ZyWALL USG 2000 Unified Security Gateway Default Login Details LAN Port P1 IP Address https://192.168.1.1 User Name admin Password 1234 www.zyxel.com Firmware Version 2.12 Edition 1, 3/2010 www.zyxel.
About This User's Guide About This User's Guide Intended Audience This manual is intended for people who want to want to configure the ZyWALL using the Web Configurator. How To Use This Guide • Read Chapter 1 on page 33 chapter for an overview of features available on the ZyWALL. • Read Chapter 3 on page 51 for web browser requirements and an introduction to the main components, icons and menus in the ZyWALL Web Configurator.
About This User's Guide • Web Configurator Online Help Click the help icon in any screen for help in configuring that screen and supplementary information. Documentation Feedback Send your comments, questions or suggestions to: techwriters@zyxel.com.tw Thank you! The Technical Writing Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park, Hsinchu, 30099, Taiwan. Need More Help? More help is available at www.zyxel.com.
About This User's Guide See http://www.zyxel.com/web/contact_us.php for contact information. Please have the following information ready when you contact an office. • Product model and serial number. • Warranty Information. • Date that you received your device. • Brief description of the problem and the steps you took to solve it.
Document Conventions Document Conventions Warnings and Notes These are how warnings and notes are shown in this User’s Guide. Warnings tell you about things that could harm you or your device. Note: Notes tell you other important information (for example, other things you may need to configure or helpful tips) or recommendations. Syntax Conventions • The ZyWALL may be referred to as the “ZyWALL”, the “device”, the “system” or the “product” in this User’s Guide.
Document Conventions Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The ZyWALL icon is not an exact representation of your device.
Safety Warnings Safety Warnings • Do NOT use this product near water, for example, in a wet basement or near a swimming pool. • Do NOT expose your device to dampness, dust or corrosive liquids. • Do NOT store things on the device. • Do NOT install, use, or service this device during a thunderstorm. There is a remote risk of electric shock from lightning. • Connect ONLY suitable accessories to the device. • Do NOT open the device or unit.
Contents Overview Contents Overview User’s Guide ........................................................................................................................... 31 Introducing the ZyWALL ............................................................................................................ 33 Features and Applications ......................................................................................................... 43 Web Configurator ................................................
Contents Overview Content Filtering ..................................................................................................................... 617 Content Filter Reports ............................................................................................................. 641 Anti-Spam ................................................................................................................................ 649 Device HA ...............................................................
Table of Contents Table of Contents About This User's Guide .......................................................................................................... 3 Document Conventions............................................................................................................ 6 Safety Warnings........................................................................................................................ 8 Contents Overview .......................................................
Table of Contents 3.3 Web Configurator Screens Overview .................................................................................. 53 3.3.1 Title Bar ...................................................................................................................... 54 3.3.2 Navigation Panel ........................................................................................................ 54 3.3.3 Main Window ..................................................................................
Table of Contents 6.2.1 Interface Types ........................................................................................................... 97 6.2.2 Default Interface and Zone Configuration .................................................................. 98 6.3 Terminology in the ZyWALL ................................................................................................. 99 6.4 Packet Flow ................................................................................................
Table of Contents 7.1 How to Configure Interfaces, Port Grouping, and Zones ....................................................119 7.1.1 Configure a WAN Ethernet Interface ........................................................................ 120 7.1.2 Configure Zones ....................................................................................................... 120 7.1.3 Configure Port Grouping .......................................................................................... 121 7.
Table of Contents 7.14 How to Use Active-Passive Device HA ........................................................................... 164 7.14.1 Before You Start ..................................................................................................... 165 7.14.2 Configure Device HA on the Master ZyWALL ........................................................ 166 7.14.3 Configure the Backup ZyWALL .............................................................................. 168 7.14.
Table of Contents 10.6 The DDNS Status Screen ................................................................................................ 236 10.7 IP/MAC Binding Monitor .................................................................................................. 236 10.8 The Login Users Screen ................................................................................................. 238 10.9 Cellular Status Screen ...........................................................................
Table of Contents 13.2 Port Grouping ................................................................................................................. 280 13.2.1 Port Grouping Overview ......................................................................................... 281 13.2.2 Port Grouping Screen ............................................................................................ 281 13.3 Ethernet Summary Screen ..............................................................................
Table of Contents Chapter 16 Routing Protocols................................................................................................................. 363 16.1 Routing Protocols Overview ............................................................................................ 363 16.1.1 What You Can Do in this Chapter .......................................................................... 363 16.1.2 What You Need to Know .......................................................................
Table of Contents 20.2.1 The HTTP Redirect Edit Screen ............................................................................. 400 Chapter 21 ALG ........................................................................................................................................ 401 21.1 ALG Overview ................................................................................................................. 401 21.1.1 What You Can Do in this Chapter ..........................................
Table of Contents 25.1 IPSec VPN Overview ....................................................................................................... 441 25.1.1 What You Can Do in this Chapter .......................................................................... 441 25.1.2 What You Need to Know ........................................................................................ 442 25.1.3 Before You Begin .................................................................................................
Table of Contents 29.1.1 What You Need to Know ........................................................................................ 505 29.2 The Main File Sharing Screen ......................................................................................... 506 29.3 Opening a File or Folder .................................................................................................. 506 29.3.1 Downloading a File ....................................................................................
Table of Contents 33.1.2 What You Need to Know ........................................................................................ 548 33.1.3 Before You Begin ................................................................................................... 550 33.2 Anti-Virus Summary Screen ............................................................................................ 550 33.2.1 Anti-Virus Policy Add or Edit Screen ......................................................................
Table of Contents 35.1.4 Before You Begin ................................................................................................... 598 35.2 The ADP General Screen ................................................................................................ 599 35.3 The Profile Summary Screen .......................................................................................... 600 35.3.1 Base Profiles ........................................................................................
Table of Contents 38.7 Anti-Spam Technical Reference ...................................................................................... 662 Chapter 39 Device HA .............................................................................................................................. 667 39.1 Overview .......................................................................................................................... 667 39.1.1 What You Can Do in this Chapter ..................................
Table of Contents 42.1.1 What You Can Do in this Chapter ...........................................................................711 42.1.2 What You Need to Know .........................................................................................711 42.2 The Service Summary Screen ......................................................................................... 712 42.2.1 The Service Add/Edit Screen ................................................................................. 714 42.
Table of Contents 46.1.3 Verifying a Certificate ............................................................................................. 741 46.2 The My Certificates Screen ............................................................................................. 743 46.2.1 The My Certificates Add Screen ............................................................................ 744 46.2.2 The My Certificates Edit Screen ............................................................................
Table of Contents 50.4 Console Port Speed ......................................................................................................... 789 50.5 DNS Overview ................................................................................................................. 789 50.5.1 DNS Server Address Assignment .......................................................................... 790 50.5.2 Configuring the DNS Screen .........................................................................
Table of Contents 51.1.1 What You Can Do In this Chapter .......................................................................... 833 51.2 Email Daily Report .......................................................................................................... 833 51.3 Log Setting Screens ....................................................................................................... 835 51.3.1 Log Setting Summary ................................................................................
Table of Contents Chapter 57 Product Specifications ......................................................................................................... 891 57.1 3G PCMCIA Card Installation .......................................................................................... 897 Appendix A Log Descriptions ............................................................................................... 899 Appendix B Common Services..................................................................
Table of Contents 30 ZyWALL USG 2000 User’s Guide
P ART I User’s Guide 31
CHAPTER 1 Introducing the ZyWALL This chapter gives an overview of the ZyWALL. It explains the front panel ports, LEDs, introduces the management methods, and lists different ways to start or stop the ZyWALL. 1.1 Overview and Key Default Settings The ZyWALL is a comprehensive security device. Its flexible configuration helps network administrators set up the network and enforce security policies efficiently.
Chapter 1 Introducing the ZyWALL standard EIA rack using a rack-mounting kit. Make sure the rack will safely support the combined weight of all the equipment it contains and that the position of the ZyWALL does not make the rack unstable or top-heavy. Take all necessary precautions to anchor the rack securely before installing the unit. Note: Leave 10 cm of clearance at the sides and 20 cm in the rear. Use a #2 Phillips screwdriver to install the screws.
Chapter 1 Introducing the ZyWALL 3 After attaching both mounting brackets, position the ZyWALL in the rack by lining up the holes in the brackets with the appropriate holes on the rack. Secure the ZyWALL to the rack with the rack-mounting screws. Figure 2 Rack Mounting 1.3 Front Panel This section introduces the ZyWALL’s front panel. Figure 3 ZyWALL Front Panel 1.3.1 Dual Personality Interfaces The ZyWALL’s dual personality interfaces are 1000Base-T/mini-GBIC combo ports.
Chapter 1 Introducing the ZyWALL 1.3.1.1 1000Base-T Ports The 1000Base-T auto-negotiating, auto-crossover Ethernet ports support 100/ 1000 Mbps Gigabit Ethernet so the speed can be 100 Mbps or 1000 Mbps. The duplex mode can be both half or full duplex at 100 Mbps and full duplex only at 1000 Mbps. An auto-negotiating port can detect and adjust to the optimum Ethernet speed (100/1000 Mbps) and duplex mode (full duplex or half duplex) of the connected device.
Chapter 1 Introducing the ZyWALL 1 Insert the transceiver into the slot with the exposed section of PCB board facing down. Figure 4 Transceiver Installation Example 2 Press the transceiver firmly until it clicks into place. Figure 5 Installed Transceiver 3 Push the end of the fiber-optic cable firmly into the transceiver until it locks into place. When the other end of the fiber-optic cable is connected, check the LEDs to verify the link status.
Chapter 1 Introducing the ZyWALL 1 Press down on the top of the fiber-optic cable where it connects to the transceiver to release it. Then pull the fiber-optic cable out. Figure 7 Removing the Fiber-optic Cable Example 2 Open the transceiver’s latch (latch styles vary). Figure 8 Opening the Transceiver’s Latch Example 3 Pull the transceiver out of the slot.
Chapter 1 Introducing the ZyWALL 1.3.2 Maximizing Throughput The ZyWALL has one internal bus for ports P1-P7 and another for port P8. To maximize the ZyWALL’s throughput, use P8 for your connection with the most traffic. Figure 10 Gigabit Interfaces and Internal Buses The ZyWALL has a slot for adding an optional Security Extension Module (SEM) to enhance the ZyWALL’s VPN and /or Unified Threat Management (UTM) capabilities.
Chapter 1 Introducing the ZyWALL Table 1 Front Panel LEDs (continued) LED COLOR STATUS DESCRIPTION SYS Green Red AUX Orange Green CARD Green Off The ZyWALL is turned off. On The ZyWALL is ready and operating normally. Flashing The ZyWALL is self-testing. On The ZyWALL is malfunctioning. Off The AUX port is not connected. On The AUX port has a dial-in management connection. Flashing The AUX port is sending or receiving packets for the dial-in management connection.
Chapter 1 Introducing the ZyWALL Web Configurator The Web Configurator allows easy ZyWALL setup and management using an Internet browser. This User’s Guide provides information about the Web Configurator. Figure 12 Managing the ZyWALL: Web Configurator Command-Line Interface (CLI) The CLI allows you to use text-based commands to configure the ZyWALL. You can access it using remote management (for example, SSH or Telnet) or via the console port.
Chapter 1 Introducing the ZyWALL Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the ZyWALL or remove the power. Not doing so can cause the firmware to become corrupt. Table 3 Starting and Stopping the ZyWALL METHOD DESCRIPTION Turning on the power A cold start occurs when you turn on the power to the ZyWALL. The ZyWALL powers up, checks the hardware, and starts the system processes.
CHAPTER 2 Features and Applications This chapter introduces the main features and applications of the ZyWALL. 2.1 Features The ZyWALL’s security features include VPN, firewall, anti-virus, content filtering, IDP (Intrusion Detection and Prevention), ADP (Anomaly Detection and Protection), and certificates. It also provides bandwidth management, NAT, port forwarding, policy routing, DHCP server and many other powerful features.
Chapter 2 Features and Applications Firewall The ZyWALL’s firewall is a stateful inspection firewall. The ZyWALL restricts access by screening data packets against defined access rules. It can also inspect sessions. For example, traffic from one zone is not allowed unless it is initiated by a computer in another zone first. Intrusion Detection and Prevention (IDP) IDP (Intrusion Detection and Protection) can detect malicious or suspicious packets and respond instantaneously.
Chapter 2 Features and Applications Anti-Virus Scanner With the anti-virus packet scanner, your ZyWALL scans files transmitting through the enabled interfaces into the network. The ZyWALL helps stop threats at the network edge before they reach the local host computers. Anti-Spam The anti-spam feature can mark or discard spam. Use the white list to identify legitimate e-mail. Use the black list to identify spam e-mail.
Chapter 2 Features and Applications 2.2.1 VPN Connectivity Set up VPN tunnels with other companies, branch offices, telecommuters, and business travelers to provide secure access to your network. You can also set up additional connections to the Internet to provide better service. Figure 13 Applications: VPN Connectivity 2.2.2 SSL VPN Network Access You can configure the ZyWALL to provide SSL VPN network access to remote users. There are two SSL VPN network access modes: reverse proxy and full tunnel.
Chapter 2 Features and Applications You do not have to install additional client software on the remote user computers for access. Figure 14 Network Access Mode: Reverse Proxy https;// LAN (192.168.1.X) Web Mail File Share Web-based Application 2.2.2.2 Full Tunnel Mode In full tunnel mode, a virtual connection is created for remote users with private IP addresses in the same subnet as the local network.
Chapter 2 Features and Applications 2.2.3 User-Aware Access Control Set up security policies that restrict access to sensitive information and shared resources based on the user who is trying to access it. Figure 16 Applications: User-Aware Access Control 2.2.4 Multiple WAN Interfaces Set up multiple connections to the Internet on the same port, or set up multiple connections on different ports. In either case, you can balance the loads between them.
Chapter 2 Features and Applications 2.2.5 Device HA Set up an additional ZyWALL as a backup gateway to ensure the default gateway is always available for the network.
Chapter 2 Features and Applications 50 ZyWALL USG 2000 User’s Guide
CHAPTER 3 Web Configurator The ZyWALL Web Configurator allows easy ZyWALL setup and management using an Internet browser. 3.1 Web Configurator Requirements In order to use the Web Configurator, you must • Use Internet Explorer 7 or later, or Firefox 1.5 or later • Allow pop-up windows (blocked by default in Windows XP Service Pack 2) • Enable JavaScript (enabled by default) • Enable Java permissions (enabled by default) • Enable cookies The recommended screen resolution is 1024 x 768 pixels. 3.
Chapter 3 Web Configurator 2 Open your web browser, and go to http://192.168.1.1. By default, the ZyWALL automatically routes this request to its HTTPS server, and it is recommended to keep this setting. The Login screen appears. Figure 19 Login Screen 3 Type the user name (default: “admin”) and password (default: “1234”). If your account is configured to use an ASAS authentication server, use the OTP (One-Time Password) token to generate a number. Enter it in the One-Time Password field.
Chapter 3 Web Configurator 5 The screen above appears every time you log in using the default user name and default password. If you change the password for the default user account, this screen does not appear anymore. Follow the directions in this screen. If you change the default password, the Login screen (Figure 19 on page 52) appears after you click Apply.
Chapter 3 Web Configurator 3.3.1 Title Bar The title bar provides some icons in the upper right corner. Figure 22 Title Bar The icons provide the following functions. Table 4 Title Bar: Web Configurator Icons LABEL DESCRIPTION Logout Click this to log out of the Web Configurator. Help Click this to open the help page for the current screen. About Click this to display basic information about the ZyWALL. Site Map Click this to see an overview of links to the Web Configurator screens.
Chapter 3 Web Configurator hide the navigation panel menus or drag it to resize them. The following sections introduce the ZyWALL’s navigation panel menus and their screens. Figure 23 Navigation Panel 3.3.2.1 Dashboard The dashboard displays general device information, system status, system resource usage, licensed service status, and interface status in widgets that you can re-arrange to suit your needs. See Chapter 9 on page 209 for details on the dashboard. 3.3.2.
Chapter 3 Web Configurator Table 5 Monitor Menu Screens Summary (continued) FOLDER OR LINK TAB Cellular Status FUNCTION Displays details about the ZyWALL’s 3G connection status. AppPatrol Statistics Displays bandwidth and protocol statistics. VPN Monitor IPSec Displays and manages the active IPSec SAs. SSL Lists users currently logged into the VPN SSL client portal. You can also log out individual users and delete related session information.
Chapter 3 Web Configurator Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK Interface Routing TAB FUNCTION Port Grouping Configure physical port groups. Ethernet Manage Ethernet interfaces and virtual Ethernet interfaces. PPP Create and manage PPPoE and PPTP interfaces. Cellular Configure a cellular Internet connection for an installed 3G card. VLAN Create and manage VLAN interfaces and virtual VLAN interfaces.
Chapter 3 Web Configurator Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK L2TP VPN AppPatrol TAB FUNCTION L2TP VPN Configure L2TP Over IPSec VPN settings. General Enable or disable traffic management by application and see registration and signature information. Common Manage traffic of the most commonly used web, file transfer and e-mail protocols. IM Manage instant messenger traffic. Peer to Peer Manage peer-to-peer traffic. VoIP Manage VoIP traffic.
Chapter 3 Web Configurator Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK User/Group Address Service TAB FUNCTION User Create and manage users. Group Create and manage groups of users. Setting Manage default settings for all users, general settings for user sessions, and rules to force user authentication. Address Create and manage host, range, and network (subnet) addresses. Address Group Create and manage groups of addresses.
Chapter 3 Web Configurator Table 6 Configuration Menu Screens Summary (continued) FOLDER OR LINK TAB FUNCTION TELNET Configure telnet server settings for the ZyWALL. FTP Configure FTP server settings. SNMP Configure SNMP communities and services. Dial-in Mgmt. Configure settings for an out of band management connection through a modem connected to the AUX port. Vantage CNM Configure and allow your ZyWALL to be managed by the Vantage CNM server. Language Select the Web Configurator language.
Chapter 3 Web Configurator 3.3.3.1 Warning Messages Warning messages, such as those resulting from misconfiguration, display in a popup window. Figure 24 Warning Message 3.3.3.2 Site Map Click Site MAP to see an overview of links to the Web Configurator screens. Click a screen’s link to go to that screen. Figure 25 Site Map 3.3.3.3 Object Reference Click Object Reference to open the Object Reference screen.
Chapter 3 Web Configurator settings reference the object. The following example shows which configuration settings reference the ldap-users user object (in this case the first firewall rule). Figure 26 Object Reference The fields vary with the type of object. The following table describes labels that can appear in this screen. Table 8 Object References 62 LABEL DESCRIPTION Object Name This identifies the object for which the configuration settings that use it are displayed.
Chapter 3 Web Configurator 3.3.3.4 CLI Messages Click CLI to look at the CLI commands sent by the Web Configurator. These commands appear in a popup window, such as the following. Figure 27 CLI Messages Click Clear to remove the currently displayed information. See the Command Reference Guide for information about the commands. 3.3.4 Tables and Lists The Web Configurator tables and lists are quite flexible and provide several options for how to display their entries. 3.3.4.
Chapter 3 Web Configurator • Sort in ascending alphabetical order • Sort in descending (reverse) alphabetical order • Select which columns to display • Group entries by field • Show entries in groups • Filter by mathematical operators (<, >, or =) or searching for text Figure 29 Common Table Column Options 3 Select a column heading cell’s right border and drag to re-size the column.
Chapter 3 Web Configurator 4 Select a column heading and drag and drop it to change the column order. A green check mark displays next to the column’s title when you drag the column to a valid new location. Figure 31 Changing the Column Order 5 Use the icons and fields at the bottom of the table to navigate to different pages of entries and control how many entries display at a time. Figure 32 Navigating Pages of Table Entries 3.3.4.
Chapter 3 Web Configurator Here are descriptions for the most common table icons. Table 9 Common Table Icons LABEL DESCRIPTION Add Click this to create a new entry. For features where the entry’s position in the numbered list is important (features where the ZyWALL applies the table’s entries in order like the firewall for example), you can select an entry and click Add to create a new entry after the selected entry.
CHAPTER 4 Installation Setup Wizard 4.1 Installation Setup Wizard Screens If you log into the Web Configurator when the ZyWALL is using its default configuration, the first Installation Setup Wizard screen displays. This wizard helps you configure Internet connection settings and activate subscription services. This chapter provides information on configuring the Web Configurator's installation setup wizard. See the feature-specific chapters in this User’s Guide for background information.
Chapter 4 Installation Setup Wizard 4.1.1 Internet Access Setup - WAN Interface Use this screen to set how many WAN interfaces to configure and the first WAN interface’s type of encapsulation and method of IP address assignment. The screens vary depending on the encapsulation type. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you don’t have that information. Note: Enter the Internet access information exactly as your ISP gave it to you.
Chapter 4 Installation Setup Wizard Note: Enter the Internet access information exactly as given to you by your ISP. Figure 37 Internet Access: Ethernet Encapsulation • Encapsulation: This displays the type of Internet connection you are configuring. • First WAN Interface: This is the number of the interface that will connect with your ISP. • Zone: This is the security zone to which this interface and Internet connection will belong. • IP Address: Enter your (static) public IP address.
Chapter 4 Installation Setup Wizard 4.1.3 Internet Access: PPPoE Note: Enter the Internet access information exactly as given to you by your ISP. Figure 38 Internet Access: PPPoE Encapsulation 4.1.3.1 ISP Parameters • Type the PPPoE Service Name from your service provider. PPPoE uses a service name to identify and reach the PPPoE server. You can use alphanumeric and _@$./ characters, and it can be up to 64 characters long.
Chapter 4 Installation Setup Wizard 4.1.3.2 WAN IP Address Assignments • WAN Interface: This is the name of the interface that will connect with your ISP. • Zone: This is the security zone to which this interface and Internet connection will belong. • IP Address: Enter your (static) public IP address. Auto displays if you selected Auto as the IP Address Assignment in the previous screen. • First / Second DNS Server: These fields display if you selected static IP address assignment.
Chapter 4 Installation Setup Wizard • CHAP/PAP - Your ZyWALL accepts either CHAP or PAP when requested by the remote node. • CHAP - Your ZyWALL accepts CHAP only. • PAP - Your ZyWALL accepts PAP only. • MSCHAP - Your ZyWALL accepts MSCHAP only. • MSCHAP-V2 - Your ZyWALL accepts MSCHAP-V2 only. • Type the User Name given to you by your ISP. You can use alphanumeric and _@$./ characters, and it can be up to 31 characters long. • Type the Password associated with the user name.
Chapter 4 Installation Setup Wizard 4.1.6 Internet Access Setup - Second WAN Interface If you selected I have two ISPs, after you configure the First WAN Interface, you can configure the Second WAN Interface. The screens for configuring the second WAN interface are similar to the first (see Section 4.1.1 on page 68). Figure 40 Internet Access: Step 3: Second WAN Interface 4.1.7 Internet Access - Finish You have set up your ZyWALL to access the Internet.
Chapter 4 Installation Setup Wizard Note: If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. Click Next and use the following screen to perform a basic registration (see Section 4.2 on page 74). If you want to do a more detailed registration or manage your account details, click myZyXEL.com. Alternatively, close the window to exit the wizard. 4.2 Device Registration Use this screen to register your ZyWALL with myZXEL.
Chapter 4 Installation Setup Wizard • Select existing myZyXEL.com account if you already have an account at myZyXEL.com and enter your user name and password in the fields below to register your ZyWALL. • Enter a User Name for your myZyXEL.com account. Use from six to 20 alphanumeric characters (and the underscore). Spaces are not allowed. Click Check to verify that it is available. • Password: Use six to 20 alphanumeric characters (and the underscore). Spaces are not allowed.
Chapter 4 Installation Setup Wizard 76 ZyWALL USG 2000 User’s Guide
CHAPTER 5 Quick Setup 5.1 Quick Setup Overview The Web Configurator's quick setup wizards help you configure Internet and VPN connection settings. This chapter provides information on configuring the quick setup screens in the Web Configurator. See the feature-specific chapters in this User’s Guide for background information. In the Web Configurator, click Configuration > Quick Setup to open the first Quick Setup screen.
Chapter 5 Quick Setup 5.2 WAN Interface Quick Setup Click WAN Interface in the main Quick Setup screen to open the WAN Interface Quick Setup Wizard Welcome screen. Use these screens to configure an interface to connect to the internet. Click Next. Figure 45 WAN Interface Quick Setup Wizard 5.2.1 Choose an Ethernet Interface Select the Ethernet interface that you want to configure for a WAN connection and click Next. Figure 46 Choose an Ethernet Interface 5.2.
Chapter 5 Quick Setup Otherwise, choose PPPoE or PPTP for a dial-up connection according to the information from your ISP. Figure 47 WAN Interface Setup: Step 2 The screens vary depending on what encapsulation type you use. Refer to information provided by your ISP to know what to enter in each field. Leave a field blank if you don’t have that information. Note: Enter the Internet access information exactly as your ISP gave it to you. 5.2.
Chapter 5 Quick Setup • IP Address Assignment: Select Auto If your ISP did not assign you a fixed IP address. Select Static If the ISP assigned a fixed IP address. 5.2.4 WAN and ISP Connection Settings Use this screen to configure the ISP and WAN interface settings. This screen is read-only if you set the IP Address Assignment to Static. Note: Enter the Internet access information exactly as your ISP gave it to you.
Chapter 5 Quick Setup Table 10 WAN and ISP Connection Settings (continued) LABEL DESCRIPTION Authentication Use the drop-down list box to select an authentication protocol for Type outgoing calls. Options are: CHAP/PAP - Your ZyWALL accepts either CHAP or PAP when requested by this remote node. CHAP - Your ZyWALL accepts CHAP only. PAP - Your ZyWALL accepts PAP only. MSCHAP - Your ZyWALL accepts MSCHAP only. MSCHAP-V2 - Your ZyWALL accepts MSCHAP-V2 only.
Chapter 5 Quick Setup Table 10 WAN and ISP Connection Settings (continued) LABEL First DNS Server Second DNS Server DESCRIPTION These fields only display for an interface with a static IP address. Enter the DNS server IP address(es) in the field(s) to the right. Leave the field as 0.0.0.0 if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it.
Chapter 5 Quick Setup Table 11 Interface Wizard: Summary WAN LABEL DESCRIPTION Server IP This field only appears for a PPTP interface. It displays the IP address of the PPTP server. User Name This is the user name given to you by your ISP. Nailed-Up If No displays the connection will not time out. Yes means the ZyWALL uses the idle timeout. Idle Timeout This is how many seconds the connection can be idle before the router automatically disconnects from the PPPoE server. 0 means no timeout.
Chapter 5 Quick Setup 5.4 VPN Setup Wizard: Wizard Type A VPN (Virtual Private Network) tunnel is a secure connection to another computer or network. Use this screen to select which type of VPN connection you want to configure. Figure 52 VPN Setup Wizard: Wizard Type Express: Use this wizard to create a VPN connection with another ZLD-based ZyWALL using a pre-shared key and default security settings. Advanced: Use this wizard to configure detailed VPN security settings such as using certificates.
Chapter 5 Quick Setup 5.5 VPN Express Wizard - Scenario Click the Express radio button as shown in Figure 52 on page 84 to display the following screen. Figure 53 VPN Express Wizard: Step 2 Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select the scenario that best describes your intended VPN connection.
Chapter 5 Quick Setup 5.5.1 VPN Express Wizard - Configuration Figure 54 VPN Express Wizard: Step 3 • Secure Gateway: If Any displays in this field, it is not configurable for the chosen scenario. If this field is configurable, enter the WAN IP address or domain name of the remote IPSec device (secure gateway) to identify the remote IPSec router by its IP address or a domain name. Use 0.0.0.0 if the remote IPSec router has a dynamic WAN IP address. • Pre-Shared Key: Type the password.
Chapter 5 Quick Setup 5.5.2 VPN Express Wizard - Summary This screen provides a read-only summary of the VPN tunnel’s configuration and also commands that you can copy and paste into another ZLD-based ZyWALL’s command line interface to configure it. Figure 55 VPN Express Wizard: Step 4 • Rule Name: Identifies the VPN gateway policy. • Secure Gateway: IP address or domain name of the remote IPSec device. If this field displays Any, only the remote IPSec device can initiate the VPN connection.
Chapter 5 Quick Setup 5.5.3 VPN Express Wizard - Finish Now you can use the VPN tunnel. Figure 56 VPN Express Wizard: Step 6 Note: If you have not already done so, use the myZyXEL.com link and register your ZyWALL with myZyXEL.com and activate trials of services like IDP. Click Close to exit the wizard.
Chapter 5 Quick Setup 5.5.4 VPN Advanced Wizard - Scenario Click the Advanced radio button as shown in Figure 52 on page 84 to display the following screen. Figure 57 VPN Advanced Wizard: Scenario Rule Name: Type the name used to identify this VPN connection (and VPN gateway). You may use 1-31 alphanumeric characters, underscores (_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. Select the scenario that best describes your intended VPN connection.
Chapter 5 Quick Setup • Remote Access (Client Role) - Choose this to connect to an IPSec server. This ZyWALL is the client (dial-in user) and can initiate the VPN tunnel. 5.5.5 VPN Advanced Wizard - Phase 1 Settings There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA (Security Association).
Chapter 5 Quick Setup that uses a 168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. AES128 uses a 128-bit key and is faster than 3DES. AES192 uses a 192-bit key and AES256 uses a 256-bit key. • Authentication Algorithm: MD5 gives minimal security. SHA-1 gives higher security. MD5 (Message Digest 5) and SHA1 (Secure Hash Algorithm) are hash algorithms used to authenticate packet data.
Chapter 5 Quick Setup 5.5.6 VPN Advanced Wizard - Phase 2 Phase 2 in an IKE uses the SA that was established in phase 1 to negotiate SAs for IPSec. Figure 59 VPN Advanced Wizard: Step 4 • Active Protocol: ESP is compatible with NAT, AH is not. • Encapsulation: Tunnel is compatible with NAT, Transport is not. • Encryption Algorithm: 3DES and AES use encryption. The longer the AES key, the higher the security (this may affect throughput). Null uses no encryption.
Chapter 5 Quick Setup • Nailed-Up: This displays for the site-to-site and remote access client role scenarios. Select this to have the ZyWALL automatically renegotiate the IPSec SA when the SA life time expires. 5.5.7 VPN Advanced Wizard - Summary This is a read-only summary of the VPN tunnel settings. Figure 60 VPN Advanced Wizard: Step 5 • Rule Name: Identifies the VPN connection (and the VPN gateway). • Secure Gateway: IP address or domain name of the remote IPSec device.
Chapter 5 Quick Setup 5.5.8 VPN Advanced Wizard - Finish Now you can use the VPN tunnel. Figure 61 VPN Wizard: Step 6: Advanced Note: If you have not already done so, you can register your ZyWALL with myZyXEL.com and activate trials of services like IDP. Click Close to exit the wizard.
CHAPTER 6 Configuration Basics This information is provided to help you configure the ZyWALL effectively. Some of it is helpful when you are just getting started. Some of it is provided for your reference when you configure various features in the ZyWALL. • Section 6.1 on page 95 introduces the ZyWALL’s object-based configuration. • Section 6.2 on page 96 introduces zones, interfaces, and port groups. • Section 6.
Chapter 6 Configuration Basics objects whenever the interface’s IP address settings change. For example, if you change an Ethernet interface’s IP address, the ZyWALL automatically updates the rules or settings that use the interface-based, LAN subnet address object. You can use the Configuration > Objects screens to create objects before you configure features that use them. If you are in a screen that uses objects, you can also usually select Create new Object to be able to configure a new object.
Chapter 6 Configuration Basics 6.2.1 Interface Types There are many types of interfaces in the ZyWALL. In addition to being used in various features, interfaces also describe the network that is directly connected to the ZyWALL. • Ethernet interfaces are the foundation for defining other interfaces and network policies. You also configure RIP and OSPF in these interfaces. • Port groups create a hardware connection between physical ports at the layer2 (data link, MAC address) level.
Chapter 6 Configuration Basics 6.2.2 Default Interface and Zone Configuration This section introduces the ZyWALL’s default zone member physical interfaces and the default configuration of those interfaces. The following figure uses letters to denote public IP addresses or part of a private IP address. Figure 63 Default Network Topology Table 13 Default Port, Interface, and Zone Configuration PORT ADDRESS AND DHCP SUGGESTED USE WITH INTERFACE ZONE IP SETTINGS DEFAULT SETTINGS P1 ge1 LAN 192.168.1.
Chapter 6 Configuration Basics • The DMZ zone contains the ge4, ge5, and ge6 interfaces (physical ports P4, P5, and P6). The DMZ zone has servers that are available to the public. These interface uses private IP addresses 192.168.2.1, 192.168.3.1, and 192.168.4.1. • Interfaces ge7 and ge8 interfaces (physical ports P7 and P8) are not part of a zone by default. Add them to zones to apply security policies. 6.
Chapter 6 Configuration Basics 6.4 Packet Flow Here is the order in which the ZyWALL applies its features and checks. Figure 64 Packet Flow 6.4.1 ZLD 2.20 Packet Flow Enhancements ZLD version 2.20 has been enhanced to simplify configuration. The packet flow has been changed as follows: • Automatic SNAT and WAN trunk routing for traffic going from internal to external interfaces (you don’t need to configure anything to all LAN to WAN or WLAN to WAN traffic).
Chapter 6 Configuration Basics • You do not need to set up policy routes for 1:1 NAT entries. • You can create Many 1:1 NAT entries to translate a range of private network addresses to a range of public IP addresses • Static and dynamic routes have their own category. Even with these changes, you can still use an existing configuration file from the previous version. 6.4.2 Routing Table Checking Flow Enhancements When the ZyWALL receives packets it defragments them and applies destination NAT.
Chapter 6 Configuration Basics 2 Policy Routes: These are the user-configured policy routes. Configure policy routes to send packets through the appropriate interface or VPN tunnel. See Chapter 15 on page 347 for more on policy routes. 3 1 to 1 and Many 1 to 1 NAT: These are the 1 to 1 NAT and many 1 to 1 NAT rules.
Chapter 6 Configuration Basics ZyWALL stops checking the packets against the NAT table and moves on to bandwidth management. Figure 66 NAT Table Checking Flow 1 SNAT defined in the policy routes. This was already in ZLD 2.1x. 2 1 to 1 SNAT (including Many 1 to 1) is also included in the NAT table. 3 NAT loopback is now included in the NAT table instead of requiring a separate policy route. 4 SNAT is also now performed by default and included in the NAT table. 6.
Chapter 6 Configuration Basics 6.5.1 Feature This provides a brief description. See the appropriate chapter(s) in this User’s Guide for more information about any feature. MENU ITEM(S) This shows you the sequence of menu items and tabs you should click to find the main screen(s) for this feature. See the web help or the related User’s Guide chapter for information about each screen. These are other features you should configure before you configure the main screen(s) for this feature.
Chapter 6 Configuration Basics subscription to update the anti-virus and IDP/application patrol signatures You must have Internet access to myZyXEL.com. MENU ITEM(S) Configuration > Licensing > Update Registration (for anti-virus and IDP/application patrol), Internet PREREQUISITES access to myZyXEL.com 6.5.4 Interface See Section 6.2 on page 96 for background information. Note: When you create an interface, there is no security applied on it until you assign it to a zone.
Chapter 6 Configuration Basics and general NAT on the source address. You have to set up the criteria, next-hops, and NAT settings first.
Chapter 6 Configuration Basics 6.5.7 Static Routes Use static routes to tell the ZyWALL about networks not directly connected to the ZyWALL. MENU ITEM(S) Configuration > Network > Routing > Static Route PREREQUISITES Interfaces 6.5.8 Zones See Section 6.2 on page 96 for background information. A zone is a group of interfaces and VPN tunnels. The ZyWALL uses zones, not interfaces, in many security settings, such as firewall rules and remote management. Zones cannot overlap.
Chapter 6 Configuration Basics The ZyWALL only checks regular (through-ZyWALL) firewall rules for packets that are redirected by NAT, it does not check the to-ZyWALL firewall rules. MENU ITEM(S) Configuration > Network > NAT PREREQUISITES Interfaces, addresses (HOST) Example: Suppose you have an FTP server with a private IP address connected to a DMZ port. You could configure a NAT rule to forwards FTP sessions from the WAN to the DMZ. 1 Click Configuration > Network > NAT to configure the NAT entry.
Chapter 6 Configuration Basics 3 Name the entry. 4 Select the interface from which you want to redirect incoming HTTP requests (ge1). 5 Specify the IP address of the HTTP proxy server. 6 Specify the port number to use for the HTTP traffic that you forward to the proxy server. 6.5.12 ALG The ZyWALL’s Application Layer Gateway (ALG) allows VoIP and FTP applications to go through NAT on the ZyWALL. You can also specify additional signaling port numbers. MENU ITEM(S) Configuration > Network > ALG 6.
Chapter 6 Configuration Basics Example: Suppose you have a SIP proxy server connected to the DMZ zone for VoIP calls. You could configure a firewall rule to allow VoIP sessions from the SIP proxy server on DMZ to the LAN so VoIP users on the LAN can receive calls. 1 Create a VoIP service object for UDP port 5060 traffic (Configuration > Object > Service). 2 Create an address object for the VoIP server (Configuration > Object > Address).
Chapter 6 Configuration Basics WHERE USED Policy routes, zones Example: See Chapter 7 on page 119. 6.5.17 L2TP VPN Use L2TP VPN to let remote users use the L2TP and IPSec client software included with their computers’ operating systems to securely connect to the network behind the ZyWALL.
Chapter 6 Configuration Basics Note: With this example, Bob would have to log in using his account. If you do not want him to have to log in, you might create an exception policy with Bob’s computer IP address as the source. 6.5.19 Anti-Virus Use anti-virus to detect and take action on viruses. You must subscribe to use anti-virus. You can subscribe using the Licensing > Registration screens or one of the wizards. MENU ITEM(S) Configuration > Anti-X > AV PREREQUISITES Registration, zones 6.5.
Chapter 6 Configuration Basics 1 Create a user account for Bill if you have not done so already (Configuration > Object > User/Group). 2 Create a schedule for the work day (Configuration > Object > Schedule). 3 Click Configuration > Anti-X > Content Filter > Filter Profile. Click the Add icon to go to the screen where you can configure a category-based profile. 4 Name the profile and enable it. 5 Enable the external web filter service.
Chapter 6 Configuration Basics 6.6 Objects Objects store information and are referenced by other features. If you update this information in response to changes, the ZyWALL automatically propagates the change through the features that use the object. Move your cursor over a configuration object that has a magnifying-glass icon (such as a user group, address, address group, service, service group, zone, or schedule) to display basic information about the object. The following table introduces the objects.
Chapter 6 Configuration Basics Table 19 User Types TYPE ABILITIES guest Access network services ext-user The same as a user or a guest except the ZyWALL looks for the specific type in an external authentication server. If the type is not available, the ZyWALL applies default settings. ext-group-user External group user account. If you want to force users to log in to the ZyWALL before the ZyWALL routes traffic for them, you might have to configure prerequisites first.
Chapter 6 Configuration Basics 2 Create an address object for the administrator’s computer (Configuration > Object > Address). 3 Click Configuration > System > WWW to configure the HTTP management access. Enable HTTPS and add an administrator service control entry. • Select the address object for the administrator’s computer. • Select the WAN zone. • Set the action to Accept. 6.7.
Chapter 6 Configuration Basics Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the ZyWALL or remove the power. Not doing so can cause the firmware to become corrupt.
Chapter 6 Configuration Basics 118 ZyWALL USG 2000 User’s Guide
CHAPTER 7 Tutorials Here are examples of using the Web Configurator to set up features in the ZyWALL. See also Chapter 8 on page 171 for an example of configuring L2TP VPN. Note: The tutorials featured here require a basic understanding of connecting to and using the Web Configurator, see Chapter 3 on page 51 for details. For field descriptions of individual screens, see Technical Reference on page 207. 7.
Chapter 7 Tutorials • You want to be able to apply security settings specifically for all VPN tunnels so you create a new VPN zone. Figure 67 Ethernet Interface, Port Grouping, and Zone Configuration Example 7.1.1 Configure a WAN Ethernet Interface You need to assign the ZyWALL’s ge2 interface a static IP address of 1.2.3.4. Click Configuration > Network > Interface > Ethernet and double-click the ge2 interface’s entry.
Chapter 7 Tutorials 1 Click Configuration > Network > Zone and then the Add icon. 2 Enter VPN as the name, select Default_L2TP_VPN_Connection and move it to the Member box and click OK. Figure 69 Configuration > Network > Zone > WAN Edit 7.1.3 Configure Port Grouping Here is how to combine physical ports P4 and P5 into the ge4 interface port group. 1 Click Configuration > Network > Interface > Port Grouping.
Chapter 7 Tutorials 2 Drag physical port 5 onto representative interface ge4 and click Apply. Figure 70 Configuration > Network > Interface > Port Grouping Example 3 Click Dashboard, and look at the Interface Status Summary. Ethernet interface ge4 has a status of Port Group Up if it is connected or Port Group Down if it is not connected. Ethernet interfaces ge5 has a Status of Port Group Inactive. Figure 71 Dashboard: Interface Status Summary After Port Grouping 7.
Chapter 7 Tutorials 3 Click Configuration > Network > Interface > Cellular. Select the 3G device’s entry and click Edit. Figure 72 Configuration > Network > Interface > Cellular 4 Enable the interface and add it to a zone. It is highly recommended that you set the Zone to WAN to apply your WAN zone security settings to this 3G connection. Leaving Zone set to none has the ZyWALL not apply any security settings to the 3G connection.
Chapter 7 Tutorials 5 Go to the Dashboard. The Interface Status Summary section should contain a “cellular” entry. When its connection status is Connected you can use the 3G connection to access the Internet. Figure 74 Status 6 The ZyWALL automatically adds the cellular interface to the system default WAN trunk. If the ZyWALL is using a user-configured trunk as its default trunk and you want this cellular interface to be part of it, use the Trunk screens to add it.
Chapter 7 Tutorials You do not have to change many of the ZyWALL’s settings from the defaults to set up this trunk. You only have to set up the outgoing bandwidth on each of the WAN interfaces and configure the WAN_TRUNK trunk’s load balancing settings. 7.3.1 Set Up Available Bandwidth on Ethernet Interfaces Here is how to set a limit on how much traffic the ZyWALL tries to send out through each WAN interface. 1 Click Configuration > Network > Interface > Ethernet and double-click the ge2 entry.
Chapter 7 Tutorials 7.3.2 Configure the WAN Trunk 1 Click Configuration > Network > Interface > Trunk. Click the Add icon. 2 Name the trunk and set the Load Balancing Algorithm field to Weighted Round Robin. Add ge2 and enter 2 in the Weight column. Add ge3 and enter 1 in the Weight column. Click OK.
Chapter 7 Tutorials 3 Select the trunk as the default trunk and click Apply. Figure 78 Configuration > Network > Interface > Trunk 7.4 How to Set Up an IPSec VPN Tunnel This example shows how to use the IPSec VPN configuration screens to create the following VPN tunnel, see Section 5.4 on page 84 for details on the VPN quick setup wizard. Figure 79 VPN Example LAN LAN 1.2.3.4 192.168.1.0/24 ZyWALL USG 2000 User’s Guide 2.2.2.2 172.16.1.
Chapter 7 Tutorials In this example, the ZyWALL is router X (1.2.3.4), and the remote IPSec router is router Y (2.2.2.2). Create the VPN tunnel between ZyWALL X’s LAN subnet (192.168.1.0/24) and the LAN subnet behind peer IPSec router Y (172.16.1.0/ 24). 7.4.1 Set Up the VPN Gateway The VPN gateway manages the IKE SA. You do not have to set up any other objects before you configure the VPN gateway because this VPN tunnel does not use any certificates or extended authentication.
Chapter 7 Tutorials 7.4.2 Set Up the VPN Connection The VPN connection manages the IPSec SA. You have to set up the address objects for the local network and remote network before you can set up the VPN connection. 1 Click Configuration > Object > Address. Click the Add icon. 2 Give the new address object a name (“VPN_REMOTE_SUBNET”), change the Address Type to SUBNET. Set up the Network field to 172.16.1.0 and the Netmask to 255.255.255.0. Click OK.
Chapter 7 Tutorials 4 Enable the VPN connection and name it (“VPN_CONN_EXAMPLE”). Under VPN Gateway select Site-to-site and the VPN gateway (VPN_GW_EXAMPLE). Under Policy, select LAN_SUBNET for the local network and VPN_REMOTE_SUBNET for the remote. Click OK. Figure 82 Configuration > VPN > IPSec VPN > VPN Connection > Add 5 Now set up the VPN settings on the peer IPSec router and try to establish the VPN tunnel.
Chapter 7 Tutorials 7.5 How to Configure a Hub-and-spoke IPSec VPN Without a VPN Concentrator A hub-and-spoke IPSec VPN connects IPSec VPN tunnels to form one secure network. This reduces the number of VPN connections that you have to set up and maintain in the network. Here is an example of a hub-and-spoke VPN that does not use the ZyWALL’s VPN concentrator feature. Here branch office A has a ZyNOS-based ZyWALL and headquarters (HQ) and branch office B have USG ZyWALLs.
Chapter 7 Tutorials • My Address: 10.0.0.1 • Peer Gateway Address: 10.0.0.2 VPN Connection (VPN Tunnel 1): • Local Policy: 192.168.168.0~192.168.169.255 • Remote Policy:192.168.167.0/255.255.255.0 • Disable Policy Enforcement VPN Gateway (VPN Tunnel2): • My Address: 10.0.0.1 • Peer Gateway Address: 10.0.0.3 VPN Connection (VPN Tunnel 2): • Local Policy: 192.168.167.0~192.168.168.255 • Remote Policy: 192.168.169.0/255.255.255.
Chapter 7 Tutorials • To have all Internet access from the spoke routers to go through the VPN tunnel, set the VPN rules in the spoke routers to use 0.0.0.0 (any) as the remote IP address. • Your firewall rules can still block VPN packets. • If the USG ZyWALLs’ VPN tunnels are members of a single zone, make sure it is not set to block intra-zone traffic.
Chapter 7 Tutorials 7.6.1 Set Up User Accounts Set up one user account for each user account in the RADIUS server. If it is possible to export user names from the RADIUS server to a text file, then you might create a script to create the user accounts instead. This example uses the Web Configurator. 1 Click Configuration > Object > User/Group > User. Click the Add icon.
