Sign In
Upload
Manuals
Brands
ZyXEL Communications Manuals
Gateway
ZyWALL II/50
ZyXEL Communications ZyWALL II/50 Manuals
Manuals and User Guides for ZyXEL Communications ZyWALL II/50. We have
1
ZyXEL Communications ZyWALL II/50 manual available for free PDF download: User Manual
ZyXEL Communications ZyWALL II/50 User Manual (342 pages)
Internet Security Gateway
Brand:
ZyXEL Communications
| Category:
Gateway
| Size: 3 MB
Table of Contents
Information for Canadian Users
4
Declaration of Conformity
5
Zyxel Limited Warranty
6
Customer Support
7
Warranty Information
7
Table of Contents
8
List of Figures
20
List of Diagrams
31
Preface
33
Syntax Conventions
34
Getting Started
35
Chapter 1 Getting to Know Your Zywall
37
The Zywall 10/10 II/50 Internet Security Gateway
37
Features
37
Applications
40
Secure Broadband Internet Access Via Cable or DSL Modem
40
Figure 1-1 Secure Internet Access Via Cable
40
Figure 1-2 Secure Internet Access Via DSL
40
VPN Application
41
Figure 1-3 VPN Application
41
Chapter 2 Hardware Installation
43
Front Panel Leds and Back Panel Ports
43
Front Panel Leds
43
Figure 2-1 Front Panel
43
Table 2-1 LED Descriptions
43
Zywall Rear Panel and Connections
44
Figure 2-2 Zywall 10 Rear Panel and Connections
45
Figure 2-3 Zywall 10 II/50Rear Panel and Connections
46
Specifications
47
Additional Installation Requirements
48
Chapter 3 Initial Setup
49
Turning on Your Zywall
49
Initial Screen
49
Entering the Password
49
Figure 3-1 Initial Screen
49
Navigating the SMT Interface
50
Figure 3-2 Password Screen
50
Table 3-1 Main Menu Commands
50
Figure 3-3 Zywall Main Menu
51
Main Menu
51
System Management Terminal Interface Summary
51
Table 3-2 Main Menu Summary
51
Figure 3-4 Getting Started and Advanced Applications SMT Menus
53
SMT Menus at a Glance
53
Figure 3-5 Advanced Management SMT Menus
54
Changing the System Password
55
Figure 3-6 Ipsec VPN Configuration SMT Menus
55
Figure 3-7 Menu 23 - System Password
55
Resetting the Zywall
56
Methods of Restoring Factory-Defaults
56
Procedure to Use the Reset Button
57
Chapter 4 General and WAN Setup
59
System Name
59
Dynamic DNS
59
DYNDNS Wildcard
60
General Setup
60
Figure 4-1 Menu 1 - General Setup
60
Table 4-1 General Setup Menu Field
60
Figure 4-2 Configure Dynamic DNS
61
Table 4-2 Configure Dynamic DNS Menu Fields
61
Configuring Dynamic Dns
61
WAN Setup
63
Figure 4-3 Menu 2 - WAN Setup
63
Table 4-3 WAN Setup Menu Fields
63
Chapter 5 LAN Setup
65
Introduction
65
LAN Port Filter Setup
65
TCP/IP and DHCP for LAN
65
Figure 5-1 Menu 3 - LAN Setup
65
Figure 5-2 Menu 3.1 - LAN Port Filter Setup
65
DHCP Configuration
66
Factory LAN Defaults
66
IP Address and Subnet Mask
66
Table 5-1 Example of Network Properties for LAN Servers with Fixed IP Addresses
66
Private IP Addresses
67
Table 5-2 Private IP Address Ranges
67
IP Multicast
68
IP Alias
69
RIP Setup
68
Figure 5-3 Physical Network
69
Figure 5-4 Partitioned Logical Networks
69
Figure 5-5 Menu 3 - TCP/IP and DHCP Setup
69
TCP/IP and DHCP Ethernet Setup Menu
69
Figure 5-6 Menu 3.2 - TCP/IP and DHCP Ethernet Setup
70
Table 5-3 DHCP Ethernet Setup Menu Fields
70
IP Alias Setup
71
Table 5-4 LAN TCP/IP Setup Menu Fields
71
Figure 5-7 Menu 3.2.1 - IP Alias Setup
72
Table 5-5 IP Alias Setup Menu Fields
