice traffic from any IP address with UDP port 5060 and the RTP ports go over a specified WAN port.
Page 597: Vpn Setup
ZyWALL 5 User’s Guide P P E N D I X VPN Setup This appendix will help you to quickly create a IPSec/VPN connection between two ZyXEL IPSec routers. It should be considered a quick reference for experienced users. General Notes •...
Page 598: Figure 38 Vpn Rules
ZyWALL 5 User’s Guide The following pages show a typical configuration that builds a tunnel between two private networks. One network is the headquarters (HQ) and the other is a branch office. Both sites have static (fixed) public addresses. Replace the Remote Gateway Address and Local/ Remote Starting IP Address settings with your own values.
Page 599: Figure 39 Headquarters Gateway Policy Edit
ZyWALL 5 User’s Guide Figure 39 Headquarters Gateway Policy Edit The IP address of the branch office IPSec router. Appendix I VPN Setup...
Page 600: Figure 40 Branch Office Gateway Policy Edit
ZyWALL 5 User’s Guide Figure 40 Branch Office Gateway Policy Edit The IP address of the headquarters IPSec router. 3 Click the add network policy ( ) icon next to the BRANCH gateway policy to configure a VPN policy. Appendix I VPN Setup...
Page 601: Figure 41 Headquarters Vpn Rule
ZyWALL 5 User’s Guide Figure 41 Headquarters VPN Rule Figure 42 Branch Office VPN Rule 4 Configure the screens in the headquarters and the branch office as follows and click Apply. Appendix I VPN Setup...
Page 602: Figure 43 Headquarters Network Policy Edit
ZyWALL 5 User’s Guide Figure 43 Headquarters Network Policy Edit Activate the network policy. IP addresses on different subnets. Appendix I VPN Setup...
Page 603: Figure 44 Branch Office Network Policy Edit
ZyWALL 5 User’s Guide Figure 44 Branch Office Network Policy Edit Activate the network policy. IP addresses on different subnets. Dialing the VPN Tunnel via Web Configurator To test whether the IPSec routers can build the VPN tunnel, click the dial ( ) icon in the VPN Rules (IKE) screen to have the IPSec routers set up the tunnel.
Page 604: Figure 45 Vpn Rule Configured
ZyWALL 5 User’s Guide Figure 45 VPN Rule Configured The following screen displays. Figure 46 VPN Dial This screen displays later if the IPSec routers can build the VPN tunnel. Figure 47 VPN Tunnel Established Appendix I VPN Setup...
Page 605: Vpn Troubleshooting
ZyWALL 5 User’s Guide VPN Troubleshooting If the IPSec tunnel does not build properly, the problem is likely a configuration error at one of the IPSec routers. Log into the web configurators of both ZyXEL IPSec routers. Check the settings in each field methodically and slowly.
Page 606: Figure 48 Vpn Log Example
ZyWALL 5 User’s Guide Figure 48 VPN Log Example ras> sys log disp ike ipsec .time source destination notes message 0|01/11/2001 18:47:22 |5.6.7.8 |5.1.2.3 |IKE Rule [ex-1] Tunnel built successfully 1|01/11/2001 18:47:22 |5.6.7.8 |5.1.2.3 |IKE The cookie pair is : 0xDAC0B43FBDE154F5 / 0xC5156C099C3F7DCA 2|01/11/2001 18:47:22 |5.6.7.8...
Page 607: Figure 49 Ike/Ipsec Debug Example
ZyWALL 5 User’s Guide IPSec Debug If you are having difficulty building an IPSec tunnel to a non-ZyXEL IPSec router, advanced users may wish to examine the IPSec debug feature (Menu 24.8). Note: If any of your VPN rules have an active network policy set to nailed-up, using the IPSec debug feature may cause the ZyWALL to continuously display new information.
Page 608: Use A Vpn Tunnel
ZyWALL 5 User’s Guide Use a VPN Tunnel A VPN tunnel gives you a secure connection to another computer or network. The VPN Status screen displays whether or not your VPN tunnel is connected. Example VPN tunnel uses are securely sending and retrieving files, and accessing corporate network drives, web servers and email.