Chapter 7 Tutorials 2 Enter the name of the group that is used in Table 20 on page 133. In this example, it is “Finance”. Then, select User/Leo and click the right arrow to move him to the Member list. This example only has one member in this group, so click OK. Of course you could add more members later. Figure 85 Configuration > Object > User/Group > Group > Add 3 Repeat this process to set up the remaining user groups. 7.6.
Chapter 7 Tutorials 1 Click Configuration > Object > AAA Server > RADIUS. Double-click the radius entry. Configure the RADIUS server’s address authentication port (1812 if you were not told otherwise), key, and click Apply. Figure 86 Configuration > Object > AAA Server > RADIUS > Add 2 Click Configuration > Object > Auth. method. Double-click the default entry. Click the Add icon. Select group radius because the ZyWALL should use the specified RADIUS server for authentication. Click OK.
Chapter 7 Tutorials Note: The users will have to log in using the Web Configurator login screen before they can use HTTP or MSN. Figure 88 Configuration > Object > User/Group > Setting > Add (Force User Authentication Policy) When the users try to browse the web (or use any HTTP/HTTPS application), the Login screen appears. They have to log in using the user name and password in the RADIUS server. 7.6.
Chapter 7 Tutorials 1 Click Configuration > AppPatrol. If application patrol and bandwidth management are not enabled, enable them, and click Apply. Figure 89 Configuration > AppPatrol > General 2 Click the Common tab and double-click the http entry.
Chapter 7 Tutorials 3 Double-click the Default policy. Figure 91 Configuration > AppPatrol > Common > http 4 Change the access to Drop because you do not want anyone except authorized user groups to browse the web. Click OK.
Chapter 7 Tutorials 5 Click the Add icon in the policy list. In the new policy, select one of the user groups that is allowed to browse the web and set the corresponding bandwidth restriction in the Inbound and Outbound fields. Click OK. Repeat this process to add exceptions for all the other user groups that are allowed to browse the web. Figure 93 Configuration > AppPatrol > Common> http > Edit Default 7.6.
Chapter 7 Tutorials 2 Give the schedule a descriptive name. Set up the days (Monday through Friday) and the times (8:30 - 18:00) when Sales is allowed to use MSN. Click OK. Figure 94 Configuration > Object > Schedule > Add (Recurring) 3 Follow the steps in Section 7.6.4 on page 137 to set up the appropriate policies for MSN in application patrol. Make sure to specify the schedule when you configure the policy for the Sales group’s MSN access. 7.6.
Chapter 7 Tutorials 2 Click the Add icon again and create a rule for one of the user groups that is allowed to access the DMZ. Figure 96 Configuration > Firewall > Add 3 Repeat this process to set up firewall rules for the other user groups that are allowed to access the DMZ. 7.7 How to Use a RADIUS Server to Authenticate User Accounts based on Groups The previous example showed how to have a RADIUS server authenticate individual user accounts.
Chapter 7 Tutorials 1 Click Configuration > Object > AAA Server > RADIUS. Double-click the radius entry. Besides configuring the RADIUS server’s address, authentication port, and key; set the Group Membership Attribute field to the attribute that the ZyWALL is to check to determine to which group a user belongs. This example uses Class. This attribute’s value is called a group identifier; it determines to which group a user belongs. In this example the values are Finance, Engineer, Sales, and Boss.
Chapter 7 Tutorials 2 Now you add ext-group-user user objects to identify groups based on the group identifier values. Set up one user account for each group of user accounts in the RADIUS server. Click Configuration > Object > User/Group > User. Click the Add icon. Enter a user name and set the User Type to ext-group-user. In the Group Identifier field, enter Finance, Engineer, Sales, or Boss and set the Associated AAA Server Object to radius.
Chapter 7 Tutorials • Select Endpoint must have Personal Firewall installed and move the Kaspersky Internet Security entries to the allowed list (you can double-click an entry to move it). • Select Endpoint must have Anti-Virus software installed and move the Kaspersky Internet Security and Kaspersky Anti-Virus anti-virus software entries to the allowed list. The following figure shows the configuration screen example.
Chapter 7 Tutorials Repeat as needed to create endpoint security objects for other Windows operating system versions. 7.8.2 Configure the Authentication Policy Click Configuration > Auth. Policy > Add to open the Endpoint Security Edit screen. Use this screen to configure an authentication policy to use endpoint security objects. • Enable the policy and name it.
Chapter 7 Tutorials 4 Turn on authentication policy and click Apply. Figure 101 Configuration > Auth. Policy The following figure shows an error message example when a user’s computer does not meet an endpoint security object’s requirements. Click Close to return to the login screen. Figure 102 Example: Endpoint Security Error Message 7.
Chapter 7 Tutorials user access (logging into SSL VPN for example). See Chapter 50 on page 783 for more on service control. The To-ZyWALL firewall rules apply to any kind of HTTP or HTTPS connection to the ZyWALL. They do not distinguish between administrator management access and user access. If you configure service control to allow management or user HTTP or HTTPS access, make sure the firewall is not configured to block that access. 7.9.
Chapter 7 Tutorials 4 Select the new rule and click the Add icon. Figure 105 Configuration > System > WWW (First Example Admin Service Rule Configured) 5 In the Zone field select ALL and set the Action to Deny. Click OK.
Chapter 7 Tutorials 6 Click Apply. Figure 107 Configuration > System > WWW (Second Example Admin Service Rule Configured) Now administrator access to the Web Configurator can only come from the LAN zone. Non-admin users can still use HTTPS to log into the ZyWALL from any of the ZyWALL’s zones (to use SSL VPN for example). 7.10 How to Allow Incoming H.323 Peer-to-peer Calls Suppose you have a H.323 device on the LAN for VoIP calls and you want it to be able to receive peer-to-peer calls from the WAN.
Chapter 7 Tutorials for ge2 IP address 10.0.0.8 to a H.323 device located on the LAN and using IP address 192.168.1.56. Figure 108 WAN to LAN H.323 Peer-to-peer Calls Example 192.168.1.56 10.0.0.8 7.10.1 Turn On the ALG Click Configuration > Network > ALG. Select Enable H.323 ALG and Enable H.323 transformations and click Apply. Figure 109 Configuration > Network > ALG 7.10.2 Set Up a NAT Policy For H.323 In this example, you need a NAT policy to forward H.
Chapter 7 Tutorials 1 Use Configuration > Object > Address > Add to create an address object for the public WAN IP address (called WAN_IP-for-H323 here). Then use it again to create an address object for the H.323 device’s private LAN IP address (called LAN_H323 here).
Chapter 7 Tutorials 2 Click Configuration > Network > NAT > Add. Configure a name for the rule (WAN-LAN_H323 here). You want the LAN H.323 device to receive peer-to-peer calls from the WAN and also be able to initiate calls to the WAN so you set the Classification to NAT 1:1. Set the Incoming Interface to ge2. Set the Original IP to the WAN address object (WAN_IP-for-H323). Set the Mapped IP to the H.323 device’s LAN IP address object (LAN_H323).
Chapter 7 Tutorials 1 Click Configuration > Firewall > Add. In the From field select WAN. In the To field select LAN. Configure a name for the rule (WAN-to-LAN_H323 here). Set the Destination to the H.323 device’s LAN IP address object (LAN_H323). LAN_H323 is the destination because the ZyWALL applies NAT to traffic before applying the firewall rule. Set the Service to H.323. Click OK. Figure 112 Configuration > Firewall > Add 7.
Chapter 7 Tutorials 7.11.1 Create the Address Objects Use Configuration > Object > Address > Add to create the address objects. 1 Create a host address object named DMZ_HTTP for the HTTP server’s private IP address of 192.168.3.7. Figure 114 Creating the Address Object for the HTTP Server’s Private IP Address 2 Create a host address object named Public_HTTP_Server_IP for the public WAN IP address 1.1.1.1. Figure 115 Creating the Address Object for the Public IP Address 7.11.
Chapter 7 Tutorials • Keep Enable NAT Loopback selected to allow users connected to other interfaces to access the HTTP server (see NAT Loopback on page 393 for details). Figure 116 Creating the NAT Entry 7.11.3 Set Up a Firewall Rule The firewall blocks traffic from the WAN zone to the DMZ zone by default so you need to create a firewall rule to allow the public to send HTTP traffic to IP address 1.1.1.1 in order to access the HTTP server. If a domain name is registered for IP address 1.1.1.
Chapter 7 Tutorials 1 Click Configuration > Firewall > Add. Set the From field as WAN and the To field as DMZ. Set the Destination to the HTTP server’s DMZ IP address object (DMZ_HTTP). DMZ_HTTP is the destination because the ZyWALL applies NAT to traffic before applying the firewall rule. Set the Access field to allow and the Service to HTTP, and click OK. Figure 117 Configuration > Firewall > Add 7.
Chapter 7 Tutorials address 1.1.1.2 that you will use on the ge3 interface and map to the IPPBX’s private IP address of 192.168.3.7. The local SIP clients are on the LAN.
Chapter 7 Tutorials 7.12.1 Turn On the ALG Click Configuration > Network > ALG. Select Enable SIP ALG and Enable SIP Transformations and click Apply. Figure 119 Configuration > Network > ALG 7.12.2 Create the Address Objects Use Configuration > Object > Address > Add to create the address objects. 1 Create a host address object named IPPBX-DMZ for the IPPBX’s private DMZ IP address of 192.168.3.9.
Chapter 7 Tutorials 2 Create a host address object named IPPBX-Public for the public WAN IP address 1.1.1.2. Figure 121 Creating the Public IP Address Object 7.12.3 Setup a NAT Policy for the IPPBX Click Configuration > Network > NAT > Add. • Configure a name for the rule (WAN-DMZ_IPPBX here). • You want the IPPBX to receive calls from the WAN and also be able to send calls to the WAN so you set the Classification to NAT 1:1. • Set the Incoming Interface to ge2.
Chapter 7 Tutorials • Click OK. Figure 122 Configuration > Network > NAT > Add 7.12.4 Set Up a WAN to DMZ Firewall Rule for SIP The firewall blocks traffic from the WAN zone to the DMZ zone by default so you need to create a firewall rule to allow the public to send SIP traffic to the IPPBX. If a domain name is registered for IP address 1.1.1.2, users can use it to connect to for making SIP calls.
Chapter 7 Tutorials 1 Click Configuration > Firewall > Add. Set the From field as WAN and the To field as DMZ. Set the Destination to the IPPBX’s DMZ IP address object (DMZ_SIP). IPPBX_DMZ is the destination because the ZyWALL applies NAT to traffic before applying the firewall rule. Set the Access field to allow and click OK. Figure 123 Configuration > Firewall > Add 7.12.
Chapter 7 Tutorials 1 Click Configuration > Firewall > Add. Set the From field as DMZ and the To field as LAN. Set the Destination to the IPPBX’s DMZ IP address object (DMZ_SIP). Set the Source to IPPBX_DMZ. Leave the Access field to allow and click OK. Figure 124 Configuration > Firewall > Add 7.
Chapter 7 Tutorials 7.13.2 Configure the Policy Route Now you need to configure a policy route that has the ZyWALL use the range of public IP addresses as the source address for WAN to LAN traffic. Click Configuration > Network > Routing > Add. Although adding a description is optional, it is recommended. This example uses LAN-to-WAN-Range. Specifying a Source Address is also optional although recommended. This example uses LAN_SUBNET. Set the Source Network Address Translation to Public-IPs and click OK.
Chapter 7 Tutorials An Ethernet switch connects both ZyWALLs’ ge1 interfaces to the LAN. Whichever ZyWALL is functioning as the master uses the default gateway IP address of the LAN computers (192.168.1.1) for its ge1 interface and the static public IP address (1.1.1.1) for its ge2 interface. If ZyWALL A recovers (has both its ge1 and ge2 interfaces connected), it resumes its role as the master and takes over all of its functions again. Figure 127 Device HA: Master Fails and Backup Takes Over LAN 192.168.
Chapter 7 Tutorials 7.14.2 Configure Device HA on the Master ZyWALL 1 Log into ZyWALL A (the master) and click Configuration > Device HA > ActivePassive Mode. Double-click ge1’s entry. 2 Configure 192.168.1.3 as the Management IP and 255.255.255.0 as the Manage IP Subnet Mask. Click OK.
Chapter 7 Tutorials 3 Set the Device Role to Master. This example focuses on the connection from the LAN (ge1) to the Internet through the ge2 interface, so select the ge1 and ge2 interfaces and click Activate. Enter a Synchronization Password (“mySyncPassword” in this example) and click Apply. Figure 130 Configuration > Device HA > Active-Passive Mode: Master ZyWALL Example 4 Click the General tab. Turn on device HA and click Apply.
Chapter 7 Tutorials 7.14.3 Configure the Backup ZyWALL 1 Connect a computer to ZyWALL B’s ge1 interface and log into its Web Configurator. Connect ZyWALL B to the Internet and subscribe it to the same subscription services (like content filtering and anti-virus) to which ZyWALL A is subscribed. See Chapter 11 on page 265 for more on the subscription services. 2 In ZyWALL B click Configuration > Device HA > Active-Passive Mode. Click ge1’s Edit icon. 3 Configure 192.168.1.
Chapter 7 Tutorials 4 Set the Device Role to Backup. Activate monitoring for the ge1 and ge2 interfaces. Set the Synchronization Server Address to 192.168.1.1, the Port to 21, and the Password to “mySyncPassword”. Select Auto Synchronize and set the Interval to 60. Click Apply. Figure 133 Configuration > Device HA > Active-Passive Mode: Backup ZyWALL Example 5 Click the General tab. Turn on device HA and click Apply.
Chapter 7 Tutorials 7.14.4 Deploy the Backup ZyWALL Connect ZyWALL B’s ge1 interface to the LAN network. Connect ZyWALL B’s ge2 interface to the same router that ZyWALL A’s ge2 interface uses for Internet access. ZyWALL B copies A’s configuration (and re-synchronizes with A every hour). If ZyWALL A fails or loses its ge1 or ge2 connection, ZyWALL B functions as the master. 7.14.
CHAPTER 8 L2TP VPN Example Here is how to create a basic L2TP VPN tunnel. 8.1 L2TP VPN Example This example uses the following settings in creating a basic L2TP VPN tunnel. Figure 135 L2TP VPN Example 172.16.1.2 L2TP_POOL: 192.168.10.10~192.168.10.20 LAN_SUBNET: 192.168.1.x • The ZyWALL has a static IP address of 172.16.1.2 for the ge2 interface. • The remote user has a dynamic public IP address and connects through the Internet.
Chapter 8 L2TP VPN Example • Configure the My Address setting. This example uses interface ge2 with static IP address 172.16.1.2. Note: If it is possible that the remote user’s public IP address could be in the same subnet as the specified My Address, click Configure > Network > Routing > Policy Route > Show Advanced Settings and select Use Policy Route to Override Direct Route. • Select Pre-Shared Key and configure a password. This example uses topsecret. Click OK.
Chapter 8 L2TP VPN Example 8.3 Configuring the Default L2TP VPN Connection Example 1 Click Configuration > VPN > Network > IPSec VPN to open the screen that lists the VPN connections. Double-click the Default_L2TP_VPN_Connection entry. 2 Click the Show Advanced Settings button. Configure and enforce the local and remote policies. • Create an address object that uses host type and contains the My Address IP address that you configured in the Default_L2TP_VPN_GW.
Chapter 8 L2TP VPN Example 3 Select the Default_L2TP_VPN_Connection entry and click Activate and then Apply to turn on the entry. Figure 139 Configuration > VPN > IPSec VPN > VPN Connection (Enable) 8.4 Configuring the L2TP VPN Settings Example 1 Click Configuration > VPN > L2TP VPN and configure the following. • Configure an IP address pool for the range of 192.168.10.10 to 192.168.10.20. It is called L2TP_POOL here. • Enable the connection. • Set the VPN Connection to the Default_L2TP_VPN_Connection.
Chapter 8 L2TP VPN Example • The other fields are left to the defaults in this example, click Apply. Figure 140 Configuration > VPN > L2TP VPN Example 8.5 Configuring L2TP VPN in Windows Vista, XP, or 2000 The following sections cover how to configure L2TP in remote user computers using Windows Vista, XP, and 2000. The example settings in these sections go along with the L2TP VPN configuration example in Section 8.1 on page 171.
Chapter 8 L2TP VPN Example 2 Select Connect to a workplace and click Next. Figure 141 Set up a connection or network: Chose a connection type 3 Select Use my Internet connection (VPN).
Chapter 8 L2TP VPN Example 4 Enter the domain name or WAN IP address configured as the My Address in the VPN gateway configuration that the ZyWALL is using for L2TP VPN (172.16.1.2 in this example). For the Destination Name, enter L2TP to ZyWALL. Select Don’t connect now, just set it up so I can connect later and click Next. Figure 143 Connect to a workplace: Type the Internet address to connect to 5 Enter the user name and password of a user account that can use the L2TP VPN connection and click Next.
Chapter 8 L2TP VPN Example 6 Click Close. Figure 145 Connect to a workplace: The connection is ready to use 7 In the Network and Sharing Center screen, click Connect to a network. Right-click the L2TP VPN connection and select Properties.
Chapter 8 L2TP VPN Example 8 Click Security, select Advanced (custom settings) and click Settings. Figure 147 Connect L2TP to ZyWALL: Security 9 Set Data encryption to Optional encryption (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Figure 148 Connect ZyWALL L2TP: Security > Advanced 10 Click Yes.
Chapter 8 L2TP VPN Example inside it. The L2TP tunnel itself does not need encryption since it is inside the encrypted IPSec VPN tunnel. Figure 149 Connect ZyWALL L2TP: Security > Advanced > Warning 11 Click Networking. Set the Type of VPN to L2TP IPSec VPN and click IPSec Settings.
Chapter 8 L2TP VPN Example 13 Select the L2TP VPN connection and click Connect. Figure 152 L2TP to ZyWALL Properties: Networking 14 Enter the user name and password of your ZyWALL user account. Click Connect.
Chapter 8 L2TP VPN Example 15 A window appears while the user name and password are verified and notifies you when the connection is established. Figure 154 Connecting to L2TP to ZyWALL 16 If a window appears asking you to select a location for the network, you can select Work if you want your computer to be discoverable by computers behind the ZyWALL.
Chapter 8 L2TP VPN Example 17 After the network location has been set, click Close. Figure 156 Set Network Location Successful 18 After the connection is up a connection icon displays in your system tray. Click it and then the L2TP connection to open a status screen.
Chapter 8 L2TP VPN Example 19 Click the L2TP connection’s View status link to open a status screen. Figure 158 Network and Sharing Center 20 Click Details to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20). Figure 159 ZyWALL-L2TP Status: Details 21 Access a server or other network resource behind the ZyWALL to make sure your access works.
Chapter 8 L2TP VPN Example 8.5.2 Configuring L2TP in Windows XP In Windows XP do the following to establish an L2TP VPN connection. 1 Click Start > Control Panel > Network Connections > New Connection Wizard. 2 Click Next in the Welcome screen. 3 Select Connect to the network at my workplace and click Next. Figure 160 New Connection Wizard: Network Connection Type 4 Select Virtual Private Network connection and click Next.
Chapter 8 L2TP VPN Example 5 Type L2TP to ZyWALL as the Company Name. Figure 162 New Connection Wizard: Connection Name 6 Select Do not dial the initial connection and click Next.
Chapter 8 L2TP VPN Example 7 Enter the domain name or WAN IP address configured as the My Address in the VPN gateway configuration that the ZyWALL is using for L2TP VPN (172.16.1.2 in this example). Figure 164 New Connection Wizard: VPN Server Selection 172.16.1.2 8 Click Finish. 9 The Connect L2TP to ZyWALL screen appears. Click Properties > Security.
Chapter 8 L2TP VPN Example 10 Click Security, select Advanced (custom settings) and click Settings. Figure 166 Connect L2TP to ZyWALL: Security 11 Select Optional encryption (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK.
Chapter 8 L2TP VPN Example 12 Click IPSec Settings. Figure 168 L2TP to ZyWALL Properties > Security 13 Select the Use pre-shared key for authentication check box and enter the preshared key used in the VPN gateway configuration that the ZyWALL is using for L2TP VPN. Click OK.
Chapter 8 L2TP VPN Example 14 Click Networking. Select L2TP IPSec VPN as the Type of VPN. Click OK. Figure 170 L2TP to ZyWALL Properties: Networking 15 Enter the user name and password of your ZyWALL account. Click Connect. Figure 171 Connect L2TP to ZyWALL 16 A window appears while the user name and password are verified. 17 A ZyWALL-L2TP icon displays in your system tray. Double-click it to open a status screen.
Chapter 8 L2TP VPN Example 18 Click Details to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20). Figure 173 ZyWALL-L2TP Status: Details 19 Access a server or other network resource behind the ZyWALL to make sure your access works. 8.5.3 Configuring L2TP in Windows 2000 Windows 2000 does not support using pre-shared keys by default. Use the following procedures to edit the registry and then configure the computer to use the L2TP client. 8.
Chapter 8 L2TP VPN Example 3 Select HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\P arameters. Figure 175 Registry Key 4 Right-click Parameters and select New > DWORD Value. Figure 176 New DWORD Value 5 Enter ProhibitIpSec as the name. And make sure the Data displays as 0’s. Figure 177 ProhibitIpSec DWORD Value 6 192 Restart the computer and continue with the next section.
Chapter 8 L2TP VPN Example 8.5.3.2 Configure the Windows 2000 IPSec Policy After you have created the registry entry and restarted the computer, use these directions to configure an IPSec policy for the computer to use. 1 Click Start > Run. Type mmc and click OK. Figure 178 Run mmc 2 Click Console > Add/Remove Snap-in.
Chapter 8 L2TP VPN Example 3 Click Add > IP Security Policy Management >Add > Finish. Click Close > OK. Figure 180 Add > IP Security Policy Management > Finish 4 Right-click IP Security Policies on Local Machine and click Create IP Security Policy. Click Next in the welcome screen.
Chapter 8 L2TP VPN Example 5 Name the IP security policy L2TP to ZyWALL, and click Next. Figure 182 IP Security Policy: Name 6 Clear the Activate the default response rule check box and click Next.
Chapter 8 L2TP VPN Example 7 Leave the Edit Properties check box selected and click Finish. Figure 184 IP Security Policy: Completing the IP Security Policy Wizard 8 In the properties dialog box, click Add > Next.
Chapter 8 L2TP VPN Example 9 Select This rule does not specify a tunnel and click Next. Figure 186 IP Security Policy Properties: Tunnel Endpoint 10 Select All network connections and click Next.
Chapter 8 L2TP VPN Example 11 Select Use this string to protect the key exchange (preshared key), type password in the text box, and click Next. Figure 188 IP Security Policy Properties: Authentication Method 12 Click Add.
Chapter 8 L2TP VPN Example 13 Type ZyWALL WAN_IP in the Name field. Clear the Use Add Wizard check box and click Add. Figure 190 IP Security Policy Properties: IP Filter List > Add 14 Configure the following in the Addressing tab. Select My IP Address in the Source address drop-down list box. Select A specific IP Address in the Destination address drop-down list box and type the ZyWALL’s WAN IP address (172.16.1.2 in this example) in the IP Address field. Make certain the Mirrored.
Chapter 8 L2TP VPN Example 15 Configure the following in the Filter Properties window’s Protocol tab. Set the protocol type to UDP from port 1701. Select To any port. Click Apply, OK, and then Close. Figure 192 Filter Properties: Protocol 16 Select ZyWALL WAN_IP and click Next.
Chapter 8 L2TP VPN Example 17 Select Require Security and click Next. Then click Finish and Close. Figure 194 IP Security Policy Properties: IP Filter List 18 In the Console window, right-click L2TP to ZyWALL and select Assign. Figure 195 Console: L2TP to ZyWALL Assign 8.5.3.3 Configure the Windows 2000 Network Connection After you have configured the IPSec policy, use these directions to create a network connection.
Chapter 8 L2TP VPN Example 1 Click Start > Settings > Network and Dial-up connections > Make New Connection. In the wizard welcome screen, click Next. Figure 196 Start New Connection Wizard 2 Select Connect to a private network through the Internet and click Next. Figure 197 New Connection Wizard: Network Connection Type 3 Enter the domain name or WAN IP address configured as the My Address in the VPN gateway configuration that the ZyWALL is using for L2TP VPN. Click Next.
Chapter 8 L2TP VPN Example 4 Select For all users and click Next. Figure 199 New Connection Wizard: Connection Availability 5 Name the connection L2TP to ZyWALL and click Finish. Figure 200 New Connection Wizard: Naming the Connection 6 Click Properties.
Chapter 8 L2TP VPN Example 7 Click Security and select Advanced (custom settings) and click Settings. Figure 202 Connect L2TP to ZyWALL: Security 8 Select Optional encryption allowed (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other check boxes. Click OK. Click Yes if a screen pops up.
Chapter 8 L2TP VPN Example 9 Click Networking and select Layer 2 Tunneling Protocol (L2TP) from the drop-down list box. Click OK. Figure 204 Connect L2TP to ZyWALL: Networking 10 Enter your user name and password and click Connect. It may take up to one minute to establish the connection and register on the network. Figure 205 Connect L2TP to ZyWALL 11 A ZyWALL-L2TP icon displays in your system tray. Double-click it to open a status screen.
Chapter 8 L2TP VPN Example 12 Click Details and scroll down to see the address that you received is from the L2TP range you specified on the ZyWALL (192.168.10.10-192.168.10.20). Figure 207 L2TP to ZyWALL Status: Details 13 Access a server or other network resource behind the ZyWALL to make sure your access works.
P ART II Technical Reference 207
CHAPTER 9 Dashboard 9.1 Overview Use the Dashboard screens to check status information about the ZyWALL. 9.1.1 What You Can Do in this Chapter Use the Dashboard screens for the following. • Use the main Dashboard screen (see Section 9.2 on page 209) to see the ZyWALL’s general device information, system status, system resource usage, licensed service status, and interface status. You can also display other status screens for more information. • Use the VPN status screen (see Section 9.2.
Chapter 9 Dashboard interface status in widgets that you can re-arrange to suit your needs. You can also collapse, refresh, and close individual widgets. Figure 208 Dashboard A B C D E The following table describes the labels in this screen. Table 21 Dashboard LABEL DESCRIPTION Widget Setting (A) Use this link to re-open closed widgets. Widgets that are already open appear grayed out. Up Arrow (B) Click this to collapse a widget.
Chapter 9 Dashboard Table 21 Dashboard (continued) LABEL DESCRIPTION The following front and rear panel labels display when you hover your cursor over a connected interface or slot. Name This field displays the name of each interface. Slot This field displays the name of each extension slot. An installed SEM (Security Extension Module) card enhances the ZyWALL’s VPN and/or UTM performance. See the SEM User’s Guide for how to install an SEM.
Chapter 9 Dashboard Table 21 Dashboard (continued) LABEL Device DESCRIPTION This identifies a device installed in one of the ZyWALL’s extension slots, the Security Extension Module slot, or USB ports. For an installed SEM (Security Extension Module) card, this field displays what kind of SEM card is installed. SEM-VPN - The VPN accelerator. The SEM-VPN provides 500 Mbps VPN throughput, 2,000 IPSec VPN tunnels, and 750 SSL VPN users. SEM-UTM - UTM accelerator.
Chapter 9 Dashboard Table 21 Dashboard (continued) LABEL Status DESCRIPTION This field displays the current status of each interface. The possible values depend on what type of interface it is. For Ethernet interfaces: Inactive - The Ethernet interface is disabled. Down - The Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet interface is enabled and connected. This field displays the port speed and duplex setting (Full or Half).
Chapter 9 Dashboard Table 21 Dashboard (continued) LABEL Action DESCRIPTION Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server. Click the Connect icon to have the ZyWALL try to connect a PPPoE/PPTP interface or the auxiliary interface. If the interface cannot use one of these ways to get or to update its IP address, this field displays n/a. Click the Disconnect icon to stop a PPPoE/PPTP or auxiliary interface’s connection.
Chapter 9 Dashboard Table 21 Dashboard (continued) LABEL DESCRIPTION Number of Login Users This field displays the number of users currently logged in to the ZyWALL. Click the icon to pop-open a list of the users who are currently logged in to the ZyWALL. See Section 9.2.6 on page 220. Boot Status This field displays details about the ZyWALL’s startup state. OK - The ZyWALL started up successfully. Firmware update OK - A firmware update was successful.
Chapter 9 Dashboard Table 21 Dashboard (continued) LABEL DESCRIPTION Destination IP This is the destination IP address of virus-infected files that the ZyWALL has detected. Occurrence This is how many times the ZyWALL has detected the event described in the entry. Top 5 Intrusions # This is the entry’s rank in the list of the most commonly detected intrusions. Signature ID This is the IDentification number of the IDP signature.
Chapter 9 Dashboard The following table describes the labels in this screen. Table 22 Dashboard > CPU Usage LABEL DESCRIPTION The y-axis represents the percentage of CPU usage. The x-axis shows the time period over which the CPU usage occurred Refresh Interval Enter how often you want this window to be automatically updated. Refresh Click this to update the information in the window right away. 9.2.2 The Memory Usage Screen Use this screen to look at a chart of the ZyWALL’s recent memory (RAM) usage.
Chapter 9 Dashboard 9.2.3 The Session Usage Screen Use this screen to look at a chart of the ZyWALL’s recent traffic session usage. To access this screen, click Session Usage in the dashboard. Figure 211 Dashboard > Session Usage The following table describes the labels in this screen. Table 24 Dashboard > Session Usage LABEL DESCRIPTION Sessions The y-axis represents the number of session.
Chapter 9 Dashboard 9.2.4 The VPN Status Screen Use this screen to look at the VPN tunnels that are currently established. To access this screen, click VPN Status in the dashboard. Figure 212 Dashboard > VPN Status The following table describes the labels in this screen. Table 25 Dashboard > VPN Status LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific SA. Name This field displays the name of the IPSec SA.
Chapter 9 Dashboard The following table describes the labels in this screen. Table 26 Dashboard > DHCP Table LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific entry. Interface This field identifies the interface that assigned an IP address to a DHCP client. IP Address This field displays the IP address currently assigned to a DHCP client or reserved for a specific MAC address. Click the column’s heading cell to sort the table entries by IP address.
Chapter 9 Dashboard The following table describes the labels in this screen. Table 27 Dashboard > Number of Login Users LABEL DESCRIPTION # This field is a sequential value and is not associated with any entry. User ID This field displays the user name of each user who is currently logged in to the ZyWALL. Reauth Lease T. This field displays the amount of reauthentication time remaining and the amount of lease time remaining for each user. See Chapter 40 on page 689.
Chapter 9 Dashboard 222 ZyWALL USG 2000 User’s Guide
CHAPTER 10 Monitor 10.1 Overview Use the Monitor screens to check status and statistics information. 10.1.1 What You Can Do in this Chapter Use the Monitor screens for the following. • Use the System Status > Port Statistics screen (see Section 10.2 on page 224) to look at packet statistics for each physical port. • Use the System Status > Port Statistics Graph screen (see Section 10.2 on page 224) to look at a line graph of packet statistics for each physical port.
Chapter 10 Monitor • Use the VPN Monitor > L2TP over IPSec screen (see Section 10.13 on page 249) to display and manage the ZyWALL’s connected L2TP VPN sessions. • Use the Anti-X Statistics > Anti-Virus screen (see Section 10.14 on page 250) to start or stop data collection and view virus statistics. • Use the Anti-X Statistics > IDP screen (Section 10.15 on page 252) to start or stop data collection and view IDP statistics. • Use the Anti-X Statistics > Content Filter screen (Section 10.
Chapter 10 Monitor The following table describes the labels in this screen. Table 28 Monitor > System Status > Port Statistics LABEL DESCRIPTION Poll Interval Enter how often you want this window to be updated automatically, and click Set Interval. Set Interval Click this to set the Poll Interval the screen uses. Stop Click this to stop the window from updating automatically. You can start it again by setting the Poll Interval and clicking Set Interval.
Chapter 10 Monitor 10.2.1 The Port Statistics Graph Screen Use this screen to look at a line graph of packet statistics for each physical port. To access this screen, click Port Statistics in the Status screen and then the Switch to Graphic View Button. Figure 216 Monitor > System Status > Port Statistics > Switch to Graphic View The following table describes the labels in this screen.
Chapter 10 Monitor Table 29 Monitor > System Status > Port Statistics > Switch to Graphic View LABEL DESCRIPTION Last Update This field displays the date and time the information in the window was last updated. System Up Time This field displays how long the ZyWALL has been running since it last restarted or was turned on. 10.3 Interface Status Screen This screen lists all of the ZyWALL’s interfaces and gives packet statistics for them.
Chapter 10 Monitor Each field is described in the following table. Table 30 Monitor > System Status > Interface Status LABEL DESCRIPTION Interface Status If an Ethernet interface does not have any physical ports associated with it, its entry is displayed in light gray text. Expand/Close Click this button to show or hide statistics for all the virtual interfaces on top of the Ethernet interfaces. Name This field displays the name of each interface.
Chapter 10 Monitor Table 30 Monitor > System Status > Interface Status (continued) LABEL DESCRIPTION HA Status This field displays the status of the interface in the virtual router. Active - This interface is the master interface in the virtual router. Stand-By - This interface is a backup interface in the virtual router. Fault - This VRRP group is not functioning in the virtual router right now. For example, this might happen if the interface is down. n/a - Device HA is not active on the interface.
Chapter 10 Monitor Table 30 Monitor > System Status > Interface Status (continued) LABEL DESCRIPTION RxPkts This field displays the number of packets received by the ZyWALL on the interface since it was last connected. Tx B/s This field displays the transmission speed, in bytes per second, on the interface in the one-second interval before the screen updated. Rx B/s This field displays the reception speed, in bytes per second, on the interface in the one-second interval before the screen updated.
Chapter 10 Monitor You use the Traffic Statistics screen to tell the ZyWALL when to start and when to stop collecting information for these reports. You cannot schedule data collection; you have to start and stop it manually in the Traffic Statistics screen. Figure 218 Monitor > System Status > Traffic Statistics There is a limit on the number of records shown in the report. Please see Table 32 on page 233 for more information. The following table describes the labels in this screen.
Chapter 10 Monitor Table 31 Monitor > System Status > Traffic Statistics (continued) LABEL DESCRIPTION Interface Select the interface from which to collect information. You can collect information from Ethernet, VLAN, bridge, PPPoE/PPTP, and auxiliary interfaces. Traffic Type Select the type of report to display. Choices are: Host IP Address/User - displays the IP addresses or users with the most traffic and how much traffic has been sent to and from each one.
Chapter 10 Monitor Table 31 Monitor > System Status > Traffic Statistics (continued) LABEL DESCRIPTION Amount This field displays how much traffic was sent or received from the indicated service / port. If the Direction is Ingress, a red bar is displayed; if the Direction is Egress, a blue bar is displayed. The unit of measure is bytes, Kbytes, Mbytes, Gbytes, or Tbytes, depending on the amount of traffic for the particular protocol or service port.
Chapter 10 Monitor • Number of bytes transmitted (so far) • Duration (so far) You can look at all the active sessions by user, service, source IP address, or destination IP address. You can also filter the information by user, protocol / service or service group, source address, and/or destination address and view it by user. Click Monitor > System Status > Session Monitor to display the following screen.
Chapter 10 Monitor Table 33 Monitor > System Status > Session Monitor (continued) LABEL DESCRIPTION User This field displays when View is set to all sessions. Type the user whose sessions you want to view. It is not possible to type part of the user name or use wildcards in this field; you must enter the whole user name. Service This field displays when View is set to all sessions. Select the service or service group whose sessions you want to view.
Chapter 10 Monitor 10.6 The DDNS Status Screen The DDNS Status screen shows the status of the ZyWALL’s DDNS domain names. Click Monitor > System Status > DDNS Status to open the following screen. Figure 220 Monitor > System Status > DDNS Status The following table describes the labels in this screen. Table 34 Monitor > System Status > DDNS Status LABEL DESCRIPTION Update Click this to have the ZyWALL update the profile to the DDNS server.
Chapter 10 Monitor session with the ZyWALL. Devices that have never established a session with the ZyWALL do not display in the list. Figure 221 Monitor > System Status > IP/MAC Binding The following table describes the labels in this screen. Table 35 Monitor > System Status > IP/MAC Binding LABEL DESCRIPTION Interface Select a ZyWALL interface that has IP/MAC binding enabled to show to which devices it has assigned an IP address. # This is the index number of an IP/MAC binding entry.
Chapter 10 Monitor 10.8 The Login Users Screen Use this screen to look at a list of the users currently logged into the ZyWALL. To access this screen, click Monitor > System Status > Login Users. Figure 222 Monitor > System Status > Login Users The following table describes the labels in this screen. Table 36 Monitor > System Status > Login Users 238 LABEL DESCRIPTION # This field is a sequential value and is not associated with any entry.
Chapter 10 Monitor 10.9 Cellular Status Screen This screen displays your 3G connection status. click Monitor > System Status > Cellular Status to display this screen. Figure 223 Monitor > System Status > Cellular Status The following table describes the labels in this screen. Table 37 Monitor > System Status > Cellular Status LABEL DESCRIPTION Refresh Click this button to update the information in the screen. # This field is a sequential value, and it is not associated with any interface.
Chapter 10 Monitor Table 37 Monitor > System Status > Cellular Status (continued) 240 LABEL DESCRIPTION Status No device - no 3G device is connected to the ZyWALL. Device detected - displays when you connect a 3G device. Device error - a 3G device is connected but there is an error. Probe device fail - the ZyWALL’s test of the 3G device failed. Probe device ok - the ZyWALL’s test of the 3G device succeeded. Init device fail - the ZyWALL was not able to initialize the 3G device.
Chapter 10 Monitor Table 37 Monitor > System Status > Cellular Status (continued) LABEL DESCRIPTION Signal Quality This displays the strength of the signal. The signal strength mainly depends on the antenna output power and the distance between your ZyWALL and the service provider’s base station. More Info. This field displays other details about the 3G connection. 10.10 Application Patrol Statistics This screen displays a bandwidth usage graph and statistics for selected protocols.
Chapter 10 Monitor 10.10.2 Application Patrol Statistics: Bandwidth Statistics The middle of the Monitor > AppPatrol Statistics screen displays a bandwidth usage line graph for the selected protocols. Figure 225 Monitor > AppPatrol Statistics: Bandwidth Statistics • The y-axis represents the amount of bandwidth used. • The x-axis shows the time period over which the bandwidth usage occurred. • A solid line represents a protocol’s incoming bandwidth usage.
Chapter 10 Monitor 10.10.3 Application Patrol Statistics: Protocol Statistics The bottom of the Monitor > AppPatrol Statistics screen displays statistics for each of the selected protocols. Figure 226 Monitor > AppPatrol Statistics: Protocol Statistics The following table describes the labels in this screen. Table 39 Monitor > AppPatrol Statistics: Protocol Statistics LABEL DESCRIPTION Service This is the protocol.
Chapter 10 Monitor Table 39 Monitor > AppPatrol Statistics: Protocol Statistics (continued) LABEL DESCRIPTION Rule This is a protocol’s rule. Inbound Kbps This is the incoming bandwidth usage for traffic that matched this protocol rule, in kilobits per second. This is the protocol’s traffic that the ZyWALL sends to the initiator of the connection. So for a connection initiated from the LAN to the WAN, the traffic sent from the WAN to the LAN is the inbound traffic.
Chapter 10 Monitor The following table describes the labels in this screen. Table 40 Monitor > AppPatrol Statistics > Service LABEL DESCRIPTION Service Name This is the application. Rule Statistics This table displays the statistics for each of the service’s application patrol rules. # This field is a sequential value, and it is not associated with a specific rule. Inbound Kbps This is the incoming bandwidth usage for traffic that matched this protocol rule, in kilobits per second.
Chapter 10 Monitor screen appears. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 228 Monitor > VPN Monitor > IPSec Each field is described in the following table. Table 41 Monitor > VPN Monitor > IPSec 246 LABEL DESCRIPTION Name Enter the name of a IPSec SA here and click Search to find it (if it is associated). You can use a keyword or regular expression. Use up to 30 alphanumeric and _+-.
Chapter 10 Monitor Table 41 Monitor > VPN Monitor > IPSec (continued) LABEL DESCRIPTION Encapsulation This field displays how the IPSec SA is encapsulated. Policy This field displays the content of the local and remote policies for this IPSec SA. The IP addresses, not the address objects, are displayed. Algorithm This field displays the encryption and authentication algorithms used in the SA. Up Time This field displays how many seconds the IPSec SA has been active.
Chapter 10 Monitor 10.12 The SSL Connection Monitor Screen The ZyWALL keeps track of the users who are currently logged into the VPN SSL client portal. Click Monitor > VPN Monitor > SSL to display the user list. Use this screen to do the following: • View a list of active SSL VPN connections. • Log out individual users and delete related session information. Once a user logs out, the corresponding entry is removed from the Connection Monitor screen.
Chapter 10 Monitor 10.13 L2TP over IPSec Session Monitor Screen Click Monitor > VPN Monitor > L2TP over IPSec to open the following screen. Use this screen to display and manage the ZyWALL’s connected L2TP VPN sessions. Figure 230 Monitor > VPN Monitor > L2TP over IPSec The following table describes the fields in this screen. Table 43 Monitor > VPN Monitor > L2TP over IPSec LABEL DESCRIPTION Disconnect Select a connection and click this button to disconnect it.
Chapter 10 Monitor 10.14 The Anti-Virus Statistics Screen Click Monitor > Anti-X Statistics > Anti-Virus to display the following screen. This screen displays anti-virus statistics. Figure 231 Monitor > Anti-X Statistics > Anti-Virus: Virus Name The following table describes the labels in this screen. Table 44 Monitor > Anti-X Statistics > Anti-Virus 250 LABEL DESCRIPTION Collect Statistics Select this check box to have the ZyWALL collect anti-virus statistics.
Chapter 10 Monitor Table 44 Monitor > Anti-X Statistics > Anti-Virus (continued) LABEL DESCRIPTION Top Entry By Use this field to have the following (read-only) table display the top antivirus entries by Virus Name, Source IP or Destination IP. Select Virus Name to list the most common viruses that the ZyWALL has detected. Select Source IP to list the source IP addresses from which the ZyWALL has detected the most virus-infected files.
Chapter 10 Monitor 10.15 The IDP Statistics Screen Click Monitor > Anti-X Statistics > IDP to display the following screen. This screen displays IDP (Intrusion Detection and Prevention) statistics. Figure 234 Monitor > Anti-X Statistics > IDP: Signature Name The following table describes the labels in this screen. Table 45 Monitor > Anti-X Statistics > IDP 252 LABEL DESCRIPTION Collect Statistics Select this check box to have the ZyWALL collect IDP statistics.
Chapter 10 Monitor Table 45 Monitor > Anti-X Statistics > IDP (continued) LABEL DESCRIPTION Top Entry By Use this field to have the following (read-only) table display the top IDP entries by Signature Name, Source or Destination. Select Signature Name to list the most common signatures that the ZyWALL has detected. Select Source to list the source IP addresses from which the ZyWALL has detected the most intrusion attempts.
Chapter 10 Monitor 10.16 The Content Filter Statistics Screen Click Monitor > Anti-X Statistics > Content Filter to display the following screen. This screen displays content filter statistics. Figure 237 Monitor > Anti-X Statistics > Content Filter The following table describes the labels in this screen. Table 46 Monitor > Anti-X Statistics > Content Filter LABEL DESCRIPTION Collect Statistics Select this check box to have the ZyWALL collect content filtering statistics.
Chapter 10 Monitor Table 46 Monitor > Anti-X Statistics > Content Filter (continued) LABEL DESCRIPTION Web Pages Warned by Category Service This is the number of web pages that matched an external database content filtering category selected in the ZyWALL and for which the ZyWALL displayed a warning before allowing users access.
Chapter 10 Monitor You can remove individual entries from the cache. When you do this, the ZyWALL queries the external content filtering database the next time someone tries to access that web site. This allows you to check whether a web site’s category has been changed. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 238 Anti-X > Content Filter > Cache The following table describes the labels in this screen.
Chapter 10 Monitor Table 47 Anti-X > Content Filter > Cache (continued) LABEL DESCRIPTION Category This field shows whether access to the web site’s URL was blocked or allowed. Click the column heading to sort the entries. Point the triangle up to display the blocked URLs before the URLs to which access was allowed. Point the triangle down to display the URLs to which access was allowed before the blocked URLs.
Chapter 10 Monitor 10.18 The Anti-Spam Statistics Screen Click Monitor > Anti-X Statistics > Anti-Spam to display the following screen. This screen displays spam statistics. Figure 239 Monitor > Anti-X Statistics > Anti-Spam The following table describes the labels in this screen. Table 48 Monitor > Anti-X Statistics > Anti-Spam 258 LABEL DESCRIPTION Collect Statistics Select this check box to have the ZyWALL collect anti-spam statistics. Apply Click Apply to save your changes back to the ZyWALL.
Chapter 10 Monitor Table 48 Monitor > Anti-X Statistics > Anti-Spam (continued) LABEL DESCRIPTION Spam Mails This is the number of e-mails that the ZyWALL has determined to be spam. Spam Mails Detected by Black List This is the number of e-mails that matched an entry in the ZyWALL’s antispam black list. Spam Mails Detected by DNSBL The ZyWALL can check the sender and relay IP addresses in an e-mail’s header against DNS (Domain Name Service)-based spam Black Lists (DNSBLs).
Chapter 10 Monitor 10.19 The Anti-Spam Status Screen Click Monitor > Anti-X Statistics > Anti-Spam > Status to display the AntiSpam Status screen. Use the Anti-Spam Status screen to see how many e-mail sessions the antispam feature is scanning and statistics for the DNSBLs. Figure 240 Monitor > Anti-X Statistics > Anti-Spam > Status The following table describes the labels in this screen.
Chapter 10 Monitor 10.20 Log Screen Log messages are stored in two separate logs, one for regular log messages and one for debugging messages. In the regular log, you can look at all the log messages by selecting All Logs, or you can select a specific category of log messages (for example, firewall or user). You can also look at the debugging log by selecting Debug Log. All debugging messages have the same priority. To access this screen, click Monitor > Log. The log is displayed in the following screen.
