ZyXEL Communications 1000 manuel d'utilisation

www .zyxel.com www .zyxel.com ZyW ALL USG 1000 Unified Security Gateway Copyright © 2010 ZyXEL Communications Corporation Firmware V ersion 2.12 Edition 1, 3/2010 Default Login Details LAN P ort P1 IP Address https://192.168 .1.1 User Name admin Pa ss w o r d 1234[...]

[...]

About This User's Guide ZyWALL USG 1000 User’s Guide 3 About This User's Guide Intended Audience This manual is intended for people who want to want to configure the Z yW AL L using the W eb Configur ator . How T o Use This Guide •R e a d Chapter 1 on page 33 chapter for an overview of features av ailable on the Z yW ALL. •R e a d C[...]

About This User's Guide ZyWALL USG 1000 U ser’s Guide 4 • W eb Configurator O nline He lp Click the help icon in an y screen for help in configuring that screen and supplementary information. Documentation Feedback Send your comments, questions or su g gestions to: techwriters@zyxel.com.tw Thank you! The T echnical W riting T eam , Z yXEL [...]

About This User's Guide ZyWALL USG 1000 User’s Guide 5 See http://www .zyxel.com/web/contact_us.php for contact informat ion. Please have the follow in g informatio n re ady when you contact an office. • Product model and serial number . •W a r r a n t y I n f o r m a t i o n . • Date that you received yo ur device. • Brief descripti[...]

Document Conventions ZyWALL USG 1000 U ser’s Guide 6 Document Conventions W arnings and Notes These are how warnings and notes are shown in this User’ s Guide. W arnings tell you about things that could harm you or your device. Note: Notes tell you other import ant informat ion (for e xample, other things you may need to configure or help ful t[...]

Document Conventions ZyWALL USG 1000 User’s Guide 7 Icons Used in Figures Figures in this User’s Guide may use the following generic icons. The Z yW ALL icon is not an exact representation of your device. ZyW A L L Computer Notebook computer Server Firewall Te l e p h o n e Switc h Ro ut e r[...]

Safety Warnings ZyWALL USG 1000 U ser’s Guide 8 Safety Warnings • Do NO T use this product near water , for exam ple, in a wet basement or n ear a swimming pool. • Do NO T expose your device to dampness, dust or corrosive liquids. • Do NO T store things on the device. • Do NOT install, use, or service this device during a thunderstorm. Th[...]

Contents Overview ZyWALL USG 1000 User’s Guide 9 Contents Overview User ’ s Guide ......................................... .......... ........... .................................................... ......... 31 Introducing the ZyWALL .............. ................ .................... ................ ................ ................... ...[...]

Contents Overview ZyWALL USG 1000 U ser’s Guide 10 Content Filtering ............ ................. ................ ................ ................ ................ ............... .... ..... 617 Content Filter Reports ........ ................ ................ ................ ............. ................ ................ ... ..... 641 Anti[...]

Table of Contents ZyWALL USG 1000 User’s Guide 11 Table of Contents About This User's Guide ..................................................... ................................................... .. 3 Document Conventions.................................................................. ......................................... .6 Safety W[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 12 3.3 Web Configurator Screens Overview .... ................. ................ ................ ................ ............. 53 3.3.1 T itle Bar ..... ... ... .... ... ................ ............. ... ... .... ... ... ... .... ... ............. ... ... ... .... ... ... ... ... ....... 54 3.3.2[...]

Table of Contents ZyWALL USG 1000 User’s Guide 13 6.2.1 Interface T ypes .......... ... .... ... ... ... ... .... ... ... ... ................. ... ... ................ ... .... ................ . .. 97 6.2.2 Default Interface and Zone Configuration .................. ................ ................ ................ 98 6.3 T erminology in the Z[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 14 7.1 How to Configure Interfaces, Port Grouping, and Zones ........................ ... ... .... ... ... ... ... .... .. 1 19 7.1.1 Configure a W AN Ethernet Interface ... ... ... .... ... ... ... ................ .... ... ... ... .... ... ... ... ... .... . 1 20 7.1.2 Configure Zones ..... ... ..[...]

Table of Contents ZyWALL USG 1000 User’s Guide 15 7.14 How to Use Active-Passive Device H A ................... ................ ................ ................ ........ 164 7.14.1 Before Y o u S tar t ................... ................ ................ ................ ................. ................ . 16 5 7.14.2 Configure Device HA on t[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 16 10.6 The DDNS S tatus Screen .... .................... ... .......... ................ ................ ................ ........... 236 10.7 IP/MAC Binding Monitor ...... .................... ... ................ ................ ............. ................ ........ 2 36 10.8 The Login Users [...]