Page 609: Importing Certificates
ZyWALL 5 User’s Guide P P E N D I X Importing Certificates This appendix shows importing certificates examples using Internet Explorer 5. Import ZyWALL Certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the ZyWALL’s server certificate by importing it into your operating system as a trusted certification authority.
Page 610: Figure 51 Login Screen
ZyWALL 5 User’s Guide Figure 51 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 52 Certificate General Information before Import 3 Click Next to begin the Install Certificate wizard. Appendix J Importing Certificates...
Page 611: Figure 53 Certificate Import Wizard 1
ZyWALL 5 User’s Guide Figure 53 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next. Figure 54 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard. Appendix J Importing Certificates...
Page 612: Figure 55 Certificate Import Wizard 3
ZyWALL 5 User’s Guide Figure 55 Certificate Import Wizard 3 6 Click Yes to add the ZyWALL certificate to the root store. Figure 56 Root Certificate Store Appendix J Importing Certificates...
Page 613: Figure 57 Certificate General Information After Import
ZyWALL 5 User’s Guide Figure 57 Certificate General Information after Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyWALL. You must have imported at least one trusted CA to the ZyWALL in order for the Authenticate Client Certificates to be active (see the Certificates chapter for details).
Page 614: Figure 58 Zywall Trusted Ca Screen
ZyWALL 5 User’s Guide Figure 58 ZyWALL Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). Installing the CA’s Certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown next.
Page 615: Figure 59 Ca Certificate Example
ZyWALL 5 User’s Guide Figure 59 CA Certificate Example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment.
Page 616: Figure 60 Personal Certificate Import Wizard 1
ZyWALL 5 User’s Guide Figure 60 Personal Certificate Import Wizard 1 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box. Click Browse if you wish to import a different certificate.
Page 617: Figure 62 Personal Certificate Import Wizard 3
ZyWALL 5 User’s Guide Figure 62 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 63 Personal Certificate Import Wizard 4 5 Click Finish to complete the wizard and begin the import process.
Page 618: Figure 64 Personal Certificate Import Wizard 5
ZyWALL 5 User’s Guide Figure 64 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 65 Personal Certificate Import Wizard 6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS.
Page 619: Figure 67 Ssl Client Authentication
ZyWALL 5 User’s Guide Figure 67 SSL Client Authentication 3 You next see the ZyWALL login screen. Figure 68 ZyWALL Secure Login Screen Appendix J Importing Certificates...
Page 620 ZyWALL 5 User’s Guide Appendix J Importing Certificates...
Page 621: Appendix K Command Interpreter
ZyWALL 5 User’s Guide P P E N D I X Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 - Command Interpreter Mode.
Page 622 ZyWALL 5 User’s Guide Appendix K Command Interpreter...
Page 623: Appendix L Firewall Commands
ZyWALL 5 User’s Guide P P E N D I X Firewall Commands The following describes the firewall commands. See Appendix K on page 619 for information on the command structure. Table 30 Firewall Commands FUNCTION COMMAND DESCRIPTION Firewall Set-Up This command turns the firewall on or off.
Page 624 ZyWALL 5 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION E-mail This command sets the IP address to which config edit firewall e-mail the e-mail messages are sent. mail-server <ip address of mail server> This command sets the source e-mail address config edit firewall e-mail of the firewall e-mails.
Page 625 ZyWALL 5 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets the threshold rate of new config edit firewall attack half-open sessions per minute where the minute-high <0-255> ZyWALL starts deleting old half-opened sessions until it gets them down to the minute- low threshold.
Page 626 ZyWALL 5 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets how long ZyWALL lets an Config edit firewall set <set inactive TCP connection remain open before #> tcp-idle-timeout <seconds> considering it closed. This command sets whether or not the Config edit firewall set <set...
Page 627 ZyWALL 5 User’s Guide Table 30 Firewall Commands (continued) FUNCTION COMMAND DESCRIPTION This command sets a rule to have the config edit firewall set <set ZyWALL check for traffic with a particular #> rule <rule #> destaddr- subnet destination (defined by IP address and subnet <ip address>...