Chapter 10 Monitor The following table describes the labels in this screen. Table 50 Monitor > Log LABEL DESCRIPTION Show Filter / Hide Filter Click this button to show or hide the filter settings. If the filter settings are hidden, the Display, Email Log Now, Refresh, and Clear Log fields are available. If the filter settings are shown, the Display, Priority, Source Address, Destination Address, Service, Keyword, and Search fields are available.
Chapter 10 Monitor Table 50 Monitor > Log (continued) LABEL DESCRIPTION Priority This field displays the priority of the log message. It has the same range of values as the Priority field above. Category This field displays the log that generated the log message. It is the same value used in the Display and (other) Category fields. Message This field displays the reason the log message was generated.
Chapter 10 Monitor 264 ZyWALL USG 2000 User’s Guide
CHAPTER 11 Registration 11.1 Overview Use the Configuration > Licensing > Registration screens to register your ZyWALL and manage its service subscriptions. 11.1.1 What You Can Do in this Chapter • Use the Registration screen (see Section 11.2 on page 267) to register your ZyWALL with myZyXEL.com and activate a service, such as content filtering. • Use the Service screen (see Section 11.3 on page 269) to display the status of your service registrations and upgrade licenses. 11.1.
Chapter 11 Registration Subscription Services Available on the ZyWALL You can have the ZyWALL use anti-virus, IDP/AppPatrol (Intrusion Detection and Prevention and application patrol), and content filtering subscription services. You can also purchase and enter a license key to have the ZyWALL use more SSL VPN tunnels. See the respective User’s Guide chapters for more information about these features.
Chapter 11 Registration 11.2 The Registration Screen Use this screen to register your ZyWALL with myZyXEL.com and activate a service, such as content filtering. Click Configuration > Licensing > Registration in the navigation panel to open the screen as shown next. Figure 242 Configuration > Licensing > Registration The following table describes the labels in this screen. Table 51 Configuration > Licensing > Registration LABEL DESCRIPTION General Setup If you select existing myZyXEL.
Chapter 11 Registration Table 51 Configuration > Licensing > Registration (continued) LABEL DESCRIPTION Confirm Password Enter the password again for confirmation. E-Mail Address Enter your e-mail address. You can use up to 80 alphanumeric characters (periods and the underscore are also allowed) without spaces. Country Select your country from the drop-down box list. Trial Service Activation Select the check box to activate a trial service subscription.
Chapter 11 Registration Note: If the ZyWALL is registered already, this screen is read-only and indicates whether trial services are activated (if any). You can still select the unchecked trial service(s) to activate it after registration. Use the Service screen to update your service subscription status. Figure 243 Configuration > Licensing > Registration: Registered Device 11.3 The Service Screen Use this screen to display the status of your service registrations and upgrade licenses.
Chapter 11 Registration The following table describes the labels in this screen. Table 52 Configuration > Licensing > Registration > Service LABEL DESCRIPTION License Status # This is the entry’s position in the list. Service This lists the services that available on the ZyWALL. Status This field displays whether a service is activated (Licensed) or not (Not Licensed) or expired (Expired).
CHAPTER 12 Signature Update 12.1 Overview This chapter shows you how to update the ZyWALL’s signature packages. 12.1.1 What You Can Do in this Chapter • Use the Configuration > Licensing > Update > Anti-virus screen (Section 12.2 on page 272) to update the anti-virus signatures. See Chapter 33 on page 547 for details on anti-virus. • Use the Configuration > Licensing > Update > IDP/AppPatrol screen (Section 12.3 on page 273) to update the signatures used for IDP and application patrol.
Chapter 12 Signature Update 12.2 The Antivirus Update Screen Click Configuration > Licensing > Update > Anti-Virus to display the following screen. Figure 245 Configuration > Licensing > Update >Anti-Virus The following table describes the labels in this screen. LABEL DESCRIPTION Signature Information The following fields display information on the current signature set that the ZyWALL is using.
Chapter 12 Signature Update LABEL DESCRIPTION Signature Update Use these fields to have the ZyWALL check for new signatures at myZyXEL.com. If new signatures are found, they are then downloaded to the ZyWALL. Update Now Click this button to have the ZyWALL check for new signatures immediately. If there are new ones, the ZyWALL will then download them. Auto Update Select this check box to have the ZyWALL automatically check for new signatures regularly at the time and day specified.
Chapter 12 Signature Update signatures from myZyXEL.com (see the Registration screens). Use the Update IDP /AppPatrol screen to schedule or immediately download IDP signatures. Figure 246 Configuration > Licensing > Update > IDP/AppPatrol The following table describes the fields in this screen. Table 53 Configuration > Licensing > Update > IDP/AppPatrol LABEL DESCRIPTION Signature Information The following fields display information on the current signature set that the ZyWALL is using.
Chapter 12 Signature Update Table 53 Configuration > Licensing > Update > IDP/AppPatrol (continued) LABEL DESCRIPTION Daily Select this option to have the ZyWALL check for new IDP signatures everyday at the specified time. The time format is the 24 hour clock, so ‘23’ means 11PM for example. Weekly Select this option to have the ZyWALL check for new IDP signatures once a week on the day and at the time specified. Apply Click this button to save your changes to the ZyWALL.
Chapter 12 Signature Update The following table describes the fields in this screen. Table 54 Configuration > Licensing > Update > System Protect LABEL DESCRIPTION Signature Information The following fields display information on the current signature set that the ZyWALL is using. Current Version This field displays the system protect signature and anomaly rule set version number. This number gets larger as the set is enhanced.
CHAPTER 13 Interfaces 13.1 Interface Overview Use the Interface screens to configure the ZyWALL’s interfaces. You can also create interfaces on top of other interfaces. • Ports are the physical ports to which you connect cables. • Interfaces are used within the system operationally. You use them in configuring various features. An interface also describes a network that is directly connected to the ZyWALL. For example, You connect the LAN network to the ge1 interface.
Chapter 13 Interfaces 13.1.2 What You Need to Know Interface Characteristics Interfaces generally have the following characteristics (although not all characteristics apply to each type of interface). • An interface is a logical entity through which (layer-3) packets pass. • An interface is bound to a physical port or another interface. • Many interfaces can share the same physical port. • An interface belongs to at most one zone. • Many interfaces can belong to the same zone.
Chapter 13 Interfaces characteristics. These characteristics are listed in the following table and discussed in more detail below.
Chapter 13 Interfaces Table 56 Relationships Between Different Types of Interfaces (continued) INTERFACE REQUIRED PORT / INTERFACE PPP interface Ethernet interface* VLAN interface* bridge interface virtual interface (virtual Ethernet interface) (virtual VLAN interface) Ethernet interface* VLAN interface* bridge interface (virtual bridge interface) trunk Ethernet interface Cellular interface VLAN interface bridge interface PPP interface auxiliary interface * - You cannot set up a PPP interface, virt
Chapter 13 Interfaces 13.2.1 Port Grouping Overview Use port grouping to create port groups and to assign physical ports and port groups to Ethernet interfaces. Each physical port is assigned to one Ethernet interface. In port grouping, the Ethernet interfaces are called representative interfaces. If you assign more than one physical port to a representative interface, you create a port group.
Chapter 13 Interfaces Each section in this screen is described below. Table 57 Configuration > Network > Interface > Port Grouping Role LABEL DESCRIPTION Representative Interface (ge1, ge2, ge3, ge4, ge5, ge6) These are Ethernet interfaces. To add a physical port to a representative interface, drag the physical port onto the corresponding representative interface. Physical Port (1, 2, 3, 4, 5, 6) These are the physical ports as they appear on the front panel of the ZyWALL.
Chapter 13 Interfaces Figure 249 Configuration > Network > Interface > Ethernet Each field is described in the following table. Table 58 Configuration > Network > Interface > Ethernet LABEL DESCRIPTION Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove a virtual interface, select it and click Remove. The ZyWALL confirms you want to remove it before doing so.
Chapter 13 Interfaces 13.3.1 Ethernet Edit The Ethernet Edit screen lets you configure IP address assignment, interface parameters, RIP settings, OSPF settings, DHCP settings, connectivity check, and MAC address settings. To access this screen, click an Edit icon in the Ethernet Summary screen. (See Section 13.3 on page 282.
Chapter 13 Interfaces Figure 250 Configuration > Network > Interface > Ethernet > Edit ZyWALL USG 2000 User’s Guide 285
Chapter 13 Interfaces This screen’s fields are described in the table below. Table 59 Configuration > Network > Interface > Ethernet > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. General Settings Enable Interface Select this to enable this interface. Clear this to disable this interface. Interface Properties Interface Type Select to which type of network you will connect this interface.
Chapter 13 Interfaces Table 59 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL DESCRIPTION Use Fixed IP Address This option appears when Interface Properties is External or General. Select this if you want to specify the IP address, subnet mask, and gateway manually. IP Address Enter the IP address for this interface. Subnet Mask Enter the subnet mask of this interface in dot decimal notation.
Chapter 13 Interfaces Table 59 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL Check Period DESCRIPTION Enter the number of seconds between connection check attempts. Check Timeout Enter the number of seconds to wait for a response before the attempt is a failure. Check Fail Tolerance Enter the number of consecutive failures before the ZyWALL stops routing through the gateway. Check Default Gateway Select this to use the default gateway for the connectivity check.
Chapter 13 Interfaces Table 59 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL Pool Size DESCRIPTION Enter the number of IP addresses to allocate. This number must be at least one and is limited by the interface’s Subnet Mask. For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Address is 10.10.10.10, the ZyWALL can allocate 10.10.10.10 to 10.10.10.254, or 245 IP addresses. If this field is blank, the IP Pool Start Address must also be blank.
Chapter 13 Interfaces Table 59 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL DESCRIPTION IP Address Enter the IP address to assign to a device with this entry’s MAC address. MAC Address Enter the MAC address to which to assign this entry’s IP address. Description Enter a description to help identify this static DHCP entry. You can use alphanumeric and ()+/:=?!*#@$_%- characters, and it can be up to 60 characters long. RIP Setting See Section 16.
Chapter 13 Interfaces Table 59 Configuration > Network > Interface > Ethernet > Edit (continued) LABEL DESCRIPTION Text Authentication Key This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to eight characters long. MD5 Authentication ID This field is available if the Authentication is MD5. Type the ID for MD5 authentication. The ID can be between 1 and 255.
Chapter 13 Interfaces Figure 251 Object References The following table describes labels that can appear in this screen. Table 60 Object References LABEL DESCRIPTION Object Name This identifies the object for which the configuration settings that use it are displayed. Click the object’s name to display the object’s configuration screen in the main window. # This field is a sequential value, and it is not associated with any entry.
Chapter 13 Interfaces Figure 252 Example: PPPoE/PPTP Interfaces PPPoE/PPTP interfaces are similar to other interfaces in some ways. They have an IP address, subnet mask, and gateway used to make routing decisions; they restrict bandwidth and packet size; and they can verify the gateway is available. There are two main differences between PPPoE/PPTP interfaces and other interfaces. • You must also configure an ISP account object for the PPPoE/PPTP interface to use.
Chapter 13 Interfaces Figure 253 Configuration > Network > Interface > PPP Each field is described in the table below. Table 61 Configuration > Network > Interface > PPP LABEL DESCRIPTION User Configuration / System Default The ZyWALL comes with the (non-removable) System Default PPP interfaces pre-configured. You can create (and delete) User Configuration PPP interfaces. Add Click this to create a new user-configured PPP interface.
Chapter 13 Interfaces Table 61 Configuration > Network > Interface > PPP (continued) LABEL DESCRIPTION Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. The connect icon is lit when the interface is connected and dimmed when it is disconnected. Name This field displays the name of the interface. Base Interface This field displays the interface on the top of which the PPPoE/PPTP interface is.
Chapter 13 Interfaces Figure 254 Configuration > Network > Interface > PPP > Add Each field is explained in the following table. Table 62 Configuration > Network > Interface > PPP > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields.
Chapter 13 Interfaces Table 62 Configuration > Network > Interface > PPP > Add (continued) LABEL Enable Interface DESCRIPTION Select this to enable this interface. Clear this to disable this interface. Interface Properties Interface Name Specify a name for the interface. It can use alphanumeric characters, hyphens, and underscores, and it can be up to 11 characters long. Base Interface Select the interface upon which this PPP interface is built.
Chapter 13 Interfaces Table 62 Configuration > Network > Interface > PPP > Add (continued) LABEL DESCRIPTION Interface Parameters Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can send through the interface to the network. Allowed values are 0 - 1048576. Ingress Bandwidth This is reserved for future use. MTU Maximum Transmission Unit. Type the maximum size of each data packet, in bytes, that can move through this interface.
Chapter 13 Interfaces Table 62 Configuration > Network > Interface > PPP > Add (continued) LABEL DESCRIPTION OK Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 13.5 Cellular Configuration Screen (3G) 3G (Third Generation) is a digital, packet-switched wireless technology. Bandwidth usage is optimized as multiple users share the same channel and bandwidth is only allocated to users when they send data.
Chapter 13 Interfaces If the signal strength of a 3G network is too low, the 3G card may switch to an available 2.5G or 2.75G network. See the following table for a comparison between 2G, 2.5G, 2.75G and 3G of wireless technologies. Table 63 2G, 2.5G, 2.75G, 3G and 3.5G Wireless Technologies MOBILE PHONE AND DATA STANDARDS NAME TYPE GSM-BASED CDMA-BASED 2G CircuitGSM (Global System for Mobile switched Communications), Personal Handy-phone System (PHS), etc.
Chapter 13 Interfaces Figure 255 Configuration > Network > Interface > Cellular The following table describes the labels in this screen. Table 64 Configuration > Network > Interface > Cellular LABEL DESCRIPTION Add Click this to create a new cellular interface. Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so.
Chapter 13 Interfaces Figure 256 Configuration > Network > Interface > Cellular > Add 302 ZyWALL USG 2000 User’s Guide
Chapter 13 Interfaces The following table describes the labels in this screen. Table 65 Configuration > Network > Interface > Cellular > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. General Settings Enable Interface Select this option to turn on this interface. Interface Properties Interface Name Select a name for the interface.
Chapter 13 Interfaces Table 65 Configuration > Network > Interface > Cellular > Add (continued) LABEL Dial String DESCRIPTION Enter the dial string if your ISP provides a string, which would include the APN, to initialize the 3G card. You can enter up to 63 ASCII printable characters. Spaces are allowed. This field is available only when you insert a GSM 3G card. Authentication Type The ZyWALL supports PAP (Password Authentication Protocol) and CHAP (Challenge Handshake Authentication Protocol).
Chapter 13 Interfaces Table 65 Configuration > Network > Interface > Cellular > Add (continued) LABEL DESCRIPTION Egress Bandwidth Enter the maximum amount of traffic, in kilobits per second, the ZyWALL can send through the interface to the network. Allowed values are 0 - 1048576. This setting is used in WAN load balancing and bandwidth management. Ingress Bandwidth This is reserved for future use. MTU Maximum Transmission Unit.
Chapter 13 Interfaces Table 65 Configuration > Network > Interface > Cellular > Add (continued) LABEL DESCRIPTION Get Automatically Select this option If your ISP did not assign you a fixed IP address. This is the default selection. Use Fixed IP Address Select this option If the ISP assigned a fixed IP address. IP Address Enter the cellular interface’s WAN IP address in this field if you selected Use Fixed IP Address. Metric Enter the priority of the gateway (if any) on this interface.
Chapter 13 Interfaces Table 65 Configuration > Network > Interface > Cellular > Add (continued) LABEL DESCRIPTION Data Budget Select this and specify how much downstream and/or upstream data (in Mega bytes) can be transmitted via the 3G connection within one month. Select Download to set a limit on the downstream traffic (from the ISP to the ZyWALL). Select Upload to set a limit on the upstream traffic (from the ZyWALL to the ISP).
Chapter 13 Interfaces Table 65 Configuration > Network > Interface > Cellular > Add (continued) LABEL DESCRIPTION OK Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving. 13.6 VLAN Interfaces A Virtual Local Area Network (VLAN) divides a physical network into multiple logical networks. The standard is defined in IEEE 802.1q. Figure 257 Example: Before VLAN A B C In this example, there are two physical networks and three departments A, B, and C.
Chapter 13 Interfaces Each VLAN is a separate network with separate IP addresses, subnet masks, and gateways. Each VLAN also has a unique identification number (ID). The ID is a 12bit value that is stored in the MAC header. The VLANs are connected to switches, and the switches are connected to the router. (If one switch has enough connections for the entire network, the network does not need switches A and B.) • Traffic inside each VLAN is layer-2 communication (data link layer, MAC addresses).
Chapter 13 Interfaces They restrict bandwidth and packet size. They can provide DHCP services, and they can verify the gateway is available. 13.6.1 VLAN Summary Screen This screen lists every VLAN interface and virtual interface created on top of VLAN interfaces. To access this screen, click Configuration > Network > Interface > VLAN. Figure 259 Configuration > Network > Interface > VLAN Each field is explained in the following table.
Chapter 13 Interfaces Table 66 Configuration > Network > Interface > VLAN (continued) LABEL DESCRIPTION IP Address This field displays the current IP address of the interface. If the IP address is 0.0.0.0, the interface does not have an IP address yet. This screen also shows whether the IP address is a static IP address (STATIC) or dynamically assigned (DHCP). IP addresses are always static in virtual interfaces. Mask This field displays the interface’s subnet mask in dot decimal notation.
Chapter 13 Interfaces Figure 260 Configuration > Network > Interface > VLAN > Edit 312 ZyWALL USG 2000 User’s Guide
Chapter 13 Interfaces Each field is explained in the following table. Table 67 Configuration > Network > Interface > VLAN > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. General Settings Enable Interface Select this to turn this interface on. Clear this to disable this interface. Interface Properties Interface Name This field is read-only if you are editing an existing VLAN interface.
Chapter 13 Interfaces Table 67 Configuration > Network > Interface > VLAN > Edit (continued) LABEL Metric DESCRIPTION Enter the priority of the gateway (if any) on this interface. The ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first.
Chapter 13 Interfaces Table 67 Configuration > Network > Interface > VLAN > Edit (continued) LABEL DHCP DESCRIPTION Select what type of DHCP service the ZyWALL provides to the network. Choices are: None - the ZyWALL does not provide any DHCP services. There is already a DHCP server on the network. DHCP Relay - the ZyWALL routes DHCP requests to one or more DHCP servers you specify. The DHCP server(s) may be on another network.
Chapter 13 Interfaces Table 67 Configuration > Network > Interface > VLAN > Edit (continued) LABEL Lease time DESCRIPTION Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are: infinite - select this if IP addresses never expire days, hours, and minutes - select this to enter how long IP addresses are valid.
Chapter 13 Interfaces Table 67 Configuration > Network > Interface > VLAN > Edit (continued) LABEL DESCRIPTION OSPF Setting See Section 16.3 on page 365 for more information about OSPF. Area Select the area in which this interface belongs. Select None to disable OSPF in this interface. Priority Enter the priority (between 0 and 255) of this interface when the area is looking for a Designated Router (DR) or Backup Designated Router (BDR).
Chapter 13 Interfaces 13.7 Bridge Interfaces This section introduces bridges and bridge interfaces and then explains the screens for bridge interfaces. Bridge Overview A bridge creates a connection between two or more network segments at the layer-2 (MAC address) level. In the following example, bridge X connects four network segments. When the bridge receives a packet, the bridge records the source MAC address and the port on which it was received in a table.
Chapter 13 Interfaces If computer B responds to computer A, bridge X records the source address 0B:0B:0B:0B:0B:0B and port 4 in the table. It also looks up 0A:0A:0A:0A:0A:0A in the table and sends the packet to port 2 accordingly. Table 69 Example: Bridge Table After Computer B Responds to Computer A MAC ADDRESS PORT 0A:0A:0A:0A:0A:0A 2 0B:0B:0B:0B:0B:0B 4 Bridge Interface Overview A bridge interface creates a software bridge between the members of the bridge interface.
Chapter 13 Interfaces 13.7.1 Bridge Summary This screen lists every bridge interface and virtual interface created on top of bridge interfaces. To access this screen, click Configuration > Network > Interface > Bridge. Figure 261 Configuration > Network > Interface > Bridge Each field is described in the following table. Table 71 Configuration > Network > Interface > Bridge LABEL DESCRIPTION Add Click this to create a new entry.
Chapter 13 Interfaces 13.7.2 Bridge Add/Edit This screen lets you configure IP address assignment, interface bandwidth parameters, DHCP settings, and connectivity check for each bridge interface. To access this screen, click the Add icon at the top of the Add column in the Bridge Summary screen, or click an Edit icon in the Bridge Summary screen. The following screen appears.
Chapter 13 Interfaces Figure 262 Configuration > Network > Interface > Bridge > Add 322 ZyWALL USG 2000 User’s Guide
Chapter 13 Interfaces Each field is described in the table below. Table 72 Configuration > Network > Interface > Bridge > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. General Settings Enable Interface Select this to enable this interface. Clear this to disable this interface. Interface Properties Interface Name This field is read-only if you are editing the interface.
Chapter 13 Interfaces Table 72 Configuration > Network > Interface > Bridge > Edit (continued) LABEL Gateway DESCRIPTION This field is enabled if you select Use Fixed IP Address. Enter the IP address of the gateway. The ZyWALL sends packets to the gateway when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. Metric Enter the priority of the gateway (if any) on this interface.
Chapter 13 Interfaces Table 72 Configuration > Network > Interface > Bridge > Edit (continued) LABEL IP Pool Start Address DESCRIPTION Enter the IP address from which the ZyWALL begins allocating IP addresses. If you want to assign a static IP address to a specific computer, click Add Static DHCP. If this field is blank, the Pool Size must also be blank.
Chapter 13 Interfaces Table 72 Configuration > Network > Interface > Bridge > Edit (continued) LABEL DESCRIPTION Add Click this to create a new entry. Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. # This field is a sequential value, and it is not associated with a specific entry. IP Address Enter the IP address to assign to a device with this entry’s MAC address.
Chapter 13 Interfaces 13.8 Auxiliary Interface This section introduces the auxiliary interface and then explains the screen for it. 13.8.1 Auxiliary Interface Overview Use the auxiliary interface to dial out from the ZyWALL’s auxiliary port. For example, you might use this interface as a backup WAN interface. You have to connect an external modem to the ZyWALL’s auxiliary port to use the auxiliary interface. Note: You have to connect an external modem to the auxiliary port.
Chapter 13 Interfaces Figure 263 Configuration > Network > Interface > Auxiliary Each field is described in the table below. Table 73 Configuration > Network > Interface > Auxiliary LABEL DESCRIPTION General Settings Enable Interface Select this to turn on the auxiliary dial up interface. The interface does not dial out, however, unless it is part of a trunk and loadbalancing conditions are satisfied.
Chapter 13 Interfaces Table 73 Configuration > Network > Interface > Auxiliary (continued) LABEL DESCRIPTION Phone Number Enter the phone number to dial here. You can use 1-20 numbers, commas (,), or plus signs (+). Use a comma to pause during dialing. Use a plus sign to tell the external modem to make an international call. User Name Enter the user name required for authentication. Password Enter the password required for authentication.
Chapter 13 Interfaces cannot change the MTU. The virtual interface uses the same MTU that the underlying interface uses. Unlike other interfaces, virtual interfaces do not provide DHCP services, and they do not verify that the gateway is available. 13.9.1 Virtual Interfaces Add/Edit This screen lets you configure IP address assignment and interface parameters for virtual interfaces.
Chapter 13 Interfaces Table 74 Configuration > Network > Interface > Add (continued) LABEL Metric DESCRIPTION Enter the priority of the gateway (if any) on this interface. The ZyWALL decides which gateway to use based on this priority. The lower the number, the higher the priority. If two or more gateways have the same priority, the ZyWALL uses the one that was configured first.
Chapter 13 Interfaces For example, if the ZyWALL gets a packet with a destination address of 100.100.25.25, it routes the packet to interface ge1. If the ZyWALL gets a packet with a destination address of 200.200.200.200, it routes the packet to interface ge2. In most interfaces, you can enter the IP address and subnet mask manually. In PPPoE/PPTP interfaces, however, the subnet mask is always 255.255.255.255 because it is a point-to-point interface. For these interfaces, you can only enter the IP address.
Chapter 13 Interfaces • Egress bandwidth sets the amount of traffic the ZyWALL sends out through the interface to the network. • Ingress bandwidth sets the amount of traffic the ZyWALL allows in through the interface from the network.1 If you set the bandwidth restrictions very high, you effectively remove the restrictions. The ZyWALL also restricts the size of each data packet. The maximum number of bytes in each packet is called the maximum transmission unit (MTU).
Chapter 13 Interfaces • IP address - If the DHCP client’s MAC address is in the ZyWALL’s static DHCP table, the interface assigns the corresponding IP address. If not, the interface assigns IP addresses from a pool, defined by the starting address of the pool and the pool size. Table 77 Example: Assigning IP Addresses from a Pool START IP ADDRESS POOL SIZE RANGE OF ASSIGNED IP ADDRESS 50.50.50.33 5 50.50.50.33 - 50.50.50.37 75.75.75.1 200 75.75.75.1 - 75.75.75.200 99.99.1.1 1023 99.99.1.1 - 99.
Chapter 13 Interfaces PPPoE/PPTP Overview Point-to-Point Protocol over Ethernet (PPPoE, RFC 2516) and Point-to-Point Tunneling Protocol (PPTP, RFC 2637) are usually used to connect two computers over phone lines or broadband connections. PPPoE is often used with cable modems and DSL connections. It provides the following advantages: • The access and authentication method works with existing systems, including RADIUS. • You can access one of several network services.
Chapter 13 Interfaces 336 ZyWALL USG 2000 User’s Guide
CHAPTER 14 Trunks 14.1 Overview Use trunks for WAN traffic load balancing to increase overall network throughput and reliability. Load balancing divides traffic loads between multiple interfaces. This allows you to improve quality of service and maximize bandwidth utilization for multiple ISP links. Maybe you have two Internet connections with different bandwidths.
Chapter 14 Trunks 14.1.2 What You Need to Know • Add WAN interfaces to trunks to have multiple connections share the traffic load. • If one WAN interface’s connection goes down, the ZyWALL sends traffic through another member of the trunk. • For example, you connect one WAN interface to one ISP and connect a second WAN interface to a second ISP. The ZyWALL balances the WAN traffic load between the connections.
Chapter 14 Trunks 2 The ZyWALL is using active/active load balancing. So when LAN user A tries to access something on the server, the request goes out through ge3. 3 The server finds that the request comes from ge3’s IP address instead of ge2’s IP address and rejects the request. If link sticking had been configured, the ZyWALL would have still used ge2 to send LAN user A’s request to the server and server would have given the user A access.
Chapter 14 Trunks Since WAN 2 has a smaller load balancing index (meaning that it is less utilized than WAN 1), the ZyWALL will send the subsequent new session traffic through WAN 2. Table 78 Least Load First Example OUTBOUND INTERFACE LOAD BALANCING INDEX (M/A) AVAILABLE (A) MEASURED (M) WAN 1 512 K 412 K 0.8 WAN 2 256 K 198 K 0.77 Weighted Round Robin The Weighted Round Robin (WRR) algorithm is best suited for situations when the bandwidths set for the two WAN interfaces are different.
Chapter 14 Trunks interface. This fully utilizes the bandwidth of the first interface to reduce Internet usage fees and avoid overloading the interface. In this example figure, the upper threshold of the first interface is set to 800K. The ZyWALL sends network traffic of new sessions that exceed this limit to the secondary WAN interface. Figure 269 Spillover Algorithm Example Finding Out More • See Section 6.5.5 on page 105 for related information on the Trunk screens. • See Section 7.
Chapter 14 Trunks 14.2 The Trunk Summary Screen Click Configuration > Network > Interface > Trunk to open the Trunk screen. This screen lists the configured trunks and the load balancing algorithm that each is configured to use. Figure 270 Configuration > Network > Interface > Trunk The following table describes the items in this screen.
Chapter 14 Trunks Table 79 Configuration > Network > Interface > Trunk (continued) LABEL DESCRIPTION Enable Default SNAT Select this to have the ZyWALL use the IP address of the outgoing interface as the source IP address of the packets it sends out through its WAN trunks. The ZyWALL automatically adds SNAT settings for traffic it routes from internal interfaces to external interfaces.
Chapter 14 Trunks Each field is described in the table below. Table 80 Configuration > Network > Interface > Trunk > Add (or Edit) LABEL DESCRIPTION Name This is read-only if you are editing an existing trunk. When adding a new trunk, enter a descriptive name for this trunk. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 14 Trunks Table 80 Configuration > Network > Interface > Trunk > Add (or Edit) (continued) LABEL DESCRIPTION Weight This field displays with the weighted round robin load balancing algorithm. Specify the weight (1~10) for the interface. The weights of the different member interfaces form a ratio. This ratio determines how much traffic the ZyWALL sends through each member interface.
Chapter 14 Trunks 346 ZyWALL USG 2000 User’s Guide
CHAPTER 15 Policy and Static Routes 15.1 Policy and Static Routes Overview Use policy routes and static routes to override the ZyWALL’s default routing behavior in order to send packets through the appropriate interface or VPN tunnel. For example, the next figure shows a computer (A) connected to the ZyWALL’s LAN interface. The ZyWALL routes most traffic from A to the Internet through the ZyWALL’s default gateway (R1).
Chapter 15 Policy and Static Routes • Use the Static Route screens (see Section 15.3 on page 357) to list and configure static routes. 15.1.2 What You Need to Know Policy Routing Traditionally, routing is based on the destination address only and the ZyWALL takes the shortest path to forward a packet. IP Policy Routing (IPPR) provides a mechanism to override the default routing behavior and alter the packet forwarding based on the policy defined by the network administrator.
Chapter 15 Policy and Static Routes Policy Routes Versus Static Routes • Policy routes are more flexible than static routes. You can select more criteria for the traffic to match and can also use schedules, NAT, and bandwidth management. • Policy routes are only used within the ZyWALL itself. Static routes can be propagated to other routers using RIP or OSPF. • Policy routes take priority over static routes.
Chapter 15 Policy and Static Routes Finding Out More • See Section 6.5.6 on page 105 for related information on the policy route screens. • See Section 7.13 on page 163 for an example of creating a policy route for using multiple static public WAN IP addresses for LAN to WAN traffic. • See Section 15.4 on page 359 for more background information on policy routing. 15.2 Policy Route Screen Click Configuration > Network > Routing to open the Policy Route screen.
Chapter 15 Policy and Static Routes The following table describes the labels in this screen. Table 81 Configuration > Network > Routing > Policy Route LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. Enable BWM This is a global setting for enabling or disabling bandwidth management on the ZyWALL.
Chapter 15 Policy and Static Routes Table 81 Configuration > Network > Routing > Policy Route (continued) LABEL DESCRIPTION DSCP Code This is the DSCP value of incoming packets to which this policy route applies. any means all DSCP values or no DSCP marker. default means traffic with a DSCP value of 0. This is usually best effort traffic The “af” entries stand for Assured Forwarding. The number following the “af” identifies one of four classes and one of three drop preferences.
Chapter 15 Policy and Static Routes 15.2.1 Policy Route Edit Screen Click Configuration > Network > Routing to open the Policy Route screen. Then click the Add or Edit icon to open the Policy Route Edit screen. Use this screen to configure or edit a policy route. Figure 274 Configuration > Network > Routing > Policy Route > Add The following table describes the labels in this screen.
Chapter 15 Policy and Static Routes Table 82 Configuration > Network > Routing > Policy Route > Edit (continued) LABEL DESCRIPTION Incoming Select where the packets are coming from; any, an interface, a tunnel, an SSL VPN, or the ZyWALL itself. For an interface, a tunnel, or an SSL VPN, you also need to select the individual interface, VPN tunnel, or SSL VPN connection. Source Address Select a source IP address object from which the packets are sent.
Chapter 15 Policy and Static Routes Table 82 Configuration > Network > Routing > Policy Route > Edit (continued) LABEL DESCRIPTION VPN Tunnel This field displays when you select VPN Tunnel in the Type field. Select a VPN tunnel through which the packets are sent to the remote network that is connected to the ZyWALL directly. Auto Destination Address This field displays when you select VPN Tunnel in the Type field.
Chapter 15 Policy and Static Routes Table 82 Configuration > Network > Routing > Policy Route > Edit (continued) LABEL DESCRIPTION Source Network Address Translation Select none to not use NAT for the route. Select outgoing-interface to use the IP address of the outgoing interface as the source IP address of the packets that matches this route. If you select outgoing-interface, you can also configure port trigger settings for this interface.
Chapter 15 Policy and Static Routes Table 82 Configuration > Network > Routing > Policy Route > Edit (continued) LABEL DESCRIPTION Maximum Bandwidth Specify the maximum bandwidth (from 1 to 1048576) allowed for the route in kbps. If you enter 0 here, there is no bandwidth limitation for the route. If the sum of the bandwidths for routes using the same next hop is higher than the actual transmission speed, lower priority traffic may not be sent if higher priority traffic uses all of the actual bandwidth.
Chapter 15 Policy and Static Routes The following table describes the labels in this screen. Table 83 Configuration > Network > Routing > Static Route LABEL DESCRIPTION Add Click this to create a new static route. Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so. # This is the number of an individual static route.
Chapter 15 Policy and Static Routes Table 84 Configuration > Network > Routing > Static Route > Add (continued) LABEL DESCRIPTION Gateway IP Select the radio button and enter the IP address of the next-hop gateway. The gateway is a router or switch on the same segment as your ZyWALL's interface(s). The gateway helps forward packets to their destinations. Interface Select the radio button and a predefined interface through which the traffic is sent.
Chapter 15 Policy and Static Routes following twelve DSCP encodings from AF11 through AF43. The decimal equivalent is listed in brackets.
Chapter 15 Policy and Static Routes 3 Computer A and game server 1 are connected to each other until the connection is closed or times out. Any other computers (such as B or C) cannot connect to remote server 1 using the same port triggering rule as computer A unless they are using a different next hop (gateway, outgoing interface, VPN tunnel or trunk) from computer A or until the connection is closed or times out.
Chapter 15 Policy and Static Routes 362 ZyWALL USG 2000 User’s Guide
CHAPTER 16 Routing Protocols 16.1 Routing Protocols Overview Routing protocols give the ZyWALL routing information about the network from other routers. The ZyWALL stores this routing information in the routing table it uses to make routing decisions. In turn, the ZyWALL can also use routing protocols to propagate routing information to other routers. See Section 6.6 on page 114 for related information on the RIP and OSPF screens.
Chapter 16 Routing Protocols 16.2 The RIP Screen RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a device to exchange routing information with other routers. RIP is a vector-space routing protocol, and, like most such protocols, it uses hop count to decide which route is the shortest. Unfortunately, it also broadcasts its routes asynchronously to the network and converges slowly. Therefore, RIP is more suitable for small networks (up to 15 routers).
Chapter 16 Routing Protocols The following table describes the labels in this screen. Table 87 Configuration > Network > Routing Protocol > RIP LABEL DESCRIPTION Authentication Authentication Select the authentication method used in the RIP network. This authentication protects the integrity, but not the confidentiality, of routing updates. None uses no authentication. Text uses a plain text password that is sent over the network (not very secure).
Chapter 16 Routing Protocols System (AS). OSPF offers some advantages over vector-space routing protocols like RIP. • OSPF supports variable-length subnet masks, which can be set up to use available IP addresses more efficiently. • OSPF filters and summarizes routing information, which reduces the size of routing tables throughout the network. • OSPF responds to changes in the network, such as the loss of a router, more quickly.
Chapter 16 Routing Protocols Each type of area is illustrated in the following figure. Figure 279 OSPF: Types of Areas This OSPF AS consists of four areas, areas 0-3. Area 0 is always the backbone. In this example, areas 1, 2, and 3 are all connected to it. Area 1 is a normal area. It has routing information about the OSPF AS and networks X and Y. Area 2 is a stub area. It has routing information about the OSPF AS, but it depends on a default route to send information to networks X and Y.
Chapter 16 Routing Protocols • An Autonomous System Boundary Router (ASBR) exchanges routing information with routers in networks outside the OSPF AS. This is called redistribution in OSPF. Table 88 OSPF: Redistribution from Other Sources to Each Type of Area SOURCE \ TYPE OF AREA NORMAL NSSA STUB Static routes Yes Yes No RIP Yes Yes Yes • A backbone router (BR) has at least one interface with area 0. By default, every router in area 0 is a backbone router, and so is every ABR.
Chapter 16 Routing Protocols to logically connect the area to the backbone. This is illustrated in the following example. Figure 281 OSPF: Virtual Link In this example, area 100 does not have a direct connection to the backbone. As a result, you should set up a virtual link on both ABR in area 10. The virtual link becomes the connection between area 100 and the backbone. You cannot create a virtual link to a router in a different area.
Chapter 16 Routing Protocols Click Configuration > Network > Routing > OSPF to open the following screen. Figure 282 Configuration > Network > Routing > OSPF The following table describes the labels in this screen. See Section 16.3.2 on page 372 for more information as well. Table 89 Configuration > Network > Routing Protocol > OSPF LABEL DESCRIPTION OSPF Router ID Select the 32-bit ID the ZyWALL uses in the OSPF AS.
Chapter 16 Routing Protocols Table 89 Configuration > Network > Routing Protocol > OSPF (continued) LABEL Type DESCRIPTION Select how OSPF calculates the cost associated with routing information from static routes. Choices are: Type 1 and Type 2. Type 1 - cost = OSPF AS cost + external cost (Metric) Type 2 - cost = external cost (Metric); the OSPF AS cost is ignored. Metric Area Type the external cost for routes provided by static routes.
Chapter 16 Routing Protocols 16.3.2 OSPF Area Add/Edit Screen The OSPF Area Add/Edit screen allows you to create a new area or edit an existing one. To access this screen, go to the OSPF summary screen (see Section 16.3 on page 365), and click either the Add icon or an Edit icon. Figure 283 Configuration > Network > Routing > OSPF > Add The following table describes the labels in this screen.
Chapter 16 Routing Protocols Table 90 Configuration > Network > Routing > OSPF > Add (continued) LABEL DESCRIPTION Text Authentication Key This field is available if the Authentication is Text. Type the password for text authentication. The key can consist of alphanumeric characters and the underscore, and it can be up to 8 characters long. MD5 Authentication ID This field is available if the Authentication is MD5. Type the default ID for MD5 authentication in the area.
Chapter 16 Routing Protocols 372) has the Type set to Normal, a Virtual Link table displays. Click either the Add icon or an entry and the Edit icon to display a screen like the following. Figure 284 Configuration > Network > Routing > OSPF > Add > Add The following table describes the labels in this screen. Table 91 Configuration > Network > Routing > OSPF > Add > Add LABEL DESCRIPTION Peer Router ID Enter the 32-bit ID (in IP address format) of the other ABR in the virtual link.
Chapter 16 Routing Protocols Authentication Types Authentication is used to guarantee the integrity, but not the confidentiality, of routing updates. The transmitting router uses its key to encrypt the original message into a smaller message, and the smaller message is transmitted with the original message. The receiving router uses its key to encrypt the received message and then verifies that it matches the smaller message sent with it.
Chapter 16 Routing Protocols 376 ZyWALL USG 2000 User’s Guide
CHAPTER 17 Zones 17.1 Zones Overview Set up zones to configure network security and network policies in the ZyWALL. A zone is a group of interfaces and/or VPN tunnels. The ZyWALL uses zones instead of interfaces in many security and policy settings, such as firewall rules, Anti-X, and remote management. Zones cannot overlap. Each Ethernet interface, VLAN interface, bridge interface, PPPoE/PPTP interface, auxiliary interface, and VPN tunnel can be assigned to at most one zone.
Chapter 17 Zones 17.1.2 What You Need to Know Effects of Zones on Different Types of Traffic Zones effectively divide traffic into three types--intra-zone traffic, inter-zone traffic, and extra-zone traffic--which are affected differently by zone-based security and policy settings. Intra-zone Traffic • Intra-zone traffic is traffic between interfaces or VPN tunnels in the same zone. For example, in Figure 285 on page 377, traffic between VLAN 2 and the Ethernet is intra-zone traffic.
Chapter 17 Zones 17.2 The Zone Screen The Zone screen provides a summary of all zones. In addition, this screen allows you to add, edit, and remove zones. To access this screen, click Configuration > Network > Zone. Figure 286 Configuration > Network > Zone The following table describes the labels in this screen. Table 92 Configuration > Network > Zone LABEL DESCRIPTION User Configuration / System Default The ZyWALL comes with pre-configured System Default zones that you cannot delete.
Chapter 17 Zones 17.3 Zone Edit The Zone Edit screen allows you to add or edit a zone. To access this screen, go to the Zone screen (see Section 17.2 on page 379), and click the Add icon or an Edit icon. Figure 287 Network > Zone > Add The following table describes the labels in this screen. Table 93 Network > Zone > Edit LABEL DESCRIPTION Name For a system default zone, the name is read only. For a user-configured zone, type the name used to refer to the zone.
CHAPTER 18 DDNS 18.1 DDNS Overview Dynamic DNS (DDNS) services let you use a domain name with a dynamic IP address. 18.1.1 What You Can Do in this Chapter • Use the DDNS screen (see Section 18.2 on page 382) to view a list of the configured DDNS domain names and their details. • Use the DDNS Add/Edit screen (see Section 18.2.1 on page 384) to add a domain name to the ZyWALL or to edit the configuration of an existing domain name. 18.1.
Chapter 18 DDNS Note: Record your DDNS account’s user name, password, and domain name to use to configure the ZyWALL. After, you configure the ZyWALL, it automatically sends updated IP addresses to the DDNS service provider, which helps redirect traffic accordingly. Finding Out More See Section 6.5.9 on page 107 for related information on these screens. 18.2 The DDNS Screen The DDNS screen provides a summary of all DDNS domain names and their configuration.
Chapter 18 DDNS Table 95 Configuration > Network > DDNS (continued) LABEL DESCRIPTION Primary Interface/IP This field displays the interface to use for updating the IP address mapped to the domain name followed by how the ZyWALL determines the IP address for the domain name. from interface - The IP address comes from the specified interface. auto detected -The DDNS server checks the source IP address of the packets from the ZyWALL for the IP address to use for the domain name.
Chapter 18 DDNS 18.2.1 The Dynamic DNS Add/Edit Screen The DDNS Add/Edit screen allows you to add a domain name to the ZyWALL or to edit the configuration of an existing domain name. Click Configuration > Network > DDNS and then an Add or Edit icon to open this screen. Figure 289 Configuration > Network > DDNS > Add The following table describes the labels in this screen.
Chapter 18 DDNS Table 96 Configuration > Network > DDNS > Add (continued) LABEL DESCRIPTION Username Type the user name used when you registered your domain name. You can use up to 31 alphanumeric characters and the underscore. Spaces are not allowed. For a Dynu DDNS entry, this user name is the one you use for logging into the service, not the name recorded in your personal information in the Dynu website. Password Type the password provided by the DDNS provider.
Chapter 18 DDNS Table 96 Configuration > Network > DDNS > Add (continued) LABEL IP Address DESCRIPTION The options available in this field vary by DDNS provider. Interface -The ZyWALL uses the IP address of the specified interface. This option appears when you select a specific interface in the Backup Binding Address Interface field. Auto -The DDNS server checks the source IP address of the packets from the ZyWALL for the IP address to use for the domain name.
CHAPTER 19 NAT 19.1 NAT Overview NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network. Use Network Address Translation (NAT) to make computers on a private network behind the ZyWALL available outside the private network.
Chapter 19 NAT 19.1.2 What You Need to Know NAT is also known as virtual server, port forwarding, or port translation. Finding Out More • See Section 6.5.10 on page 107 for related information on these screens. • See Section 19.3 on page 393 for technical background information related to these screens. • See Section 7.10.2 on page 151 for an example of how to configure NAT to allow H.323 traffic from the WAN to the LAN. • See Section 7.11.
Chapter 19 NAT Table 97 Configuration > Network > NAT (continued) LABEL DESCRIPTION Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. # This field is a sequential value, and it is not associated with a specific entry. Status This icon is lit when the entry is active and dimmed when the entry is inactive.
Chapter 19 NAT 19.2.1 The NAT Add/Edit Screen The NAT Add/Edit screen lets you create new NAT rules and edit existing ones. To open this window, open the NAT summary screen. (See Section 19.2 on page 388.) Then, click on an Add icon or Edit icon to open the following screen. Figure 292 Configuration > Network > NAT > Add The following table describes the labels in this screen.
Chapter 19 NAT Table 98 Configuration > Network > NAT > Add (continued) LABEL DESCRIPTION Classification Select what kind of NAT this rule is to perform. Virtual Server - This makes computers on a private network behind the ZyWALL available to a public network outside the ZyWALL (like the Internet).
Chapter 19 NAT Table 98 Configuration > Network > NAT > Add (continued) LABEL DESCRIPTION Mapped IP Subnet/Range This field displays for Many 1:1 NAT. Select to which translated destination IP address subnet or IP address range this NAT rule forwards packets. The original and mapped IP address subnets or ranges must have the same number of IP addresses.
Chapter 19 NAT Table 98 Configuration > Network > NAT > Add (continued) LABEL DESCRIPTION Firewall By default the firewall blocks incoming connections from external addresses. After you configure your NAT rule settings, click the Firewall link to configure a firewall rule to allow the NAT rule’s traffic to come in. The ZyWALL checks NAT rules before it applies To-ZyWALL firewall rules, so To-ZyWALL firewall rules do not apply to traffic that is forwarded by NAT rules.
Chapter 19 NAT For example, a LAN user’s computer at IP address 192.168.1.89 queries a public DNS server to resolve the SMTP server’s domain name (xxx.LAN-SMTP.com in this example) and gets the SMTP server’s mapped public IP address of 1.1.1.1. Figure 293 LAN Computer Queries a Public DNS Server DNS xxx.LAN-SMTP.com = 1.1.1.1 xxx.LAN-SMTP.com = ? 1.1.1.1 LAN 192.168.1.89 192.168.1.21 The LAN user’s computer then sends traffic to IP address 1.1.1.1.
Chapter 19 NAT SMTP server replied directly to the LAN user without the traffic going through NAT, the source would not match the original destination address which would cause the LAN user’s computer to shut down the session. Figure 295 LAN to LAN Return Traffic NAT Source 192.168.1.21 Source 1.1.1.1 SMTP SMTP LAN 192.168.1.21 ZyWALL USG 2000 User’s Guide 192.168.1.