72
Chapter 6 Internet Access
73
Internet Access Setup
73
Ethernet Encapsulation
73
Figure 6-1 Menu 4 - Internet Access Setup (Ethernet)
73
Table 6-1 Internet Access Setup Menu Fields
73
PPTP Encapsulation
74
Configuring the PPTP Client
75
Pppoe Encapsulation
75
Figure 6-2 Internet Access Setup (PPTP)
75
Table 6-2 New Fields in Menu 4 (PPTP) Screen
75
Figure 6-3 Internet Access Setup (Pppoe)
76
Table 6-3 New Fields in Menu 4 (Pppoe) Screen
76
Basic Setup Complete
77
Advanced Applications
79
Chapter 7 Remote Node Setup
81
Remote Node Profile
81
Ethernet Encapsulation
81
Figure 7-1 Menu 11.1 - Remote Node Profile for Ethernet Encapsulation
82
Outgoing Authentication Protocol
84
Figure 7-2 Menu 11.1 - Remote Node Profile for Pppoe Encapsulation
84
PPTP Encapsulation
85
Table 7-2 Fields in Menu 11.1 (Pppoe Encapsulation Specific)
85
Figure 7-3 Menu 11.1 - Remote Node Profile for PPTP Encapsulation
86
Table 7-3 Fields in Menu 11.1 (PPTP Encapsulation)
86
Editing TCP/IP Options (with Ethernet Encapsulation)
87
Figure 7-4 Menu 11.3 - Remote Node Network Layer Options
87
Table 7-4 Remote Node Network Layer Options Menu Fields
87
Editing TCP/IP Options (with PPTP Encapsulation)
88
Figure 7-5 Menu 11.3 - Remote Node Network Layer Options
89
Editing TCP/IP Options (with Pppoe Encapsulation)
90
Remote Node Filter
90
Figure 7-6 Menu 11.5 - Remote Node Filter (Ethernet Encapsulation)
91
Figure 7-7 Menu 11.5 - Remote Node Filter (Pppoe or PPTP Encapsulation)
91
Chapter 8 IP Static Route Setup
93
IP Static Route Setup
93
Figure 8-1 Example of Static Routing Topology
93
Figure 8-2 Menu 12 - IP Static Route Setup
94
Figure 8-3 Menu 12. 1 - Edit IP Static Route
94
Table 8-1 IP Static Route Menu Fields
95
Chapter 9 Network Address Translation (NAT)
97
Introduction
97
NAT Definitions
97
Table 9-1 NAT Definitions
97
What NAT Does
98
How NAT Works
98
NAT Application
99
Figure 9-1 How NAT Works
99
NAT Mapping Types
100
Figure 9-2 NAT Application with IP Alias
100
Table 9-2 NAT Mapping Types
101
Using NAT
102
SUA (Single User Account) Versus NAT
102
Applying NAT
102
Figure 9-3 Menu 4 - Applying NAT for Internet Access
102
Figure 9-4 Menu 11.3 - Applying NAT to the Remote Node
103
NAT Setup
104
Address Mapping Sets
104
Figure 9-5 Menu 15 - NAT Setup
104
Figure 9-6 Menu 15.1 - Address Mapping Sets
104
Figure 9-7 Menu 15.1.1 - SUA Address Mapping Rules
105
Table 9-4 SUA Address Mapping Rules
105
Figure 9-8 Menu 15.1.1 - First Set
107
Figure 9-9 Menu 15.1.1.1 - Editing/Configuring an Individual Rule in a Set
108
NAT Server Sets - Port Forwarding
109
Table 9-6 Menu 15.1.1.1 - Editing/Configuring an Individual Rule in a Set
109
Configuring a Server Behind NAT
110
Table 9-7 Services & Port Numbers
110
Figure 9-10 Menu 15.2 - NAT Server Setup
111
Figure 9-11 Multiple Servers Behind NAT Example
112
General NAT Examples
113
Internet Access Only
113
Figure 9-13 Menu 4 - Internet Access & NAT Example
113
Example 2: Internet Access with an Inside Server
114
Example 3: Multiple Public IP Addresses with Inside Servers
115
Figure 9-15 Menu 15.2 - Specifying an Inside Server
115
Example 4: NAT Unfriendly Application Programs
119
Figure 9-22 Example 4: Menu 15.1.1.1 - Address Mapping Rule
120