Page 628 ZyWALL 5 User’s Guide Appendix L Firewall Commands...
Page 629: Netbios Filter Commands
ZyWALL 5 User’s Guide P P E N D I X NetBIOS Filter Commands The following describes the NetBIOS packet filter commands. See Appendix K on page 619 for information on the command structure. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN.
Page 630: Table 31 Netbios Filter Default Settings
ZyWALL 5 User’s Guide The filter types and their default settings are as follows. Table 31 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN This field displays whether NetBIOS packets are blocked or forwarded Block and WAN between the LAN and the WAN.
Page 631 ZyWALL 5 User’s Guide This command blocks IPSec NetBIOS packets. sys filter netbios config 3 on This command stops NetBIOS commands from initiating calls. sys filter netbios config 4 off Appendix M NetBIOS Filter Commands...
Page 632 ZyWALL 5 User’s Guide Appendix M NetBIOS Filter Commands...
Page 633: Certificates Commands
ZyWALL 5 User’s Guide P P E N D I X Certificates Commands The following describes the certificate commands. See Appendix K on page 619 information on the command structure. All of these commands start with certificates. Table 32 Certificates Commands...
Page 634 ZyWALL 5 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Create a certificate request and enroll for a create cmp_enroll certificate immediately online using CMP <name> <CA protocol. <name> specifies a descriptive name addr> <CA for the enrolled certificate. <CA addr> specifies cert>...
Page 635 ZyWALL 5 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Create a certificate using your device MAC replace_fact address that will be specific to this device. The factory default certificate is a common default certificate for all ZyWALL models.
Page 636 ZyWALL 5 User’s Guide Table 32 Certificates Commands (continued) COMMAND DESCRIPTION Delete the specified trusted remote host delete <name> certificate. <name> specifies the name of the certificate to be deleted. List all trusted remote host certificate names and list basic information.
Page 637: Appendix O Brute-Force Password Guessing Protection
ZyWALL 5 User’s Guide P P E N D I X Brute-Force Password Guessing Protection Brute-force password guessing protection allows you to specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered.
Page 638 ZyWALL 5 User’s Guide Appendix O Brute-Force Password Guessing Protection...
Page 639: Appendix P Boot Commands
ZyWALL 5 User’s Guide P P E N D I X Boot Commands The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your ZyWALL, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen.
Page 640: Figure 70 Boot Module Commands
ZyWALL 5 User’s Guide Figure 70 Boot Module Commands just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time...
Page 641: Appendix Q Log Descriptions
ZyWALL 5 User’s Guide P P E N D I X Log Descriptions This appendix provides descriptions of example log messages. Table 34 System Maintenance Logs LOG MESSAGE DESCRIPTION The router has adjusted its time based on information from the Time calibration is time server.
Page 642: Table 35 System Error Logs
ZyWALL 5 User’s Guide Table 34 System Maintenance Logs (continued) LOG MESSAGE DESCRIPTION The router is saving configuration changes. Configuration Change: PC = 0x%x, Task ID = 0x%x Someone has logged on to the router’s SSH server. Successful SSH login Someone has failed to log on to the router’s SSH server.
Page 643: Table 36 Access Control Logs
ZyWALL 5 User’s Guide Table 36 Access Control Logs LOG MESSAGE DESCRIPTION Attempted TCP/UDP/IGMP/ESP/GRE/OSPF access Firewall default policy: [ TCP | matched the default policy and was blocked or forwarded UDP | IGMP | ESP | GRE | OSPF ] according to the default policy’s setting.
Page 644: Table 38 Packet Filter Logs
ZyWALL 5 User’s Guide Table 37 TCP Reset Logs (continued) LOG MESSAGE DESCRIPTION The router sent a TCP reset packet when the number of Exceed MAX incomplete, incomplete connections (TCP and UDP) exceeded the user- sent TCP RST configured threshold. (Incomplete count is for all TCP and UDP connections through the firewall.)Note: When the number of...