Chapter 19 NAT 396 ZyWALL USG 2000 User’s Guide
CHAPTER 20 HTTP Redirect 20.1 Overview HTTP redirect forwards the client’s HTTP request (except HTTP traffic destined for the ZyWALL) to a web proxy server. In the following example, proxy server A is connected to the DMZ interface. When a client connected to the LAN zone wants to open a web page, its HTTP request is redirected to proxy server A first. If proxy server A cannot find the web page in its cache, a policy route allows it to access the Internet to get them from a server.
Chapter 20 HTTP Redirect 20.1.2 What You Need to Know Web Proxy Server A proxy server helps client devices make indirect requests to access the Internet or outside network resources/services. A proxy server can act as a firewall or an ALG (application layer gateway) between the private network and the Internet or other networks. It also keeps hackers from knowing internal IP addresses. A client connects to a web proxy server each time he/she wants to access the Internet.
Chapter 20 HTTP Redirect • a application patrol rule to allow HTTP traffic between ge4 and ge2. • a policy route to forward HTTP traffic from proxy server A to the Internet. Finding Out More See Section 6.5.11 on page 108 for related information on these screens. 20.2 The HTTP Redirect Screen To configure redirection of a HTTP request to a proxy server, click Configuration > Network > HTTP Redirect. This screen displays the summary of the HTTP redirect rules.
Chapter 20 HTTP Redirect Table 99 Configuration > Network > HTTP Redirect (continued) LABEL DESCRIPTION Port This is the service port number used by the proxy server. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. 20.2.1 The HTTP Redirect Edit Screen Click Network > HTTP Redirect to open the HTTP Redirect screen. Then click the Add or Edit icon to open the HTTP Redirect Edit screen where you can configure the rule.
CHAPTER 21 ALG 21.1 ALG Overview Application Layer Gateway (ALG) allows the following applications to operate properly through the ZyWALL’s NAT. • SIP - Session Initiation Protocol (SIP) - An application-layer protocol that can be used to create voice and multimedia sessions over Internet. • H.323 - A teleconferencing protocol suite that provides audio, data and video conferencing. • FTP - File Transfer Protocol - an Internet file transfer service.
Chapter 21 ALG 21.1.2 What You Need to Know Application Layer Gateway (ALG), NAT and Firewall The ZyWALL can function as an Application Layer Gateway (ALG) to allow certain NAT un-friendly applications (such as SIP) to operate properly through the ZyWALL’s NAT and firewall. The ZyWALL dynamically creates an implicit NAT session and firewall session for the application’s traffic from the WAN to the LAN. The ALG on the ZyWALL supports all of the ZyWALL’s NAT mapping types.
Chapter 21 ALG • There should be only one SIP server (total) on the ZyWALL’s private networks. Any other SIP servers must be on the WAN. So for example you could have a Back-to-Back User Agent such as the IPPBX x6004 or an asterisk PBX on the DMZ or on the LAN but not on both. • Using the SIP ALG allows you to use bandwidth management on SIP traffic. • The SIP ALG handles SIP calls that go through NAT or that the ZyWALL routes. You can also make other SIP calls that do not go through NAT or routing.
Chapter 21 ALG can receive incoming calls from the Internet, LAN IP addresses B and C can still make calls out to the Internet. Figure 301 VoIP Calls from the WAN with Multiple Outgoing Calls VoIP with Multiple WAN IP Addresses With multiple WAN IP addresses on the ZyWALL, you can configure different firewall and NAT (port forwarding) rules to allow incoming calls from each WAN IP address to go to a specific IP address on the LAN (or DMZ). Use policy routing to have the H.
Chapter 21 ALG • See Section 21.3 on page 407 for ALG background/technical information. 21.1.3 Before You Begin You must also configure the firewall and enable NAT in the ZyWALL to allow sessions initiated from the WAN. 21.2 The ALG Screen Click Configuration > Network > ALG to open the ALG screen. Use this screen to turn ALGs off or on, configure the port numbers to which they apply, and configure SIP ALG time outs.
Chapter 21 ALG The following table describes the labels in this screen. Table 101 Configuration > Network > ALG LABEL DESCRIPTION Enable SIP ALG Turn on the SIP ALG to detect SIP traffic and help build SIP sessions through the ZyWALL’s NAT. Enabling the SIP ALG also allows you to use the application patrol to detect SIP traffic and manage the SIP traffic’s bandwidth (see Chapter 32 on page 521).
Chapter 21 ALG Table 101 Configuration > Network > ALG (continued) LABEL DESCRIPTION Enable FTP ALG Turn on the FTP ALG to detect FTP (File Transfer Program) traffic and help build FTP sessions through the ZyWALL’s NAT. Enabling the FTP ALG also allows you to use the application patrol to detect FTP traffic and manage the FTP traffic’s bandwidth (see Chapter 32 on page 521).
Chapter 21 ALG connections to the second (passive) interface when the active interface’s connection goes down. When the active interface’s connection fails, the client needs to re-initialize the connection through the second interface (that was set to passive) in order to have the connection go through the second interface. VoIP clients usually re-register automatically at set intervals or the users can manually force them to re-register.
CHAPTER 22 IP/MAC Binding 22.1 IP/MAC Binding Overview IP address to MAC address binding helps ensure that only the intended devices get to use privileged IP addresses. The ZyWALL uses DHCP to assign IP addresses and records to MAC address it assigned each IP address. The ZyWALL then checks incoming connection attempts against this list. A user cannot manually assign another IP to his computer and use it to connect to the ZyWALL. Suppose you configure access privileges for IP address 192.168.1.
Chapter 22 IP/MAC Binding 22.1.2 What You Need to Know DHCP IP/MAC address bindings are based on the ZyWALL’s dynamic and static DHCP entries. Interfaces Used With IP/MAC Binding IP/MAC address bindings are grouped by interface. You can use IP/MAC binding with Ethernet, bridge, and VLAN interfaces. You can also enable or disable IP/MAC binding and logging in an interface’s configuration screen. 22.
Chapter 22 IP/MAC Binding The following table describes the labels in this screen. Table 102 Configuration > Network > IP/MAC Binding > Summary LABEL DESCRIPTION Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. # This field is a sequential value, and it is not associated with a specific entry.
Chapter 22 IP/MAC Binding The following table describes the labels in this screen. Table 103 Configuration > Network > IP/MAC Binding > Edit LABEL DESCRIPTION IP/MAC Binding Settings Interface Name This field displays the name of the interface within the ZyWALL and the interface’s IP address and subnet mask. Enable IP/ MAC Binding Select this option to have this interface enforce links between specific IP addresses and specific MAC addresses.
Chapter 22 IP/MAC Binding screen. Use this screen to configure an interface’s IP to MAC address binding settings. Figure 307 Configuration > Network > IP/MAC Binding > Edit > Add The following table describes the labels in this screen. Table 104 Configuration > Network > IP/MAC Binding > Edit > Add LABEL DESCRIPTION Interface Name This field displays the name of the interface within the ZyWALL and the interface’s IP address and subnet mask.
Chapter 22 IP/MAC Binding The following table describes the labels in this screen. Table 105 Configuration > Network > IP/MAC Binding > Exempt List LABEL DESCRIPTION Add Click this to create a new entry. Edit Click an entry or select it and click Edit to modify the entry’s settings. Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so. # This is the index number of the IP/MAC binding list entry.
CHAPTER 23 Authentication Policy 23.1 Overview Use authentication policies to control who can access the network. You can authenticate users (require them to log in) and even perform Endpoint Security (EPS) checking to make sure users’ computers comply with defined corporate policies before they can access the network. After a users passes authentication the user’s computer must meet the endpoint security object’s Operating System (OS) option and security requirements to gain access.
Chapter 23 Authentication Policy 23.1.2 What You Need to Know Authentication Policy and VPN Authentication policies are applied based on a traffic flow’s source and destination IP addresses. If VPN traffic matches an authentication policy’s source and destination IP addresses, the user must pass authentication. Multiple Endpoint Security Objects You can set an authentication policy to use multiple endpoint security objects. This allows checking of computers with different OSs or security settings.
Chapter 23 Authentication Policy Click Configuration > Auth. Policy to display the screen. Figure 310 Configuration > Auth.
Chapter 23 Authentication Policy The following table gives an overview of the objects you can configure. Table 106 Configuration > Auth. Policy LABEL DESCRIPTION Enable Authentication Policy Select this to turn on the authentication policy feature. Exceptional Services Use this table to list services that users can access without logging in. Click Add to change the list’s membership. A screen appears. Available services appear on the left.
Chapter 23 Authentication Policy Table 106 Configuration > Auth. Policy (continued) LABEL DESCRIPTION Status This icon is lit when the entry is active and dimmed when the entry is inactive. Priority This is the position of the authentication policy in the list. The priority is important as the policies are applied in order of priority. Default displays for the default authentication policy that the ZyWALL uses on traffic that does not match any exceptional service or other authentication policy.
Chapter 23 Authentication Policy Figure 312 Configuration > Auth. Policy > Add The following table gives an overview of the objects you can configure. Table 107 Configuration > Auth. Policy > Add 420 LABEL DESCRIPTION Create new Object Use to configure any new settings objects that you need to use in this screen. Enable Policy Select this check box to activate the authentication policy. This field is available for user-configured policies.
Chapter 23 Authentication Policy Table 107 Configuration > Auth. Policy > Add (continued) LABEL DESCRIPTION Schedule Select a schedule that defines when the policy applies. Otherwise, select none and the rule is always effective. This is none and not configurable for the default policy. Authentication Select the authentication requirement for users when their traffic matches this policy. unnecessary - Users do not need to be authenticated. required - Users need to be authenticated.
Chapter 23 Authentication Policy 422 ZyWALL USG 2000 User’s Guide
CHAPTER 24 Firewall 24.1 Overview Use the firewall to block or allow services that use static port numbers. Use application patrol (see Chapter 32 on page 521) to control services using flexible/ dynamic port numbers. The firewall can also limit the number of user sessions. This figure shows the ZyWALL’s default firewall rules in action and demonstrates how stateful inspection works. User 1 can initiate a Telnet session from within the LAN zone and responses to this request are allowed.
Chapter 24 Firewall 24.1.2 What You Need to Know Stateful Inspection The ZyWALL has a stateful inspection firewall. The ZyWALL restricts access by screening data packets against defined access rules. It also inspects sessions. For example, traffic from one zone is not allowed unless it is initiated by a computer in another zone first. Zones A zone is a group of interfaces or VPN tunnels. Group the ZyWALL’s interfaces into different zones based on your needs.
Chapter 24 Firewall • The ZyWALL drops most packets from the DMZ zone to the ZyWALL itself, except for DNS and NetBIOS traffic, and generates a log. When you configure a firewall rule for packets destined for the ZyWALL itself, make sure it does not conflict with your service control rule. See Chapter 50 on page 783 for more information about service control (remote management). The ZyWALL checks the firewall rules before the service control rules for traffic destined for the ZyWALL.
Chapter 24 Firewall traffic blocking to allow or block VPN traffic transmitting between the VPN tunnel and other interfaces in the LAN zone. If you add the VPN tunnel to a new zone (the VPN zone for example), you can configure rules for VPN traffic between the VPN zone and other zones or From VPN To-ZyWALL rules for VPN traffic destined for the ZyWALL. Session Limits Accessing the ZyWALL or network resources through the ZyWALL requires a NAT session and corresponding firewall session.
Chapter 24 Firewall the firewall rule to always be in effect. The following figure shows the results of this rule. Figure 314 Blocking All LAN to WAN IRC Traffic Example Your firewall would have the following rules. Table 109 Blocking All LAN to WAN IRC Traffic Example # USER SOURCE DESTINATION SCHEDULE SERVICE ACTION 1 Any Any Any Any IRC Deny 2 Any Any Any Any Any Allow • The first row blocks LAN access to the IRC service on the WAN.
Chapter 24 Firewall Now you configure a LAN to WAN firewall rule that allows IRC traffic from the IP address of the CEO’s computer (192.168.1.7 for example) to go to any destination address. You do not need to specify a schedule since you want the firewall rule to always be in effect. The following figure shows the results of your two custom rules. Figure 315 Limited LAN to WAN IRC Traffic Example Your firewall would have the following configuration.
Chapter 24 Firewall • The first row allows any LAN computer to access the IRC service on the WAN by logging into the ZyWALL with the CEO’s user name. • The second row blocks LAN access to the IRC service on the WAN. • The third row is the firewall’s default policy of allowing all traffic from the LAN to go to the WAN. The rule for the CEO must come before the rule that blocks all LAN to WAN IRC traffic.
Chapter 24 Firewall 5 The screen for configuring a service object opens. Configure it as follows and click OK. Figure 318 Firewall Example: Create a Service Object 6 Select From WAN and To LAN1. 7 Enter the name of the firewall rule. 8 Select Dest_1 is selected for the Destination and Doom is selected as the Service. Enter a description and configure the rest of the screen as follows. Click OK when you are done.
Chapter 24 Firewall 9 The firewall rule appears in the firewall rule summary. Figure 320 Firewall Example: Doom Rule in Summary 24.2 The Firewall Screen Asymmetrical Routes If an alternate gateway on the LAN has an IP address in the same subnet as the ZyWALL’s LAN IP address, return traffic may not go through the ZyWALL. This is called an asymmetrical or “triangle” route. This causes the ZyWALL to reset the connection, as the connection has not been acknowledged.
Chapter 24 Firewall 4 The ZyWALL then sends it to the computer on the LAN in Subnet 1. Figure 321 Using Virtual Interfaces to Avoid Asymmetrical Routes LAN 24.2.1 Configuring the Firewall Screen Click Configuration > Firewall to open the Firewall screen. Use this screen to enable or disable the firewall and asymmetrical routes, set a maximum number of sessions per host, and display the configured firewall rules.
Chapter 24 Firewall • The ordering of your rules is very important as rules are applied in sequence. Figure 322 Configuration > Firewall The following table describes the labels in this screen. Table 112 Configuration > Firewall LABEL DESCRIPTION General Settings Enable Firewall Select this check box to activate the firewall. The ZyWALL performs access control when the firewall is activated.
Chapter 24 Firewall Table 112 Configuration > Firewall (continued) LABEL DESCRIPTION From Zone / To Zone This is the direction of travel of packets. Select from which zone the packets come and to which zone they go. Firewall rules are grouped based on the direction of travel of packets to which they apply. For example, from LAN to LAN means packets traveling from a computer or subnet on the LAN to either another computer or subnet on the LAN.
Chapter 24 Firewall Table 112 Configuration > Firewall (continued) LABEL DESCRIPTION Service This displays the service object to which this firewall rule applies. Access This field displays whether the firewall silently discards packets (deny), discards packets and sends a TCP reset packet to the sender (reject) or permits the passage of packets (allow). Log This field shows you whether a log (and alert) is created when packets match this rule or not.
Chapter 24 Firewall Table 113 Configuration > Firewall > Add (continued) LABEL DESCRIPTION Description Enter a descriptive name of up to 60 printable ASCII characters for the firewall rule. Spaces are allowed. Schedule Select a schedule that defines when the rule applies. Otherwise, select none and the rule is always effective. User This field is not available when you are configuring a to-ZyWALL rule. Select a user name or user group to which to apply the rule.
Chapter 24 Firewall individual limits for specific users, addresses, or both. The individual limit takes priority if you apply both. Figure 324 Configuration > Firewall > Session Limit The following table describes the labels in this screen. Table 114 Configuration > Firewall > Session Limit LABEL DESCRIPTION General Settings Enable Session limit Select this check box to control the number of concurrent sessions hosts can have.
Chapter 24 Firewall Table 114 Configuration > Firewall > Session Limit (continued) LABEL DESCRIPTION # This is the index number of a session limit rule. It is not associated with a specific rule. User This is the user name or user group name to which this session limit rule applies. Address This is the address object to which this session limit rule applies. Limit This is how many concurrent sessions this user or address is allowed to have.
Chapter 24 Firewall Table 115 Configuration > Firewall > Session Limit > Edit (continued) LABEL DESCRIPTION User Select a user name or user group to which to apply the rule. The rule is activated only when the specified user logs into the system and the rule will be disabled when the user logs out. Otherwise, select any and there is no need for user logging.
Chapter 24 Firewall 440 ZyWALL USG 2000 User’s Guide
CHAPTER 25 IPSec VPN 25.1 IPSec VPN Overview A virtual private network (VPN) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing. It is used to transport traffic over the Internet or any insecure network that uses TCP/IP for communication.
Chapter 25 IPSec VPN • Use the VPN Gateway screens (see Section 25.2.1 on page 446) to manage the ZyWALL’s VPN gateways. A VPN gateway specifies the IPSec routers at either end of a VPN tunnel and the IKE SA settings (phase 1 settings). You can also activate and deactivate each VPN gateway. • Use the VPN Concentrator screens (see Section 25.4 on page 465) to combine several IPSec VPN connections into a single secure network. 25.1.
Chapter 25 IPSec VPN Application Scenarios The ZyWALL’s application scenarios make it easier to configure your VPN connection settings. Table 116 IPSec VPN Application Scenarios SITE-TO-SITE Choose this if the remote IPSec router has a static IP address or a domain name. This ZyWALL can initiate the VPN tunnel. The remote IPSec router can also initiate the VPN tunnel if this ZyWALL has a static IP address or a domain name.
Chapter 25 IPSec VPN • See Section 25.5 on page 469 for IPSec VPN background information. • See Section 5.3 on page 83 for the IPSec VPN quick setup wizard. • See Section 7.4 on page 127 for an example of configuring IPSec VPN. • See Section 7.5 on page 131 for an example of how to configure a hub-andspoke IPSec VPN without using a VPN concentrator. 25.1.3 Before You Begin This section briefly explains the relationship between VPN tunnels and other features.
Chapter 25 IPSec VPN SA). Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 328 Configuration > VPN > IPSec VPN > VPN Connection Each field is discussed in the following table. See Section 25.2.2 on page 453 and Section 25.2.1 on page 446 for more information.
Chapter 25 IPSec VPN Table 117 Configuration > VPN > IPSec VPN > VPN Connection (continued) LABEL DESCRIPTION Disconnect To disconnect an IPSec SA, select it and click Disconnect. # This field is a sequential value, and it is not associated with a specific connection. Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. The connect icon is lit when the interface is connected and dimmed when it is disconnected.
Chapter 25 IPSec VPN Figure 329 Configuration > VPN > IPSec VPN > VPN Connection > Edit (IKE) ZyWALL USG 2000 User’s Guide 447
Chapter 25 IPSec VPN Each field is described in the following table. Table 118 Configuration > VPN > IPSec VPN > VPN Connection > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. Create new Object Use to configure any new settings objects that you need to use in this screen. General Settings Connection Name Type the name used to identify this IPSec SA.
Chapter 25 IPSec VPN Table 118 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued) LABEL DESCRIPTION Policy Local Policy Select the address corresponding to the local network. Use Create new Object if you need to configure a new one. Remote Policy Select the address corresponding to the remote network. Use Create new Object if you need to configure a new one.
Chapter 25 IPSec VPN Table 118 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued) LABEL Encryption DESCRIPTION This field is applicable when the Active Protocol is ESP. Select which key size and encryption algorithm to use in the IPSec SA.
Chapter 25 IPSec VPN Table 118 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued) LABEL Check Method DESCRIPTION Select how the ZyWALL checks the connection. The peer must be configured to respond to the method you select. Select icmp to have the ZyWALL regularly ping the address you specify to make sure traffic can still go through the connection. You may need to configure the peer to respond to pings.
Chapter 25 IPSec VPN Table 118 Configuration > VPN > IPSec VPN > VPN Connection > Edit (continued) LABEL DESCRIPTION Inbound Traffic 452 Source NAT This translation hides the source address of computers in the remote network. Source Select the address object that represents the original source address (or select Create Object to configure a new one). This is the address object for the remote network.
Chapter 25 IPSec VPN 25.2.2 The VPN Connection Add/Edit Manual Key Screen The VPN Connection Add/Edit Manual Key screen allows you to create a new VPN connection or edit an existing one using a manual key. This is useful if you have problems with IKE key management. To access this screen, go to the VPN Connection summary screen (see Section 25.2 on page 444), and click either the Add icon or an existing manual key entry’s Edit icon. In the VPN Gateway section of the screen, select Manual Key.
Chapter 25 IPSec VPN Table 119 Configuration > VPN > IPSec VPN > VPN Connection > Add > Manual Key (continued) LABEL DESCRIPTION Secure Gateway Address Type the IP address of the remote IPSec router in the IPSec SA. SPI Type a unique SPI (Security Parameter Index) between 256 and 4095. The SPI is used to identify the ZyWALL during authentication. The ZyWALL and remote IPSec router must use the same SPI. Encapsulation Mode Select which type of encapsulation the IPSec SA uses.
Chapter 25 IPSec VPN Table 119 Configuration > VPN > IPSec VPN > VPN Connection > Add > Manual Key (continued) LABEL DESCRIPTION Encryption Key This field is applicable when you select an Encryption Algorithm. Enter the encryption key, which depends on the encryption algorithm.
Chapter 25 IPSec VPN 25.3 The VPN Gateway Screen The VPN Gateway summary screen displays the IPSec VPN gateway policies in the ZyWALL, as well as the ZyWALL’s address, remote IPSec router’s address, and associated VPN connections for each one. In addition, it also lets you activate and deactivate each VPN gateway. To access this screen, click Configuration > VPN > Network > IPSec VPN > VPN Gateway. The following screen appears.
Chapter 25 IPSec VPN Table 120 Configuration > VPN > IPSec VPN > VPN Gateway (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. 25.3.1 The VPN Gateway Add/Edit Screen The VPN Gateway Add/Edit screen allows you to create a new VPN gateway policy or edit an existing one. To access this screen, go to the VPN Gateway summary screen (see Section 25.
Chapter 25 IPSec VPN Figure 332 Configuration > VPN > IPSec VPN > VPN Gateway > Edit 458 ZyWALL USG 2000 User’s Guide
Chapter 25 IPSec VPN Each field is described in the following table. Table 121 Configuration > VPN > IPSec VPN > VPN Gateway > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. General Settings VPN Gateway Name Type the name used to identify this VPN gateway. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 25 IPSec VPN Table 121 Configuration > VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL Pre-Shared Key DESCRIPTION Select this to have the ZyWALL and remote IPSec router use a preshared key (password) to identify each other when they negotiate the IKE SA. Type the pre-shared key in the field to the right. The preshared key can be • • 8 - 32 alphanumeric characters or ,;|`~!@#$%^&*()_+\{}':./ <>=-". 8 - 32 pairs of hexadecimal (0-9, A-F) characters, preceded by “0x”.
Chapter 25 IPSec VPN Table 121 Configuration > VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL Content DESCRIPTION This field is read-only if the ZyWALL and remote IPSec router use certificates to identify each other. Type the identity of the ZyWALL during authentication. The identity depends on the Local ID Type. IP - type an IP address; if you type 0.0.0.0, the ZyWALL uses the IP address specified in the My Address field.
Chapter 25 IPSec VPN Table 121 Configuration > VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL Content DESCRIPTION This field is disabled if the Peer ID Type is Any. Type the identity of the remote IPSec router during authentication. The identity depends on the Peer ID Type. If the ZyWALL and remote IPSec router do not use certificates, IP - type an IP address; see the note at the end of this description.
Chapter 25 IPSec VPN Table 121 Configuration > VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL Negotiation Mode DESCRIPTION Select the negotiation mode to use to negotiate the IKE SA. Choices are Main - this encrypts the ZyWALL’s and remote IPSec router’s identities but takes more time to establish the IKE SA Aggressive - this is faster but does not encrypt the identities The ZyWALL and the remote IPSec router must use the same negotiation mode. Proposal Add Click this to create a new entry.
Chapter 25 IPSec VPN Table 121 Configuration > VPN > IPSec VPN > VPN Gateway > Edit (continued) LABEL NAT Traversal DESCRIPTION Select this if any of these conditions are satisfied. • • This IKE SA might be used to negotiate IPSec SAs that use ESP as the active protocol. There are one or more NAT routers between the ZyWALL and remote IPSec router, and these routers do not support IPSec pass-thru or a similar feature.
Chapter 25 IPSec VPN 25.4 VPN Concentrator A VPN concentrator combines several IPSec VPN connections into one secure network. Figure 333 VPN Topologies (Fully Meshed and Hub and Spoke) 1 2 In a fully-meshed VPN topology (1 in the figure), there is a VPN connection between every pair of routers. In a hub-and-spoke VPN topology (2 in the figure), there is a VPN connection between each spoke router (B, C, D, and E) and the hub router (A), which uses the VPN concentrator.
Chapter 25 IPSec VPN • Branch office A’s ZyWALL uses one VPN rule to access both the headquarters (HQ) network and branch office B’s network. • Branch office B’s ZyWALL uses one VPN rule to access branch office A’s network only. Branch office B is not permitted to access the headquarters network. Figure 334 IPSec VPN Concentrator Example This IPSec VPN concentrator example uses the following settings. Branch Office A (ZyNOS-based ZyWALL): VPN Gateway (VPN Tunnel 1): • My Address: 10.0.0.
Chapter 25 IPSec VPN VPN Connection (VPN Tunnel 1): • Local Policy: 192.168.1.0/255.255.255.0 • Remote Policy:192.168.11.0/255.255.255.0 • Disable Policy Enforcement VPN Gateway (VPN Tunnel 2): • My Address: 10.0.0.1 • Peer Gateway Address: 10.0.0.3 VPN Connection (VPN Tunnel 2): • Local Policy: 192.168.1.0/255.255.255.0 • Remote Policy: 192.168.12.0/255.255.255.0 • Disable Policy Enforcement Concentrator • Add VPN tunnel 1 and VPN tunnel 2 to an IPSec VPN concentrator.
Chapter 25 IPSec VPN • The local IP addresses configured in the VPN rules should not overlap. • The concentrator must have at least one separate VPN rule for each spoke. In the local policy, specify the IP addresses of the networks with which the spoke is to be able to have a VPN tunnel. This may require you to use more than one VPN rule for each spoke. • To have all Internet access from the spoke routers go through the VPN tunnel, set the VPN rules in the spoke routers to use 0.0.0.
Chapter 25 IPSec VPN Concentrator summary screen (see Section 25.4 on page 465), and click either the Add icon or an Edit icon. Figure 336 Configuration > VPN > IPSec VPN > Concentrator > Edit Each field is described in the following table. Table 123 VPN > IPSec VPN > Concentrator > Edit LABEL DESCRIPTION Name Enter the name of the concentrator. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 25 IPSec VPN IKE SA Overview The IKE SA provides a secure connection between the ZyWALL and remote IPSec router. It takes several steps to establish an IKE SA. The negotiation mode determines how many. There are two negotiation modes--main mode and aggressive mode. Main mode provides better security, while aggressive mode is faster. Note: Both routers must use the same negotiation mode. These modes are discussed in more detail in Negotiation Mode on page 474.
Chapter 25 IPSec VPN The ZyWALL sends one or more proposals to the remote IPSec router. (In some devices, you can only set up one proposal.) Each proposal consists of an encryption algorithm, authentication algorithm, and DH key group that the ZyWALL wants to use in the IKE SA. The remote IPSec router selects an acceptable proposal and sends the accepted proposal back to the ZyWALL. If the remote IPSec router rejects all of the proposals, the ZyWALL and remote IPSec router cannot establish an IKE SA.
Chapter 25 IPSec VPN 3 Y 4 the longer it takes to encrypt and decrypt information. For example, DH2 keys X (1024 bits) are more secure than DH1 keys (768 bits), but DH2 keys take longer to encrypt and decrypt. Authentication Before the ZyWALL and remote IPSec router establish an IKE SA, they have to verify each other’s identity. This process is based on pre-shared keys and router identities. In main mode, the ZyWALL and remote IPSec router authenticate each other in steps 5 and 6, as illustrated below.
Chapter 25 IPSec VPN Router identity consists of ID type and content. The ID type can be domain name, IP address, or e-mail address, and the content is a (properly-formatted) domain name, IP address, or e-mail address. The content is only used for identification. Any domain name or e-mail address that you enter does not have to actually exist. Similarly, any domain name or IP address that you enter does not have to correspond to the ZyWALL’s or remote IPSec router’s properties.
Chapter 25 IPSec VPN Negotiation Mode There are two negotiation modes--main mode and aggressive mode. Main mode provides better security, while aggressive mode is faster. Main mode takes six steps to establish an IKE SA. Steps 1 - 2: The ZyWALL sends its proposals to the remote IPSec router. The remote IPSec router selects an acceptable proposal and sends it back to the ZyWALL.
Chapter 25 IPSec VPN feature, router X and router Y can establish a VPN tunnel as long as the active protocol is ESP. (See Active Protocol on page 476 for more information about active protocols.) If router A does not have an IPSec pass-thru or if the active protocol is AH, you can solve this problem by enabling NAT traversal. In NAT traversal, router X and router Y add an extra header to the IKE SA and IPSec SA packets.
Chapter 25 IPSec VPN • The local and peer ID type and content come from the certificates. Note: You must set up the certificates for the ZyWALL and remote IPSec router first. IPSec SA Overview Once the ZyWALL and remote IPSec router have established the IKE SA, they can securely negotiate an IPSec SA through which to send data between computers on the networks. Note: The IPSec SA stays connected even if the underlying IKE SA is not available anymore.
Chapter 25 IPSec VPN These modes are illustrated below. Figure 341 VPN: Transport and Tunnel Mode Encapsulation Original Packet IP Header TCP Header Data Transport Mode Packet IP Header AH/ESP Header TCP Header Data Tunnel Mode Packet IP Header AH/ESP Header IP Header TCP Header Data In tunnel mode, the ZyWALL uses the active protocol to encapsulate the entire IP packet.
Chapter 25 IPSec VPN Additional Topics for IPSec SA This section provides more information about IPSec SA in your ZyWALL. IPSec SA using Manual Keys You might set up an IPSec SA using manual keys when you want to establish a VPN tunnel quickly, for example, for troubleshooting. You should only do this as a temporary solution, however, because it is not as secure as a regular IPSec SA. In IPSec SAs using manual keys, the ZyWALL and remote IPSec router do not establish an IKE SA.
Chapter 25 IPSec VPN Each kind of translation is explained below. The following example is used to help explain each one. Figure 342 VPN Example: NAT for Inbound and Outbound Traffic Source Address in Outbound Packets (Outbound Traffic, Source NAT) This translation lets the ZyWALL route packets from computers that are not part of the specified local network (local policy) through the IPSec SA.
Chapter 25 IPSec VPN • SNAT - the translated source address; a different IP address (range of addresses) to hide the original source address. Destination Address in Inbound Packets (Inbound Traffic, Destination NAT) You can set up this translation if you want the ZyWALL to forward some packets from the remote network to a specific computer in the local network.
CHAPTER 26 SSL VPN 26.1 Overview Use SSL VPN to allow users to use a web browser for secure remote user login (the remote users do not need a VPN router or VPN client software. 26.1.1 What You Can Do in this Chapter • Use the VPN > SSL VPN > Access Privilege screens (see Section 26.2 on page 484) to configure SSL access policies. • Use the Click VPN > SSL VPN > Global Setting screen (see Section 26.
Chapter 26 SSL VPN You do not have to install additional client software on the remote user computers for access. Figure 343 Network Access Mode: Reverse Proxy Full Tunnel Mode In full tunnel mode, a virtual connection is created for remote users with private IP addresses in the same subnet as the local network. This allows them to access network resources in the same way as if they were part of the internal network.
Chapter 26 SSL VPN changes through the SSL policies that use the object(s). When you delete an SSL policy, the objects are not removed. Table 126 Objects OBJECT TYPE OBJECT SCREEN DESCRIPTION User Accounts User Account/ User Group Configure a user account or user group to which you want to apply this SSL access policy. Endpoint Security Endpoint Security Endpoint Security (EPS) checking makes sure users’ computers comply with defined corporate policies before they can access the SSL VPN tunnel.
Chapter 26 SSL VPN 26.2 The SSL Access Privilege Screen Click VPN > SSL VPN to open the Access Privilege screen. This screen lists the configured SSL access policies. Figure 345 VPN > SSL VPN > Access Privilege The following table describes the labels in this screen. Table 127 VPN > SSL VPN > Access Privilege LABEL DESCRIPTION Add Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry.
Chapter 26 SSL VPN Table 127 VPN > SSL VPN > Access Privilege LABEL DESCRIPTION Apply Click Apply to save the settings. Reset Click Reset to discard all changes.
Chapter 26 SSL VPN 26.2.1 The SSL Access Policy Add/Edit Screen To create a new or edit an existing SSL access policy, click the Add or Edit icon in the Access Privilege screen.
Chapter 26 SSL VPN The following table describes the labels in this screen. Table 128 VPN > SSL VPN > Access Privilege > Add/Edit LABEL DESCRIPTION Create new Object Use to configure any new settings objects that you need to use in this screen. Configuration Enable Policy Select this option to activate this SSL access policy. Name Enter a descriptive name to identify this policy. You can enter up to 15 characters (“a-z”, A-Z”, “0-9”) with no spaces allowed.
Chapter 26 SSL VPN Table 128 VPN > SSL VPN > Access Privilege > Add/Edit (continued) LABEL DESCRIPTION SSL Application List (Optional) The Selectable Application Objects list displays the name(s) of the SSL application(s) you can select for this SSL access policy. To associate an SSL application to this SSL access policy, select a name and click >> to add to the Selected Application Objects list. You can select more than one application.
Chapter 26 SSL VPN on your network for full tunnel mode access, enter access messages or upload a custom logo to be displayed on the remote user screen. Figure 347 VPN > SSL VPN > Global Setting The following table describes the labels in this screen. Table 129 VPN > SSL VPN > Global Setting LABEL DESCRIPTION Global Setting Network Extension Local IP Specify the IP address of the ZyWALL (or a gateway device) for full tunnel mode SSL VPN access.
Chapter 26 SSL VPN Table 129 VPN > SSL VPN > Global Setting (continued) LABEL DESCRIPTION Logout Message Specify a message to display on the screen when a user logs out and the SSL VPN connection is terminated successfully. You can enter up to 60 characters (“a-z”, A-Z”, “0-9”) with spaces allowed. Update Client Virtual Desktop Logo You can upload a graphic logo to be displayed on the web browser on the remote user computer. The ZyXEL company logo is the default logo.
Chapter 26 SSL VPN The following shows an example logo on the remote user screen. Figure 348 Example Logo Graphic Display 26.4 Establishing an SSL VPN Connection After you have configured the SSL VPN settings on the ZyWALL, use the ZyWALL login screen’s SSL VPN button to establish an SSL VPN connection. See Section 27.2 on page 494 for details. 1 Display the ZyWALL’s login screen and enter your user account information (the user name and password). Click SSL VPN.
Chapter 26 SSL VPN 2 SSL VPN connection starts. This may take several minutes depending on your network connection. Once the connection is up, you should see the client portal screen. The following shows an example. Figure 350 SSL VPN Client Portal Screen Example If the user account is not set up for SSL VPN access, an “SSL VPN connection is not activated” message displays in the Login screen. Clear the Login to SSL VPN check box and try logging in again.
CHAPTER 27 SSL User Screens 27.1 Overview This chapter introduces the remote user SSL VPN screens. The following figure shows a network example where a remote user (A) logs into the ZyWALL from the Internet to access the web server (WWW) on the local network. Figure 351 Network Example Internet WWW A 27.1.
Chapter 27 SSL User Screens System Requirements Here are the browser and computer system requirements for remote user access. • Windows 7 (32 or 64-bit), Vista (32 or 64-bit), 2003 (32-bit), XP (32-bit), or 2000 (32-bit) • Internet Explorer 7 and above or Firefox 1.5 and above • Using RDP requires Internet Explorer • Sun’s Java (Java Runtime Environment or ‘JRE’) installed and enabled with a minimum version of 1.6.
Chapter 27 SSL User Screens 1 Open a web browser and enter the web site address or IP address of the ZyWALL. For example, “http://sslvpn.mycompany.com”. Figure 352 Enter the Address in a Web Browser 2 Click OK or Yes if a security screen displays. Figure 353 Login Security Screen 3 A login screen displays. Enter the user name and password of your login account. If a token password is also required, enter it in the One-Time Password field.
Chapter 27 SSL User Screens 5 Your computer starts establishing a secure connection to the ZyWALL after a successful login. This may take up to two minutes. If you get a message about needing Java, download and install it and restart your browser and re-login. If a certificate warning screen displays, click OK, Yes or Continue. Figure 355 Java Needed Message 6 The ZyWALL tries to install the SecuExtender client.
Chapter 27 SSL User Screens 7 The ZyWALL tries to install the SecuExtender client. You may need to click a popup to get your browser to allow this. In Internet Explorer, click Install. Figure 357 SecuExtender Blocked by Internet Explorer 8 The ZyWALL tries to run the “ssltun” application. You may need to click something to get your browser to allow this. In Internet Explorer, click Run.
Chapter 27 SSL User Screens 10 If a screen like the following displays, click Continue Anyway to finish installing the SecuExtender client on your computer. Figure 360 Hardware Installation Warning 11 The Application screen displays showing the list of resources available to you. See Figure 361 on page 499 for a screen example. Note: Available resource links vary depending on the configuration your network administrator made.
Chapter 27 SSL User Screens 27.3 The SSL VPN User Screens This section describes the main elements in the remote user screens. Figure 361 Remote User Screen 1 2 3 4 5 6 The following table describes the various parts of a remote user screen. Table 130 Remote User Screen Overview # DESCRIPTION 1 Click on a menu tab to go to the Application or File Sharing screen. 2 Click this icon to create a bookmark to the SSL VPN user screen in your web browser.
Chapter 27 SSL User Screens 27.4 Bookmarking the ZyWALL You can create a bookmark of the ZyWALL by clicking the Add to Favorite icon. This allows you to access the ZyWALL using the bookmark without having to enter the address every time. 1 In any remote user screen, click the Add to Favorite icon. 2 A screen displays. Accept the default name in the Name field or enter a descriptive name to identify this link. 3 Click OK to create a bookmark in your web browser. Figure 362 Add Favorite 27.
Chapter 27 SSL User Screens 3 An information screen displays to indicate that the SSL VPN connection is about to terminate.
Chapter 27 SSL User Screens 502 ZyWALL USG 2000 User’s Guide
CHAPTER 28 SSL User Application Screens 28.1 SSL User Application Screens Overview Use the Application screen to access web-based applications (such as web sites and e-mail) on the network through the SSL VPN connection. Which applications you can access depends on the ZyWALL’s configuration. 28.2 The Application Screen Click the Application tab to display the screen. The Name field displays the descriptive name for an application.
Chapter 28 SSL User Application Screens 504 ZyWALL USG 2000 User’s Guide
CHAPTER 29 SSL User File Sharing 29.1 Overview The File Sharing screen lets you access files on a file server through the SSL VPN connection. 29.1.1 What You Need to Know Use the File Sharing screen to display and access shared files/folders on a file server. You can also perform the following actions: • Access a folder. • Open a file (if your web browser cannot open the file, you are prompted to download it). • Save a file to your computer. • Create a new folder. • Rename a file or folder.
Chapter 29 SSL User File Sharing 29.2 The Main File Sharing Screen The first File Sharing screen displays the name(s) of the shared folder(s) available. The following figure shows an example with one file share. Figure 366 File Sharing 29.3 Opening a File or Folder You can open a file if the file extension is recognized by the web browser and the associated application is installed on your computer. 506 1 Log in as a remote user and click the File Sharing tab. 2 Click on a file share icon.
Chapter 29 SSL User File Sharing 3 If an access user name and password are required, a screen displays as shown in the following figure. Enter the account information and click Login to continue.
Chapter 29 SSL User File Sharing 4 A list of files/folders displays. Click on a file to open it in a separate browser window. You can also click a folder to access it. For this example, click on a .doc file to open the Word document. Figure 368 File Sharing: Open a Word File 29.3.1 Downloading a File You are prompted to download a file which cannot be opened using a web browser. Follow the on-screen instructions to download and save the file to your computer.
Chapter 29 SSL User File Sharing 29.3.2 Saving a File After you have opened a file in a web browser, you can save a copy of the file by clicking File > Save As and following the on-screen instructions. Figure 369 File Sharing: Save a Word File 29.4 Creating a New Folder To create a new folder in the file share location, click the New Folder icon. Specify a descriptive name for the folder. You can enter up to 356 characters. Then click Add.
Chapter 29 SSL User File Sharing 29.5 Renaming a File or Folder To rename a file or folder, click the Rename icon next to the file/folder. Figure 371 File Sharing: Rename A popup window displays. Specify the new name and/or file extension in the field provided. You can enter up to 356 characters. Then click Apply. Note: Make sure the length of the name does not exceed the maximum allowed on the file server. You may not be able to open a file if you change the file extension.
Chapter 29 SSL User File Sharing 29.7 Uploading a File Follow the steps below to upload a file to the file server. 1 Log into the remote user screen and click the File Sharing tab. 2 Specify the location and/or name of the file you want to upload. Or click Browse to locate it. 3 Click Upload to send the file to the file server. 4 After the file is uploaded successfully, you should see the name of the file and a message in the screen.
Chapter 29 SSL User File Sharing 512 ZyWALL USG 2000 User’s Guide
CHAPTER 30 ZyWALL SecuExtender The ZyWALL automatically loads the ZyWALL SecuExtender client program to your computer after a successful login. The ZyWALL SecuExtender lets you: • Access servers, remote desktops and manage files as if you were on the local network. • Use applications like e-mail, file transfer, and remote desktop programs directly without using a browser. For example, you can use Outlook for e-mail instead of the ZyWALL’s web-based e-mail.
Chapter 30 ZyWALL SecuExtender 30.2 Statistics Right-click the ZyWALL SecuExtender icon in the system tray and select Status to open the Status screen. Use this screen to view the ZyWALL SecuExtender’s statistics. Figure 375 ZyWALL SecuExtender Status The following table describes the labels in this screen.
Chapter 30 ZyWALL SecuExtender Table 131 ZyWALL SecuExtender Statistics LABEL DESCRIPTION Transmitted This is how many bytes and packets the computer has sent through the SSL VPN connection. Received This is how many bytes and packets the computer has received through the SSL VPN connection. 30.3 View Log If you have problems with the ZyWALL SecuExtender, customer support may request you to provide information from the log.
Chapter 30 ZyWALL SecuExtender connected but not send any traffic through it until you right-click the icon and resume the connection. 30.5 Stop the Connection Right-click the icon and select Stop Connection to disconnect the SSL VPN tunnel. 30.6 Uninstalling the ZyWALL SecuExtender Do the following if you need to remove the ZyWALL SecuExtender. 1 Click start > All Programs > ZyXEL > ZyWALL SecuExtender > Uninstall. 2 In the confirmation screen, click Yes.
CHAPTER 31 L2TP VPN 31.1 Overview L2TP VPN lets remote users use the L2TP and IPSec client software included with their computers’ operating systems to securely connect to the network behind the ZyWALL. The remote users do not need their own IPSec gateways or VPN client software. Figure 379 L2TP VPN Overview 31.1.1 What You Can Do in this Chapter • Use the L2TP VPN screen (see Section 31.2 on page 519) to configure the ZyWALL’s L2TP VPN settings. 31.1.
Chapter 31 L2TP VPN • Use transport mode. • Not be a manual key VPN connection. • Use Pre-Shared Key authentication. • Use a VPN gateway with the Secure Gateway set to 0.0.0.0 if you need to allow L2TP VPN clients to connect from more than one IP address. Using the Default L2TP VPN Connection Default_L2TP_VPN_Connection is pre-configured to be convenient to use for L2TP VPN. If you use it, edit the following. Configure the local and remote policies as follows.
Chapter 31 L2TP VPN Finding Out More • See Section 6.5.17 on page 111 for related information on these screens. • See Chapter 8 on page 171 for an example of how to create a basic L2TP VPN tunnel. 31.2 L2TP VPN Screen Click Configuration > VPN > L2TP VPN to open the following screen. Use this screen to configure the ZyWALL’s L2TP VPN settings. Note: Disconnect any existing L2TP VPN sessions before modifying L2TP VPN settings.
Chapter 31 L2TP VPN Table 132 Configuration > VPN > IPSec VPN > VPN Connection (continued) LABEL DESCRIPTION VPN Connection Select the IPSec VPN connection the ZyWALL uses for L2TP VPN. All of the configured VPN connections display here, but the one you use must meet the requirements listed in IPSec Configuration Required for L2TP VPN on page 517. Note: Modifying this VPN connection (or the VPN gateway that it uses) disconnects any existing L2TP VPN sessions.
CHAPTER 32 Application Patrol 32.1 Overview Application patrol provides a convenient way to manage the use of various applications on the network. It manages general protocols (for example, HTTP and FTP) and instant messenger (IM), peer-to-peer (P2P), Voice over IP (VoIP), and streaming (RSTP) applications. You can even control the use of a particular application’s individual features (like text messaging, voice, video conferencing, and file transfers).
Chapter 32 Application Patrol 32.1.2 What You Need to Know If you want to use a service, make sure both the firewall and application patrol allow the service’s packets to go through the ZyWALL. Note: The ZyWALL checks firewall rules before it checks application patrol rules for traffic going through the ZyWALL. Application patrol examines every TCP and UDP connection passing through the ZyWALL and identifies what application is using the connection.
Chapter 32 Application Patrol numbers for SIP traffic. Likewise, configuring the SIP ALG to use custom port numbers for SIP traffic also configures application patrol to use the same port numbers for SIP traffic. DiffServ and DSCP Marking QoS is used to prioritize source-to-destination traffic flows. All packets in the same flow are given the same priority. CoS (class of service) is a way of managing traffic in a network by grouping similar types of traffic together and treating each type as a class.
Chapter 32 Application Patrol • The outbound traffic flows from the connection initiator to the connection responder. • The inbound traffic flows from the connection responder to the connection initiator. For example, a LAN to WAN connection is initiated from LAN and goes to the WAN. • Outbound traffic goes from a LAN zone device to a WAN zone device. Bandwidth management is applied before sending the packets out a WAN zone interface on the ZyWALL.
Chapter 32 Application Patrol Bandwidth Management Priority • The ZyWALL gives bandwidth to higher-priority traffic first, until it reaches its configured bandwidth rate. • Then lower-priority traffic gets bandwidth. • The ZyWALL uses a fairness-based (round-robin) scheduler to divide bandwidth among traffic flows with the same priority. • The ZyWALL automatically treats traffic with bandwidth management disabled as priority 7 (the lowest priority).