Figure 9-23 Example 4: Menu 15.1.1 - Address Mapping Rules
120
Firewall and Content Filters
121
Chapter 10 Firewalls
123
What Is a Firewall
123
Types of Firewalls
123
Packet Filtering Firewalls
123
Application-Level Firewalls
123
Stateful Inspection Firewalls
124
Introduction to Zyxel's Firewall
124
Denial of Service
125
Basics
125
Figure 10-1 Zywall Firewall Application
125
Types of Dos Attacks
126
Table 10-1 Common IP Ports
126
Figure 10-2 Three-Way Handshake
127
Figure 10-3 SYN Flood
127
Figure 10-4 Smurf Attack
128
Table 10-2 ICMP Commands that Trigger Alerts
128
Stateful Inspection
129
Table 10-3 Legal Netbios Commands
129
Table 10-4 Legal SMTP Commands
129
Figure 10-5 Stateful Inspection
130
Stateful Inspection Process
130
Stateful Inspection and the Zywall
131
TCP Security
132
UDP/ICMP Security
132
Upper Layer Protocols
133
Guidelines for Enhancing Security with Your Firewall
133
Security in General
134
Packet Filtering Vs Firewall
134
Packet Filtering
135
Firewall
135
Chapter 11 Introducing the Zywall Firewall
137
Remote Management and the Firewall
137
Access Methods
137
Using Zywall SMT Menus
137
Activating the Firewall
137
Figure 11-1 Menu 21 - Filter and Firewall Setup
137
Viewing the Firewall Log
138
Figure 11-2 Menu 21.2 - Firewall Setup
138
Figure 11-3 Example Firewall Log
138
Table 11-1 View Firewall Log
139
Chapter 12 Using the Zywall Web Configurator
141
Web Configurator Login and Main Menu Screens
141
Enabling the Firewall
142
E-Mail
142
Alerts
142
Figure 12-1 Enabling the Firewall
142
Logs
143
Figure 12-2 E-Mail Screen
143
Table 12-1 E-Mail
144
SMTP Error Messages
145
Example E-Mail Log
145
Table 12-2 SMTP Error Messages
145
Attack Alert
146
Threshold Values
146
Figure 12-3 E-Mail Log
146
Half-Open Sessions
147
Figure 12-4 Attack Alert
148
Table 12-3 Attack Alert
148
Chapter 13 Creating Custom Rules
151
Rules Overview
151
Rule Logic Overview
151
Rule Checklist
151
Security Ramifications
152
Key Fields for Configuring Rules
152
Connection Direction
153
LAN to WAN Rules
153
Figure 13-1 LAN to WAN Traffic
153
WAN to LAN Rules
154
Rule Summary
154
Figure 13-2 WAN to LAN Traffic
154
Figure 13-3 Firewall Rules Summary - First Screen
155
Table 13-1 Firewall Rules Summary - First Screen
155
Predefined Services
157
Table 13-2 Predefined Services
157
Creating/Editing Firewall Rules
160
Figure 13-4 Creating/Editing a Firewall Rule
160
Table 13-3 Creating/Editing a Firewall Rule
160
Source and Destination Addresses
161
Figure 13-5 Adding/Editing Source and Destination Addresses
162
Timeout
163
Factors Influencing Choices for Timeout Values
163
Table 13-4 Adding/Editing Source and Destination Addresses
163
Figure 13-6 Timeout Screen
164
Table 13-5 Timeout Menu
165
Chapter 14 Custom Ports
167
Introduction
167
Figure 14-1 Custom Ports
167
Table 14-1 Custom Ports
168
Creating/Editing a Custom Port
169
Figure 14-2 Creating/Editing a Custom Port
169
Table 14-2 Creating/Editing a Custom Port
170
Chapter 15 Logs
171
Log Screen
171
Figure 15-1 Log Screen
171
Table 15-1 Log Screen
172
Chapter 16 Example Firewall Rules
173
Examples
173
Example 1: Firewall Rule to Allow Web Service from the Internet
173
Figure 16-1 Activate the Firewall
174
Figure 16-2 Example 1: E-Mail Screen
175
Figure 16-3 Example 1: Configuring a Rule