Page 645: Table 40 Cdr Logs
ZyWALL 5 User’s Guide Table 40 CDR Logs LOG MESSAGE DESCRIPTION The router received the setup requirements for a call. “call” is board %d line %d channel %d, the reference (count) number of the call. “dev” is the device call %d, %s C01 Outgoing Call type (3 is for dial-up, 6 is for PPPoE, 10 is for PPTP).
Page 646: Table 44 Attack Logs
ZyWALL 5 User’s Guide Table 43 Content Filtering Logs (continued) LOG MESSAGE DESCRIPTION %s: Forbidden Web site The web site is in the forbidden web site list. The web site contains ActiveX. %s: Contains ActiveX The web site contains a Java applet.
Page 647: Table 45 Remote Management Logs
ZyWALL 5 User’s Guide Table 44 Attack Logs (continued) LOG MESSAGE DESCRIPTION The firewall detected an ICMP IP spoofing attack on the WAN port. ip spoofing - WAN ICMP (type:%d, code:%d) The firewall detected an ICMP echo attack. icmp echo : ICMP (type:%d, code:%d) The firewall detected a TCP syn flood attack.
Page 648: Table 46 Wireless Logs
ZyWALL 5 User’s Guide Table 45 Remote Management Logs LOG MESSAGE DESCRIPTION Remote Management: WWW denied Attempted use of WWW service was blocked according to remote management settings. Remote Management: HTTPS denied Attempted use of HTTPS service was blocked according to remote management settings.
Page 649: Table 48 Ike Logs
ZyWALL 5 User’s Guide Table 47 IPSec Logs (continued) LOG MESSAGE DESCRIPTION Cannot find outbound SA for A packet matches a rule, but there is no phase 2 SA for outbound traffic. rule <%d> Rule [%s] sends an echo The device sent a ping packet to check the specified VPN tunnel's connectivity.
Page 650 ZyWALL 5 User’s Guide Table 48 IKE Logs (continued) LOG MESSAGE DESCRIPTION IKE uses ISAKMP to transmit data. Each ISAKMP packet Recv <packet> contains many different types of payloads. All of them show in the LOG. Refer to RFC2408 – ISAKMP for a list of all ISAKMP payload types.
Page 651 ZyWALL 5 User’s Guide Table 48 IKE Logs (continued) LOG MESSAGE DESCRIPTION The listed rule’s IKE phase 1 authentication method did not Rule [%d] Phase 1 match between the router and the peer. authentication method mismatch The listed rule’s IKE phase 1 key group did not match Rule [%d] Phase 1 key group between the router and the peer.
Page 652: Table 49 Pki Logs
ZyWALL 5 User’s Guide Table 49 PKI Logs LOG MESSAGE DESCRIPTION The SCEP online certificate enrollment was successful. The Enrollment successful Destination field records the certification authority server IP address and port. The SCEP online certificate enrollment failed. The Destination field Enrollment failed records the certification authority server’s IP address and port.
Page 653: Table 50 Certificate Path Verification Failure Reason Codes
ZyWALL 5 User’s Guide Table 50 Certificate Path Verification Failure Reason Codes CODE DESCRIPTION Algorithm mismatch between the certificate and the search constraints. Key usage mismatch between the certificate and the search constraints. Certificate was not valid in the time interval.
Page 654: Table 52 Acl Setting Notes
ZyWALL 5 User’s Guide Table 51 802.1X Logs (continued) LOG MESSAGE DESCRIPTION A user was not authenticated by the local user database Local User Database does not because the user is not listed in the local user database. find user`s credential.
Page 655: Table 53 Icmp Notes
ZyWALL 5 User’s Guide Table 52 ACL Setting Notes (continued) PACKET DIRECTION DIRECTION DESCRIPTION (L to L/ZW) LAN to LAN/ ACL set for packets traveling from the LAN to the LAN or ZyWALL the ZyWALL. (W to W/ZW) WAN to WAN/...
Page 656: Table 54 Syslog Logs
ZyWALL 5 User’s Guide Table 53 ICMP Notes (continued) TYPE CODE DESCRIPTION Timestamp reply message Information Request Information request message Information Reply Information reply message Syslog Logs There are two types of syslog: event logs and traffic logs. The device generates an event log when a system event occurs, for example, when a user logs in or the device is under attack.