Chapter 32 Application Patrol Configured Rate Effect In the following table the configured rates total less than the available bandwidth and maximize bandwidth usage is disabled, both servers get their configured rate. Table 133 Configured Rate Effect POLICY CONFIGURED RATE MAX. B. U. PRIORITY ACTUAL RATE A 300 kbps No 1 300 kbps B 200 kbps No 1 200 kbps Priority Effect Here the configured rates total more than the available bandwidth.
Chapter 32 Application Patrol regardless of its priority, server B gets almost no bandwidth with this configuration. Table 136 Priority and Over Allotment of Bandwidth Effect POLICY CONFIGURED RATE MAX. B. U. PRIORITY ACTUAL RATE A 1000 kbps Yes 1 999 kbps B 1000 kbps Yes 2 1 kbps Finding Out More • See Section 6.5.18 on page 111 for related information on these screens. • See Section 7.6 on page 133 for an example of how to set up web surfing policies with bandwidth restrictions.
Chapter 32 Application Patrol • FTP traffic from the LAN to the DMZ can use more bandwidth since the interfaces support up to 1 Gbps connections, but it must be the lowest priority and limited so it does not interfere with SIP and HTTP traffic. Figure 385 Application Patrol Bandwidth Management Example SIP: Any to WAN Outbound: 200 Kbps Inbound: 200 Kbps Priority: 1 Max. B. U. SIP: WAN to Any Outbound: 200 Kbps Inbound: 200 Kbps Priority: 1 Max. B. U.
Chapter 32 Application Patrol • Enable maximize bandwidth usage so the SIP traffic can borrow unused bandwidth. Figure 386 SIP Any to WAN Bandwidth Management Example Outbound: 200 kbps BWM BWM Inbound: 200 kbps 32.1.3.3 SIP WAN to Any Bandwidth Management Example You also create a policy for calls coming in from the SIP server on the WAN. It is the same as the SIP Any to WAN policy, but with the directions reversed (WAN to Any instead of Any to WAN). 32.1.3.
Chapter 32 Application Patrol 32.1.3.5 FTP WAN to DMZ Bandwidth Management Example • ADSL supports more downstream than upstream so you allow remote users 300 kbps for uploads to the DMZ FTP server (outbound) but only 100 kbps for downloads (inbound). • Third highest priority (3). • Disable maximize bandwidth usage since you do not want to give FTP more bandwidth. Figure 388 FTP WAN to DMZ Bandwidth Management Example Outbound: 300 kbps BWM BWM Inbound: 100 kbps 32.1.3.
Chapter 32 Application Patrol 32.2 Application Patrol General Screen Use this screen to enable and disable application patrol. It also lists the registration status and details about the signature set the ZyWALL is using. Note: You must register for the IDP/AppPatrol signature service (at least the trial) before you can use it. See Chapter 11 on page 265 for how to register. Click Configuration > App Patrol to open the following screen.
Chapter 32 Application Patrol Table 137 Configuration > App Patrol > General (continued) LABEL Enable Highest Bandwidth Priority for SIP Traffic Registration DESCRIPTION Select this to maximize the throughput of SIP traffic to improve SIPbased VoIP call sound quality. This has the ZyWALL immediately send SIP traffic upon identifying it.
Chapter 32 Application Patrol Click Configuration > App Patrol > Common to open the following screen. Figure 391 Configuration > App Patrol > Common The following table describes the labels in this screen. See Section 32.3.1 on page 533 for more information as well. Table 138 Configuration > App Patrol > Common LABEL DESCRIPTION Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings.
Chapter 32 Application Patrol Streaming screen and click an application’s Edit icon. The screen displayed here is for the MSN instant messenger service. Figure 392 Application Edit The following table describes the labels in this screen. Table 139 Application Edit LABEL DESCRIPTION Service Enable Service Select this check box to turn on patrol for this application. Service Identification Name This field displays the name of the application.
Chapter 32 Application Patrol Table 139 Application Edit (continued) LABEL # DESCRIPTION This field is a sequential value, and it is not associated with a specific entry. Note: The ZyWALL checks ports in the order they appear in the list. While this sequence does not affect the functionality, you might improve the performance of the ZyWALL by putting more commonly used ports at the top of the list. Service Port This column lists port numbers the ZyWALL uses to identify this application.
Chapter 32 Application Patrol Table 139 Application Edit (continued) LABEL Access DESCRIPTION This field displays what the ZyWALL does with packets for this application that match this policy. forward - the ZyWALL routes the packets for this application. Drop - the ZyWALL does not route the packets for this application and does not notify the client of its decision. Reject - the ZyWALL does not route the packets for this application and notifies the client of its decision.
Chapter 32 Application Patrol Table 139 Application Edit (continued) LABEL DESCRIPTION OK Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. 32.3.2 The Application Patrol Policy Edit Screen The Application Policy Edit screen allows you to edit a group of settings for an application.
Chapter 32 Application Patrol Table 140 Application Policy Edit (continued) LABEL DESCRIPTION Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Chapter 43 on page 717 for details). Otherwise, select none to make the policy always effective. User Select a user name or user group to which to apply the policy. Use Create new Object if you need to configure a new user account (see Section 40.2.1 on page 692 for details).
Chapter 32 Application Patrol Table 140 Application Policy Edit (continued) LABEL DESCRIPTION Action Block For some applications, you can select individual uses of the application that the policy will have the ZyWALL block. These fields only apply when Access is set to forward. Login - Select this option to block users from logging in to a server for this application. Message - Select this option to block users from sending or receiving instant messages.
Chapter 32 Application Patrol Table 140 Application Policy Edit (continued) LABEL Priority DESCRIPTION This field displays when the inbound or outbound bandwidth management is not set to 0. Enter a number between 1 and 7 to set the priority for this application’s traffic that matches this policy. The smaller the number, the higher the priority. The ZyWALL gives traffic of an application with higher priority bandwidth before traffic of an application with lower priority.
Chapter 32 Application Patrol Click AppPatrol > Other to open the Other (applications) screen. Figure 394 AppPatrol > Other The following table describes the labels in this screen. See Section 32.4.1 on page 543 for more information as well. Table 141 AppPatrol > Other LABEL DESCRIPTION Add Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Edit Select an entry and click this to be able to modify it.
Chapter 32 Application Patrol Table 141 AppPatrol > Other (continued) LABEL DESCRIPTION Destination This is the destination address or address group for whom this policy applies. If any displays, the policy is effective for every destination. Protocol This is the protocol of the traffic to which this policy applies. Access This field displays what the ZyWALL does with packets that match this policy. forward - the ZyWALL routes the packets.
Chapter 32 Application Patrol Table 141 AppPatrol > Other (continued) LABEL DESCRIPTION Log Select whether to have the ZyWALL generate a log (log), log and alert (log alert) or neither (no) when traffic matches this policy. See Chapter 51 on page 833 for more on logs. Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. 32.4.
Chapter 32 Application Patrol Table 142 AppPatrol > Other > Edit (continued) LABEL DESCRIPTION Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Chapter 43 on page 717 for details). Otherwise, select any to make the policy always effective. User Select a user name or user group to which to apply the policy. Use Create new Object if you need to configure a new user account (see Section 40.2.1 on page 692 for details).
Chapter 32 Application Patrol Table 142 AppPatrol > Other > Edit (continued) LABEL Inbound kbps DESCRIPTION Type how much inbound bandwidth, in kilobits per second, this policy allows the traffic to use. Inbound refers to the traffic the ZyWALL sends to a connection’s initiator. If you enter 0 here, this policy does not apply bandwidth management for the matching traffic that the ZyWALL sends to the initiator.
Chapter 32 Application Patrol Table 142 AppPatrol > Other > Edit (continued) 546 LABEL DESCRIPTION OK Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes.
CHAPTER 33 Anti-Virus 33.1 Overview Use the ZyWALL’s anti-virus feature to protect your connected network from virus/ spyware infection. The ZyWALL checks traffic going in the direction(s) you specify for signature matches. In the following figure the ZyWALL is set to check traffic coming from the WAN zone (which includes two interfaces) to the LAN zone. Figure 396 ZyWALL Anti-Virus Example 33.1.1 What You Can Do in this Chapter • Use the General screens (Section 33.
Chapter 33 Anti-Virus 33.1.2 What You Need to Know Anti-Virus Engines Subscribe to signature files for ZyXEL’s anti-virus engine or one powered by Kaspersky. When using the trial, you can switch from one engine to the other in the Registration screen. After the trial expires, you need to purchase an iCard for the anti-virus engine you want to use and register it in the Registration > Service screen.
Chapter 33 Anti-Virus 2 If the packets are not session connection setup packets (such as SYN, ACK and FIN), the ZyWALL records the sequence of the packets. 3 The scanning engine checks the contents of the packets for virus. 4 If a virus pattern is matched, the ZyWALL removes the infected portion of the file along with the rest of the file. The un-infected portion of the file before a virus pattern was matched still goes through.
Chapter 33 Anti-Virus 33.1.3 Before You Begin • Before using anti-virus, see Chapter 11 on page 265 for how to register for the anti-virus service. • You may need to customize the zones (in the Network > Zone) used for the anti-virus scanning direction. 33.2 Anti-Virus Summary Screen Click Configuration > Anti-X > Anti-Virus to display the configuration screen as shown next.
Chapter 33 Anti-Virus The following table describes the labels in this screen. Table 143 Configuration > Anti-X > Anti-Virus > General LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. Enable AntiVirus and AntiSpyware Select this check box to check traffic for viruses and spyware. The following table lists policies that define which traffic the ZyWALL scans and the action it takes upon finding a virus.
Chapter 33 Anti-Virus Table 143 Configuration > Anti-X > Anti-Virus > General (continued) LABEL Protocol DESCRIPTION These are the protocols of traffic to scan for viruses. FTP applies to traffic using the TCP port number specified for FTP in the ALG screen. HTTP applies to traffic using TCP ports 80, 8080 and 3128. SMTP applies to traffic using TCP port 25. POP3 applies to traffic using TCP port 110. IMAP4 applies to traffic using TCP port 143.
Chapter 33 Anti-Virus 33.2.1 Anti-Virus Policy Add or Edit Screen Click the Add or Edit icon in the Configuration > Anti-X > Anti-Virus > General screen to display the configuration screen as shown next. Figure 398 Configuration > Anti-X > Anti-Virus > General > Add The following table describes the labels in this screen.
Chapter 33 Anti-Virus Table 144 Configuration > Anti-X > Anti-Virus > General > Add (continued) LABEL DESCRIPTION Actions When Matched Destroy infected file When you select this check box, if a virus pattern is matched, the ZyWALL overwrites the infected portion of the file (and the rest of the file) with zeros. The un-infected portion of the file before a virus pattern was matched goes through unmodified.
Chapter 33 Anti-Virus Table 144 Configuration > Anti-X > Anti-Virus > General > Add (continued) LABEL DESCRIPTION Destroy compressed files that could not be decompressed Note: When you select this option, the ZyWALL deletes ZIP files that use password encryption. Select this check box to have the ZyWALL delete any ZIP files that it is not able to unzip. The ZyWALL cannot unzip password protected ZIP files or a ZIP file within another ZIP file.
Chapter 33 Anti-Virus The following table describes the labels in this screen. Table 145 Configuration > Anti-X > Anti-Virus > Black/White List > Black List LABEL DESCRIPTION Enable Black List Select this check box to log and delete files with names that match the black list patterns. Use the black list to log and delete files with names that match the black list patterns. Add Click this to create a new entry. Edit Select an entry and click this to be able to modify it.
Chapter 33 Anti-Virus The following table describes the labels in this screen. Table 146 Configuration > Anti-X > Anti-Virus > Black/White List > Black List (or White List) > Add LABEL DESCRIPTION Enable If this is a black list entry, select this option to have the ZyWALL apply this entry when using the black list. If this is a white list entry, select this option to have the ZyWALL apply this entry when using the white list.
Chapter 33 Anti-Virus column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 401 Configuration > Anti-X > Anti-Virus > Black/White List > White List The following table describes the labels in this screen.
Chapter 33 Anti-Virus If Internet Explorer opens a warning screen about a script making Internet Explorer run slowly and the computer maybe becoming unresponsive, just click No to continue. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order.
Chapter 33 Anti-Virus The following table describes the labels in this screen. Table 148 Configuration > Anti-X > Anti-Virus > Signature LABEL DESCRIPTION Signatures Search Select the criteria on which to perform the search. Select By Name from the drop down list box and type the name or part of the name of the signature(s) you want to find. This search is not case-sensitive. Select By ID from the drop down list box and type the ID or part of the ID of the signature you want to find.
Chapter 33 Anti-Virus 33.7 Anti-Virus Technical Reference Types of Computer Viruses The following table describes some of the common computer viruses. Table 149 Common Computer Virus Types TYPE DESCRIPTION File Infector This is a small program that embeds itself in a legitimate program. A file infector is able to copy and attach itself to other programs that are executed on an infected computer.
Chapter 33 Anti-Virus A host-based anti-virus (HAV) scanner is often software installed on computers and/or servers in the network. It inspects files for virus patterns as they are moved in and out of the hard drive. However, host-based anti-virus scanners cannot eliminate all viruses for a number of reasons: • HAV scanners are slow in stopping virus threats through real-time traffic (such as from the Internet).
CHAPTER 34 IDP 34.1 Overview This chapter introduces packet inspection IDP (Intrusion, Detection and Prevention), IDP profiles, binding an IDP profile to a traffic flow, custom signatures and updating signatures. An IDP system can detect malicious or suspicious packets and respond instantaneously. IDP on the ZyWALL protects against network-based intrusions. 34.1.1 What You Can Do in this Chapter • Use the Anti-X > IDP > General screen (Section 34.
Chapter 34 IDP IDP Profiles An IDP profile is a set of related IDP signatures that you can activate as a set and configure common log and action settings. You can apply IDP profiles to traffic flowing from one zone to another. For example, apply the default LAN_IDP profile to any traffic going to the LAN zone in order to protect your LAN computers. Note: You can only apply one IDP profile to one traffic flow. Base IDP Profiles Base IDP profiles are templates that you use to create new IDP profiles.
Chapter 34 IDP 34.2 The IDP General Screen Click Configuration > Anti-X > IDP > General to open this screen. Use this screen to turn IDP on or off, bind IDP profiles to traffic directions, and view registration and signature information. Note: You must register in order to use packet inspection signatures. See the Registration screens. If you try to enable IDP when the IDP service has not yet been registered, a warning screen displays and IDP is not enabled.
Chapter 34 IDP Table 150 Configuration > Anti-X > IDP > General (continued) LABEL DESCRIPTION Remove Select an entry and click this to delete it. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. Move To change an entry’s position in the numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed.
Chapter 34 IDP Table 150 Configuration > Anti-X > IDP > General (continued) LABEL DESCRIPTION Current Version This field displays the IDP signature set version number. This number gets larger as the set is enhanced. Signature Number This field displays the number of IDP signatures in this set. This number usually gets larger as the set is enhanced. Older signatures and rules may be removed if they are no longer applicable or have been supplanted by newer ones.
Chapter 34 IDP 34.3.1 Base Profiles The ZyWALL comes with several base profiles. You use base profiles to create new profiles. In the Configuration > Anti-X > IDP > Profile screen, click Add to display the following screen. Figure 404 Base Profiles The following table describes this screen. Table 151 Base Profiles BASE PROFILE 568 DESCRIPTION none All signatures are disabled. No logs are generated nor actions are taken. all All signatures are enabled.
Chapter 34 IDP Table 151 Base Profiles (continued) BASE PROFILE DESCRIPTION dmz This profile is most suitable for networks containing your servers. Signatures for common services such as DNS, FTP, HTTP, ICMP, IMAP, MISC, NETBIOS, POP3, RPC, RSERVICE, SMTP, SNMP, SQL, TELNET, Oracle, MySQL are enabled. Signatures with a high or severe severity level (greater than three) generate log alerts and cause packets that trigger them to be dropped.
Chapter 34 IDP Table 152 Configuration > Anti-X > IDP > Profile (continued) LABEL DESCRIPTION Name This is the name of the profile you created. Base Profile This is the base profile from which the profile was created. 34.5 Creating New Profiles You may want to create a new profile if not all signatures in a base profile are applicable to your network. In this case you should disable non-applicable signatures so as to improve ZyWALL IDP processing efficiency.
Chapter 34 IDP 34.6 Profiles: Packet Inspection Select Configuration > Anti-X > IDP > Profile and then add a new or edit an existing profile select. Packet inspection signatures examine the contents of a packet for malicious data. It operates at layer-4 to layer-7. 34.6.
Chapter 34 IDP The following table describes the fields in this screen. Table 153 Configuration > Anti-X > IDP > Profile > Group View LABEL DESCRIPTION Name This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 34 IDP Table 153 Configuration > Anti-X > IDP > Profile > Group View (continued) LABEL DESCRIPTION Action To edit what action the ZyWALL takes when a packet matches a signature, select the signature and use the Action icon. none: Select this action on an individual signature or a complete service group to have the ZyWALL take no action when a packet matches the signature(s).
Chapter 34 IDP Table 153 Configuration > Anti-X > IDP > Profile > Group View (continued) LABEL DESCRIPTION Log These are the log options. To edit this, select an item and use the Log icon. Action This is the action the ZyWALL should take when a packet matches a signature here. To edit this, select an item and use the Action icon. OK A profile consists of three separate screens.
Chapter 34 IDP Table 154 Policy Types (continued) POLICY TYPE DESCRIPTION Scan A scan describes the action of searching a network for an exposed service. An attack may then occur once a vulnerability has been found. Scans occur on several network levels. A network scan occurs at layer-3. For example, an attacker looks for network devices such as a router or server running in an IP network. A scan on a protocol is commonly referred to as a layer-4 scan.
Chapter 34 IDP Table 155 IDP Service Groups (continued) SQL SNMP SMTP RSERVICES RPC POP3 POP2 P2P ORACLE NNTP NETBIOS MYSQL MISC_EXPLOIT MISC_DDOS MISC_BACKDOOR MISC IMAP IM ICMP FTP FINGER DNS The following figure shows the WEB_PHP service group that contains signatures related to attacks on web servers using PHP exploits. PHP (PHP: Hypertext Preprocessor) is a server-side HTML embedded scripting language that allows web developers to build dynamic websites.
Chapter 34 IDP signatures by criteria such as name, ID, severity, attack type, vulnerable attack platforms, service category, log options or actions. Figure 408 Configuration > Anti-X > IDP > Profile: Query View The following table describes the fields specific to this screen’s query view. Table 156 Configuration > Anti-X > IDP > Profile: Query View LABEL DESCRIPTION Name This is the name of the profile that you created in the IDP > Profiles > Group View screen.
Chapter 34 IDP Table 156 Configuration > Anti-X > IDP > Profile: Query View (continued) LABEL Severity DESCRIPTION Search for signatures by severity level(s). Hold down the [Ctrl] key if you want to make multiple selections. These are the severities as defined in the ZyWALL. The number in brackets is the number you use if using commands. Severe (5): These denote attacks that try to run arbitrary code or gain system privileges.
Chapter 34 IDP 34.6.
Chapter 34 IDP • Actions: Any Figure 409 Query Example Search Criteria Figure 410 Query Example Search Results 580 ZyWALL USG 2000 User’s Guide
Chapter 34 IDP 34.7 Introducing IDP Custom Signatures Create custom signatures for new attacks or attacks peculiar to your network. Custom signatures can also be saved to/from your computer so as to share with others. You need some knowledge of packet headers and attack types to create your own custom signatures. 34.7.1 IP Packet Header These are the fields in an Internet Protocol (IP) version 4 packet header.
Chapter 34 IDP Table 157 IP v4 Packet Headers (continued) HEADER DESCRIPTION Time To Live This is a counter that decrements every time it passes through a router. When it reaches zero, the datagram is discarded. It is used to prevent accidental routing loops. Protocol The protocol indicates the type of transport packet being carried, for example, 1 = ICMP; 2= IGMP; 6 = TCP; 17= UDP.
Chapter 34 IDP Note: The ZyWALL checks all signatures and continues searching even after a match is found. If two or more rules have conflicting actions for the same packet, then the ZyWALL applies the more restrictive action (reject-both, reject-receiver or reject-sender, drop, none in this order). If a packet matches a rule for rejectreceiver and it also matches a rule for reject-sender, then the ZyWALL will reject-both.
Chapter 34 IDP Table 158 Configuration > Anti-X > IDP > Custom Signatures (continued) LABEL DESCRIPTION Customer Signature Rule Importing Use this part of the screen to import custom signatures (previously saved to your computer) to the ZyWALL. Note: The name of the complete custom signature file on the ZyWALL is ‘custom.rules’. If you import a file named ‘custom.rules’, then all custom signatures on the ZyWALL are overwritten with the new file.
Chapter 34 IDP Try to write signatures that target a vulnerability, for example a certain type of traffic on certain operating systems, instead of a specific exploit.
Chapter 34 IDP The following table describes the fields in this screen. Table 159 Configuration > Anti-X > IDP > Custom Signatures > Add/Edit LABEL DESCRIPTION Name Type the name of your custom signature. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 34 IDP Table 159 Configuration > Anti-X > IDP > Custom Signatures > Add/Edit (continued) LABEL DESCRIPTION Fragmentation A fragmentation flag identifies whether the IP datagram should be fragmented, not fragmented or is a reserved bit. Some intrusions can be identified by this flag. Select the check box and then select the flag that the intrusion uses. Fragmentation Offset When an IP datagram is fragmented, it is reassembled at the final destination.
Chapter 34 IDP Table 159 Configuration > Anti-X > IDP > Custom Signatures > Add/Edit (continued) LABEL Flow DESCRIPTION If selected, the signature only applies to certain directions of the traffic flow and only to clients or servers. Select Flow and then select the identifying options.
Chapter 34 IDP Table 159 Configuration > Anti-X > IDP > Custom Signatures > Add/Edit (continued) LABEL Payload Size DESCRIPTION This field may be used to check for abnormally sized packets or for detecting buffer overflows. Select the check box, then select Equal, Smaller or Greater and then type the payload size. Stream rebuilt packets are not checked regardless of the size of the payload. Add Click this to create a new entry. Edit Select an entry and click this to be able to modify it.
Chapter 34 IDP Table 159 Configuration > Anti-X > IDP > Custom Signatures > Add/Edit (continued) LABEL DESCRIPTION OK Click this button to save your changes to the ZyWALL and return to the summary screen. Cancel Click this button to return to the summary screen without saving any changes. 34.8.2 Custom Signature Example Before creating a custom signature, you must first clearly understand the vulnerability. 34.8.2.1 Understand the Vulnerability Check the ZyWALL logs when the attack occurs.
Chapter 34 IDP 34.8.2.2 Analyze Packets Use the packet capture screen (see Section 53.3 on page 860) and a packet analyzer (also known as a network or protocol analyzer) such as Wireshark or Ethereal to investigate some more. Figure 414 DNS Query Packet Details From the details about DNS query you see that the protocol is UDP and the port is 53. The type of DNS packet is standard query and the Flag is 0x0100 with an offset of 2. Therefore enter |010| as the first pattern.
Chapter 34 IDP The final custom signature should look like as shown in the following figure. Figure 415 Example Custom Signature 34.8.3 Applying Custom Signatures After you create your custom signature, it becomes available in the IDP service group category in the Configuration > Anti-X > IDP > Profile > Edit screen. Custom signatures have an SID from 9000000 to 9999999.
Chapter 34 IDP You can activate the signature, configure what action to take when a packet matches it and if it should generate a log or alert in a profile. Then bind the profile to a zone. Figure 416 Example: Custom Signature in IDP Profile 34.8.4 Verifying Custom Signatures Configure the signature to create a log when traffic matches the signature. (You may also want to configure an alert if it is for a serious attack and needs immediate attention.
Chapter 34 IDP destination port is the service port (53 for DNS in this case) that the attack tries to exploit. Figure 417 Custom Signature Log 34.9 IDP Technical Reference This section contains some background information on IDP. Host Intrusions The goal of host-based intrusions is to infiltrate files on an individual computer or server in with the goal of accessing confidential information or destroying information on a computer. You must install a host IDP directly on the system being protected.
Chapter 34 IDP Network Intrusions Network-based intrusions have the goal of bringing down a network or networks by attacking computer(s), switch(es), router(s) or modem(s). If a LAN switch is compromised for example, then the whole LAN is compromised. Host-based intrusions may be used to cause network-based intrusions when the goal of the host virus is to propagate attacks on the network, or attack computer/server operating system vulnerabilities with the goal of bringing down the computer/ server.
Chapter 34 IDP Table 160 ZyWALL - Snort Equivalent Terms (continued) ZYWALL TERM SNORT EQUIVALENT TERM Same IP sameip Transport Protocol Transport Protocol: TCP Port (In Snort rule header) Flow flow Flags flags Sequence Number seq Ack Number ack Window Size window Transport Protocol: UDP Port (In Snort rule header) (In Snort rule header) Transport Protocol: ICMP Type itype Code icode ID icmp_id Sequence Number icmp_seq Payload Options (Snort rule options) Payload Size dsize Of
CHAPTER 35 ADP 35.1 Overview This chapter introduces ADP (Anomaly Detection and Prevention), anomaly profiles and applying an ADP profile to a traffic direction. ADP protects against anomalies based on violations of protocol standards (RFCs – Requests for Comments) and abnormal flows such as port scans. 35.1.
Chapter 35 ADP Protocol Anomalies Protocol anomalies are packets that do not comply with the relevant RFC (Request For Comments). Protocol anomaly detection includes HTTP Inspection, TCP Decoder, UDP Decoder and ICMP Decoder. Protocol anomaly rules may be updated when you upload new firmware. ADP Profile An ADP profile is a set of traffic anomaly rules and protocol anomaly rules that you can activate as a set and configure common log and action settings.
Chapter 35 ADP 35.2 The ADP General Screen Click Configuration > Anti-X > ADP > General. Use this screen to turn anomaly detection on or off and apply anomaly profiles to traffic directions. Figure 418 Configuration > Anti-X > ADP > General The following table describes the screens in this screen. Table 161 Configuration > Anti-X > ADP > General LABEL DESCRIPTION General Settings Enable Anomaly Detection Policies Select this check box to enable traffic anomaly and protocol anomaly detection.
Chapter 35 ADP Table 161 Configuration > Anti-X > ADP > General (continued) LABEL DESCRIPTION Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. From, To This is the direction of travel of packets to which an anomaly profile is bound. Traffic direction is defined by the zone the traffic is coming from and the zone the traffic is going to. Use the From field to specify the zone from which the traffic is coming.
Chapter 35 ADP 35.3.1 Base Profiles The ZyWALL comes with base profiles. You use base profiles to create new profiles. In the Configuration > Anti-X > ADP > Profile screen, click Add to display the following screen. Figure 419 Base Profiles These are the default base profiles at the time of writing. Table 162 Base Profiles BASE PROFILE DESCRIPTION none All traffic anomaly and protocol anomaly rules are disabled. No logs are generated nor actions are taken.
Chapter 35 ADP The following table describes the fields in this screen. Table 163 Anti-X > ADP > Profile LABEL DESCRIPTION Add Click this to create a new entry. Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. # This is the entry’s index number in the list. Name This is the name of the profile you created. Base Profile This is the base profile from which the profile was created. 35.3.
Chapter 35 ADP belonging to this profile, make sure you have clicked OK or Save to save the changes before selecting the Traffic Anomaly tab.
Chapter 35 ADP The following table describes the fields in this screen. Table 164 Configuration > ADP > Profile > Traffic Anomaly LABEL DESCRIPTION Name This is the name of the ADP profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 35 ADP Table 164 Configuration > ADP > Profile > Traffic Anomaly (continued) LABEL DESCRIPTION Name This is the name of the traffic anomaly rule. Click the Name column heading to sort in ascending or descending order according to the rule name. Log These are the log options. To edit this, select an item and use the Log icon. Action This is the action the ZyWALL should take when a packet matches a rule. To edit this, select an item and use the Action icon.
Chapter 35 ADP Figure 422 Profiles: Protocol Anomaly 606 ZyWALL USG 2000 User’s Guide
Chapter 35 ADP The following table describes the fields in this screen. Table 165 Configuration > ADP > Profile > Protocol Anomaly LABEL DESCRIPTION Name This is the name of the profile. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 35 ADP Table 165 Configuration > ADP > Profile > Protocol Anomaly (continued) LABEL DESCRIPTION Action To edit what action the ZyWALL takes when a packet matches a signature, select the signature and use the Action icon. original setting: Select this action to return each signature in a service group to its previously saved configuration. none: Select this action on an individual signature or a complete service group to have the ZyWALL take no action when a packet matches a rule.
Chapter 35 ADP Table 165 Configuration > ADP > Profile > Protocol Anomaly (continued) LABEL DESCRIPTION OK Click OK to save your settings to the ZyWALL, complete the profile and return to the profile summary page. Cancel Click Cancel to return to the profile summary page without saving any changes. Save Click Save to save the configuration to the ZyWALL but remain in the same page. You may then go to the another profile screen (tab) in order to complete the profile.
Chapter 35 ADP Decoy Port Scans Decoy port scans are scans where the attacker has spoofed the source address. These are some decoy scan types: • TCP Decoy Portscan • UDP Decoy Portscan • IP Decoy Portscan Distributed Port Scans Distributed port scans are many-to-one port scans. Distributed port scans occur when multiple hosts query one host for open services. This may be used to evade intrusion detection.
Chapter 35 ADP • ICMP Filtered Portsweep • TCP Filtered Distributed • UDP Filtered Portscan Distributed Portscan • IP Filtered Distributed Portscan Flood Detection Flood attacks saturate a network with useless data, use up all available bandwidth, and therefore make communications in the network impossible. ICMP Flood Attack An ICMP flood is broadcasting many pings or UDP packets so that so much data is sent to the system, that it slows it down or locks it up.
Chapter 35 ADP the initiator responds with an ACK (acknowledgment). After this handshake, a connection is established. Figure 424 TCP Three-Way Handshake A SYN flood attack is when an attacker sends a series of SYN packets. Each packet causes the receiver to reply with a SYN-ACK response. The receiver then waits for the ACK that follows the SYN-ACK, and stores all outstanding SYN-ACK responses on a backlog queue.
Chapter 35 ADP UDP Flood Attack UDP is a connection-less protocol and it does not require any connection setup procedure to transfer data. A UDP flood attack is possible when an attacker sends a UDP packet to a random port on the victim system. When the victim system receives a UDP packet, it will determine what application is waiting on the destination port.
Chapter 35 ADP Table 166 HTTP Inspection and TCP/UDP/ICMP Decoders (continued) LABEL 614 DESCRIPTION DOUBLE-ENCODING ATTACK This rule is IIS specific. IIS does two passes through the request URI, doing decodes in each one. In the first pass, IIS encoding (UTF-8 unicode, ASCII, bare byte, and %u) is done. In the second pass ASCII, bare byte, and %u encodings are done. IIS-BACKSLASHEVASION ATTACK This is an IIS emulation rule that normalizes backslashes to slashes.
Chapter 35 ADP Table 166 HTTP Inspection and TCP/UDP/ICMP Decoders (continued) LABEL WEBROOT-DIRECTORYTRAVERSAL ATTACK DESCRIPTION This is when a directory traversal traverses past the web server root directory. This generates much fewer false positives than the directory option, because it doesn’t alert on directory traversals that stay within the web server directory structure.
Chapter 35 ADP Table 166 HTTP Inspection and TCP/UDP/ICMP Decoders (continued) LABEL 616 DESCRIPTION TRUNCATED-HEADER ATTACK This is when an ICMP packet is sent which has an ICMP datagram length of less than the ICMP header length. This may cause some applications to crash. TRUNCATEDTIMESTAMP-HEADER ATTACK This is when an ICMP packet is sent which has an ICMP datagram length of less than the ICMP Time Stamp header length. This may cause some applications to crash.
CHAPTER 36 Content Filtering 36.1 Overview Use the content filtering feature to control access to specific web sites or web content. 36.1.1 What You Can Do in this Chapter • Use the General screens (Section 36.2 on page 619) to configure global content filtering settings, configure content filtering policies, and check the content filtering license status. • Use the Filter Profile screens (Section 36.4 on page 624) to set up content filtering profiles. 36.1.
Chapter 36 Content Filtering Content Filtering Profiles A content filtering profile conveniently stores your custom settings for the following features. • Category-based Blocking The ZyWALL can block access to particular categories of web site content, such as pornography or racial intolerance. • Restrict Web Features The ZyWALL can disable web proxies and block web features such as ActiveX controls, Java applets and cookies.
Chapter 36 Content Filtering Since the ZyWALL checks the URL’s domain name (or IP address) and file path separately, it will not find items that go across the two. For example, with the URL www.zyxel.com.tw/news/pressroom.php, the ZyWALL would find “tw” in the domain name (www.zyxel.com.tw). It would also find “news” in the file path (news/pressroom.php) but it would not find “tw/news”. Finding Out More • See Section 6.5.22 on page 112 for related information on these screens. • See Section 36.
Chapter 36 Content Filtering your list of content filter policies, create a denial of access message or specify a redirect URL and check your external web filtering service registration status. Figure 426 Configuration > Anti-X > Content Filter > General The following table describes the labels in this screen. Table 167 Configuration > Anti-X > Content Filter > General LABEL DESCRIPTION General Settings Enable Content Filter Select this check box to enable the content filter.
Chapter 36 Content Filtering Table 167 Configuration > Anti-X > Content Filter > General (continued) LABEL DESCRIPTION Move To change an entry’s position in the numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed. # This column lists the index numbers of the content filter policies.
Chapter 36 Content Filtering Table 167 Configuration > Anti-X > Content Filter > General (continued) LABEL DESCRIPTION License Status This read-only field displays the status of your content-filtering database service registration. Not Licensed displays if you have not successfully registered and activated the service. Expired displays if your subscription to the service has expired. Licensed displays if you have successfully registered the ZyWALL and activated the service.
Chapter 36 Content Filtering filter policy. A content filter policy defines which content filter profile should be applied, when it should be applied, and to whose web access it should be applied. Figure 427 Configuration > Anti-X > Content Filter > General > Add l The following table describes the labels in this screen.
Chapter 36 Content Filtering 36.4 Content Filter Profile Screen Click Configuration > Anti-X > Content Filter > Filter Profile to open the Filter Profile screen. A content filter profile defines to which web services, web sites or web site categories access is to be allowed or denied. Figure 428 Configuration > Anti-X > Content Filter > Filter Profile The following table describes the labels in this screen.
Chapter 36 Content Filtering See Chapter 37 on page 641 for how to view content filtering reports.
Chapter 36 Content Filtering The following table describes the labels in this screen. Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add LABEL DESCRIPTION License Status This read-only field displays the status of your content-filtering database service registration. Not Licensed displays if you have not successfully registered and activated the service. Expired displays if your subscription to the service has expired.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Action for Unsafe Web Pages Select Pass to allow users to access web pages that match the unsafe categories that you select below. Select Block to prevent users from accessing web pages that match the unsafe categories that you select below.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Action When Category Server Is Unavailable Select Pass to allow users to access any requested web page if the external content filtering database is unavailable. Select Block to block access to any requested web page if the external content filtering database is unavailable.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Spyware/Malware Sources This category includes pages which distribute spyware and other malware. Spyware and malware are defined as software which takes control of your computer, modifies computer settings, collects or reports personal information, or misrepresents itself by tricking users to install, download, or enter personal information.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Nudity This category includes pages containing nude or seminude depictions of the human body. These depictions are not necessarily sexual in intent or effect, but may include pages containing nude paintings or photo galleries of artistic nature. This category also includes nudist or naturist pages that contain pictures of nude individuals.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Arts/Entertainment This category includes pages that promote and provide information about motion pictures, videos, television, music and programming guides, books, comics, movie theatres, galleries, artists or reviews on entertainment.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Government/Legal This category includes pages sponsored by or which provide information on government, government agencies and government services such as taxation and emergency services. It also includes pages that discuss or explain laws of various governmental entities.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Religion This category includes pages that promote and provide information on conventional or unconventional religious or quasi-religious subjects, as well as churches, synagogues, or other houses of worship. It does not include pages containing alternative religions such as Wicca or witchcraft or atheist beliefs (Alternative Spirituality/Occult).
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) 634 LABEL DESCRIPTION Sports/Recreation/ Hobbies This category includes pages that promote or provide information about spectator sports, recreational activities, or hobbies. This includes pages that discuss or promote camping, gardening, and collecting.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Alcohol Sites that promote, offer for sale, glorify, review, or in any way advocate the use or creation of alcoholic beverages, including but not limited to beer, wine, and hard liquors. Pages that sell alcohol as a subset of other products such as restaurants or grocery stores are not included.
Chapter 36 Content Filtering Table 170 Configuration > Anti-X > Content Filter > Filter Profile > Add (continued) LABEL DESCRIPTION Placeholders This category includes pages that are under construction, parked domains, search-bait or otherwise generally having no useful value. Test Web Site Category URL to test You can check which category a web page belongs to. Enter a web site URL in the text box.
Chapter 36 Content Filtering 36.6 Content Filter Customization Screen Click Configuration > Anti-X > Content Filter > Filter Profile > Add or Edit > Customization to open the Customization screen. You can create a list of good (allowed) web site addresses and a list of bad (blocked) web site addresses. You can also block web sites based on whether the web site’s address contains a keyword. Use this screen to add or remove specific sites or keywords from the filter list.
Chapter 36 Content Filtering Table 171 Configuration > Anti-X > Content Filter > Filter Profile > Customization LABEL DESCRIPTION Allow Web traffic for trusted web sites only When this box is selected, the ZyWALL blocks Web access to sites that are not on the Trusted Web Sites list. If they are chosen carefully, this is the most effective way to block objectionable material. Restricted Web Features Select the check box(es) to restrict a feature.
Chapter 36 Content Filtering Table 171 Configuration > Anti-X > Content Filter > Filter Profile > Customization LABEL DESCRIPTION Forbidden Web Sites This list displays the forbidden web sites already added. Enter host names such as www.bad-site.com into this text field. Do not enter the complete URL of the site – that is, do not include “http://”. All subdomains are also blocked. For example, entering “bad-site.com” also blocks “www.badsite.com”, “partner.bad-site.com”, “press.bad-site.com”, and do on.
Chapter 36 Content Filtering External Content Filter Server Lookup Procedure The content filter lookup process is described below. Figure 432 Content Filter Lookup Procedure 640 1 A computer behind the ZyWALL tries to access a web site. 2 The ZyWALL looks up the web site in its cache. If an attempt to access the web site was made in the past, a record of that web site’s category will be in the ZyWALL’s cache. The ZyWALL blocks, blocks and logs or just logs the request based on your configuration.
CHAPTER 37 Content Filter Reports 37.1 Overview You can view content filtering reports after you have activated the category-based content filtering subscription service. See Chapter 11 on page 265 on how to create a myZyXEL.com account, register your device and activate the subscription services. 37.2 Viewing Content Filter Reports Content filtering reports are generated statistics and charts of access attempts to web sites belonging to the categories you selected in your device content filter screen.
Chapter 37 Content Filter Reports 2 Fill in your myZyXEL.com account information and click Login. Figure 433 myZyXEL.
Chapter 37 Content Filter Reports 3 A welcome screen displays. Click your ZyWALL’s model name and/or MAC address under Registered ZyXEL Products (the ZyWALL 70 is shown as an example here). You can change the descriptive name for your ZyWALL using the Rename button in the Service Management screen (see Figure 435 on page 644). Figure 434 myZyXEL.
Chapter 37 Content Filter Reports 4 In the Service Management screen click Content Filter in the Service Name column to open the content filter reports screens. Figure 435 myZyXEL.com: Service Management 5 In the Web Filter Home screen, click the Reports tab.
Chapter 37 Content Filter Reports 6 Select items under Global Reports to view the corresponding reports. Figure 437 Content Filter Reports: Report Home 7 Select a time period in the Date Range field, either Allowed or Blocked in the Action Taken field and a category (or enter the user name if you want to view single user reports) and click Run Report.The screens vary according to the report type you selected in the Report Home screen.
Chapter 37 Content Filter Reports 8 A chart and/or list of requested web site categories display in the lower half of the screen.
Chapter 37 Content Filter Reports 9 You can click a category in the Categories report or click URLs in the Report Home screen to see the URLs that were requested.
Chapter 37 Content Filter Reports 648 ZyWALL USG 2000 User’s Guide
CHAPTER 38 Anti-Spam 38.1 Overview The anti-spam feature can mark or discard spam (unsolicited commercial or junk e-mail). Use the white list to identify legitimate e-mail. Use the black list to identify spam e-mail. The ZyWALL can also check e-mail against a DNS black list (DNSBL) of IP addresses of servers that are suspected of being used by spammers. 38.1.1 What You Can Do in this Chapter • Use the General screens (Section 38.3 on page 651) to turn anti-spam on or off and manage anti-spam policies.
Chapter 38 Anti-Spam Black List Configure black list entries to identify spam. The black list entries have the ZyWALL classify any e-mail that is from or forwarded by a specified IP address or uses a specified header field and header value as being spam. If an e-mail does not match any of the white list entries, the ZyWALL checks it against the black list entries. The ZyWALL classifies an e-mail that matches a black list entry as spam and immediately takes the configured action for dealing with spam.
Chapter 38 Anti-Spam E-mail Header Buffer Size The ZyWALL has a 5 K buffer for an individual e-mail header. If an e-mail’s header is longer than 5 K, the ZyWALL only checks up to the first 5 K. DNSBL A DNS Black List (DNSBL) is a server that hosts a list of IP addresses known or suspected of having sent or forwarded spam. A DNSBL is also known as a DNS spam blocking list.
Chapter 38 Anti-Spam spam policies. You can also select the action the ZyWALL takes when the mail sessions threshold is reached. Figure 440 Configuration > Anti-X > Anti-Spam > General The following table describes the labels in this screen. Table 172 Configuration > Anti-X > Anti-Spam > General LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields.
Chapter 38 Anti-Spam Table 172 Configuration > Anti-X > Anti-Spam > General LABEL DESCRIPTION Remove Select an entry and click this to delete it. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. Move To change an entry’s position in the numbered list, select it and click Move to display a field to type a number for where you want to put that entry and press [ENTER] to move the entry to the number that you typed.
Chapter 38 Anti-Spam check, which e-mail protocols to scan, the scanning options, and the action to take on spam traffic. Figure 441 Configuration > Anti-X > Anti-Spam > General > Add The following table describes the labels in this screen. Table 173 Configuration > Anti-X > Anti-Virus > General > Add LABEL DESCRIPTION Enable Policy Select this check box to have the ZyWALL apply this anti-spam policy to check e-mail traffic for spam.
Chapter 38 Anti-Spam Table 173 Configuration > Anti-X > Anti-Virus > General > Add (continued) LABEL DESCRIPTION Check White List Select this check box to check e-mail against the white list. The ZyWALL classifies e-mail that matches a white list entry as legitimate (not spam). Check Black List Select this check box to check e-mail against the black list. The ZyWALL classifies e-mail that matches a black list entry as spam.
Chapter 38 Anti-Spam specific subject text. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 442 Configuration > Anti-X > Anti-Spam > Black/White List > Black List The following table describes the labels in this screen.
Chapter 38 Anti-Spam 38.4.1 The Anti-Spam Black or White List Add/Edit Screen In the anti-spam Black List or White List screen, click the Add icon or an Edit icon to display the following screen. Use this screen to configure an anti-spam black list entry to identify spam e-mail. You can create entries based on specific subject text, or the sender’s or relay’s IP address or e-mail address. You can also create entries that check for particular header fields and values.
Chapter 38 Anti-Spam Table 175 Configuration > Anti-X > Anti-Spam > Black/White List > Black List (or White List) > Add LABEL DESCRIPTION Sender or Mail Relay IP Address This field displays when you select the IP type. Enter an IP address in dotted decimal notation. Netmask This field displays when you select the IP type. Enter the subnet mask here, if applicable. Sender E-Mail Address This field displays when you select the E-Mail type. Enter a keyword (up to 63 ASCII characters). See Section 38.4.
Chapter 38 Anti-Spam 38.5 The Anti-Spam White List Screen Click Configuration > Anti-X > Anti-Spam > Black/White List and then the White List tab to display the Anti-Spam White List screen. Configure the white list to identify legitimate e-mail. You can create white list entries based on the sender’s or relay’s IP address or e-mail address. You can also create entries that check for particular header fields and values or specific subject text.
Chapter 38 Anti-Spam Table 176 Configuration > Anti-X > Anti-Spam > Black/White List > White List LABEL DESCRIPTION Type This field displays whether the entry is based on the e-mail’s subject, source or relay IP address, source e-mail address, or a header. Content This field displays the subject content, source or relay IP address, source e-mail address, or header value for which the entry checks. OK Click OK to save your changes.
Chapter 38 Anti-Spam The following table describes the labels in this screen. Table 177 Configuration > Anti-X > Anti-Spam > DNSBL LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. Enable DNS Black List (DNSBL) Checking Select this to have the ZyWALL check the sender and relay IP addresses in e-mail headers against the DNSBL servers maintained by the DNSBL domains listed in the ZyWALL.
Chapter 38 Anti-Spam Table 177 Configuration > Anti-X > Anti-Spam > DNSBL (continued) LABEL DESCRIPTION Edit Select an entry and click this to be able to modify it. Remove Select an entry and click this to delete it. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. # This is the entry’s index number in the list.
Chapter 38 Anti-Spam Here is an example of an e-mail classified as spam based on DNSBL replies. Figure 446 DNSBL Spam Detection Example DNSBL A IPs: a.a.a.a b.b.b.b 1 4 a? . a. ? a . a b m .b . pa ts b .b o N .a a . a.a 2 a.a.a.a? b.b.b.b? DNSBL B a .a . b .b a .a ? .b . b? b .b .b . DNSBL C bS pa m 3 1 The ZyWALL receives an e-mail that was sent from IP address a.a.a.a and relayed by an e-mail server at IP address b.b.b.b.
Chapter 38 Anti-Spam Here is an example of an e-mail classified as legitimate based on DNSBL replies. Figure 447 DNSBL Legitimate E-mail Detection Example DNSBL A IPs: c.c.c.c d.d.d.d c? .c . ? c . c d .d . d .d 1 c.c.c.c? d.d.d.d? DNSBL B d.d.d.d Not spam c .c 4 d .d c.c 664 2 .c . c? .d . d? DNSBL C .c. c No ts pa m 3 1 The ZyWALL receives an e-mail that was sent from IP address c.c.c.c and relayed by an e-mail server at IP address d.d.d.d.