176
Figure 16-4 Example 1: Destination Address for Traffic Originating from the Internet
177
Example 2: Small Office with Mail, FTP and Web Servers
178
Figure 16-5 Example 1: Rule Summary Screen
178
Figure 16-6 Send Alerts When Attacked
179
Figure 16-7 Configuring a POP Custom Port
180
Figure 16-8 Example 2: Local Network Rule 1 Configuration
181
Figure 16-9 Example 2: Local Network Rule Summary
182
Figure 16-10 Example: Internet to Local Network Rule Summary
183
Example 3: DHCP Negotiation and Syslog Connection from the Internet
184
Advanced Management
185
Chapter 18 Filter Configuration
187
About Filtering
187
The Filter Structure of the Zywall
188
Figure 18-1 Outgoing Packet Filtering Process
188
Figure 18-2 Filter Rule Process
189
Configuring a Filter Set
190
Filter Rules Summary Menu
192
Table 18-1 Abbreviations Used in the Filter Rules Summary Menu
192
Table 18-2 Rule Abbreviations Used
192
Configuring a Filter Rule
193
TCP/IP Filter Rule
193
Table 18-3 TCP/IP Filter Rule Menu Fields
194
Filter Configuration
197
Generic Filter Rule
198
Table 18-4 Generic Filter Rule Menu Fields
199
Example Filter
200
Filter Types and NAT
203
Firewall
203
Applying a Filter and Factory Defaults
204
LAN Traffic
204
Remote Node Filters
204
Chapter 19 SNMP Configuration
207
About SNMP
207
Figure 19-1 SNMP Management Model
208
Supported Mibs
209
Configuring SNMP
209
Table 19-1 General SNMP Commands
209
Figure 19-2 Menu 22 - SNMP Configuration
210
Table 19-2 SNMP Configuration Menu Fields
210
SNMP Traps
211
Table 19-3 SNMP Traps
211
Chapter 20 System Information & Diagnosis
213
System Status
213
Figure 20-1 Menu 24 - System Maintenance
213
Figure 20-2 Menu 24.1 - System Maintenance - Status
214
Table 20-1 System Maintenance - Status Menu Fields
214
System Information and Console Port Speed
215
System Information
216
Figure 20-3 Menu 24.2 - System Information and Console Port Speed
216
Figure 20-4 Menu 24.2.1 - System Maintenance - Information
216
Table 20-2 Fields in System Maintenance - Information
216
Console Port Speed
217
Log and Trace
217
Viewing Error Log
217
Figure 20-5 Menu 24.2.2 - System Maintenance - Change Console Port Speed
217
Figure 20-6 Menu 24.3 - System Maintenance - Log and Trace
218
Figure 20-7 Examples of Error and Information Messages
218
UNIX Syslog
219
Figure 20-8 Menu 24.3.2 - System Maintenance - UNIX Syslog
219
Table 20-3 System Maintenance Menu Syslog Parameters
219
Filter Log
221
Ppp Log
221
Call-Triggering Packet
222
Diagnostic
223
Figure 20-9 Call-Triggering Packet Example
223
Figure 20-10 Menu 24.4 - System Maintenance - Diagnostic
224
Wan Dhcp
224
Figure 20-11 WAN & LAN DHCP
225
Table 20-4 System Maintenance Menu Diagnostic
225
Chapter 21 Firmware and Configuration Maintenance
227
Filename Conventions
227
Backup Configuration
228
Table 21-1 Filename Conventions
228
Example of FTP Commands from the Command Line
229
Using the FTP Command from the Command Line
229
Figure 21-2 FTP Session Example
230
GUI-Based FTP Clients
230
Table 21-2 General Commands for GUI-Based FTP Clients
230
TFTP and FTP over WAN will Not Work When
230
Backup Configuration Using TFTP
231
TFTP Command Example
231
Backup Via Console Port
232
Figure 21-3 System Maintenance - Backup Configuration