Page 657: Figure 71 Displaying Log Categories Example
ZyWALL 5 User’s Guide Table 55 RFC-2408 ISAKMP Payload Types (continued) LOG DISPLAY PAYLOAD TYPE Key Exchange Identification Certificate Certificate Request CER_REQ Hash HASH Signature Nonce NONCE Notification NOTFY Delete Vendor ID Log Commands Go to the command interpreter interface.
Page 658: Figure 72 Displaying Log Parameters Example
ZyWALL 5 User’s Guide Figure 72 Displaying Log Parameters Example ras> sys logs category access Usage: [0:none/1:log/2:alert/3:both] [0:don't show debug type/ 1:show debug type] 4 Use followed by a log category and a parameter to decide what to sys logs category record.
Page 659: Log Command Example
ZyWALL 5 User’s Guide Log Command Example This example shows how to set the ZyWALL to record the access logs and alerts and then view the results. ras> sys logs load ras> sys logs category access 3 ras> sys logs save ras>...
Page 660 ZyWALL 5 User’s Guide Appendix Q Log Descriptions...
Page 661: Index
ZyWALL 5 User’s Guide Index Numerics 10/100 Mbps Ethernet WAN Backup 384, 492 110V AC Backup WAN 230V AC Bandwidth Borrowing Bandwidth Class Bandwidth Filter 301, 311 Bandwidth Management 47, 301 Bandwidth Management Statistics Bandwidth Manager Class Configuration Bandwidth Manager Class Setup...
Page 662 ZyWALL 5 User’s Guide Client-server Protocol Diffie-Hellman Key Groups Command Interpreter Mode IP Alias Command Line IP Alias Setup Community Port Filter Setup Configuration 66, 85 Setup 427, 428 Configuration File TCP/IP Setup Backup Connecting Cables DNS Server Connection ID/Name...
Page 663 ZyWALL 5 User’s Guide Full Network Management Factory Default Factory LAN Defaults Fairness-based Scheduler Gas Pipes Filename Conventions Gateway IP Addr Filter 413, 438, 463 Gateway IP Address 424, 442 Applying General Setup 371, 397 Configuration Germany, Contact Information Configuring...
Page 664 ZyWALL 5 User’s Guide Internet Access LAND 154, 155 ISP's Name Lightning Internet Access Setup 423, 424, 443 Link type 59, 62, 99 Internet Control Message Protocol (ICMP) Liquids, Corrosive Internet Protocol Security (IPSec) Local Introduction to Filters IP Address...
Page 665 ZyWALL 5 User’s Guide Pairwise Master Key (PMK) 408, 435 Password 372, 390, 395, 424, 477 Nailed-Up Connection 408, 435 Path cost Nailed-up Connection PCMCIA Port Nailed-Up Connections Perfect Forward Secrecy 86, 290, 291, 410, 437, 474 Period(hr) 408, 435...
Page 666 ZyWALL 5 User’s Guide RTS (Request To Send) RTS (Request To Send) threshold RTS Threshold 573, 574 RADIUS 48, 103, 576 RTS/CTS handshake Shared Secret Key 104, 577 Rules 163, 166 RADIUS Message Types 103, 576 Checklist RADIUS Messages Creating Custom...
Page 667 ZyWALL 5 User’s Guide Smurf 155, 156 SNMP 50, 290, 291, 345 Community TCP Maximum Incomplete 182, 183, 184 Configuration TCP Security Manager TCP/IP 153, 154, 343, 409, 416, 418, 428, 436, 468, MIBs 469, 471, 474 Trap Setup Trusted Host...
Page 668 ZyWALL 5 User’s Guide UPnP Port Mapping Upper Layer Protocols 159, 160 www.dyndns.org User Authentication User Name User Profiles User Specified IP Addr Xmodem File Upload XMODEM Protocol Vendor Ventilation Slots Virtual Private Network Voltage Supply ZyNOS 482, 492 Voltage, High...