Chapter 38 Anti-Spam If the ZyWALL receives conflicting DNSBL replies for an e-mail routing IP address, the ZyWALL classifies the e-mail as spam. Here is an example. Figure 448 Conflicting DNSBL Replies Example DNSBL A IPs: a.b.c.d w.x.y.z 1 4 d? . c. a.b y.z? m . pa ts w.x o dN .c. b . a 2 a.b.c.d? w.x.y.z? a.b.c.d Spam! a .b w.x . DNSBL B 3 . c. d? y.z ? DNSBL C 1 The ZyWALL receives an e-mail that was sent from IP address a.b.c.d and relayed by an e-mail server at IP address w.x.y.z.
Chapter 38 Anti-Spam 666 ZyWALL USG 2000 User’s Guide
CHAPTER 39 Device HA 39.1 Overview Device HA lets a backup ZyWALL (B) automatically take over if the master ZyWALL (A) fails. Figure 449 Device HA Backup Taking Over for the Master A B 39.1.1 What You Can Do in this Chapter • Use the General screen (Section 39.2 on page 669) to configure device HA global settings, and see the status of each interface monitored by device HA. • Use the Active-Passive Mode screens (Section 39.3 on page 670) to use active-passive mode device HA.
Chapter 39 Device HA • Legacy mode allows for more complex relationships between the master and backup ZyWALLs, such as active-active or using different ZyWALLs as the master ZyWALL for individual interfaces. Legacy mode configuration involves a greater degree of complexity. Active-passive mode is recommended for general failover deployments. • The ZyWALLs must all support and be set to use the same device HA mode (either active-passive or legacy).
Chapter 39 Device HA 39.2 Device HA General The Configuration > Device HA General screen lets you enable or disable device HA, and displays which device HA mode the ZyWALL is set to use along with a summary of the monitored interfaces. Figure 450 Configuration > Device HA > General The following table describes the labels in this screen. Table 178 Configuration > Device HA > General LABEL DESCRIPTION Enable Device HA Turn the ZyWALL’s device HA feature on or off.
Chapter 39 Device HA Table 178 Configuration > Device HA > General (continued) LABEL DESCRIPTION HA Status The text before the slash shows whether the device is configured as the master or the backup role. This text after the slash displays the monitored interface’s status in the virtual router. Active - This interface is up and using the virtual IP address and subnet mask. Stand-By - This interface is a backup interface in the virtual router. It is not using the virtual IP address and subnet mask.
Chapter 39 Device HA B form a virtual router that uses cluster ID 1. ZyWALLs C and D form a virtual router that uses cluster ID 2. Figure 452 Cluster IDs for Multiple Virtual Routers A 1 B C D 2 Monitored Interfaces in Active-Passive Mode Device HA You can select which interfaces device HA monitors. If a monitored interface on the ZyWALL loses its connection, device HA has the backup ZyWALL take over. Enable monitoring for the same interfaces on the master and backup ZyWALLs.
Chapter 39 Device HA 192.168.1.5 and ZyWALL B has its own LAN management IP address of 192.168.1.6. These do not change when ZyWALL B becomes the master. Figure 453 Management IP Addresses A 192.168.1.1 192.168.1.5 B 192.168.1.1 192.168.1.6 39.3.1 Configuring Active-Passive Mode Device HA The Device HA Active-Passive Mode screen lets you configure general activepassive mode device HA settings, view and manage the list of monitored interfaces, and synchronize backup ZyWALLs.
Chapter 39 Device HA The following table describes the labels in this screen. See Section 39.4 on page 675 for more information as well. Table 179 Configuration > Device HA > Active-Passive Mode LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. Device Role Select the device HA role that the ZyWALL plays in the virtual router. Choices are: Master - This ZyWALL is the master ZyWALL in the virtual router.
Chapter 39 Device HA Table 179 Configuration > Device HA > Active-Passive Mode (continued) LABEL DESCRIPTION Monitored Interface Summary This table shows the status of the device HA settings and status of the ZyWALL’s interfaces. Edit Select an entry and click this to be able to modify it. Activate To turn on an entry, select it and click Activate. Inactivate To turn off an entry, select it and click Inactivate. # This is the entry’s index number in the list.
Chapter 39 Device HA Table 179 Configuration > Device HA > Active-Passive Mode (continued) LABEL DESCRIPTION Password Enter the password used for verification during synchronization. Every ZyWALL in the virtual router must use the same password. If you leave this field blank in the master ZyWALL, no backup ZyWALLs can synchronize from it. If you leave this field blank in a backup ZyWALL, it cannot synchronize from the master ZyWALL.
Chapter 39 Device HA A bridge interface’s device HA settings are not retained if you delete the bridge interface. Figure 455 Configuration > Device HA > Active-Passive Mode > Edit The following table describes the labels in this screen. Table 180 Configuration > Device HA > Active-Passive Mode > Edit LABEL DESCRIPTION Enable Monitored Interface Select this to have device HA monitor the status of this interface’s connection. Interface Name This identifies the interface.
Chapter 39 Device HA 39.5 The Legacy Mode Screen Virtual Router Redundancy Protocol (VRRP) Legacy mode device HA uses Virtual Router Redundancy Protocol (VRRP) to create redundant backup gateways to ensure that a default gateway is always available. The ZyWALL uses a custom VRRP implementation and is not compatible with standard VRRP.
Chapter 39 Device HA 39.6 Configuring the Legacy Mode Screen The Device HA Legacy Mode screen lets you configure general legacy mode HA settings including link monitoring, configure the VRRP group and synchronize backup ZyWALLs. To access this screen, click Configuration > Device HA > Legacy Mode. Figure 456 Configuration > Device HA > Legacy Mode The following table describes the labels in this screen. See Table 182 on page 681 for more information as well.
Chapter 39 Device HA Table 181 Configuration > Device HA > Legacy Mode (continued) LABEL DESCRIPTION Remove Select an entry and click this to delete it. Activate To turn on an entry, select it and click Activate. Activating a VRRP group has the ZyWALL monitor the connection of the group’s interface. Each interface must have a static IP address and be connected to the same subnet as the group’s interface on the other ZyWALL. Inactivate To turn off an entry, select it and click Inactivate.
Chapter 39 Device HA Table 181 Configuration > Device HA > Legacy Mode (continued) LABEL DESCRIPTION Auto Synchronize Select this to get configuration and subscription service updates automatically from the specified ZyWALL according to the specified Interval. The first synchronization begins after the specified Interval; the ZyWALL does not synchronize immediately. Interval This field is only available if Auto Synchronize is checked. Type the number of minutes to wait between synchronizations.
Chapter 39 Device HA The following table describes the labels in this screen. Table 182 Configuration > Device HA > Legacy Mode > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. Enable VRRP Group Select this to make the specified interface part of the virtual router. Clear this to take the specified interface out of the virtual router.
Chapter 39 Device HA Table 182 Configuration > Device HA > Legacy Mode > Add (continued) LABEL DESCRIPTION VRID Type the virtual router ID number. Virtual Router IP (VRIP) / Subnet Mask This is the interface’s IP address and subnet mask in the virtual router. Authentication Select the authentication method used in the virtual router. Every interface in a virtual router must use the same authentication method and password.
Chapter 39 Device HA 1 Make sure the bridge interfaces of the master ZyWALL (A) and the backup ZyWALL (B) are not connected. A B 2 Configure the bridge interface on the master ZyWALL, set the bridge interface as a monitored interface, and activate device HA. Br0 {ge4, ge5} A B 3 Configure the bridge interface on the backup ZyWALL, set the bridge interface as a monitored interface, and activate device HA.
Chapter 39 Device HA 4 Connect the ZyWALLs. Br0 {ge4, ge5} A B Br0 {ge4, ge5} Second Option for Connecting the Bridge Interfaces on Two ZyWALLs Another option is to disable the bridge interfaces, connect the bridge interfaces, activate device HA, and finally reactivate the bridge interfaces as shown in the following example. 1 In this case the ZyWALLs are already connected, but the bridge faces have not been configured yet. Configure a disabled bridge interface on the master ZyWALL but disable it.
Chapter 39 Device HA 2 Configure a corresponding disabled bridge interface on the backup ZyWALL. Then set the bridge interface as a monitored interface, and activate device HA. Br0 {ge4, ge5} Disabled A B Br0 {ge4, ge5} 3 Disabled Enable the bridge interface on the master ZyWALL and then on the backup ZyWALL. Br0 {ge4, ge5} A B Br0 {ge4, ge5} 4 Connect the ZyWALLs.
Chapter 39 Device HA Legacy Mode ZyWALL VRRP Application In VRRP, a virtual router represents a number of ZyWALLs associated with one IP address, the IP address of the default gateway. Each virtual router is identified by a unique 8-bit identification number called a Virtual Router ID (VR ID). In the example below, ZyWALL A and ZyWALL B are part of virtual router 10 with IP address 192.168.10.254. Figure 458 Example: VRRP, Normal Operation The VR ID is not shown.
Chapter 39 Device HA If ZyWALL A becomes available again, ZyWALL A preempts ZyWALL B and becomes the master again (the network returns to the state shown in Figure 458 on page 686). Synchronization During synchronization, the master ZyWALL sends the following information to the backup ZyWALL. • Startup configuration file (startup-config.
Chapter 39 Device HA 688 ZyWALL USG 2000 User’s Guide
CHAPTER 40 User/Group 40.1 Overview This chapter describes how to set up user accounts, user groups, and user settings for the ZyWALL. You can also set up rules that control when users have to log in to the ZyWALL before the ZyWALL routes traffic for them. 40.1.1 What You Can Do in this Chapter • The User screen (see Section 40.2 on page 692) provides a summary of all user accounts. • The Group screen (see Section 40.3 on page 695) provides a summary of all user groups.
Chapter 40 User/Group Table 183 Types of User Accounts (continued) TYPE ABILITIES LOGIN METHOD(S) limited-admin Look at ZyWALL configuration (web, CLI) WWW, TELNET, SSH, Console, Dial-in Perform basic diagnostics (CLI) Access Users user Access network services WWW, TELNET, SSH Browse user-mode commands (CLI) guest Access network services WWW ext-user External user account WWW ext-group-user External group user account WWW Note: The default admin account is always authenticated locally, rega
Chapter 40 User/Group See Setting up User Attributes in an External Server on page 703 for a list of attributes and how to set up the attributes in an external server. Ext-Group-User Accounts Ext-Group-User accounts work are similar to ext-user accounts but allow you to group users by the value of the group membership attribute configured for the AD or LDAP server. See Section 44.2.1 on page 727 for more on the group membership attribute.
Chapter 40 User/Group 40.2 User Summary Screen The User screen provides a summary of all user accounts. To access this screen, login to the Web Configurator, and click Configuration > Object > User/Group. Figure 460 Configuration > Object > User/Group The following table describes the labels in this screen. Table 184 Configuration > Object > User/Group LABEL DESCRIPTION Add Click this to create a new entry.
Chapter 40 User/Group • - [dashes] The first character must be alphabetical (A-Z a-z), an underscore (_), or a dash (). Other limitations on user names are: • User names are case-sensitive. If you enter a user 'bob' but use 'BOB' when connecting via CIFS or FTP, it will use the account settings used for 'BOB' not ‘bob’. • User names have to be different than user group names.
Chapter 40 User/Group The following table describes the labels in this screen. Table 185 Configuration > User/Group > User > Add LABEL DESCRIPTION User Name Type the user name for this user account. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive. User names have to be different than user group names, and some words are reserved. See Section 40.2.1.1 on page 692.
Chapter 40 User/Group Table 185 Configuration > User/Group > User > Add (continued) LABEL DESCRIPTION Reauthentication Time This field is not available if you select the ext-group-user type. Configuration Validation Use a user account from the group specified above to test if the configuration is correct. Enter the account’s user name in the User Name field and click Test. OK Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes.
Chapter 40 User/Group Table 186 Configuration > Object > User/Group > Group (continued) LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific user group. Group Name This field displays the name of each user group. Description This field displays the description for each user group. Member This field lists the members in the user group. Each member is separated by a comma. 40.3.
Chapter 40 User/Group Table 187 Configuration > User/Group > Group > Add (continued) LABEL DESCRIPTION Member List The Member list displays the names of the users and user groups that have been added to the user group. The order of members is not important. Select users and groups from the Available list that you want to be members of this group and move them to the Member list.
Chapter 40 User/Group To access this screen, login to the Web Configurator, and click Configuration > Object > User/Group > Setting. Figure 464 Configuration > Object > User/Group > Setting The following table describes the labels in this screen. Table 188 Configuration > Object > User/Group > Setting LABEL DESCRIPTION User Authentication Timeout Settings 698 Default Authentication Timeout Settings These authentication timeout settings are used by default when you create a new user account.
Chapter 40 User/Group Table 188 Configuration > Object > User/Group > Setting (continued) LABEL User Type DESCRIPTION These are the kinds of user account the ZyWALL supports.
Chapter 40 User/Group Table 188 Configuration > Object > User/Group > Setting (continued) LABEL DESCRIPTION Limit the number of simultaneous logons for administration account Select this check box if you want to set a limit on the number of simultaneous logins by admin users. If you do not select this, admin users can login as many times as they want at the same time using the same or different IP addresses. Maximum number per administration account This field is effective when Limit ...
Chapter 40 User/Group To access this screen, go to the Configuration > Object > User/Group > Setting screen (see Section 40.4 on page 697), and click one of the Default Authentication Timeout Settings section’s Edit icons. Figure 465 Configuration > Object > User/Group > Setting > Edit The following table describes the labels in this screen.
Chapter 40 User/Group 40.4.2 User Aware Login Example Access users cannot use the Web Configurator to browse the configuration of the ZyWALL. Instead, after access users log into the ZyWALL, the following screen appears. Figure 466 Web Configurator for Non-Admin Users The following table describes the labels in this screen. Table 190 Web Configurator for Non-Admin Users LABEL DESCRIPTION User-defined lease time (max ...
Chapter 40 User/Group 40.5 User /Group Technical Reference This section provides some information on users who use an external authentication server in order to log in. Setting up User Attributes in an External Server To set up user attributes, such as reauthentication time, in LDAP or RADIUS servers, use the following keywords in the user configuration file. Table 191 LDAP/RADIUS: Keywords for User Attributes KEYWORD CORRESPONDING ATTRIBUTE IN WEB CONFIGURATOR type User Type.
Chapter 40 User/Group 704 ZyWALL USG 2000 User’s Guide
CHAPTER 41 Addresses 41.1 Overview Address objects can represent a single IP address or a range of IP addresses. Address groups are composed of address objects and other address groups. 41.1.1 What You Can Do in this Chapter • The Address screen (Section 41.2 on page 705) provides a summary of all addresses in the ZyWALL. Use the Address Add/Edit screen to create a new address or edit an existing one. • Use the Address Group summary screen (Section 41.
Chapter 41 Addresses • RANGE - a range address is defined by a Starting IP Address and an Ending IP Address. • SUBNET - a network address is defined by a Network IP address and Netmask subnet mask. The Address screen provides a summary of all addresses in the ZyWALL. To access this screen, click Configuration > Object > Address > Address. Click a column’s heading cell to sort the table entries by that column’s criteria. Click the heading cell again to reverse the sort order.
Chapter 41 Addresses 41.2.1 Address Add/Edit Screen The Configuration > Address Add/Edit screen allows you to create a new address or edit an existing one. To access this screen, go to the Address screen (see Section 41.2 on page 705), and click either the Add icon or an Edit icon. Figure 470 Configuration > Object > Address > Address > Edit The following table describes the labels in this screen.
Chapter 41 Addresses Table 193 Configuration > Object > Address > Address > Edit (continued) LABEL DESCRIPTION Interface If you selected INTERFACE IP, INTERFACE SUBNET, or INTERFACE GATEWAY as the Address Type, use this field to select the interface of the network that this address object represents. OK Click OK to save your changes back to the ZyWALL. Cancel Click Cancel to exit this screen without saving your changes. 41.
Chapter 41 Addresses 41.3.1 Address Group Add/Edit Screen The Address Group Add/Edit screen allows you to create a new address group or edit an existing one. To access this screen, go to the Address Group screen (see Section 41.3 on page 708), and click either the Add icon or an Edit icon. Figure 472 Configuration > Object > Address > Address Group > Add The following table describes the labels in this screen.
Chapter 41 Addresses 710 ZyWALL USG 2000 User’s Guide
CHAPTER 42 Services 42.1 Overview Use service objects to define TCP applications, UDP applications, and ICMP messages. You can also create service groups to refer to multiple service objects in other features. 42.1.1 What You Can Do in this Chapter • Use the Service screens (Section 42.2 on page 712) to view and configure the ZyWALL’s list of services and their definitions. • Use the Service Group screens (Section 42.2 on page 712) to view and configure the ZyWALL’s list of service groups. 42.1.
Chapter 42 Services Both TCP and UDP use ports to identify the source and destination. Each port is a 16-bit number. Some port numbers have been standardized and are used by lowlevel system processes; many others have no particular meaning. Unlike TCP and UDP, Internet Control Message Protocol (ICMP, IP protocol 1) is mainly used to send error messages or to investigate problems. For example, ICMP is used to send the response if a computer cannot be reached. Another use is ping.
Chapter 42 Services entries by that column’s criteria. Click the heading cell again to reverse the sort order. Figure 473 Configuration > Object > Service > Service The following table describes the labels in this screen. Table 196 Configuration > Object > Service > Service LABEL DESCRIPTION Add Click this to create a new entry. Edit Double-click an entry or select it and click Edit to be able to modify the entry’s settings. Remove To remove an entry, select it and click Remove.
Chapter 42 Services 42.2.1 The Service Add/Edit Screen The Service Add/Edit screen allows you to create a new service or edit an existing one. To access this screen, go to the Service screen (see Section 42.2 on page 712), and click either the Add icon or an Edit icon. Figure 474 Configuration > Object > Service > Service > Edit The following table describes the labels in this screen.
Chapter 42 Services To access this screen, log in to the Web Configurator, and click Configuration > Object > Service > Service Group. Figure 475 Configuration > Object > Service > Service Group The following table describes the labels in this screen. See Section 42.3.1 on page 716 for more information as well. Table 198 Configuration > Object > Service > Service Group LABEL DESCRIPTION Add Click this to create a new entry.
Chapter 42 Services 42.3.1 The Service Group Add/Edit Screen The Service Group Add/Edit screen allows you to create a new service group or edit an existing one. To access this screen, go to the Service Group screen (see Section 42.3 on page 714), and click either the Add icon or an Edit icon. Figure 476 Configuration > Object > Service > Service Group > Edit The following table describes the labels in this screen.
CHAPTER 43 Schedules 43.1 Overview Use schedules to set up one-time and recurring schedules for policy routes, firewall rules, application patrol, and content filtering. The ZyWALL supports onetime and recurring schedules. One-time schedules are effective only once, while recurring schedules usually repeat. Both types of schedules are based on the current date and time in the ZyWALL. Note: Schedules are based on the ZyWALL’s current date and time. 43.1.
Chapter 43 Schedules Finding Out More • See Section 6.6 on page 114 for related information on these screens. • See Section 50.3 on page 785 for information about the ZyWALL’s current date and time. 43.2 The Schedule Summary Screen The Schedule summary screen provides a summary of all schedules in the ZyWALL. To access this screen, click Configuration > Object > Schedule. Figure 477 Configuration > Object > Schedule The following table describes the labels in this screen. See Section 43.2.
Chapter 43 Schedules Table 200 Configuration > Object > Schedule (continued) LABEL DESCRIPTION Recurring Add Click this to create a new entry. Edit Double-click an entry or select it and click Edit to be able to modify the entry’s settings. Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so. Object References Select an entry and click Object References to open a screen that shows which settings use the entry. See Section 13.3.
Chapter 43 Schedules Table 201 Configuration > Object > Schedule > Edit (One Time) (continued) LABEL DESCRIPTION Date Time StartDate Specify the year, month, and day when the schedule begins. Year - 1900 - 2999 Month - 1 - 12 Day - 1 - 31 (it is not possible to specify illegal dates, such as February 31.) Hour - 0 - 23 Minute - 0 - 59 StartTime Specify the hour and minute when the schedule begins. Hour - 0 - 23 Minute - 0 - 59 StopDate Specify the year, month, and day when the schedule ends.
Chapter 43 Schedules (see Section 43.2 on page 718), and click either the Add icon or an Edit icon in the Recurring section. Figure 479 Configuration > Object > Schedule > Edit (Recurring) The Year, Month, and Day columns are not used in recurring schedules and are disabled in this screen. The following table describes the remaining labels in this screen.
Chapter 43 Schedules 722 ZyWALL USG 2000 User’s Guide
CHAPTER 44 AAA Server 44.1 Overview You can use a AAA (Authentication, Authorization, Accounting) server to provide access control to your network. The AAA server can be a Active Directory, LDAP, or RADIUS server. Use the AAA Server screens to create and manage objects that contain settings for using AAA servers. You use AAA server objects in configuring ext-group-user user objects and authentication method objects (see Chapter 45 on page 733). 44.1.
Chapter 44 AAA Server 44.1.2 RADIUS Server RADIUS (Remote Authentication Dial-In User Service) authentication is a popular protocol used to authenticate users by means of an external server instead of (or in addition to) an internal device user database that is limited to the memory capacity of the device. In essence, RADIUS authentication allows you to validate a large number of users from a central location. Figure 481 RADIUS Server Network Example 44.1.
Chapter 44 AAA Server • Use the Configuration > Object > AAA Server > RADIUS screen (Section 44.3 on page 729) to configure the default external RADIUS server to use for user authentication. 44.1.5 What You Need To Know AAA Servers Supported by the ZyWALL The following lists the types of authentication server the ZyWALL supports.
Chapter 44 AAA Server organizational boundaries. The following figure shows a basic directory structure branching from countries to organizations to organizational units to individuals. Figure 482 Basic Directory Structure Sales Sprint RD3 US QA UPS CSO Root Sales Japan NEC Countries Organizations RD Organization Units Unique Common Name (cn) Distinguished Name (DN) A DN uniquely identifies an entry in a directory. A DN consists of attribute-value pairs separated by commas.
Chapter 44 AAA Server • See Section 7.7 on page 142 for an example of how to use a RADIUS server to authenticate user accounts based on groups. 44.2 Active Directory or LDAP Server Summary Use the Active Directory or LDAP screen to manage the list of AD or LDAP servers the ZyWALL can use in authenticating users. Click Configuration > Object > AAA Server > Active Directory (or LDAP) to display the Active Directory (or LDAP) screen.
Chapter 44 AAA Server following screen. Use this screen to create a new AD or LDAP entry or edit an existing one. Figure 484 Configuration > Object > AAA Server > Active Directory (or LDAP) > Add The following table describes the labels in this screen. Table 204 Configuration > Object > AAA Server > Active Directory (or LDAP) > Add LABEL DESCRIPTION Name Enter a descriptive name (up to 63 alphanumerical characters) for identification purposes.
Chapter 44 AAA Server Table 204 Configuration > Object > AAA Server > Active Directory (or LDAP) > Add LABEL DESCRIPTION Base DN Specify the directory (up to 127 alphanumerical characters). For example, o=ZyXEL, c=US. Use SSL Select Use SSL to establish a secure connection to the AD or LDAP server(s). Search time limit Specify the timeout period (between 1 and 300 seconds) before the ZyWALL disconnects from the AD or LDAP server. In this case, user authentication fails.
Chapter 44 AAA Server Click Configuration > Object > AAA Server > RADIUS to display the RADIUS screen. Figure 485 Configuration > Object > AAA Server > RADIUS The following table describes the labels in this screen. Table 205 Configuration > Object > AAA Server > RADIUS LABEL DESCRIPTION Add Click this to create a new entry. Edit Double-click an entry or select it and click Edit to open a screen where you can modify the entry’s settings. Remove To remove an entry, select it and click Remove.
Chapter 44 AAA Server 44.3.1 Adding a RADIUS Server Click Configuration > Object > AAA Server > RADIUS to display the RADIUS screen. Click the Add icon or an Edit icon to display the following screen. Use this screen to create a new AD or LDAP entry or edit an existing one. Figure 486 Configuration > Object > AAA Server > RADIUS > Add The following table describes the labels in this screen.
Chapter 44 AAA Server Table 206 Configuration > Object > AAA Server > RADIUS > Add (continued) LABEL DESCRIPTION Timeout Specify the timeout period (between 1 and 300 seconds) before the ZyWALL disconnects from the RADIUS server. In this case, user authentication fails. Search timeout occurs when either the user information is not in the RADIUS server or the RADIUS server is down.
CHAPTER 45 Authentication Method 45.1 Overview Authentication method objects set how the ZyWALL authenticates HTTP/HTTPS clients, peer IPSec routers (extended authentication), and L2TP VPN clients. Configure authentication method objects to have the ZyWALL use the local user database, and/or the authentication servers and authentication server groups specified by AAA server objects. By default, user accounts created and stored on the ZyWALL are authenticated locally. 45.1.
Chapter 45 Authentication Method 3 Select Server Mode and select an authentication method object from the dropdown list box. 4 Click OK to save the settings. Figure 487 Example: Using Authentication Method in VPN 45.2 Authentication Method Objects Click Configuration > Object > Auth. Method to display the screen as shown. Note: You can create up to 16 authentication method objects. Figure 488 Configuration > Object > Auth. Method The following table describes the labels in this screen.
Chapter 45 Authentication Method Table 207 Configuration > Object > Auth. Method (continued) LABEL DESCRIPTION Method List This field displays the authentication method(s) for this entry. Add icon Click Add to add a new entry. Click Edit to edit the settings of an entry. Click Delete to remove an entry. 45.2.1 Creating an Authentication Method Object Follow the steps below to create an authentication method object. 1 Click Configuration > Object > Auth. Method. 2 Click Add.
Chapter 45 Authentication Method 7 Click OK to save the settings or click Cancel to discard all changes and return to the previous screen. Figure 489 Configuration > Object > Auth. Method > Add The following table describes the labels in this screen. Table 208 Configuration > Object > Auth. Method > Add LABEL DESCRIPTION Name Specify a descriptive name for identification purposes. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number.
Chapter 45 Authentication Method Table 208 Configuration > Object > Auth. Method > Add (continued) LABEL DESCRIPTION Add icon Click Add to add a new entry. Click Edit to edit the settings of an entry. Click Delete to delete an entry. OK Click OK to save the changes. Cancel Click Cancel to discard the changes.
Chapter 45 Authentication Method 738 ZyWALL USG 2000 User’s Guide
CHAPTER 46 Certificates 46.1 Overview The ZyWALL can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. A certificate contains the certificate owner’s identity and public key. Certificates provide a way to exchange public keys for use in authentication. 46.1.1 What You Can Do in this Chapter • Use the My Certificate screens (see Section 46.2 on page 743 to Section 46.2.
Chapter 46 Certificates 2 Tim keeps the private key and makes the public key openly available. This means that anyone who receives a message seeming to come from Tim can read it and verify whether it is really from him or not. 3 Tim uses his private key to sign the message and sends it to Jenny. 4 Jenny receives the message and uses Tim’s public key to verify it.
Chapter 46 Certificates Factory Default Certificate The ZyWALL generates its own unique self-signed certificate when you first turn it on. This certificate is referred to in the GUI as the factory default certificate. Certificate File Formats Any certificate that you want to import has to be in one of these file formats: • Binary X.509: This is an ITU-T recommendation that defines the formats for X.509 certificates. • PEM (Base-64) encoded X.
Chapter 46 Certificates 2 Make sure that the certificate has a “.cer” or “.crt” file name extension. Figure 490 Remote Host Certificates 3 Double-click the certificate’s icon to open the Certificate window. Click the Details tab and scroll down to the Thumbprint Algorithm and Thumbprint fields. Figure 491 Certificate Details 4 742 Use a secure method to verify that the certificate owner has the same information in the Thumbprint Algorithm and Thumbprint fields.
Chapter 46 Certificates 46.2 The My Certificates Screen Click Configuration > Object > Certificate > My Certificates to open the My Certificates screen. This is the ZyWALL’s summary list of certificates and certification requests. Figure 492 Configuration > Object > Certificate > My Certificates The following table describes the labels in this screen.
Chapter 46 Certificates Table 209 Configuration > Object > Certificate > My Certificates (continued) LABEL DESCRIPTION Type This field displays what kind of certificate this is. REQ represents a certification request and is not yet a valid certificate. Send a certification request to a certification authority, which then issues a certificate. Use the My Certificate Import screen to import the certificate and replace the request. SELF represents a self-signed certificate.
Chapter 46 Certificates ZyWALL create a self-signed certificate, enroll a certificate with a certification authority or generate a certification request.
Chapter 46 Certificates The following table describes the labels in this screen. Table 210 Configuration > Object > Certificate > My Certificates > Add LABEL DESCRIPTION Name Type a name to identify this certificate. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters. Subject Information Use these fields to record information that identifies the owner of the certificate.
Chapter 46 Certificates Table 210 Configuration > Object > Certificate > My Certificates > Add (continued) LABEL DESCRIPTION Create a certification request and save it locally for later manual enrollment Select this to have the ZyWALL generate and store a request for a certificate. Use the My Certificate Details screen to view the certification request and copy it to send to the certification authority.
Chapter 46 Certificates Table 210 Configuration > Object > Certificate > My Certificates > Add (continued) LABEL DESCRIPTION Request Authentication When you select Create a certification request and enroll for a certificate immediately online, the certification authority may want you to include a reference number and key to identify you when you send a certification request. Fill in both the Reference Number and the Key fields if your certification authority uses the CMP enrollment protocol.
Chapter 46 Certificates 46.2.2 The My Certificates Edit Screen Click Configuration > Object > Certificate > My Certificates and then the Edit icon to open the My Certificate Edit screen. You can use this screen to view in-depth certificate information and change the certificate’s name.
Chapter 46 Certificates The following table describes the labels in this screen. Table 211 Configuration > Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificate. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters. Certification Path This field displays for a certificate, not a certification request.
Chapter 46 Certificates Table 211 Configuration > Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Key Algorithm This field displays the type of algorithm that was used to generate the certificate’s key pair (the ZyWALL uses RSA encryption) and the length of the key set in bits (1024 bits for example). Subject Alternative Name This field displays the certificate owner‘s IP address (IP), domain name (DNS) or e-mail address (EMAIL).
Chapter 46 Certificates Table 211 Configuration > Object > Certificate > My Certificates > Edit LABEL DESCRIPTION OK Click OK to save your changes back to the ZyWALL. You can only change the name. Cancel Click Cancel to quit and return to the My Certificates screen. 46.2.3 The My Certificates Import Screen Click Configuration > Object > Certificate > My Certificates > Import to open the My Certificate Import screen. Follow the instructions in this screen to save an existing certificate to the ZyWALL.
Chapter 46 Certificates Table 212 Configuration > Object > Certificate > My Certificates > Import (continued) LABEL DESCRIPTION Password This field only applies when you import a binary PKCS#12 format file. Type the file’s password that was created when the PKCS #12 file was exported. OK Click OK to save the certificate on the ZyWALL. Cancel Click Cancel to quit and return to the My Certificates screen. 46.
Chapter 46 Certificates Table 213 Configuration > Object > Certificate > Trusted Certificates (continued) LABEL DESCRIPTION Object References You cannot delete certificates that any of the ZyWALL’s features are configured to use. Select an entry and click Object References to open a screen that shows which settings use the entry. See Section 13.3.2 on page 291 for an example. # This field displays the certificate index number. The certificates are listed in alphabetical order.
Chapter 46 Certificates authority’s list of revoked certificates before trusting a certificate issued by the certification authority.
Chapter 46 Certificates The following table describes the labels in this screen. Table 214 Configuration > Object > Certificate > Trusted Certificates > Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificate. You can change the name. You can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=- characters.
Chapter 46 Certificates Table 214 Configuration > Object > Certificate > Trusted Certificates > Edit LABEL DESCRIPTION Type This field displays general information about the certificate. CA-signed means that a Certification Authority signed the certificate. Self-signed means that the certificate’s owner signed the certificate (not a certification authority). X.509 means that this certificate was created and signed according to the ITU-T X.
Chapter 46 Certificates Table 214 Configuration > Object > Certificate > Trusted Certificates > Edit LABEL DESCRIPTION SHA1 Fingerprint This is the certificate’s message digest that the ZyWALL calculated using the SHA1 algorithm. You can use this value to verify with the certification authority (over the phone for example) that this is actually their certificate.
Chapter 46 Certificates The following table describes the labels in this screen. Table 215 Configuration > Object > Certificate > Trusted Certificates > Import LABEL DESCRIPTION File Path Type in the location of the file you want to upload in this field or click Browse to find it. You cannot import a certificate with the same name as a certificate that is already in the ZyWALL. Browse Click Browse to find the certificate file you want to upload. OK Click OK to save the certificate on the ZyWALL.
Chapter 46 Certificates 760 ZyWALL USG 2000 User’s Guide
CHAPTER 47 ISP Accounts 47.1 Overview Use ISP accounts to manage Internet Service Provider (ISP) account information for PPPoE/PPTP interfaces. An ISP account is a profile of settings for Internet access using PPPoE or PPTP. Finding Out More • See Section 13.4 on page 292 for information about PPPoE/PPTP interfaces. • See Section 6.6 on page 114 for related information on these screens. 47.1.1 What You Can Do in this Chapter Use the Object > ISP Account screens (Section 47.
Chapter 47 ISP Accounts The following table describes the labels in this screen. See the ISP Account Edit section below for more information as well. Table 216 Configuration > Object > ISP Account LABEL DESCRIPTION Add Click this to create a new entry. Edit Double-click an entry or select it and click Edit to be able to modify the entry’s settings. Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so.
Chapter 47 ISP Accounts The following table describes the labels in this screen. Table 217 Configuration > Object > ISP Account > Edit LABEL DESCRIPTION Profile Name This field is read-only if you are editing an existing account. Type in the profile name of the ISP account. The profile name is used to refer to the ISP account. You may use 1-31 alphanumeric characters, underscores(_), or dashes (-), but the first character cannot be a number. This value is case-sensitive.
Chapter 47 ISP Accounts Table 217 Configuration > Object > ISP Account > Edit (continued) 764 LABEL DESCRIPTION Compression Select On button to turn on stac compression, and select Off to turn off stac compression. Stac compression is a data compression technique capable of compressing data by a factor of about four. Idle Timeout This value specifies the number of seconds that must elapse without outbound traffic before the ZyWALL automatically disconnects from the PPPoE/PPTP server.
CHAPTER 48 SSL Application 48.1 Overview You use SSL application objects in SSL VPN. Configure an SSL application object to specify the type of application and the address of the local computer, server, or web site SSL users are to be able to access. You can apply one or more SSL application objects in the VPN > SSL VPN screen for a user account/user group. 48.1.1 What You Can Do in this Chapter • Use the SSL Application screen (Section 48.
Chapter 48 SSL Application Remote Desktop Connections Use SSL VPN to allow remote users to manage LAN computers. Depending on the functions supported by the remote desktop software, they can install or remove software, run programs, change settings, and open, copy, create, and delete files. This is useful for troubleshooting, support, administration, and remote access to files and programs.
Chapter 48 SSL Application 2 Click the Add button and select Web Application in the Type field. In the Server Type field, select Web Server. Enter a descriptive name in the Display Name field. For example, “CompanyIntranet”. In the Address field, enter “http://info”. Select Web Page Encryption to prevent users from saving the web content. Click Apply to save the settings. The configuration screen should look similar to the following figure.
Chapter 48 SSL Application The following table describes the labels in this screen. Table 218 Configuration > Object > SSL Application LABEL DESCRIPTION Add Click this to create a new entry. Edit Double-click an entry or select it and click Edit to be able to modify the entry’s settings. Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so.
Chapter 48 SSL Application The following table describes the labels in this screen. Table 219 Configuration > Object > SSL Application > Add/Edit: Web Application LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings This displays for VNC or RDP type web application objects. Click this button to display a greater or lesser number of configuration fields. Create new Object Use this to configure any new settings objects that you need to use in this screen.
Chapter 48 SSL Application Table 219 Configuration > Object > SSL Application > Add/Edit: Web Application LABEL DESCRIPTION Server Address(es) This field displays if the Server Type is set to RDP or VNC. Specify the IP address or Fully-Qualified Domain Name (FQDN) of the computer(s) that you want to allow the remote users to manage. Starting Port This field displays if the Server Type is set to RDP or VNC.
Chapter 48 SSL Application The following table describes the labels in this screen. Table 220 Configuration > Object > SSL Application > Add/Edit: File Sharing LABEL DESCRIPTION Create new Object Use this to configure any new settings objects that you need to use in this screen. Object Type Select File Sharing to create a file share application for VPN SSL. File Sharing Name Enter a descriptive name to identify this object. You can enter up to 31 characters (“0-9”, “a-z”, “A-Z”, “-” and “_”).
Chapter 48 SSL Application 772 ZyWALL USG 2000 User’s Guide
CHAPTER 49 Endpoint Security 49.1 Overview Use Endpoint Security (EPS), also known as endpoint control, to make sure users’ computers comply with defined corporate policies before they can access the network or an SSL VPN tunnel. After a successful user authentication, a user’s computer must meet the endpoint security object’s Operating System (OS) option and security requirements to gain access.
Chapter 49 Endpoint Security 49.1.1 What You Can Do in this Chapter Use the Configuration > Object > Endpoint Security screens (Section 49.2 on page 775) to create and manage endpoint security objects. 49.1.2 What You Need to Know What Endpoint Security Can Check The settings endpoint security can check vary depending on the OS of the user’s computer.
Chapter 49 Endpoint Security 49.2 Endpoint Security Screen The Endpoint Security screen displays the endpoint security objects you have configured on the ZyWALL. Click Configuration > Object > Endpoint Security to display the screen. Figure 507 Configuration > Object > Endpoint Security The following table gives an overview of the objects you can configure. Table 221 Configuration > Object > Endpoint Security LABEL DESCRIPTION Add Click this to create a new entry.
Chapter 49 Endpoint Security Table 221 Configuration > Object > Endpoint Security (continued) 776 LABEL DESCRIPTION Apply Click this button to save your changes to the ZyWALL. Reset Click this button to return the screen to its last-saved settings.
Chapter 49 Endpoint Security 49.3 Endpoint Security Add/Edit Click Configuration > Object > Endpoint Security and then the Add (or Edit) icon to open the Endpoint Security Edit screen. Use this screen to configure an endpoint security object.
Chapter 49 Endpoint Security Figure 508 Configuration > Object > Endpoint Security > Add 778 ZyWALL USG 2000 User’s Guide
Chapter 49 Endpoint Security The following table gives an overview of the objects you can configure. Table 222 Configuration > Object > Endpoint Security > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. General Setup Object Name Specify a descriptive name for identification purposes. You can enter up to 31 characters (“0-9”, “a-z”, “A-Z”, “-”, “_” with no spaces allowed).
Chapter 49 Endpoint Security Table 222 Configuration > Object > Endpoint Security > Add (continued) LABEL DESCRIPTION Checking Item - Personal Firewall If you selected Windows as the operating system, you can select whether or not the user’s computer is required to have personal firewall software installed. Move the permitted personal firewalls from the Available list to the Allowed Personal Firewall List. Use the [Shift] and/or [Ctrl] key to select multiple entries.
Chapter 49 Endpoint Security Table 222 Configuration > Object > Endpoint Security > Add (continued) LABEL DESCRIPTION Checking Item - File Information If you selected Windows or Linux as the operating system, you can use this table to check details of specific files on the user’s computer.
Chapter 49 Endpoint Security 782 ZyWALL USG 2000 User’s Guide
CHAPTER 50 System 50.1 Overview Use the system screens to configure general ZyWALL settings. 50.1.1 What You Can Do in this Chapter • Use the System > Host Name screen (see Section 50.2 on page 784) to configure a unique name for the ZyWALL in your network. • Use the System > Date/Time screen (see Section 50.3 on page 785) to configure the date and time for the ZyWALL. • Use the System > Console Speed screen (see Section 50.
Chapter 50 System • Connect an external serial modem to the AUX port to provide a management connection in case the ZyWALL’s other WAN connections are down. Use the System > Dial-in Mgmt. screen (see Section 50.11 on page 827) to configure the external serial modem. • Vantage CNM (Centralized Network Management) is a browser-based global management tool that allows an administrator to manage ZyXEL devices. Use the System > Vantage CNM screen (see Section 50.
Chapter 50 System 50.3 Date and Time For effective scheduling and logging, the ZyWALL system time must be accurate. The ZyWALL’s Real Time Chip (RTC) keeps track of the time and date. There is also a software mechanism to set the time manually or get the current time and date from an external server. To change your ZyWALL’s time based on your local time zone and date, click Configuration > System > Date/Time. The screen displays as shown.
Chapter 50 System Table 224 Configuration > System > Date and Time (continued) LABEL DESCRIPTION Manual Select this radio button to enter the time and date manually. If you configure a new time and date, time zone and daylight saving at the same time, the time zone and daylight saving will affect the new time and date you entered. When you enter the time settings manually, the ZyWALL uses the new setting once you click Apply.
Chapter 50 System Table 224 Configuration > System > Date and Time (continued) LABEL DESCRIPTION End Date Configure the day and time when Daylight Saving Time ends if you selected Enable Daylight Saving. The at field uses the 24 hour format. Here are a couple of examples: Daylight Saving Time ends in the United States on the first Sunday of November. Each time zone in the United States stops using Daylight Saving Time at 2 A.M. local time.
Chapter 50 System 50.3.2 Time Server Synchronization Click the Synchronize Now button to get the time and date from the time server you specified in the Time Server Address field. When the Please Wait... screen appears, you may have to wait up to one minute. Figure 511 Synchronization in Process The Current Time and Current Date fields will display the appropriate settings if the synchronization is successful. If the synchronization was not successful, a log displays in the View Log screen.
Chapter 50 System 5 Under Time and Date Setup, enter a Time Server Address (Table 225 on page 787). 6 Click Apply. 50.4 Console Port Speed This section shows you how to set the console port speed when you connect to the ZyWALL via the console port using a terminal emulation program. See Table 2 on page 41 for default console port settings. Click Configuration > System > Console Speed to open the Console Speed screen.
Chapter 50 System 50.5.1 DNS Server Address Assignment The ZyWALL can get the DNS server addresses in the following ways. • The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, manually enter them in the DNS server fields. • If your ISP dynamically assigns the DNS server IP addresses (along with the ZyWALL’s WAN IP address), set the DNS server fields to get the DNS server address from the ISP.
Chapter 50 System The following table describes the labels in this screen. Table 227 Configuration > System > DNS LABEL DESCRIPTION Address/PTR Record This record specifies the mapping of a Fully-Qualified Domain Name (FQDN) to an IP address. An FQDN consists of a host and domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain.
Chapter 50 System Table 227 Configuration > System > DNS (continued) LABEL DESCRIPTION DNS Server This is the IP address of a DNS server. This field displays N/A if you have the ZyWALL get a DNS server IP address from the ISP dynamically but the specified interface is not active. Query Via This is the interface through which the ZyWALL sends DNS queries to the entry’s DNS server. If the ZyWALL connects through a VPN tunnel, tunnel displays.
Chapter 50 System 50.5.3 Address Record An address record contains the mapping of a Fully-Qualified Domain Name (FQDN) to an IP address. An FQDN consists of a host and domain name. For example, www.zyxel.com is a fully qualified domain name, where “www” is the host, “zyxel” is the second-level domain, and “com” is the top level domain. mail.myZyXEL.com.tw is also a FQDN, where “mail” is the host, “myZyXEL” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain.
Chapter 50 System The following table describes the labels in this screen. Table 228 Configuration > System > DNS > Address/PTR Record Edit LABEL DESCRIPTION FQDN Type a Fully-Qualified Domain Name (FQDN) of a server. An FQDN starts with a host name and continues all the way up to the top-level domain name. For example, www.zyxel.com.tw is a fully qualified domain name, where “www” is the host, “zyxel” is the third-level domain, “com” is the second-level domain, and “tw” is the top level domain.
Chapter 50 System The following table describes the labels in this screen. Table 229 Configuration > System > DNS > Domain Zone Forwarder Add LABEL DESCRIPTION Domain Zone A domain zone is a fully qualified domain name without the host. For example, zyxel.com.tw is the domain zone for the www.zyxel.com.tw fully qualified domain name. For example, whenever the ZyWALL receives needs to resolve a zyxel.com.tw domain name, it can send a query to the recorded name server IP address.
Chapter 50 System 50.5.9 Adding a MX Record Click the Add icon in the MX Record table to add a MX record. Figure 516 Configuration > System > DNS > MX Record Add The following table describes the labels in this screen. Table 230 Configuration > System > DNS > MX Record Add LABEL DESCRIPTION Domain Name Enter the domain name where the mail is destined for.
Chapter 50 System The following table describes the labels in this screen. Table 231 Configuration > System > DNS > Service Control Rule Add LABEL DESCRIPTION Create new Object Use this to configure any new settings objects that you need to use in this screen. Address Object Select ALL to allow or deny any computer to send DNS queries to the ZyWALL. Select a predefined address object to just allow or deny the computer with the IP address that you specified to send DNS queries to the ZyWALL.
Chapter 50 System • See To-ZyWALL Rules on page 424 for more on To-ZyWALL firewall rules. • See Section 7.9 on page 147 for an example of configuring service control to block administrator HTTPS access from all zones except the LAN. To stop a service from accessing the ZyWALL, clear Enable in the corresponding service screen. 50.6.1 Service Access Limitations A service cannot be used to access the ZyWALL when: 1 You have disabled that service in the corresponding screen.
Chapter 50 System It relies upon certificates, public keys, and private keys (see Chapter 46 on page 739 for more information). HTTPS on the ZyWALL is used so that you can securely access the ZyWALL using the Web Configurator.
Chapter 50 System Note: Admin Service Control deals with management access (to the Web Configurator). User Service Control deals with user access to the ZyWALL (logging into SSL VPN for example). Figure 520 Configuration > System > WWW > Service Control The following table describes the labels in this screen.
Chapter 50 System Table 232 Configuration > System > WWW > Service Control (continued) LABEL DESCRIPTION Server Port The HTTPS server listens on port 443 by default. If you change the HTTPS server port to a different number on the ZyWALL, for example 8443, then you must notify people who need to access the ZyWALL Web Configurator to use “https://ZyWALL IP Address:8443” as the URL.