232
GUI-Based TFTP Clients
232
Table 21-3 General Commands for GUI-Based TFTP Clients
232
Restore Configuration
233
Figure 21-4 System Maintenance - Starting Xmodem Download Screen
233
Figure 21-5 Backup Configuration Example
233
Figure 21-6 Successful Backup Confirmation Screen
233
Procedure to Restore Using FTP
234
Restore Using FTP or TFTP
234
Figure 21-8 Restore Using FTP or TFTP Session Example
235
Figure 21-9 System Maintenance - Restore Configuration
235
Restore Using FTP Session Example
235
Restore Via Console Port
235
Uploading Firmware and Configuration Files
236
Figure 21-10 System Maintenance - Starting Xmodem Download Screen
236
Figure 21-11 Restore Configuration Example
236
Figure 21-12 Successful Restoration Confirmation Screen
236
Configuration File Upload
237
Figure 21-13 Telnet into Menu 24.7.1 - Upload System Firmware
237
Firmware File Upload
237
Figure 21-14 Telnet into Menu 24.7.2 - System Maintenance
238
FTP File Upload Command from the Command Line Example
238
Figure 21-15 FTP Session Example of Firmware File Upload
239
FTP Session Example of Firmware File Upload
239
TFTP File Upload
239
TFTP Upload Command Example
240
Uploading a Firmware File Via Console Port
240
Uploading Via Console Port
240
Example Xmodem Firmware Upload Using Hyperterminal
241
Figure 21-16 Menu 24.7.1 Using the Console Port
241
Figure 21-17 Example Xmodem Upload
241
Example Xmodem Configuration Upload Using Hyperterminal
242
Figure 21-18 Menu 24.7.2 Using the Console Port
242
Uploading a Configuration File Via Console Port
242
Figure 21-19 Example Xmodem Upload
243
Chapter 22 System Maintenance & Information
245
Command Interpreter Mode
245
Call Control Support
246
Figure 22-2 Valid Commands
246
Figure 22-3 Call Control
246
Budget Management
247
Figure 22-4 Budget Management
247
Table 22-1 Budget Management
247
Call History
248
Figure 22-5 Call History
248
Table 22-2 Call History Fields
248
Time and Date Setting
248
Figure 22-6 Menu 24 - System Maintenance
249
Figure 22-7 Menu 24.10 System Maintenance - Time and Date Setting
249
Resetting the Time
250
Table 22-3 Time and Date Setting Fields
250
Chapter 23 Remote Management
253
Telnet
253
Ftp
253
Figure 23-1 Telnet Configuration on a TCP/IP Network
253
Web
254
Remote Management
254
Figure 23-2 Menu 24.11 - Remote Management Control
255
Table 23-1 Menu 24.11 - Remote Management Control
255
Remote Management and NAT
256
Remote Management Limitations
256
System Timeout
257
Call Scheduling and Vpn/Ipsec
259
Chapter 24 Call Scheduling
261
Introduction
261
Figure 24-1 Menu 26 - Schedule Setup
261
Figure 24-2 Schedule Set Setup
262
Table 24-1 Schedule Set Setup Fields
262
Figure 24-3 Applying Schedule Set(S) to a Remote Node (Pppoe)
264
Figure 24-4 Applying Schedule Set(S) to a Remote Node (PPTP)
264
Chapter 25 Introduction to Ipsec
265
Introduction
265
Vpn
265
Ipsec
265
Security Association
265
Other Terminology
265
VPN Applications
266
Figure 25-1 Encryption and Decryption
266
Ipsec Architecture
267
Figure 25-2 VPN Application
267
Figure 25-3 Ipsec Architecture
268
Ipsec Algorithms
268
Key Management
268
Encapsulation
269
Transport Mode
269
Tunnel Mode
269
Ipsec and NAT
269
Figure 25-4 Transport and Tunnel Mode Ipsec Encapsulation