Table of Contents ZyWALL USG 1000 User’s Guide 17 13.2 Port Grouping ............ ................ ................ ................... ................ ................. ........... ...... 280 13.2.1 Port Grouping Overview ............. ................. ................ ................ ................ ........... 281 13.2.2 Port Grouping Scre[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 18 Chapter 16 Routing Protocols ...................... ..................................................... ................................... ... 363 16.1 Routing Protocols Overvi ew ............. .................... ................ ................ ................ ........... 363 16.1.1 What [...]

Table of Contents ZyWALL USG 1000 User’s Guide 19 20.2.1 The HTTP Redire ct Edit Screen . ................. ................ ................ ................ ........... 400 Chapter 21 ALG ............................................. ..................................................... .......................... ............ 401 21.1 ALG Overv[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 20 25.1 IPSec VPN Ov erview ........ ................... ................. ................ ................ ................... ........ 441 25.1.1 What Y ou Can Do in this Chapter ..... ... ................ ............. ................ ................ ..... 441 25.1.2 What Y ou Need to Know ...[...]

Table of Contents ZyWALL USG 1000 User’s Guide 21 29.1.1 What Y ou Need to Know ............ ................. ................ ................ ................ ........... 505 29.2 The Main File Sharing Screen ............. .... ............. ................ ................ ................ ........... 506 29.3 Opening a File or Folder ......[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 22 33.1.2 What Y ou Need to Know ............ ................. ................ ................ ................ ........... 548 33.1.3 Before Y ou Begin ....... .... ................ ................ ................ ................ ................ ........ 550 33.2 Anti-Virus Summary Screen ..[...]

Table of Contents ZyWALL USG 1000 User’s Guide 23 35.1.4 Before Y ou Begin ....... .... ................ ................ ................ ................ ................ ........ 598 35.2 The ADP General Sc reen . ................ ................ ................. ................ ................ .............. 599 35.3 The Profile Summary S[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 24 38.7 Anti-S p am T echnical Ref erence .................... .................... ................ ................... ........... 662 Chapter 39 Device HA .............. ..................................................... ................................................... ........ 667 39.1 Ove[...]

Table of Contents ZyWALL USG 1000 User’s Guide 25 42.1.1 What Y ou Can Do in this Chapter ..... ... ................ ............. ................ ................ ......71 1 42.1.2 What Y ou Need to Know ............ ................. ................ ................ ................ ............ 71 1 42.2 The Service Summary Screen . ........[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 26 46.1.3 V erifying a Certificate . ................ ................. ................ ................... ................ ........ 741 46.2 The My Certificates Screen ........ ................ ................ ................ ................ ................ ..... 74 3 46.2.1 The My Certificat[...]

Table of Contents ZyWALL USG 1000 User’s Guide 27 50.4 Console Port S peed .......... ................ .................... ................ ................ ................ ......... .. 789 50.5 DNS Overview ..... ................ ................ ................. ................ ................... ................ .... .... 789 50.5.1 DNS S[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 28 51.1.1 What Y ou Can Do In th is Chapter .. ................ ................ ................ ................ ........ 833 51.2 Email Daily Report ..... ................ ................ ................ ................ ................ ................ . .... 833 51.3 Log Setting Screens .. .[...]

Table of Contents ZyWALL USG 1000 User’s Guide 29 Chapter 57 Product Sp ecifications ................................... ..................................................... ................. 891 57.1 3G PCMCIA Card Installati on ........... ................ ................. ................ ................ .............. 8 97 Appendix A Log D[...]

Table of Contents ZyWALL USG 1000 U ser’s Guide 30[...]

31 P ART I User ’ s Guide[...]

32[...]

ZyWALL USG 1000 User’s Guide 33 C HAPTER 1 Introducing the ZyWALL This chapter gives an overview of t he Z yWALL. It explains the front panel ports, LEDs, introduces the manage ment methods, and lists di fferent w ays to start or stop the Z yW ALL. 1.1 Overview and Key Default Settings The Z yWALL is a comprehensive security device. It s flexible[...]

Chapter 1 Introducing the ZyWALL ZyWALL USG 1000 U ser’s Guide 34 1.2.1 Rack-Mounted Inst allation Procedure 1 Align one brack et with the holes on one si d e of the Z yW ALL and secure it with the included br acket screws (smaller than the r ack -mounting sc rews). 2 Attach the other brack et in a similar fashion. Figure 1 Att aching Mounting Br[...]