Chapter 50 System Table 232 Configuration > System > WWW > Service Control (continued) LABEL DESCRIPTION HTTP Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the ZyWALL Web Configurator using HTTP connections. Server Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service to access the ZyWALL.
Chapter 50 System Table 232 Configuration > System > WWW > Service Control (continued) LABEL DESCRIPTION Apply Click Apply to save your changes back to the ZyWALL. Reset Click Reset to return the screen to its last-saved settings. 50.6.5 Service Control Rules Click Add or Edit in the Service Control table in a WWW, SSH, Telnet, FTP or SNMP screen to add a service control rule. Figure 521 Configuration > System > Service Control Rule > Edit The following table describes the labels in this screen.
Chapter 50 System also customize the page that displays after an access user logs into the Web Configurator to access network services like the Internet. See Chapter 40 on page 689 for more on access user accounts.
Chapter 50 System The following figures identify the parts you can customize in the login and access pages.
Chapter 50 System • Click Color to display a screen of web-safe colors from which to choose. • Enter the name of the desired color. • Enter a pound sign (#) followed by the six-digit hexadecimal number that represents the desired color. For example, use “#000000” for black. • Enter “rgb” followed by red, green, and blue values in parenthesis and separate by commas. For example, use “rgb(0,0,0)” for black.
Chapter 50 System Table 234 Configuration > System > WWW > Login Page LABEL DESCRIPTION Note Message Enter a note to display below the title. Use up to 64 printable ASCII characters. Spaces are allowed. Window Background Set how the window’s background looks. To use a graphic, select Picture and upload a graphic. Specify the location and file name of the logo graphic or click Browse to locate it. Note: Use a GIF, JPG, or PNG of 100 kilobytes or less.
Chapter 50 System 50.6.7.2 Netscape Navigator Warning Messages When you attempt to access the ZyWALL HTTPS server, a Website Certified by an Unknown Authority screen pops up asking if you trust the server certificate. Click Examine Certificate if you want to verify that the certificate is from the ZyWALL. If Accept this certificate temporarily for this session is selected, then click OK to continue in Netscape.
Chapter 50 System • The issuing certificate authority of the ZyWALL’s HTTPS server certificate is not one of the browser’s trusted certificate authorities. The issuing certificate authority of the ZyWALL's factory default certificate is the ZyWALL itself since the certificate is a self-signed certificate. • For the browser to trust a self-signed certificate, import the self-signed certificate into your operating system as a trusted certificate.
Chapter 50 System Apply for a certificate from a Certification Authority (CA) that is trusted by the ZyWALL (see the ZyWALL’s Trusted CA Web Configurator screen). Figure 529 ZyWALL Trusted CA Screen The CA sends you a package containing the CA’s trusted certificate(s), your personal certificate(s) and a password to install the personal certificate(s). 50.6.7.5.1 Installing the CA’s Certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown next.
Chapter 50 System 50.6.7.5.2 Installing Your Personal Certificate(s) You need a password in advance. The CA may issue the password or you may have to specify it during the enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to the one shown next 1 Click Next to begin the wizard. Figure 531 Personal Certificate Import Wizard 1 2 The file name and path of the certificate you double-clicked should automatically appear in the File name text box.
Chapter 50 System 3 Enter the password given to you by the CA. Figure 533 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location.
Chapter 50 System 5 Click Finish to complete the wizard and begin the import process. Figure 535 Personal Certificate Import Wizard 5 6 You should see the following screen when the certificate is correctly installed on your computer. Figure 536 Personal Certificate Import Wizard 6 50.6.7.6 Using a Certificate When Accessing the ZyWALL Example Use the following procedure to access the ZyWALL via HTTPS. 1 Enter ‘https://ZyWALL IP Address/ in your browser’s web address field.
Chapter 50 System 2 When Authenticate Client Certificates is selected on the ZyWALL, the following screen asks you to select a personal certificate to send to the ZyWALL. This screen displays even if you only have a single certificate as in the example. Figure 538 SSL Client Authentication 3 You next see the Web Configurator login screen. Figure 539 Secure Web Configurator Login Screen 50.7 SSH You can use SSH (Secure SHell) to securely access the ZyWALL’s command line interface.
Chapter 50 System SSH is a secure communication protocol that combines authentication and data encryption to provide secure encrypted communication between two hosts over an unsecured network. In the following figure, computer A on the Internet uses SSH to securely connect to the WAN port of the ZyWALL for a management session. Figure 540 SSH Communication Over the WAN Example 50.7.
Chapter 50 System 2 Encryption Method Once the identification is verified, both the client and server must agree on the type of encryption method to use. 3 Authentication and Data Transmission After the identification is verified and data encryption activated, a secure tunnel is established between the client and the server. The client then sends its authentication information (user name and password) to the server to log in to the server. 50.7.
Chapter 50 System Note: It is recommended that you disable Telnet and FTP when you configure SSH for secure connections. Figure 542 Configuration > System > SSH The following table describes the labels in this screen. Table 235 Configuration > System > SSH LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the ZyWALL CLI using this service.
Chapter 50 System Table 235 Configuration > System > SSH (continued) LABEL DESCRIPTION Move To change an entry’s position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. # This the index number of the service control rule. Zone This is the zone on the ZyWALL the user is allowed or denied to access.
Chapter 50 System Enter the password to log in to the ZyWALL. The CLI screen displays next. 50.7.5.2 Example 2: Linux This section describes how to access the ZyWALL using the OpenSSH client program that comes with most Linux distributions. 1 Test whether the SSH service is available on the ZyWALL. Enter “telnet 192.168.1.1 22” at a terminal prompt and press [ENTER]. The computer attempts to connect to port 22 on the ZyWALL (using the default IP address of 192.168.1.1).
Chapter 50 System 50.8.1 Configuring Telnet Click Configuration > System > TELNET to configure your ZyWALL for remote Telnet access. Use this screen to specify from which zones Telnet can be used to manage the ZyWALL. You can also specify from which IP addresses the access can come. Figure 546 Configuration > System > TELNET The following table describes the labels in this screen.
Chapter 50 System Table 236 Configuration > System > TELNET (continued) LABEL DESCRIPTION # This the index number of the service control rule. The entry with a hyphen (-) instead of a number is the ZyWALL’s (nonconfigurable) default policy. The ZyWALL applies this to traffic that does not match any other configured rule. It is not an editable rule. To apply other behavior, configure a rule that traffic will match so the ZyWALL will not have to use the default policy.
Chapter 50 System be used to access the ZyWALL. You can also specify from which IP addresses the access can come. Figure 547 Configuration > System > FTP The following table describes the labels in this screen. Table 237 Configuration > System > FTP LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the ZyWALL using this service.
Chapter 50 System Table 237 Configuration > System > FTP (continued) LABEL DESCRIPTION Move To change an entry’s position in the numbered list, select the method and click Move to display a field to type a number for where you want to put it and press [ENTER] to move the rule to the number that you typed. # This the index number of the service control rule. The entry with a hyphen (-) instead of a number is the ZyWALL’s (nonconfigurable) default policy.
Chapter 50 System and version two (SNMPv2c). The next figure illustrates an SNMP management operation. Figure 548 SNMP Management Model An SNMP managed network consists of two main types of component: agents and a manager. An agent is a management software module that resides in a managed device (the ZyWALL). An agent translates the local management information from the managed device into a form compatible with SNMP.
Chapter 50 System • GetNext - Allows the manager to retrieve the next object variable from a table or list within an agent. In SNMPv1, when a manager wants to retrieve all elements of a table from an agent, it initiates a Get operation, followed by a series of GetNext operations. • Set - Allows the manager to set values for object variables within an agent. • Trap - Used by the agent to inform the manager of some events. 50.10.
Chapter 50 System settings, including from which zones SNMP can be used to access the ZyWALL. You can also specify from which IP addresses the access can come. Figure 549 Configuration > System > SNMP The following table describes the labels in this screen. Table 239 Configuration > System > SNMP LABEL DESCRIPTION Enable Select the check box to allow or disallow the computer with the IP address that matches the IP address(es) in the Service Control table to access the ZyWALL using this service.
Chapter 50 System Table 239 Configuration > System > SNMP (continued) LABEL DESCRIPTION Add Click this to create a new entry. Select an entry and click Add to create a new entry after the selected entry. Refer to Table 233 on page 803 for details on the screen that opens. Edit Double-click an entry or select it and click Edit to be able to modify the entry’s settings. Remove To remove an entry, select it and click Remove. The ZyWALL confirms you want to remove it before doing so.
Chapter 50 System Hang Up check box is selected, the ZyWALL uses this hardware signal to force the WAN device to hang up, in addition to issuing the drop command ATH. Response Strings The response strings tell the ZyWALL the tags, or labels, immediately preceding the various call parameters sent from the serial modem. The response strings have not been standardized; please consult the documentation of your serial modem to find the correct tags. 50.11.
Chapter 50 System Table 240 Configuration > System > Dial-in Mgmt (continued) LABEL DESCRIPTION Port Speed Use the drop-down list box to select the speed of the connection between the ZyWALL’s auxiliary port and the external modem. Available speeds are: 9600, 19200, 38400, 57600, or 115200 bps. Initial String Type the AT command string that the ZyWALL returns to the external serial modem connected to the ZyWALL’s auxiliary port during connection initialization.
Chapter 50 System 50.12.1 Configuring Vantage CNM Vantage CNM is disabled on the device by default. Click Configuration > System > Vantage CNM to configure your device’s Vantage CNM settings. Figure 551 Configuration > System > Vantage CNM The following table describes the labels in this screen. Table 241 Configuration > System > Vantage CNM LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields.
Chapter 50 System Table 241 Configuration > System > Vantage CNM (continued) LABEL DESCRIPTION Transfer Protocol Select whether the Vantage CNM sessions should use regular HTTP connections or secure HTTPS connections. Note: HTTPS is recommended. The Vantage CNM server must use the same setting. Device Management IP Select Auto to have the ZyWALL allow Vantage CNM sessions to connect to any of the ZyWALL’s IP addresses. Custom IP Specify the ZyWALL’s IP address that allows Vantage CNM sessions.
Chapter 50 System 50.13 Language Screen Click Configuration > System > Language to open the following screen. Use this screen to select a display language for the ZyWALL’s Web Configurator screens. Figure 552 Configuration > System > Language The following table describes the labels in this screen. Table 242 Configuration > System > Language 832 LABEL DESCRIPTION Language Setting Select a display language for the ZyWALL’s Web Configurator screens.
CHAPTER 51 Log and Report 51.1 Overview Use these screens to configure daily reporting and log settings. 51.1.1 What You Can Do In this Chapter • Use the Email Daily Report screen (Section 51.2 on page 833) to configure where and how to send daily reports and what reports to send. • Use the Maintenance > Log Setting screens (Section 51.3 on page 835) to specify which log messages are e-mailed, where they are e-mailed, and how often they are e-mailed. 51.
Chapter 51 Log and Report Click Configuration > Log & Report > Email Daily Report to display the following screen. Configure this screen to have the ZyWALL e-mail you system statistics every day.
Chapter 51 Log and Report The following table describes the labels in this screen. Table 243 Configuration > Log & Report > Email Daily Report LABEL DESCRIPTION Enable Email Daily Report Select this to send reports by e-mail every day. Mail Server Type the name or IP address of the outgoing SMTP server. Mail Subject Type the subject line for the outgoing e-mail. Select Append system name to add the ZyWALL’s system name to the subject.
Chapter 51 Log and Report The Log Setting tab also controls what information is saved in each log. For the system log, you can also specify which log messages are e-mailed, where they are e-mailed, and how often they are e-mailed. For alerts, the Log Settings tab controls which events generate alerts and where alerts are e-mailed. The Log Settings Summary screen provides a summary of all the settings.
Chapter 51 Log and Report Table 244 Configuration > Log & Report > Log Setting (continued) LABEL DESCRIPTION # This field is a sequential value, and it is not associated with a specific log. Name This field displays the name of the log (system log or one of the remote servers). Log Format This field displays the format of the log. Internal - system log; you can view the log on the View Log tab. VRPT/Syslog - ZyXEL’s Vantage Report, syslog-compatible format.
Chapter 51 Log and Report Figure 555 Configuration > Log & Report > Log Setting > Edit (System Log) 838 ZyWALL USG 2000 User’s Guide
Chapter 51 Log and Report The following table describes the labels in this screen. Table 245 Configuration > Log & Report > Log Setting > Edit (System Log) LABEL DESCRIPTION E-Mail Server 1/2 Active Select this to send log messages and alerts according to the information in this section. You specify what kinds of log messages are included in log information and what kinds of log messages are included in alerts in the Active Log and Alert section.
Chapter 51 Log and Report Table 245 Configuration > Log & Report > Log Setting > Edit (System Log) LABEL E-mail Server 1 DESCRIPTION Use the E-Mail Server 1 drop-down list to change the settings for e-mailing logs to e-mail server 1 for all log categories. Using the System Log drop-down list to disable all logs overrides your e-mail server 1 settings. enable normal logs (green check mark) - e-mail log messages for all categories to e-mail server 1.
Chapter 51 Log and Report Table 245 Configuration > Log & Report > Log Setting > Edit (System Log) LABEL DESCRIPTION Active Select this to activate log consolidation. Log consolidation aggregates multiple log messages that arrive within the specified Log Consolidation Interval. In the View Log tab, the text “[count=x]”, where x is the number of original log messages, is appended at the end of the Message field, when multiple log messages were aggregated.
Chapter 51 Log and Report 51.3.3 Edit Remote Server Log Settings The Log Settings Edit screen controls the detailed settings for each log in the remote server (syslog). Go to the Log Settings Summary screen (see Section 51.3.1 on page 836), and click a remote server Edit icon.
Chapter 51 Log and Report The following table describes the labels in this screen. Table 246 Configuration > Log & Report > Log Setting > Edit (Remote Server) LABEL DESCRIPTION Log Settings for Remote Server Active Select this check box to send log information according to the information in this section. You specify what kinds of messages are included in log information in the Active Log section. Log Format This field displays the format of the log information. It is read-only.
Chapter 51 Log and Report 51.3.4 Active Log Summary Screen The Active Log Summary screen allows you to view and to edit what information is included in the system log, e-mail profiles, and remote servers at the same time. It does not let you change other log settings (for example, where and how often log information is e-mailed or remote server names).To access this screen, go to the Log Settings Summary screen (see Section 51.3.1 on page 836), and click the Active Log Summary button.
Chapter 51 Log and Report The following table describes the fields in this screen. Table 247 Configuration > Log & Report > Log Setting > Active Log Summary LABEL DESCRIPTION System log Use the System Log drop-down list to change the log settings for all of the log categories. disable all logs (red X) - do not log any information for any category for the system log or e-mail any logs to e-mail server 1 or 2.
Chapter 51 Log and Report Table 247 Configuration > Log & Report > Log Setting > Active Log Summary LABEL DESCRIPTION System log Select which events you want to log by Log Category.
CHAPTER 52 File Manager 52.1 Overview Configuration files define the ZyWALL’s settings. Shell scripts are files of commands that you can store on the ZyWALL and run when you need them. You can apply a configuration file or run a shell script without the ZyWALL restarting. You can store multiple configuration files and shell script files on the ZyWALL. You can edit configuration files or shell scripts in a text editor and upload them to the ZyWALL. Configuration files use a .
Chapter 52 File Manager These files have the same syntax, which is also identical to the way you run CLI commands manually. An example is shown below. Figure 558 Configuration File / Shell Script: Example # enter configuration mode configure terminal # change administrator password username admin password 4321 user-type admin # configure ge3 interface ge3 ip address 172.23.37.240 255.255.255.0 ip gateway 172.23.37.
Chapter 52 File Manager Your configuration files or shell scripts can use “exit” or a command line consisting of a single “!” to have the ZyWALL exit sub command mode. Note: “exit” or “!'” must follow sub commands if it is to make the ZyWALL exit sub command mode. Line 3 in the following example exits sub command mode. interface ge1 ip address dhcp ! Lines 1 and 3 in the following example are comments and line 4 exits sub command mode.
Chapter 52 File Manager 52.2 The Configuration File Screen Click Maintenance > File Manager > Configuration File to open the Configuration File screen. Use the Configuration File screen to store, run, and name configuration files. You can also download configuration files from the ZyWALL to your computer and upload configuration files from your computer to the ZyWALL.
Chapter 52 File Manager The following table describes the labels in this screen. Table 249 Maintenance > File Manager > Configuration File LABEL DESCRIPTION Rename Use this button to change the label of a configuration file on the ZyWALL. You can only rename manually saved configuration files. You cannot rename the lastgood.conf, system-default.conf and startupconfig.conf files. You cannot rename a configuration file to the name of another configuration file in the ZyWALL.
Chapter 52 File Manager Table 249 Maintenance > File Manager > Configuration File (continued) LABEL DESCRIPTION Copy Use this button to save a duplicate of a configuration file on the ZyWALL. Click a configuration file’s row to select it and click Copy to open the Copy File screen. Figure 561 Maintenance > File Manager > Configuration File > Copy Specify a name for the duplicate configuration file. Use up to 25 characters (including a-zA-Z0-9;‘~!@#$%^&()_+[]{}’,.=-).
Chapter 52 File Manager Table 249 Maintenance > File Manager > Configuration File (continued) LABEL DESCRIPTION Apply Use this button to have the ZyWALL use a specific configuration file. Click a configuration file’s row to select it and click Apply to have the ZyWALL use that configuration file. The ZyWALL does not have to restart in order to use a different configuration file, although you will need to wait for a few minutes while the system reconfigures.
Chapter 52 File Manager Table 249 Maintenance > File Manager > Configuration File (continued) LABEL DESCRIPTION File Name This column displays the label that identifies a configuration file. You cannot delete the following configuration files or change their file names. The system-default.conf file contains the ZyWALL’s default settings. Select this file and click Apply to reset all of the ZyWALL settings to the factory defaults. This configuration file is included when you upload a firmware package.
Chapter 52 File Manager Note: The Web Configurator is the recommended method for uploading firmware. You only need to use the command line interface if you need to recover the firmware. See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it. Find the firmware package at www.zyxel.com in a file that (usually) uses the system model name with a .bin extension, for example, “zywall.bin”.
Chapter 52 File Manager After you see the Firmware Upload in Process screen, wait two minutes before logging into the ZyWALL again. Figure 564 Firmware Upload In Process Note: The ZyWALL automatically reboots after a successful upload. The ZyWALL automatically restarts causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop.
Chapter 52 File Manager Note: You should include write commands in your scripts. If you do not use the write command, the changes will be lost when the ZyWALL restarts. You could use multiple write commands in a long script. Figure 567 Maintenance > File Manager > Shell Script Each field is described in the following table. Table 251 Maintenance > File Manager > Shell Script LABEL DESCRIPTION Rename Use this button to change the label of a shell script file on the ZyWALL.
Chapter 52 File Manager Table 251 Maintenance > File Manager > Shell Script (continued) LABEL DESCRIPTION Copy Use this button to save a duplicate of a shell script file on the ZyWALL. Click a shell script file’s row to select it and click Copy to open the Copy File screen. Figure 569 Maintenance > File Manager > Shell Script > Copy Specify a name for the duplicate file. Use up to 25 characters (including a-zAZ0-9;‘~!@#$%^&()_+[]{}’,.=-).
CHAPTER 53 Diagnostics 53.1 Overview Use the diagnostics screens for troubleshooting. 53.1.1 What You Can Do in this Chapter • Use the Maintenance > Diagnostics screen (see Section 53.2 on page 859) to generate a file containing the ZyWALL’s configuration and diagnostic information if you need to provide it to customer support during troubleshooting. • Use the Maintenance > Diagnostics > Packet Capture screens (see Section 53.3 on page 860) to capture packets going through the ZyWALL. 53.
Chapter 53 Diagnostics The following table describes the labels in this screen. Table 252 Maintenance > Diagnostics LABEL DESCRIPTION Filename This is the name of the most recently created diagnostic file. Last modified This is the date and time that the last diagnostic file was created. The format is yyyy-mm-dd hh:mm:ss. Size This is the size of the most recently created diagnostic file. Collect Now Click this to have the ZyWALL create a new diagnostic file.
Chapter 53 Diagnostics The following table describes the labels in this screen. Table 253 Maintenance > Diagnostics > Packet Capture LABEL DESCRIPTION Interfaces Enabled interfaces (except for virtual interfaces) appear under Available Interfaces. Select interfaces for which to capture packets and click the right arrow button to move them to the Capture Interfaces list. Use the [Shift] and/or [Ctrl] key to select multiple objects. IP Type Select the protocol of traffic for which to capture packets.
Chapter 53 Diagnostics Table 253 Maintenance > Diagnostics > Packet Capture (continued) LABEL DESCRIPTION Capture Click this button to have the ZyWALL capture packets according to the settings configured in this screen. You can configure the ZyWALL while a packet capture is in progress although you cannot modify the packet capture settings. The ZyWALL’s throughput or performance may be affected while a packet capture is in progress.
Chapter 53 Diagnostics Table 254 Maintenance > Diagnostics > Packet Capture > Files (continued) LABEL DESCRIPTION # This column displays the number for each packet capture file entry. The total number of packet capture files that you can save depends on the file sizes and the available flash storage space. File Name This column displays the label that identifies the file. The file name format is interface name-file suffix.cap. Size This column displays the size (in bytes) of a configuration file.
Chapter 53 Diagnostics 864 ZyWALL USG 2000 User’s Guide
CHAPTER 54 Reboot 54.1 Overview Use this to restart the device (for example, if the device begins behaving erratically). See also Section 1.5 on page 41 for information on different ways to start and stop the ZyWALL. 54.1.1 What You Need To Know If you applied changes in the Web configurator, these were saved automatically and do not change when you reboot. If you made changes in the CLI, however, you have to use the write command to save the configuration before you reboot.
Chapter 54 Reboot 866 ZyWALL USG 2000 User’s Guide
CHAPTER 55 Shutdown 55.1 Overview Use this to shutdown the device in preparation for disconnecting the power. See also Section 1.5 on page 41 for information on different ways to start and stop the ZyWALL. Always use Maintenance > Shutdown > Shutdown or the shutdown command before you turn off the ZyWALL or remove the power. Not doing so can cause the firmware to become corrupt. 55.1.1 What You Need To Know Shutdown writes all cached data to the local storage and stops the system processes. 55.
Chapter 55 Shutdown 868 ZyWALL USG 2000 User’s Guide
CHAPTER 56 Troubleshooting This chapter offers some suggestions to solve problems you might encounter. • You can also refer to the logs (see Chapter 10 on page 261). For individual log descriptions, Appendix A on page 899. For the order in which the ZyWALL applies its features and checks, see Section 6.4 on page 100. None of the LEDs turn on. ZyWALLMake sure that you have both power cords connected to the ZyWALL and plugged into appropriate power sources.
Chapter 56 Troubleshooting • Ping the ZyWALL from a LAN computer. Make sure your computer’s Ethernet card is installed and functioning properly. Also make sure that its IP address is in the same subnet as the ZyWALL’s. • In the computer, click Start, (All) Programs, Accessories and then Command Prompt. In the Command Prompt window, type "ping" followed by the ZyWALL’s LAN IP address (192.168.1.1 is the default) and then press [ENTER]. The ZyWALL should reply.
Chapter 56 Troubleshooting I cannot update the IDP/application patrol signatures. • Make sure your ZyWALL has the IDP/application patrol service registered and that the license is not expired. Purchase a new license if the license is expired. • Make sure your ZyWALL is connected to the Internet. I downloaded updated anti-virus or IDP/application patrol signatures. Why has the ZyWALL not re-booted yet? The ZyWALL does not have to reboot when you upload new signatures.
Chapter 56 Troubleshooting The ZyWALL checks the firewall rules in the order that they are listed. So make sure that your custom firewall rule comes before any other rules that the traffic would also match. I cannot enter the interface name I want. • The format of interface names other than the Ethernet interface names is very strict. Each name consists of 2-4 letters (interface type), followed by a number (x, limited by the maximum number of each type of interface).
Chapter 56 Troubleshooting The data rates through my cellular connection are no-where near the rates I expected. The actual cellular data rate you obtain varies depending on the cellular device you use, the signal strength to the service provider’s base station, and so on. created a cellular interface but cannot connect through it. • Make sure you have a compatible 3G device installed or connected. See Chapter 57 on page 891 for details. • Make sure you have the cellular interface enabled.
Chapter 56 Troubleshooting The ZyWALL is not applying my application patrol bandwidth management settings. Bandwidth management in policy routes has priority over application patrol bandwidth management. The ZyWALL’s performance slowed down after I configured many new application patrol entries. The ZyWALL checks the ports and conditions configured in application patrol entries in the order they appear in the list.
Chapter 56 Troubleshooting The ZyWALL’s performance seems slower after configuring IDP. Depending on your network topology and traffic load, binding every packet direction to an IDP profile may affect the ZyWALL’s performance. You may want to focus IDP scanning on certain traffic directions such as incoming traffic. IDP is dropping traffic that matches a rule that says no action should be taken. The ZyWALL checks all signatures and continues searching even after a match is found.
Chapter 56 Troubleshooting The ZyWALL routes and applies SNAT for traffic from some interfaces but not from others. The ZyWALL automatically uses SNAT for traffic it routes from internal interfaces to external interfaces. For example LAN to WAN traffic. You must manually configure a policy route to add routing and SNAT settings for an interface with the Interface Type set to General.
Chapter 56 Troubleshooting I cannot get the application patrol to manage H.323 traffic. Make sure you have the H.323 ALG enabled. I cannot get the application patrol to manage FTP traffic. Make sure you have the FTP ALG enabled. The ZyWALL keeps resetting the connection. If an alternate gateway on the LAN has an IP address in the same subnet as the ZyWALL’s LAN IP address, return traffic may not go through the ZyWALL. This is called an asymmetrical or “triangle” route.
Chapter 56 Troubleshooting • The ZyWALL and remote IPSec router must use the same authentication method to establish the IKE SA. • Both routers must use the same negotiation mode. • Both routers must use the same encryption algorithm, authentication algorithm, and DH key group. • When using manual keys, the ZyWALL and remote IPSec router must use the same encryption key and authentication key. • When using pre-shared keys, the ZyWALL and the remote IPSec router must use the same pre-shared key.
Chapter 56 Troubleshooting of its Trusted Certificates to authenticate the remote IPSec router’s certificate. The trusted certificate can be the remote IPSec router’s self-signed certificate or that of a trusted CA that signed the remote IPSec router’s certificate. • Multiple SAs connecting through a secure gateway must have the same negotiation mode. I cannot set up an L2TP VPN tunnel. • Make sure you have configured L2TP correctly on the remote user computers. See Section 8.5 on page 175 for examples.
Chapter 56 Troubleshooting I uploaded a logo to show in the SSL VPN user screens but it does not display properly. The logo graphic must be GIF, JPG, or PNG format. The graphic should use a resolution of 127 x 57 pixels to avoid distortion when displayed. The ZyWALL automatically resizes a graphic of a different resolution to 127 x 57 pixels. The file size must be 100 kilobytes or less. Transparent background is recommended. I logged into the SSL VPN but cannot see some of the resource links.
Chapter 56 Troubleshooting decompressed option while you download the firmware package. See Section 33.2.1 on page 553 for more on the anti-virus Destroy compressed files that could not be decompressed option. I changed the LAN IP address and can no longer access the Internet. The ZyWALL automatically updates address objects based on an interface’s IP address, subnet, or gateway if the interface’s IP address settings change.
Chapter 56 Troubleshooting • You may need to disable STP (Spanning Tree Protocol). • The master and its backups must all use the same device HA mode (either active-passive or legacy). • Configure a static IP address for each interface that you will have device HA monitor. • Configure a separate management IP address for each interface. You can use it to access the ZyWALL for management whether the ZyWALL is the master or a backup.
Chapter 56 Troubleshooting I cannot add the admin users to a user group with access users. You cannot put access users and admin users in the same user group. I cannot add the default admin account to a user group. You cannot put the default admin account into any user group. I cannot get the device HA synchronization to work. Only ZyWALLs of the same model and firmware version can synchronize. Device HA synchronization is not working for subscription services.
Chapter 56 Troubleshooting 2 You must remove any spaces from the certificate’s filename before you can import the certificate. 3 Any certificate that you want to import has to be in one of these file formats: • Binary X.509: This is an ITU-T recommendation that defines the formats for X.509 certificates. • PEM (Base-64) encoded X.509: This Privacy Enhanced Mail format uses lowercase letters, uppercase letters and numerals to convert a binary X.509 certificate into a printable form.
Chapter 56 Troubleshooting I uploaded a logo to use as the screen or window background but it does not display properly. Make sure the logo file is a GIF, JPG, or PNG of 100 kilobytes or less. The ZyWALL’s traffic throughput rate decreased after I started collecting traffic statistics. Data collection may decrease the ZyWALL’s traffic throughput rate. I can only see newer logs. Older logs are missing.
Chapter 56 Troubleshooting See the CLI Reference Guide for how to determine if you need to recover the firmware and how to recover it. My packet capture captured less than I wanted or failed. The packet capture screen’s File Size sets a maximum size limit for the total combined size of all the capture files on the ZyWALL, including any existing capture files and any new capture files you generate. If you have existing capture files you may need to set this size larger or delete existing capture files.
Chapter 56 Troubleshooting 2 Press the RESET button and hold it until the SYS LED begins to blink. (This usually takes about five seconds.) 3 Release the RESET button, and wait for the ZyWALL to restart. You should be able to access the ZyWALL using the default settings. 56.2 Changing a Power Module The ZyWALL has two power modules. It can continue operating on a single power module if one fails. The power modules are near the top of the front panel of the main chassis.
Chapter 56 Troubleshooting 5 Use the handle to slide out the power module and remove it. Figure 577 Removing the Power Module 6 Install the new ZyWALL power module. Figure 578 Installing the Replacement Power Module 7 Tighten the power module’s retaining screw.
Chapter 56 Troubleshooting 8 Connect the power cord to the new ZyWALL power module. 9 Reconnect the power cord to the power outlet. 10 Push the ZyWALL power module switch to the on position. 56.3 Getting More Troubleshooting Help Search for support information for your model at www.zyxel.com for more troubleshooting suggestions.
Chapter 56 Troubleshooting 890 ZyWALL USG 2000 User’s Guide
CHAPTER 57 Product Specifications The following specifications are subject to change without notice. See Chapter 2 on page 43 for a general overview of key features. This table provides basic device specifications. Table 255 Default Login Information ATTRIBUTE SPECIFICATION Default IP Address (ge1) 192.168.1.1 Default Subnet Mask (ge1) 255.255.255.0 (24 bits) Default Password 1234 This table provides hardware specifications.
Chapter 57 Product Specifications Table 256 Hardware Specifications (continued) FEATURE SPECIFICATION AUX port RS-232, DB9M connector USB Slots 2, 2.0 plug and play Compatible USB Cards (3G) Huawei: E220, E270, E160, E169, E800, and E180 HDD Slot Slot for an optional 2.5” SATA hard drive (reserved for future use) Extension Card Slot 2 Slots for optional hardware accessories 2 PCMCIA slots for a cellular (3G) card.
Chapter 57 Product Specifications Table 257 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.
Chapter 57 Product Specifications Table 257 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.
Chapter 57 Product Specifications Table 257 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.
Chapter 57 Product Specifications Table 257 ZyWALL USG 2000 Feature Specifications (continued) VERSION # V2.10 V2.11, V2.12 V2.
Chapter 57 Product Specifications Table 258 Standards Referenced by Features (continued) FEATURE STANDARDS REFERENCED Built-in service, DNS server RFCs 1034, 1035, 1123, 1183, 1535, 1536, 1706, 1712, 1750, 1876, 1982, 1995, 1996, 2136, 2163, 2181, 2230, 2308, 2535, 2536, 2537, 2538, 2539, 2671, 2672, 2673, 2782, 3007, 3090 Built-in service, DHCP server RFCs 1542, 2131, 2132, 2485, 2489 Built-in service, HTTP server RFCs 1945, 2616, 2965, 2732, 2295 Built-in service, SNMP agent RFCs 1067, 1213, 257
Chapter 57 Product Specifications 898 ZyWALL USG 2000 User’s Guide
APPENDIX A Log Descriptions This appendix provides descriptions of example log messages for the ZLD-based ZyWALLs. The logs do not all apply to all of the ZLD-based ZyWALLs. You will not necessecarily see all of these logs in your device. Table 259 Content Filter Logs LOG MESSAGE DESCRIPTION Content filter has been enabled An administrator turned the content filter on. Content filter has been disabled An administrator turned the content filter off.
Appendix A Log Descriptions Table 261 Blocked Web Site Logs LOG MESSAGE DESCRIPTION %s :%s The rating server responded that the web site is in a specified category and access was blocked according to a content filter profile. 1st %s: website host 2nd %s: website category %s: Unrated The rating server responded that the web site cannot be categorized and access was blocked according to a content filter profile.
Appendix A Log Descriptions Table 261 Blocked Web Site Logs (continued) LOG MESSAGE DESCRIPTION %s: Proxy mode is detected The system detected a proxy connection and blocked access according to a profile. %s: website host %s: Forbidden Web site The web site is in forbidden web site list. %s: website host %s: Keyword blocking The web content matched a user defined keyword.
Appendix A Log Descriptions Table 262 Anti-Spam Logs (continued) 902 LOG MESSAGE DESCRIPTION Black List checking has been activated. The anti-spam black list has been turned on. Black List checking has been deactivated. The anti-spam black list has been turned off. Black List rule %d has been added. The anti-spam black list rule with the specified index number (%d) has been added. Black List rule %d has been modified.
Appendix A Log Descriptions Table 263 SSL VPN Logs LOG MESSAGE DESCRIPTION %s %s from %s has logged in SSLVPN A user has logged into SSL VPN. The first %s is the type of user account. The second %s is the user’s user name. The third %s is the name of the service the user is using (HTTP or HTTPS). %s %s from %s has logged out SSLVPN A user has logged out of SSL VPN. The first %s is the type of user account. The second %s is the user’s user name.
Appendix A Log Descriptions Table 263 SSL VPN Logs (continued) 904 LOG MESSAGE DESCRIPTION The %s address-object is wrong type for 'network' in SSL Policy %s. The listed address object (first %s) is not the right kind to be specified as a network in the listed SSL VPN policy (second %s). The SSL VPN policy %s has been changed 'ippool' value. The IP pool setting has been modified in the specified SSL VPN policy (%s). The SSL VPN policy %s has been changed '1stdns' value.
Appendix A Log Descriptions Table 263 SSL VPN Logs (continued) LOG MESSAGE DESCRIPTION %s %s is accessed. sent= rcvd= The listed SSL VPN access was used to send and receive the listed numbers of bytes. The first %s is the type of SSL VPN access (web application, file sharing, or network extension). The second %s is the name of the application. This is N/A for a network extension.
Appendix A Log Descriptions Table 264 L2TP Over IPSec Logs 906 LOG MESSAGE DESCRIPTION The configuration of L2TP over IPSec has been changed. The L2TP over IPSec configuration has been modified. L2TP over IPSec may not work since Crypto Map %s using Manual Key. L2TP over IPSec does not support manual key management. L2TP over IPSec may not work because the IPSec VPN connection it uses (Crypto Map %s) has been set to use manual key management.
Appendix A Log Descriptions The ZySH logs deal with internal system errors. Table 265 ZySH Logs LOG MESSAGE DESCRIPTION Invalid message queue. Maybe someone starts another zysh daemon.
Appendix A Log Descriptions Table 265 ZySH Logs (continued) LOG MESSAGE DESCRIPTION Can't remove %s 1st:zysh list name Table OPS 908 %s: cannot retrieve entries from table! 1st:zysh table name %s: index is out of range! 1st:zysh table name %s: cannot set entry #%d 1st:zysh table name,2st: zysh entry num %s: table is full! 1st:zysh table name %s: invalid old/new index! 1st:zysh table name Unable to move entry #%d! 1st:zysh entry num %s: invalid index! 1st:zysh table name Unable to delete
Appendix A Log Descriptions Table 266 ADP Logs LOG MESSAGE DESCRIPTION from to [type=] , Action: , Severity: The ZyWALL detected an anomaly in traffic traveling between the specified zones. The = {scan-detection() | flooddetection() | http-inspection() | tcpdecoder()}. The gives details about the attack, although the message is dropped if the log is more than 128 characters.
Appendix A Log Descriptions Table 267 Anti-Virus Logs LOG MESSAGE DESCRIPTION Initializing Anti-Virus signature reference table has failed. The ZyWALL failed to initialize the anti-virus signatures due to an internal error. Reloading Anti-Virus signature database has failed. The ZyWALL failed to reload the anti-virus signatures due to an internal error. Reloading Anti-Virus signature reference table has failed. The ZyWALL failed to reload the anti-virus signatures due to an internal error.
Appendix A Log Descriptions Table 267 Anti-Virus Logs (continued) LOG MESSAGE DESCRIPTION AV signature update has failed. Can not update last update time. The anti-virus signatures update did not succeed. AV signature update has failed. (Replacement failure) Anti-virus signatures update failed because the ZyWALL was not able to replace the old set of anti-virus signatures with the new one. AV signature update has failed. (Unknown signature package).
Appendix A Log Descriptions Table 267 Anti-Virus Logs (continued) LOG MESSAGE DESCRIPTION Anti-Virus rule %d has been modified. The anti-virus rule of the specified number has been changed. Anti-Virus rule %d has been inserted. An anti-virus rule has been inserted. %d is the number of the new rule. Anti-Virus rule %d has been appended. The anti-virus rule with the listed number (%d) has been added to the end of the list.
Appendix A Log Descriptions Table 268 User Logs LOG MESSAGE DESCRIPTION %s %s from %s has logged in ZyWALL A user logged into the ZyWALL. 1st %s: The type of user account. 2nd %s: The user’s user name. 3rd %s: The name of the service the user is using (HTTP, HTTPS, FTP, Telnet, SSH, or console). %s %s from %s has logged out ZyWALL A user logged out of the ZyWALL. 1st %s: The type of user account. 2nd %s: The user’s user name.
Appendix A Log Descriptions Table 268 User Logs (continued) LOG MESSAGE DESCRIPTION Failed login attempt to ZyWALL from %s (login on a lockout address) A login attempt came from an IP address that the ZyWALL has locked out. Failed login attempt to ZyWALL from %s (reach the max. number of user) The ZyWALL blocked a login because the maximum login capacity for the particular service has already been reached. Failed login attempt to ZyWALL from %s (reach the max.
Appendix A Log Descriptions Table 269 myZyXEL.com Logs (continued) LOG MESSAGE DESCRIPTION Registration has failed. Because of lack must fields. The device received an incomplete response from the myZyXEL.com server and it caused a parsing error for the device. %s:Trial service activation has failed:%s. Trail service activation failed for the specified service, an error message returned by the MyZyXEL.com server will be appended to this log.
Appendix A Log Descriptions Table 269 myZyXEL.com Logs (continued) 916 LOG MESSAGE DESCRIPTION Do device register. The device started device registration. Do trial service activation. The device started trail service activation. Do standard service activation. The device started standard service activation. Do expiration check. The device started the service expiration day check. Build query message has failed. Some information was missing in the packets that the device sent to the MyZyXEL.
Appendix A Log Descriptions Table 269 myZyXEL.com Logs (continued) LOG MESSAGE DESCRIPTION Device has latest signature file; no need to update The device already has the latest version of the signature file so no update is needed. Connect to update server has failed. The device cannot connect to the update server. Wrong format for packets received. The device cannot parse the response returned by the server. Maybe some required fields are missing. Server setting error. Update stop.
Appendix A Log Descriptions Table 269 myZyXEL.com Logs (continued) LOG MESSAGE DESCRIPTION Get server response has failed. The device sent packets to the server, but did not receive a response. The root cause may be that the connection is abnormal. Expiration dailycheck has failed:%s. The daily check for service expiration failed, an error message returned by the MyZyXEL.com server will be appended to this log. %s: error message returned by myZyXEL.com server 918 Do expiration dailycheck has failed.
Appendix A Log Descriptions Table 269 myZyXEL.com Logs (continued) LOG MESSAGE DESCRIPTION Self signed certificate. Verification of a server’s certificate failed because it is selfsigned. Self signed certificate in certificate chain. Verification of a server’s certificate failed because there is a self-signed certificate in the server’s certificate chain. Verify peer certificates has succeeded. The device verified a server’s certificate while processing an HTTPS connection.
Appendix A Log Descriptions Table 270 IDP Logs (continued) 920 LOG MESSAGE DESCRIPTION Enable IDP engine succeeded. The device turned on the IDP engine. Disable IDP engine succeeded. The device turned off the IDP engine. IDP service is not registered. IDP will not be activated. The IDP service could has not been turned on and the IDP signatures will not be updated because the IDP service is not registered. IDP service standard license is expired. Update signature failed.
Appendix A Log Descriptions Table 270 IDP Logs (continued) LOG MESSAGE DESCRIPTION Add custom signature error: signature is over length. An attempt to add a custom IDP signature failed because the signature’s contents were too long. Edit custom signature error: signature is over length. An attempt to edit a custom IDP signature failed because the signature’s contents were too long. IDP off-line update failed. File damaged. An update attempt for the IDP signatures failed.
Appendix A Log Descriptions Table 270 IDP Logs (continued) LOG MESSAGE DESCRIPTION from to [type=] , Action: , Severity: The ZyWALL detected an intrusion in traffic traveling between the specified zones. The = {scan-detection() | flooddetection() | http-inspection() | tcpdecoder()}. The gives details about the attack, although the message is dropped if the log is more than 128 characters.
Appendix A Log Descriptions Table 270 IDP Logs (continued) LOG MESSAGE DESCRIPTION Duplicate sid in import file at line . The listed signature ID is duplicated at the listed line number in the signature file. IDP rule has been deleted. The listed IDP rule has been removed. IDP rule has been moved to . The IDP rule with the specified index number (first num) was moved to the specified index number (second num). New IDP rule has been appended.
Appendix A Log Descriptions Table 271 Application Patrol (continued) MESSAGE EXPLANATION Protocol %s has been enabled. The listed protocol has been turned on in the application patrol. Protocol %s has been disabled. The listed protocol has been turned off in the application patrol. Classification mode of protocol %s has been modified to portless. The device will now use the portless classification mode to identify the listed protocol’s traffic.
Appendix A Log Descriptions Table 272 IKE Logs LOG MESSAGE DESCRIPTION Peer has not announced DPD capability The remote IPSec router has not announced its dead peer detection (DPD) capability to this device. [COOKIE] Invalid cookie, no sa found Cannot find SA according to the cookie. [DPD] No response from peer. Using existing Phase-1 SA in %u seconds. Trying with Phase-1 rekey. The device’s DPD feature has not detected a response from the remote IPSec router. %u is the retry time.
Appendix A Log Descriptions Table 272 IKE Logs (continued) LOG MESSAGE DESCRIPTION [SA] : Tunnel [%s] Phase 1 invalid protocol %s is the tunnel name. When negotiating Phase-1, the packet was not a ISKAMP packet in the protocol field. [SA] : Tunnel [%s] Phase 1 invalid transform %s is the tunnel name. When negotiating Phase-1, the transform ID was invalid. [SA] : Tunnel [%s] Phase 1 key group mismatch %s is the tunnel name.
Appendix A Log Descriptions Table 272 IKE Logs (continued) LOG MESSAGE DESCRIPTION Could not dial manual key tunnel "%s" %s is the tunnel name. The manual key tunnel cannot be dialed. DPD response with invalid ID When receiving a DPD response with invalid ID ignored. DPD response with no active request When receiving a DPD response with no active query. IKE Packet Retransmit When retransmitting the IKE packets. Phase 1 IKE SA process done When Phase 1 negotiation is complete.
Appendix A Log Descriptions Table 272 IKE Logs (continued) LOG MESSAGE DESCRIPTION VPN gateway %s was enabled %s is the gateway name. An administrator enabled the VPN gateway. XAUTH fail! My name: %s %s is the my xauth name. This indicates that my name is invalid. XAUTH fail! Remote user: %s %s is the remote xauth name. This indicates that a remote user’s name is invalid. XAUTH succeed! My name: %s %s is the my xauth name. This indicates that my name is valid.
Appendix A Log Descriptions Table 273 IPSec Logs (continued) LOG MESSAGE DESCRIPTION Get outbound transform fail When outgoing packet need to be transformed, the engine cannot obtain the transform context. Inbound transform operation fail After encryption or hardware accelerated processing, the hardware accelerator dropped a packet (resource shortage, corrupt packet, invalid MAC, and so on).
Appendix A Log Descriptions Table 274 Firewall Logs (continued) LOG MESSAGE DESCRIPTION Firewall %s %s rule %d was %s. 1st %s is from zone, 2nd %s is to zone, %d is the index of the rule 3rd %s is appended/inserted/modified Firewall %s %s rule %d has been moved to %d. 1st %s is from zone, 2nd %s is to zone, 1st %d is the old index of the rule 2nd %d is the new index of the rule Firewall %s %s rule %d has been deleted.
Appendix A Log Descriptions Table 276 Policy Route Logs (continued) LOG MESSAGE DESCRIPTION The policy route %d Use an empty object group. uses empty user group! %d: the policy route rule number The policy route %d uses empty source address group! Use an empty object group. The policy route %d uses empty destination address group! Use an empty object group. The policy route %d uses empty service group Use an empty object group. Policy-route rule %d was inserted. Rules is inserted into system.
Appendix A Log Descriptions Table 277 Built-in Services Logs (continued) LOG MESSAGE DESCRIPTION HTTPS port has been changed to port %s. An administrator changed the port number for HTTPS. HTTPS port has been changed to default port. An administrator changed the port number for HTTPS back to the default (443). HTTP port has changed to port %s. An administrator changed the port number for HTTP. HTTP port has changed to default port.
Appendix A Log Descriptions Table 277 Built-in Services Logs (continued) LOG MESSAGE DESCRIPTION Console baud has been reset to %d. An administrator changed the console port baud rate back to the default (115200). %d is default baud rate DHCP Server on Interface %s will not work due to Device HA status is Stand-By If interface is stand-by mode for device HA, DHCP server can't be run. Otherwise it has conflict with the interface in master mode.