269
Table 25-1 VPN and NAT
270
Chapter 26 Vpn/Ipsec Setup
271
Vpn/Ipsec Setup
271
Figure 26-1 VPN SMT Menu Tree
271
Ipsec Algorithms
272
AH (Authentication Header) Protocol
272
ESP (Encapsulating Security Payload) Protocol
272
Figure 26-2 Menu 27 - Vpn/Ipsec Setup
272
Ipsec Summary
273
Figure 26-3 Ipsec Summary Fields
273
Table 26-1 AH and ESP
273
My IP Address
274
Secure Gateway Address
274
Table 26-2 Telecommuter and Headquarters Configuration Example
274
Figure 26-4 Telecommuter's Zywall Configuration
275
Figure 26-5 Headquarters Zywall Configuration
275
Figure 26-6 Menu 27.1 - Ipsec Summary
276
Table 26-3 Menu 27.1 - Ipsec Summary
276
Ipsec Setup
279
Table 26-4 Menu 27.1.1 — Ipsec Setup
281
IKE Setup
282
IKE Phases
282
Negotiation Mode
283
Figure 26-8 Two Phases to Set up the Ipsec SA
283
Pre-Shared Key
284
Diffie-Hellman (DH) Key Groups
284
Perfect Forward Secrecy (PFS)
284
Figure 26-9 Menu
285
Table 26-5 Menu
285
Manual Setup
287
Active Protocol
287
Security Parameter Index (SPI)
287
Table 26-6 Active Protocol - Encapsulation and Security Protocol
287
Figure 26-10 Menu 27.1.1.2 - Manual Setup
288
Table 26-7 Menu 27.1.1.2 - Manual Setup
288
Chapter 27 SA Monitor
291
Introduction
291
Using SA Monitor
291
Figure 27-1 Menu 27.2 - SA Monitor
291
Table 27-1 Menu 27.2 - SA Monitor
292
Chapter 28 Ipsec Log
295
VPN Initiator Ipsec Log
295
Figure 28-1 Example VPN Initiator Ipsec Log
295
VPN Responder Ipsec Log
296
Figure 28-2 Example VPN Responder Ipsec Log
296
Table 28-1 Sample IKE Key Exchange Logs
296
Table 28-2 Sample Ipsec Logs During Packet Transmission
298
Table 28-3 RFC-2408 ISAKMP Payload Types
298
Troubleshooting, Appendices and Index
301
Chapter 29 Troubleshooting
303
Problems Starting up the Zywall
303
Table 29-1 Troubleshooting the Start-Up of Your Zywall
303
Problems with the LAN Interface
304
Problems with the WAN Interface
304
Table 29-2 Troubleshooting the LAN Interface
304
Table 29-3 Troubleshooting the WAN Interface
304
Problems with Internet Access
305
Problems with the Password
305
Table 29-4 Troubleshooting Internet Access
305
Table 29-5 Troubleshooting the Password
305
Problems with Remote Management
306
Appendix A the Big Picture
307
Appendix B Pppoe
309
Pppoe in Action
309
Benefits of Pppoe
309
How Pppoe Works
310
Appendix C PPTP
311
Appendix D Hardware Specifications
315
Appendix E Important Safety Instructions
317
Appendix F Boot Commands
319
Appendix G Command Interpreter
321
Appendix H Firewall Commands
323
Appendix I Netbios Filter Commands
329
Appendix J Netbios Filter Commands
329
Index
335
Chapter 17 Content Filtering
335
Categories
335
Advertisement
Advertisement
Related Products
ZyXEL Communications ISG50-ISDN
ZyXEL Communications ISG50-PSTN
ZyXEL Communications ISG50
ZyXEL Communications ZyXEL ZyWALL IDP 10
ZyXEL Communications ZYWALL 35 - V4.04
ZyXEL Communications ZYWALL 5 - V4.04
ZyXEL Communications ZYWALL 70 - V4.04
ZyXEL Communications ZYWALL USG 300
ZyXEL Communications ZYWALL 20W -
ZyXEL Communications ZYWALL - CLI
ZyXEL Communications Categories
Gateway
Network Router
Switch
Wireless Router
Adapter
More ZyXEL Communications Manuals
Login
Sign In
OR
Sign in with Facebook
Sign in with Google
Upload manual
Upload from disk
Upload from URL