Appendix A Log Descriptions Table 277 Built-in Services Logs (continued) LOG MESSAGE DESCRIPTION DNS access control rule %u has been moved to %d. An administrator moved the rule %u to index %d. %u is previous index %d variable is current index The default record of Zone Forwarder have reached the maximum number of 128 DNS servers. The default record DNS servers is more than 128. Interface %s ping check is successful. Zone Forwarder adds DNS servers in records. Ping check ok, add DNS servers in bind.
Appendix A Log Descriptions Table 277 Built-in Services Logs (continued) LOG MESSAGE DESCRIPTION Access control rule %u of %s was modified. An access control rule was modified successfully. %u is the index of the access control rule. %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET. Access control rule %u of %s was deleted. An access control rule was removed successfully. %u is the index of the access control rule. %s is HTTP/HTTPS/SSH/SNMP/FTP/TELNET.
Appendix A Log Descriptions Table 278 System Logs (continued) LOG MESSAGE DESCRIPTION DHCP Server executed with cautious mode disabled DHCP Server executed with cautious mode disabled. Received packet is not A packet was received but it is not an ARP response packet. an ARP response packet 936 Receive an ARP response The device received an ARP response. Receive ARP response from %s (%s) The device received an ARP response from the listed source.
Appendix A Log Descriptions Table 278 System Logs (continued) LOG MESSAGE DESCRIPTION Device is rebooted by administrator! An administrator restarted the device. Insufficient memory. Cannot allocate system memory. Connect to dyndns server has failed. Cannot connect to members.dyndns.org to update DDNS. Update the profile %s has failed because of strange server response. Update profile failed because the response was strange, %s is the profile name.
Appendix A Log Descriptions Table 278 System Logs (continued) LOG MESSAGE DESCRIPTION Update the profile %s has failed because the feature requested is only available to donators. Update profile failed because the feature requested is only available to donators, %s is the profile name. Update the profile %s has failed because of error response. Update profile failed because the response is incorrect, %s is the profile name.
Appendix A Log Descriptions Table 278 System Logs (continued) LOG MESSAGE DESCRIPTION The profile %s has been paused because the HA interface of VRRP status was standby. The profile is paused by Device-HA, because the VRRP status of that HA iface is standby, %s is the profile name. Update the profile %s has failed because HA interface was linkdown. DDNS profile cannot be updated for HA IP address because HA iface is link-down, %s is the profile name.
Appendix A Log Descriptions Table 279 Connectivity Check Logs LOG MESSAGE DESCRIPTION Can't open link_up2 Cannot recover routing status which is link-down. Can not open %s.pid Cannot open connectivity check process ID file. %s: interface name Can not open %s.arg Cannot open configuration file for connectivity check process. %s: interface name The connectivitycheck is activate for %s interface The link status of interface is still activate after check of connectivity check process.
Appendix A Log Descriptions Table 279 Connectivity Check Logs (continued) LOG MESSAGE DESCRIPTION Can't use MULTICAST IP for destination The connectivity check process can't use multicast address to check link-status. The destination is invalid, because destination IP is broadcast IP The connectivity check process can't use broadcast address to check link-status. Can't get MAC address of %s interface! The connectivity check process can't get MAC address of interface.
Appendix A Log Descriptions Table 280 Device HA Logs (continued) LOG MESSAGE DESCRIPTION %s file not existed, There is no file to be synchronized from the Master when Skip syncing it for %s syncing a object (AV/AS/IDP/Certificate/System Configuration), But in fact, there should be something in the Master for the device to synchronize with, 1st %s: The syncing object, 2ed %s: The feature name for the syncing object. 942 Master firmware version can not be recognized. Stop syncing from Master.
Appendix A Log Descriptions Table 280 Device HA Logs (continued) LOG MESSAGE DESCRIPTION Device HA authentication type for VRRP group %s maybe wrong. A VRRP group’s Authentication Type (Md5 or IPSec AH) configuration may not match between the Backup and the Master. %s: The name of the VRRP group. Device HA authenticaton string of text for VRRP group %s maybe wrong. A VRRP group’s Simple String (Md5) configuration may not match between the Backup and the Master. %s: The name of the VRRP group.
Appendix A Log Descriptions Table 281 Routing Protocol Logs 944 LOG MESSAGE DESCRIPTION RIP on interface %s has been stopped because Device-HA binds this interface. Device-HA is currently running on the interface %s, so all the local service have to be stopped including RIP.
Appendix A Log Descriptions Table 281 Routing Protocol Logs (continued) LOG MESSAGE DESCRIPTION RIP md5 authentication id and key have been deleted. RIP md5 authentication id and key have been deleted. RIP global version has been deleted. RIP global version has been deleted. RIP redistribute OSPF routes has been disabled. RIP redistribute OSPF routes has been disabled. RIP redistribute static routes has been disabled. RIP redistribute static routes has been disabled.
Appendix A Log Descriptions Table 281 Routing Protocol Logs (continued) LOG MESSAGE DESCRIPTION Invalid OSPF virtuallink %s authentication of area %s. Virtual-link %s authentication has been set to same-as-area but the area has invalid authentication configuration. %s: Virtual-Link ID Invalid OSPF md5 authentication on interface %s. Invalid OSPF md5 authentication is set on interface %s. %s: Interface Name Invalid OSPF text authentication on interface %s.
Appendix A Log Descriptions Table 282 NAT Logs (continued) LOG MESSAGE DESCRIPTION Register SIP ALG SIP ALG apply signal port failed. signal port=%d failed. %d: Port number Register H.323 ALG extra port=%d failed. H323 ALG apply additional signal port failed. %d: Port number Register H.323 ALG H323 ALG apply signal port failed. signal port=%d failed. %d: Port number Register FTP ALG extra port=%d failed. FTP ALG apply additional signal port failed.
Appendix A Log Descriptions Table 283 PKI Logs (continued) 948 LOG MESSAGE DESCRIPTION SCEP enrollment "%s" successfully, CA "%s", URL "%s" The device used SCEP to enroll a certificate. 1st %s is a request name, 2nd %s is the CA name, 3rd %s is the URL . SCEP enrollment "%s" failed, CA "%s", URL "%s" The device was unable to use SCEP to enroll a certificate.
Appendix A Log Descriptions Table 283 PKI Logs (continued) LOG MESSAGE DESCRIPTION Export X509 certificate "%s" from "Trusted Certificate" successfully The device exported a x509 format certificate from Trusted Certificates. %s is the certificate request name. Export X509 certificate "%s" from "My Certificate" failed The device was not able to export a x509 format certificate from My Certificates. %s is the certificate request name.
Appendix A Log Descriptions CODE DESCRIPTION 25 Database method failed due to timeout. 26 Database method failed. 27 Path was not verified. 28 Maximum path length reached. Table 284 Interface Logs 950 LOG MESSAGE DESCRIPTION Interface %s has been deleted. An administrator deleted an interface. %s is the interface name. AUX Interface dialing failed. This AUX interface is not enabled. A user tried to dial the AUX interface, but the AUX interface is not enabled.
Appendix A Log Descriptions Table 284 Interface Logs (continued) LOG MESSAGE DESCRIPTION Interface %s is enabled. An administrator enabled an interface. %s: interface name. Interface %s is disabled. An administrator disabled an interface. %s: interface name. %s MTU > (%s MTU - 8), %s may not work correctly.
Appendix A Log Descriptions Table 284 Interface Logs (continued) 952 LOG MESSAGE DESCRIPTION Interface %s connect failed: MS-CHAP authentication failed. MS-CHAP authentication failed (the server must support MSCHAP and verify that the authentication failed, this does not include cases where the server does not support MS-CHAP). %s: interface name. Interface %s connect failed: CHAP authentication failed.
Appendix A Log Descriptions Table 284 Interface Logs (continued) LOG MESSAGE DESCRIPTION "SIM card has been successfully unlocked by PUK code on interface cellular%d. You entered the correct PUK code and unlocked the SIM card for the cellular device associated with the listed cellular interface (%d). "Incorrect PUK code of interface cellular%d. Please check the PUK code setting.
Appendix A Log Descriptions Table 284 Interface Logs (continued) LOG MESSAGE DESCRIPTION "Cellular device [%s %s] has been removed from %s. The cellular device (identified by its manufacturer and model) has been removed from the specified slot. Interface cellular%d required authentication password.Please set password in cellular%d edit page. You need to manually enter the password for the listed cellular interface (%d). Table 285 Account Logs LOG MESSAGE DESCRIPTION Account %s %s has been deleted.
Appendix A Log Descriptions Table 287 Force Authentication Logs LOG MESSAGE DESCRIPTION Force User Authentication will be enabled due to http server is enabled. Force user authentication will be turned on because HTTP server was turned on. Force User Authentication will be disabled due to http server is disabled. Force user authentication will be turned off because HTTP server was turned off.
Appendix A Log Descriptions Table 289 DHCP Logs LOG MESSAGE DESCRIPTION Can't find any lease for this client - %s, DHCP pool full! All of the IP addresses in the DHCP pool are already assigned to DHCP clients, so there is no IP address to give to the listed DHCP client. DHCP server offered %s to %s(%s) The DHCP server feature gave the listed IP address to the computer with the listed hostname and MAC address.
Appendix A Log Descriptions Table 291 IP-MAC Binding Logs LOG MESSAGE DESCRIPTION Drop packet %s%u.%u.%u.%u%02X:%02X:%02X:%02 X:%02X:%02X The IP-MAC binding feature dropped an Ethernet packet. The interface the packet came in through and the sender’s IP address and MAC address are also shown. Cannot bind ip-mac from dhcpd: %s#%u.%u.%u.%u#%0 2X:%02X:%02X:%02X: %02X:%02X. The IP-MAC binding feature could not create an IP-MAC binding hash table entry.
Appendix A Log Descriptions 958 ZyWALL USG 2000 User’s Guide
APPENDIX B Common Services The following table lists some commonly-used services and their associated protocols and port numbers. For a comprehensive list of port numbers, ICMP type/ code numbers and services, visit the IANA (Internet Assigned Number Authority) web site. • Name: This is a short, descriptive name for the service. You can use this one or create a different one, if you like. • Protocol: This is the type of IP protocol used by the service.
Appendix B Common Services Table 293 Commonly Used Services (continued) 960 NAME PROTOCOL PORT(S) DESCRIPTION ESP (IPSEC_TUNNEL) User-Defined 50 The IPSEC ESP (Encapsulation Security Protocol) tunneling protocol uses this service. FINGER TCP 79 Finger is a UNIX or Internet related command that can be used to find out if a user is logged on. FTP TCP 20 TCP 21 File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail. H.
Appendix B Common Services Table 293 Commonly Used Services (continued) NAME PROTOCOL PORT(S) DESCRIPTION PPTP TCP 1723 Point-to-Point Tunneling Protocol enables secure transfer of data over public networks. This is the control channel. PPTP_TUNNEL (GRE) User-Defined 47 PPTP (Point-to-Point Tunneling Protocol) enables secure transfer of data over public networks. This is the data channel. RCMD TCP 512 Remote Command Service.
Appendix B Common Services Table 293 Commonly Used Services (continued) 962 NAME PROTOCOL PORT(S) DESCRIPTION TFTP UDP 69 Trivial File Transfer Protocol is an Internet file transfer protocol similar to FTP, but uses the UDP (User Datagram Protocol) rather than TCP (Transmission Control Protocol). VDOLIVE TCP 7000 Another videoconferencing solution.
APPENDIX C Displaying Anti-Virus Alert Messages in Windows With the anti-virus packet scan, when a virus is detected, you can have the ZyWALL display an alert message on Miscrosoft Windows-based computers. If the log shows that virus files are being detected but your Miscrosoft Windows-based computer is not displaying an alert message, use one of the following procedures to make sure your computer is set to display the messages. Windows XP 1 Click Start > Control Panel > Administrative Tools > Services.
Appendix C Displaying Anti-Virus Alert Messages in Windows 2 Select the Messenger service and click Start. Figure 581 Windows XP: Starting the Messenger Service 3 Close the window when you are done. Windows 2000 1 Click Start > Settings > Control Panel > Administrative Tools > Services.
Appendix C Displaying Anti-Virus Alert Messages in Windows 2 Select the Messenger service and click Start Service. Figure 583 Windows 2000: Starting the Messenger Service 3 Close the window when you are done. Windows 98 SE/Me For Windows 98 SE/Me, you must open the WinPopup window in order to view real-time alert messages. Click Start > Run and enter “winpopup” in the field provided and click OK. The WinPopup window displays as shown.
Appendix C Displaying Anti-Virus Alert Messages in Windows 1 Right-click on the program task bar and click Properties. Figure 585 WIndows 98 SE: Program Task Bar 2 Click the Start Menu Programs tab and click Advanced ... Figure 586 Windows 98 SE: Task Bar Properties 3 966 Double-click Programs and click StartUp.
Appendix C Displaying Anti-Virus Alert Messages in Windows 4 Right-click in the StartUp pane and click New, Shortcut. Figure 587 Windows 98 SE: StartUp 5 A Create Shortcut window displays. Enter “winpopup” in the Command line field and click Next.
Appendix C Displaying Anti-Virus Alert Messages in Windows 6 Specify a name for the shortcut or accept the default and click Finish. Figure 589 Windows 98 SE: Startup: Select a Title for the Program 7 A shortcut is created in the StartUp pane. Restart the computer when prompted. Figure 590 Windows 98 SE: Startup: Shortcut Note: The WinPopup window displays after the computer finishes the startup process (see Figure 584 on page 965).
APPENDIX D Importing Certificates This appendix shows you how to import public key certificates into your web browser. Public key certificates are used by web browsers to ensure that a secure web site is legitimate. When a certificate authority such as VeriSign, Comodo, or Network Solutions, to name a few, receives a certificate request from a website operator, they confirm that the web domain and contact information in the request match those on public record with a domain name registrar.
Appendix D Importing Certificates 1 If your device’s Web Configurator is set to use SSL certification, then the first time you browse to it you are presented with a certification error. Figure 591 Internet Explorer 7: Certification Error 2 Click Continue to this website (not recommended). Figure 592 Internet Explorer 7: Certification Error 3 In the Address Bar, click Certificate Error > View certificates.
Appendix D Importing Certificates 4 In the Certificate dialog box, click Install Certificate. Figure 594 Internet Explorer 7: Certificate 5 In the Certificate Import Wizard, click Next.
Appendix D Importing Certificates 6 If you want Internet Explorer to Automatically select certificate store based on the type of certificate, click Next again and then go to step 9. Figure 596 Internet Explorer 7: Certificate Import Wizard 7 Otherwise, select Place all certificates in the following store and then click Browse.
Appendix D Importing Certificates 8 In the Select Certificate Store dialog box, choose a location in which to save the certificate and then click OK. Figure 598 Internet Explorer 7: Select Certificate Store 9 In the Completing the Certificate Import Wizard screen, click Finish.
Appendix D Importing Certificates 10 If you are presented with another Security Warning, click Yes. Figure 600 Internet Explorer 7: Security Warning 11 Finally, click OK when presented with the successful certificate installation message. Figure 601 Internet Explorer 7: Certificate Import Wizard 12 The next time you start Internet Explorer and go to a ZyXEL Web Configurator page, a sealed padlock icon appears in the address bar. Click it to view the page’s Website Identification information.
Appendix D Importing Certificates Installing a Stand-Alone Certificate File in Internet Explorer Rather than browsing to a ZyXEL Web Configurator and installing a public key certificate when prompted, you can install a stand-alone certificate file if one has been issued to you. 1 Double-click the public key certificate file. Figure 603 Internet Explorer 7: Public Key Certificate File 2 In the security warning dialog box, click Open.
Appendix D Importing Certificates 1 Open Internet Explorer and click Tools > Internet Options. Figure 605 Internet Explorer 7: Tools Menu 2 In the Internet Options dialog box, click Content > Certificates.
Appendix D Importing Certificates 3 In the Certificates dialog box, click the Trusted Root Certificates Authorities tab, select the certificate that you want to delete, and then click Remove. Figure 607 Internet Explorer 7: Certificates 4 In the Certificates confirmation, click Yes. Figure 608 Internet Explorer 7: Certificates 5 In the Root Certificate Store dialog box, click Yes.
Appendix D Importing Certificates 6 The next time you go to the web site that issued the public key certificate you just removed, a certification error appears. Firefox The following example uses Mozilla Firefox 2 on Windows XP Professional; however, the screens can also apply to Firefox 2 on all platforms. 1 If your device’s Web Configurator is set to use SSL certification, then the first time you browse to it you are presented with a certification error.
Appendix D Importing Certificates 3 The certificate is stored and you can now connect securely to the Web Configurator. A sealed padlock appears in the address bar, which you can click to open the Page Info > Security window to view the web page’s security information.
Appendix D Importing Certificates 1 Open Firefox and click Tools > Options. Figure 612 Firefox 2: Tools Menu 2 In the Options dialog box, click Advanced > Encryption > View Certificates.
Appendix D Importing Certificates 3 In the Certificate Manager dialog box, click Web Sites > Import. Figure 614 4 Use the Select File dialog box to locate the certificate and then click Open. Figure 615 5 Firefox 2: Certificate Manager Firefox 2: Select File The next time you visit the web site, click the padlock in the address bar to open the Page Info > Security window to see the web page’s security information.
Appendix D Importing Certificates Removing a Certificate in Firefox This section shows you how to remove a public key certificate in Firefox 2. 1 Open Firefox and click Tools > Options. Figure 616 Firefox 2: Tools Menu 2 In the Options dialog box, click Advanced > Encryption > View Certificates.
Appendix D Importing Certificates 3 In the Certificate Manager dialog box, select the Web Sites tab, select the certificate that you want to remove, and then click Delete. Figure 618 4 Firefox 2: Certificate Manager In the Delete Web Site Certificates dialog box, click OK. Figure 619 Firefox 2: Delete Web Site Certificates 5 The next time you go to the web site that issued the public key certificate you just removed, a certification error appears.
Appendix D Importing Certificates 1 If your device’s Web Configurator is set to use SSL certification, then the first time you browse to it you are presented with a certification error. 2 Click Install to accept the certificate. Figure 620 Opera 9: Certificate signer not found 3 The next time you visit the web site, click the padlock in the address bar to open the Security information window to view the web page’s security details.
Appendix D Importing Certificates Installing a Stand-Alone Certificate File in Opera Rather than browsing to a ZyXEL Web Configurator and installing a public key certificate when prompted, you can install a stand-alone certificate file if one has been issued to you. 1 Open Opera and click Tools > Preferences.
Appendix D Importing Certificates 2 In Preferences, click Advanced > Security > Manage certificates.
Appendix D Importing Certificates 3 In the Certificates Manager, click Authorities > Import. Figure 624 4 Opera 9: Certificate manager Use the Import certificate dialog box to locate the certificate and then click Open.
Appendix D Importing Certificates 5 In the Install authority certificate dialog box, click Install. Figure 626 6 Next, click OK. Figure 627 7 Opera 9: Install authority certificate Opera 9: Install authority certificate The next time you visit the web site, click the padlock in the address bar to open the Security information window to view the web page’s security details. Removing a Certificate in Opera This section shows you how to remove a public key certificate in Opera 9.
Appendix D Importing Certificates 1 Open Opera and click Tools > Preferences. Figure 628 Opera 9: Tools Menu 2 In Preferences, Advanced > Security > Manage certificates.
Appendix D Importing Certificates 3 In the Certificates manager, select the Authorities tab, select the certificate that you want to remove, and then click Delete. Figure 630 4 Opera 9: Certificate manager The next time you go to the web site that issued the public key certificate you just removed, a certification error appears. Note: There is no confirmation when you delete a certificate authority, so be absolutely certain that you want to go through with it before clicking the button.
Appendix D Importing Certificates 2 Click Continue. Figure 631 Konqueror 3.5: Server Authentication 3 Click Forever when prompted to accept the certificate. Figure 632 Konqueror 3.5: Server Authentication 4 Click the padlock in the address bar to open the KDE SSL Information window and view the web page’s security details. Figure 633 Konqueror 3.
Appendix D Importing Certificates Installing a Stand-Alone Certificate File in Konqueror Rather than browsing to a ZyXEL Web Configurator and installing a public key certificate when prompted, you can install a stand-alone certificate file if one has been issued to you. 1 Double-click the public key certificate file. Figure 634 Konqueror 3.5: Public Key Certificate File 2 In the Certificate Import Result - Kleopatra dialog box, click OK. Figure 635 Konqueror 3.
Appendix D Importing Certificates 3 The next time you visit the web site, click the padlock in the address bar to open the KDE SSL Information window to view the web page’s security details. Removing a Certificate in Konqueror This section shows you how to remove a public key certificate in Konqueror 3.5. 1 Open Konqueror and click Settings > Configure Konqueror. Figure 637 Konqueror 3.5: Settings Menu 2 In the Configure dialog box, select Crypto.
Appendix D Importing Certificates 4 The next time you go to the web site that issued the public key certificate you just removed, a certification error appears. Note: There is no confirmation when you remove a certificate authority, so be absolutely certain you want to go through with it before clicking the button.
APPENDIX E Open Software Announcements End-User License Agreement for “ZyWALL USG 2000” WARNING: ZyXEL Communications Corp. IS WILLING TO LICENSE THE SOFTWARE TO YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS CONTAINED IN THIS LICENSE AGREEMENT. PLEASE READ THE TERMS CAREFULLY BEFORE COMPLETING THE INSTALLATION PROCESS AS INSTALLING THE SOFTWARE WILL INDICATE YOUR ASSENT TO THEM.
Appendix E Open Software Announcements You may not remove any proprietary notice of ZyXEL or any of its licensors from any copy of the Software or Documentation. 4.Restrictions You may not publish, display, disclose, sell, rent, lease, modify, store, loan, distribute, or create derivative works of the Software, or any part thereof. You may not assign, sublicense, convey or otherwise transfer, pledge as security or otherwise encumber the rights and licenses granted hereunder with respect to the Software.
Appendix E Open Software Announcements 6.No Warranty THE SOFTWARE IS PROVIDED "AS IS." TO THE MAXIMUM EXTENT PERMITTED BY LAW, ZyXEL DISCLAIMS ALL WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
Appendix E Open Software Announcements 9.Audit Rights ZyXEL SHALL HAVE THE RIGHT, AT ITS OWN EXPENSE, UPON REASONABLE PRIOR NOTICE, TO PERIODICALLY INSPECT AND AUDIT YOUR RECORDS TO ENSURE YOUR COMPLIANCE WITH THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT. 10.Termination This License Agreement is effective until it is terminated. You may terminate this License Agreement at any time by destroying or returning to ZyXEL all copies of the Software and Documentation in your possession or under your control.
Appendix E Open Software Announcements bridge-utils 0.9.5. http://linux-net.osdl.org/index.php/Bridge dhcpcd-1.3.22-pl4 1.3.22-pl4 http://www.phystech.com/download/ ppp-2.4.2 2.4.2 http://ppp.samba.org/ppp/index.html pptp-1.7.0 1.7.0 http://pptpclient.sourceforge.net/ rp-pppoe-3.5 3.5 http://www.roaringpenguin.com/penguin/open_source_rp-pppoe.php vlan-1.8 1.8 http://www.candelatech.com/~greear/ keepalived-1.1.11-p1 1.1.11-p1 http://www.keepalived.org/ libnet 1.1.2.1 http://www.
Appendix E Open Software Announcements libxml2-2.6.8 2.6.8 http://www.xmlsoft.org libgcgi-0.9.5 0.9.5 http://catchen.org/gcgi/ Linux kernel 2.4.27 http://www.kernel.org/ hostapd-0.5.7 0.5.7 http://hostap.epitest.fi/hostapd/ wireless_tools.28 28 http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html arp-sk-0.0.16 0.0.16 http://sid.rstack.org/arp-sk/ Prototype 1.6.0 http://www.prototypejs.org/ tablekit 1.2.1 http://www.millstream.com.au/view/code/tablekit/ ipset 2.3.
Appendix E Open Software Announcements PPP License Copyright (c) 1993 The Australian National University. All rights reserved. Redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials, and other materials related to such distribution and use acknowledge that the software was developed by the Australian National University.
Appendix E Open Software Announcements All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1.Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2.
Appendix E Open Software Announcements This Product includes expat-1.95.
Appendix E Open Software Announcements •This license is compatible with The GNU General Public License, Version 2 This is just like a Simple Permissive license, but it requires that a copyright notice be maintained.
Appendix E Open Software Announcements 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. All advertising materials mentioning features or use of this software must display the following acknowledgment: "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/ )" 4.
Appendix E Open Software Announcements be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson (tjh@cryptsoft.com). Copyright remains Eric Young's, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used.
Appendix E Open Software Announcements This Product includes libevent-1.1a and xinetd-2.3.14 software under the a 3clause BSD License a 3-clause BSD-style license This is a Free Software License •This license is compatible with The GNU General Public License, Version 1 •This license is compatible with The GNU General Public License, Version 2 This is the BSD license without the obnoxious advertising clause. It's also known as the "modified BSD license.
Appendix E Open Software Announcements * Neither the name of [original copyright holder] nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
Appendix E Open Software Announcements DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. $Id: COPYRIGHT,v 1.6.2.2 2002/02/12 06:05:48 marka Exp $ Portions Copyright (C) 1996-2001 Nominum, Inc.
Appendix E Open Software Announcements Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.
Appendix E Open Software Announcements "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity.
Appendix E Open Software Announcements "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License.
Appendix E Open Software Announcements attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
Appendix E Open Software Announcements Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS Version 1.1 Copyright (c) 1999-2003 The Apache Software Foundation. All rights reserved.
Appendix E Open Software Announcements USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This software consists of voluntary contributions made by many individuals on behalf of the Apache Software Foundation. For more information on the Apache Software Foundation, please see . Portions of this software are based upon public domain software originally written at the National Center for Supercomputing Applications, University of Illinois, Urbana-Champaign.
Appendix E Open Software Announcements guarantee your freedom to share and change free software--to make sure the software is free for all its users. This license, the Lesser General Public License, applies to some specially designated software packages--typically libraries--of the Free Software Foundation and other authors who decide to use it.
Appendix E Open Software Announcements Most GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.
Appendix E Open Software Announcements 0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".
Appendix E Open Software Announcements still operates, and performs whatever part of its purpose remains meaningful. (For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.
Appendix E Open Software Announcements "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License. However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License.
Appendix E Open Software Announcements version is interface-compatible with the version that the work was made with. c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution. d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.
Appendix E Open Software Announcements 10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License. 11.
Appendix E Open Software Announcements Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation. 14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this.
Appendix E Open Software Announcements pcmcia-cs-3.2.8, libeeprog, mgetty-1.1.35, gmp-4.1, msmtp-1.4.12 and libqsearch 0.8 software under GPL license. GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
Appendix E Open Software Announcements the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents.
Appendix E Open Software Announcements b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.
Appendix E Open Software Announcements source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.
Appendix E Open Software Announcements whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices.
Appendix E Open Software Announcements DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12.
Appendix E Open Software Announcements means a mechanism generally accepted in the software development community for the electronic transfer of data. 1.5. "Executable" means Covered Code in any form other than Source Code. 1.6. "Initial Developer" means the individual or entity identified as the Initial Developer in the Source Code notice required by Exhibit A. 1.7. "Larger Work" means a work which combines Covered Code or portions thereof with code not governed by the terms of this License. 1.8.
Appendix E Open Software Announcements 1.11. "Source Code" means the preferred form of the Covered Code for making modifications to it, including all modules it contains, plus any associated interface definition files, scripts used to control compilation and installation of an Executable, or source code differential comparisons against either the Original Code or another well known, available Covered Code of the Contributor's choice.
Appendix E Open Software Announcements Subject to third party intellectual property claims, each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license under intellectual property rights (other than patent or trademark) Licensable by Contributor, to use, reproduce, modify, display, perform, sublicense and distribute the Modifications created by such Contributor (or portions thereof) either on an unmodified basis, with other Modifications, as Covered Code and/or as part of a Larger W
Appendix E Open Software Announcements made available via Electronic Distribution Mechanism, must remain available for at least twelve (12) months after the date it initially became available, or at least six (6) months after a subsequent version of that particular Modification has been made available to such recipients. You are responsible for ensuring that the Source Code version remains available even if the Electronic Distribution Mechanism is maintained by a third party. 3.3.
Appendix E Open Software Announcements You must duplicate the notice in Exhibit A in each file of the Source Code. If it is not possible to put such notice in a particular Source Code file due to its structure, then You must include such notice in a location (such as a relevant directory) where a user would be likely to look for such a notice. If You created one or more Modification(s) You may add your name as a Contributor to the notice described in Exhibit A.
Appendix E Open Software Announcements regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) describe the limitations and the code they affect. Such description must be included in the legal file described in Section 3.4 and must be included with all distributions of the Source Code. Except to the extent prohibited by statute or regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be able to understand it. 5.
Appendix E Open Software Announcements (not the initial developer or any other contributor) assume the cost of any necessary servicing, repair or correction. This disclaimer of warranty constitutes an essential part of this license. No use of any covered code is authorized hereunder except under this disclaimer. 8. Termination 8.1.
Appendix E Open Software Announcements granted by You or any distributor hereunder prior to termination shall survive termination. 9.
Appendix E Open Software Announcements As between Initial Developer and the Contributors, each party is responsible for claims and damages arising, directly or indirectly, out of its utilization of rights under this License and You agree to work with Initial Developer and Contributors to distribute such responsibility on an equitable basis. Nothing herein is intended or shall be deemed to constitute any admission of liability. 13.
Appendix E Open Software Announcements NOTE: The text of this Exhibit A may differ slightly from the text of the notices in the Source Code files of the Original Code. You should use the text of this Exhibit A rather than the text found in the Original Code Source Code for Your Modifications. This Product includes libnet-1.1.2.1, net-snmp-5.1.1, libpcap-0.9.4, openssh4.3p2, unzip-5.50, zip-2.3 and tcpdump-3.6.
Appendix E Open Software Announcements USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This Product includes libxml2-2.6.8, Prototype 1.6.0 and persist-js-0.1.
Appendix E Open Software Announcements Redistribution and use of this software and associated documentation("Software"), with or without modification, are permitted provided that the following conditions are met: 1. Redistributions in source form must retain copyright statements and notices, 2.
Appendix E Open Software Announcements Copyright 1999-2003 The OpenLDAP Foundation, Redwood City, California, USA. All Rights Reserved. Permission to copy and distribute verbatim copies of this document is granted. This Product includes gd-2.0.36RC1 software under the below License Portions copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 by Cold Spring Harbor Laboratory. Funded under Grant P41-RR02188 by the National Institutes of Health.
Appendix E Open Software Announcements use of gd. If you have questions, ask. "Derived works" includes all programs that utilize the library. Credit must be given in user-accessible documentation. This software is provided "AS IS." The copyright holders disclaim all warranties, either express or implied, including but not limited to implied warranties of merchantability and fitness for a particular purpose, with respect to this code and accompanying documentation.
Appendix E Open Software Announcements Copyright (C) 1999, 2000, 2002 Aladdin Enterprises. All rights reserved. This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software. Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions: 1.
Appendix E Open Software Announcements 3. This notice may not be removed or altered from any source distribution. COPYRIGHT NOTICE, DISCLAIMER, and LICENSE: * * If you modify libpng you may insert additional notices immediately following * this sentence. * * libpng versions 1.2.6, August 15, 2004, through 1.2.12, June 27, 2006, are * Copyright (c) 2004, 2006 Glenn Randers-Pehrson, and are * distributed according to the same disclaimer and license as libpng-1.2.
Appendix E Open Software Announcements * There is no warranty against interference with your enjoyment of the * library or against infringement. There is no warranty that our * efforts or the library will fulfill any of your particular purposes * or needs. This library is provided with all faults, and the entire * risk of satisfactory quality, performance, accuracy, and effort is with * the user. * * libpng versions 0.97, January 1998, through 1.0.
Appendix E Open Software Announcements * Greg Roelofs * Tom Tanner * * libpng versions 0.5, May 1995, through 0.88, January 1996, are * Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc. * * For the purposes of this copyright and license, "Contributing Authors" * is defined as the following set of individuals: * * Andreas Dilger * Dave Martindale * Guy Eric Schalnat * Paul Schmidt * Tim Wegner * * The PNG Reference Library is supplied "AS IS".
Appendix E Open Software Announcements * to the following restrictions: * * 1. The origin of this source code must not be misrepresented. * * 2. Altered versions must be plainly marked as such and * must not be misrepresented as being the original source. * * 3. This Copyright notice may not be removed or altered from * any source or altered source distribution. * * The Contributing Authors and Group 42, Inc.
Appendix E Open Software Announcements 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name of the project nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
Appendix E Open Software Announcements PARTICULAR PURPOSE ARE DISCLAIMED.
APPENDIX F Legal Information Copyright Copyright © 2010 by ZyXEL Communications Corporation. The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a retrieval system, translated into any language, or transmitted in any form or by any means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written permission of ZyXEL Communications Corporation. Published by ZyXEL Communications Corporation.
Appendix F Legal Information • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operations. This device has been tested and found to comply with the limits for a Class B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation.
Appendix F Legal Information Notices Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. This Class B digital apparatus complies with Canadian ICES-003. Cet appareil numérique de la classe B est conforme à la norme NMB-003 du Canada. Viewing Certifications 1 Go to http://www.zyxel.com. 2 Select your product on the ZyXEL home page to go to that product's page.
Appendix F Legal Information To obtain the services of this warranty, contact your vendor. You may also refer to the warranty policy for the region in which you bought the device at http:// www.zyxel.com/web/support_warranty_info.php. Registration Register your product online to receive e-mail notices of firmware upgrades and information at www.zyxel.com.
Index Index Symbols Numerics 1 to 1 NAT 102 1 to 1 SNAT 103 3322 Dynamic DNS 381 3DES 471 3G 122 3G see also cellular 299 A AAA Base DN 726 Bind DN 726, 729 directory structure 725 Distinguished Name, see DN DN 726, 727, 729, 730 password 729 port 728, 731 search time limit 729 SSL 729 AAA server 723 AD 725 and users 690 directory service 723 LDAP 723, 725 local user database 725 object, where used 114 RADIUS 724, 725, 729 RADIUS group 731 see also RADIUS access 51 access control attacks 575 Access Point
Index and SNMP 827 and SSH 818 and Telnet 821 and VPN connections 444 and WWW 803 HOST 705 RANGE 706 SUBNET 706 types of 705 where used 114 address record 793 admin user troubleshooting 883 admin users 689 multiple logins 700 see also users 689 ADP 597 base profiles 598, 601 configuration overview 112 false negatives 602 false positives 602 inline profile 602 monitor profile 602 port scanning 609 prerequisites 112 protocol anomaly 598 signatures 275 traffic anomaly 598, 602 updating signatures 275 Advanced
Index real-time alert message 965 registration status 552 scanner types 561 signatures 558 statistics 250 trial service activation 268 troubleshooting 871, 874 troubleshooting signatures update 870 updating signatures 272 virus 548 virus types 561 white list 554, 558 Windows 98/Me requirements 965 worm 548 Apache server 613, 614 Apache-whitespace attack 613 APN 303 Application Layer Gateway, see ALG application order 100 application patrol 521 actions 522 and firewall 522 and HTTP redirect 398 bandwidth man
Index truncated-options 615 truncated-timestamp-header 616 TTCP-detected 615 types of 574 u-encoding 614 undersize-len 615 undersize-offset 615 UTF-8-encoding 614 virus 548, 575 worm 575 Authenex Strong Authentication System (ASAS) 724 authentication in IPSec 450 LDAP/AD 725 server 723 authentication algorithms 375, 470, 471 and active protocol 471 and routing protocols 375 MD5 375, 471 SHA1 471 text 375 Authentication Header, see AH authentication method objects 733 and users 690 and WWW 802 create 735 exa
Index bridge interfaces 278, 319 and virtual interfaces of members 319 basic characteristics 279 effect on routing table 319 member interfaces 319 virtual 329 bridges 318 broadcast storm troubleshooting 882 buffer overflow 575 buffer overflow attacks 575 C CA and certificates 740 CA (Certificate Authority), see certificates capturing packets 860 card installation 897 CARD LED 40 and HTTPS 799 and IKE SA 475 and SSH 817 and synchronization (device HA) 687 and VPN gateways 444 and WWW 801 certification path
Index computer names 289, 315, 325, 334, 520 computer virus 548 infection and prevention 561 see also virus concurrent e-mail sessions 259, 652 configuration information 859 object-based 95 overview 103 web-based SSL application example 766 configuration file troubleshooting 885 configuration files 847 at restart 850 backing up 850 downloading 851 downloading with FTP 821 editing 847 how applied 848 lastgood.conf 850, 854 managing 850 not stopping or starting the ZyWALL 42 startup-config.
Index D dashboard 53, 55, 209 Data Encryption Standard, see DES Data Terminal Ready, see DTR date 785 daylight savings 786 DDNS 381 backup mail exchanger 386 configuration overview 107 mail exchanger 386 prerequisites 107 service providers 381 status 236 troubleshooting 876 DDoS attacks 574 Dead Peer Detection, see DPD decompression of files (in anti-virus) 554 default firewall behavior 424 interfaces and zones 98 LAN IP address 33 login settings 891 port mapping 33 default SNAT 103, 343 default trunk 343
Index file structure 725 directory traversal attack 613 egress bandwidth 305 directory traversals 613 EICAR 551 disclaimer 5, 1051 distributed port scans 610 e-mail 649 daily statistics report 834 header buffer 651 headers 650 virus 561 DN 726, 727, 729, 730 e-Mule 574 DNS 789 address records 793 domain name forwarders 794 domain name to IP address 793 IP address to domain name 793 L2TP VPN 520 Mail eXchange (MX) records 795 pointer (PTR) records 793 Encapsulating Security Payload, see ESP Distin
Index basic characteristics 279 virtual 329 Ethernet ports 33, 35 default settings 36 examples (tutorials) 119 exceptional services 418 experimental-options attack 615 extended authentication and VPN gateways 444 IKE SA 475 external interface 100, 286 external modems 327, 873 ext-group 142 ext-user troubleshooting 882 F false negatives 570, 602 false positives 570, 602, 604 FCC interference statement 1051 feature specifications 892 and IPSec SA 425 and IPSec VPN 878 and logs 421, 436 and NAT 432 and port
Index FTP 821 additional signaling port 407 ALG 401 and address groups 823 and address objects 823 and certificates 822 and zones 823 signaling port 407 troubleshooting 877 with Transport Layer Security (TLS) 822 full tunnel mode 47, 482, 488 Fully-Qualified Domain Name, see FQDN G gateway policy, see VPN gateways ge 33 ge1 33 ge2 33 ge3 33 Generic Routing Encapsulation, see GRE.
Index action 573, 608 alerts 572 and services 712 applying custom signatures 592 base profiles 564, 568 configuration overview 112 custom signature example 590 custom signatures 581 false negatives 570 false positives 570 inline profile 570 log options 572, 574, 605, 608 monitor profile 570 packet inspection profiles 571 packet inspection signatures 571 policy types 574 prerequisites 112 profiles 563, 565, 566 query view 572, 576 registration status 270, 566 reject sender 573, 608 reject-both 573, 608 rejec
Index and layer-3 virtualization 278 and NAT 391 and physical ports 96, 278 and policy routes 355 and static routes 359 and VPN gateways 444 and VRRP groups 677 and zones 96, 278 as DHCP relays 333 as DHCP servers 333, 784 auxiliary, see also auxiliary interface. backup, see trunks bandwidth management 332, 345 bridge, see also bridge interfaces. cellular 278 configuration overview 105 default configuration 98 DHCP clients 332 Ethernet, see also Ethernet interfaces.
Index Perfect Forward Secrecy 450 PFS 450 phase 2 settings 449 policy enforcement 449 remote access 448 remote IPSec router 441 remote network 441 remote policy 449 replay detection 448 SA life time 449 SA monitor 245 SA see also IPSec SA 476 see also VPN site-to-site with dynamic peer 448 static site-to-site 448 transport encapsulation 449 tunnel encapsulation 449 VPN gateway 444 IPSec SA active protocol 476 and firewall 425, 878 and to-ZyWALL firewall 878 authentication algorithms 470, 471 authentication
Index remote user configuration 175 session monitor 249 troubleshooting 879 where used 111 WINS 520 LAN interface 33 IP address 33 weighted round robin 340 local user database 725 log display 261 troubleshooting 885 lastgood.
Index main routing table 102 main window 60 MSCHAP-V2 (Microsoft Challenge-Handshake Authentication Protocol Version 2) 329, 763 maintenance menu 60 MTU 305 malware 629 multiple slash encoding 614 managed web pages 627 multiple WAN IP addresses 163 management access troubleshooting 884 mutation virus 561 management access and device HA 668 mute 828 Management Information Base (MIB) 824, 825 My Certificates, see also certificates 743 managing bandwidth 523 MyDoom 595 manual key IPSec 448 myZ
Index NetBIOS Broadcast over IPSec 448 Name Server, see NBNS. Open Shortest Path First, see OSPF NetBIOS Name Server, see NBNS order of feature application 100 NetMeeting 408 see also H.
Index offset attack 615 request-uri-directory attack 614 packet statistics graph 226 PIN code 304 PIN generator 724 pointer record 793 P Point-to-Point Protocol over Ethernet, see PPPoE.
Index port sweep 610 Public-Key Infrastructure (PKI) 740 port translation, see NAT public-private key pairs 739 port triggering 360 and firewall 356, 876 and policy routes 356 and service groups 356 and services 356 troubleshooting 876 PWR troubleshooting 869 ports 33 Post Office Protocol, see POP 650 power module 892 changing 887 connecting 889 disconnecting 887 PWR LEDs 39 Q QoS 349, 523 query view (IDP) 572, 576 quick setup wizard 77 Quick Start Guide 3 power off 42, 867 power on 42 PPP 335 trou
Index regular expressions 247 1631 (NAT) 359 1889 (RTP) 408 2131 (DHCP) 333 2132 (DHCP) 333 2328 (OSPF) 365 2338 (VRRP) 677 2402 (AH) 449, 476 2406 (ESP) 449, 476 2510 (Certificate Management Protocol or CMP) 747 2516 (PPPoE) 335 2637 (PPTP) 335 2890 (GRE) 335 3261 (SIP) 408 reject (IDP) both 573, 608 receiver 573, 608 sender 573, 608 related documentation 3 Relative Distinguished Name (RDN) 726, 727, 729, 730 remote access IPSec 448 Remote Authentication Dial-In User Service, see RADIUS remote desktop co
Index SCEP (Simple Certificate Enrollment Protocol) 747 Session Initiation Protocol, see SIP schedule troubleshooting 883 session monitor 233 schedules 717 and content filtering 617, 618 and current date/time 717 and firewall 421, 436, 538, 541, 544 and policy routes 354, 535, 538, 541, 544 one-time 717 recurring 717 types of 717 where used 114 screen resolution 51 SecuExtender 513 Secure Hash Algorithm, see SHA1 Secure Socket Layer, see SSL security associations, see IPSec security settings troubleshoo
Index and firewall 403 and RTP 408 media inactivity timeout 406 signaling inactivity timeout 406 signaling port 406 troubleshooting 876 site map 61 SMTP 650 smurf attack 611 SNAT 103, 359 default 103, 343 troubleshooting 876 SNMP 823, 824 agents 824 and address groups 827 and address objects 827 and zones 827 Get 824 GetNext 825 Manager 824 managers 824 MIB 824, 825 network components 824 Set 825 Trap 825 traps 825 versions 823 Snort equivalent terms 595 rule header 595 rule options 595 signatures 595 Sourc
Index access policy 482 configuration overview 110 full tunnel mode 47, 482 network access mode 46 prerequisites 110 remote desktop connections 766 reverse proxy mode 46, 481 see also SSL 481 troubleshooting 880 weblink 766 where used 111 supported browsers 51 SWM 351 stac compression 764 SYN flood 612 starting the ZyWALL 41, 42 startup-config.
Index port numbers 712 portscan 609 portsweep 610 RST 610 SYN (synchronize) 611 SYN flood 611 window size 588 technical reference 207 Telnet 819 and address groups 821 and address objects 821 and zones 821 with SSH 818 terminology differences bandwidth management 99 NAT 99 with other products 99 with ZyNOS 99 three-way handshake 612 throughput rate troubleshooting 885 TightVNC 766 time 785 time servers (default) 787 time to live 582 timestamp 582 title bar 54 token 724 to-ZyWALL firewall 424 and NAT 393 and
Index PPP 872 PWR 869 RADIUS server 882 routing 876 schedules 883 security settings 871 shell scripts 885 SIP 876 SNAT 876 SSL 880 SSL VPN 880 throughput rate 885 VLAN 873 VPN 879 VPN concentrator 879 zipped files 874 truncated-address-header attack 615 truncated-header attack 615, 616 truncated-options attack 615 truncated-timestamp-header attack 616 trunk 33, 102 trunks 278, 337 and ALG 407 and policy routes 338, 355 configuration overview 105 default 343 link sticking 338 member interface mode 344 member
Index user portal links 765 logo 490 see SSL user screens 493, 499 UTF-8 decode 614 user sessions, see sessions UTF-8-encoding attack 614 user SSL screens 493, 499 access methods 493 bookmarks 500 certificates 494 login 494 logout 500 required information 494 system requirements 494 User’s Guide 31 user-aware 133 users 689 access, see also access users admin (type) 689 admin, see also admin users and AAA servers 690 and authentication method objects 690 and content filtering 617 and firewall 436, 439 an
Index see also ALG 402 VPN 441 active protocol 476 and NAT 474 and the firewall 425 basic troubleshooting 877 hub-and-spoke, see VPN concentrator IKE SA, see IKE SA IPSec 441 IPSec SA proposal 471 security associations (SA) 442 see also IKE SA see also IPSec 441 see also IPSec SA see also L2TP VPN 441 status 219 troubleshooting 879 VPN concentrator 465 advantages 465 and IPSec SA policy enforcement 469 disadvantages 465 troubleshooting 879 VPN connections and address objects 444 and policy routes 355, 878
Index and authentication method objects 802 and certificates 801 and zones 803 see also HTTP, HTTPS 148, 799 Z zipped files troubleshooting 874 zones 96, 377 and firewall 424, 434 and FTP 823 and interfaces 96, 377 and SNMP 827 and SSH 818 and Telnet 821 and VPN 96, 377 and WWW 803 block intra-zone traffic 380, 432 configuration overview 107 default 98 extra-zone traffic 378 inter-zone traffic 378 intra-zone traffic 378 prerequisites 107 types of traffic 378 where used 107 ZyWALL terminology differences 99