Chapter 1 Introducin g the ZyWALL ZyWALL USG 1000 User’s Guide 35 1.3 Front Panel This section introduces the Z yWALL’ s front panel. Figure 3 ZyW A LL Front Panel 1.3.1 Front Panel LEDs The following table describes t he LEDs. 1.4 Management Overview Y ou can use the followin g ways to manage the Z yW ALL. T able 1 Front Panel LEDs LED COLOR S[...]

Chapter 1 Introducing the ZyWALL ZyWALL USG 1000 U ser’s Guide 36 Web Configurator The W eb Confi gurator allows easy Z yW ALL setup and management using an Internet browser . This User’ s Guid e prov ides information about the W eb Configurator . Figure 4 Managing the ZyW ALL: Web Configu rator Command-Line Interface (CLI) The CLI allows you t[...]

Chapter 1 Introducin g the ZyWALL ZyWALL USG 1000 User’s Guide 37 Always use Maintenance > Shut down > Shut down or the shutdown command before you turn off the Zy W ALL or remove the power . Not doing so can cause the firmwa re to become corr upt. The Z yWALL does not stop or start the system processes when y ou apply configuration fi les [...]

Chapter 1 Introducing the ZyWALL ZyWALL USG 1000 U ser’s Guide 38[...]

ZyWALL USG 1000 User’s Guide 43 C HAPTER 2 Features and Applications This chapter introduces the main features and applications of the Z yWALL. 2.1 Features The Z yWALL ’s security features include VPN, firew all, anti- virus, content filtering, IDP (Intrusion Detection and Prev en tion), ADP (Anomaly Detection and Protection), and certificat e[...]

Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 44 Firewall The Z yWALL’ s firew all is a stateful inspection firew all. The Z yWALL rest ricts access by screening data packets against defined access rules. It can also inspect sessions. F or example, tr affic from one zone is not allowed unle ss it is initiated by a computer i[...]

Chapter 2 Features an d Applications ZyWALL USG 1000 User’s Guide 45 Anti-Virus Scanner With the anti- virus packet s canner , your Z yW ALL scans files tr ansmitting through the enabled interfaces into the network. The Z yW ALL helps stop threats at the network edge before they reach th e local host computers. Anti-Sp a m The anti-spam feature c[...]

Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 46 2.2.1 VPN Connectivity Set up VPN tunnels with other companies, branch offices, t elecommuters, and business tr a velers to provide secure access t o y our network. Y ou can also set up additional connections to the Inte rnet to provide better service. Figure 13 Applicatio ns: V[...]

Chapter 2 Features an d Applications ZyWALL USG 1000 User’s Guide 47 Y ou do not have to install additional client software on the remote user computers for access. Figure 14 Network Access Mode: Reverse Proxy 2.2.2.2 Full T unnel Mode In full tunnel mode, a virtual connection is created for remote users with private IP addresses in the same subn[...]

Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 48 2.2.3 User-A ware Access Control Set up security policies that restrict access to sensitiv e information and shared resources based on the user who is trying to access it. Figure 16 Applications: User-A ware Access Control 2.2.4 Multiple W AN Interfaces Set up multiple connect i[...]

Chapter 2 Features an d Applications ZyWALL USG 1000 User’s Guide 49 2.2.5 Device HA Set up an addit ional Z yW ALL as a backup gatew ay to ensure the defaul t gateway is always availab le for the network. Figure 18 Applications: Device HA[...]

Chapter 2 Features and Applications ZyWALL USG 1000 U ser’s Guide 50[...]

ZyWALL USG 1000 User’s Guide 51 C HAPTER 3 Web Configurator The Z yW ALL W eb Configur ator allows easy Z yW ALL setup and management usi ng an Internet browser . 3.1 W eb Configurator Requirement s In order to use the W e b Configur ator , you must • Use Internet Explorer 7 or la ter , or Firefox 1.5 or l ater • Allow pop-up wi ndows (block [...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 52 2 Open your web browser , and go to http://192.168.1.1 . By default, the Z yWALL automatically routes this req uest to its HT TPS server , and it is recommended to keep this setting. The Login screen appears. Figure 19 Login Screen 3 T ype the user name (default: “adm in”) and p[...]

Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 53 5 The screen above appears every time y ou log in using the default user name and default password. If you chang e the passw ord for the default user account, this screen does not appear anymore. Fol low the directions in this screen. If you change the default password, the Login screen ([...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 54 • B - navigati on panel • C - main window 3.3.1 T itle Bar The title bar prov ides some icons in the upper right corner . Figure 22 Tit l e B a r The icons provide the following functions. 3.3.2 Navigation Panel Use the menu items on the na vigati on panel to open screens to con[...]

Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 55 hide the navigation panel menus or drag it to resize them. The following sections introduce the Z yWALL ’s navigati on panel menus and their screens. Figure 23 Navigation Pan el 3.3.2.1 Dashboard The dashboard displays gener al device information, system status, system resource usage, l[...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 56 3.3.2.3 Configuration Menu Use the configurat ion menu screens to configure the ZyW ALL’ s features. Cellular Status Displays details about the Z yW ALL’ s 3G connection status. AppP atrol Statistics Displays bandwidth and protocol statistics. VPN Monitor IPSec Displays and mana[...]

Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 57 Interface Por t Gr o up i ng Configure physical port groups. Ethernet Manage Ethernet interfaces and virtual Ethernet interfaces. PPP Create and manage PPPoE and PPTP interfaces. Cellular Configure a cellular Internet connection for an installed 3G card. VLAN Create and manage VLAN interf[...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 58 L2TP VPN L2TP VPN Configure L2TP Over IPSec VPN settings. AppPatrol Gener al Enable or disable traffic management by application and see registration and signature information. Common Manage tr affic of the most commonly used web, file transfer and e-mail protocols. IM Manage instan[...]

Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 59 User/Group User Create and manage users. Group Create and manage groups of users. Setting Manage default settings for all users, general settings for user sessions, and rules to force user authentication. Address Address Create and manage host, range, and network (subnet) addresses. Addre[...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 60 3.3.2.4 Maintenance Menu Use the maintenan ce menu screens to mana ge configuration and firmw are files, run diagnostics, and reb oot or shut down the Z yWALL. 3.3.3 Main Window The main window shows the screen you sele ct in the navigation panel. The main window screens are discuss[...]

Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 61 3.3.3.1 W a rning Messages W arning messages, such as those resultin g from misconfigur ation, display in a popup window . Figure 24 W arning Message 3.3.3.2 Site Map Click Site MAP to see an o v erview of links to the W eb Configur ator screens. Click a screen’ s link to go to that s c[...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 62 settings reference the object. The follo wing example shows which configuration settings reference the ldap-users user obje ct (in this case the first firewall rule). Figure 26 Object Refer ence The fields vary with the t ype of object. The following table describes labels that can [...]

Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 63 3.3.3.4 CLI Messages Click CLI to look at the CLI commands sen t by th e Web Configurator . These commands appear in a popup window , such as the following. Figure 27 CLI Messages Click Clear to remove the currently displa y ed information. See the Command Reference Guide fo r information[...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 64 • Sort in ascending alphabetical order • Sort in descending (reverse) al phabetical order • Select which columns to display • Group entries by field • Show entries in groups • Filter by mathematical oper ators (< , >, or =) or searching for text Figure 29 Common T [...]

Chapter 3 Web Configurator ZyWALL USG 1000 User’s Guide 65 4 Select a column heading and dr ag and drop it to change the column order . A green check mark displays next to the col umn’s title when you drag the column to a valid new location. Figure 31 Changing the Column Order 5 Use the icons and fields at the bottom of the table to navigate to[...]

Chapter 3 Web C onfig ur a t or ZyWALL USG 1000 U ser’s Guide 66 Here are descriptions for the most common table icons. 3.3.4.3 Wo rking with List s When a list of av ailable entries displays ne xt to a list of sele cted entries, you can often just double-click an entry to move it from one list to the other . In some lists you can also use the [S[...]

ZyWALL USG 1000 User’s Guide 67 C HAPTER 4 Installation Setup Wizard 4.1 Inst allation Setup Wizard Screens If you lo g into the W eb Configurator when the Z y WALL is using its def ault configuration, the firs t Installation Setup Wizard screen displays. This wizard helps you configure Internet connection settings and activate subscript ion serv[...]

Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 1000 U ser’s Guide 68 4.1.1 Internet Access Setup - W AN Interface Use this screen to set how many W AN interfaces to configure and the first W AN interface’ s type of encapsulation and method of IP address assignment. The screens v ary depending on the encapsulation type. Refer to information [...]

Chapter 4 Installa tion Setup Wizard ZyWALL USG 1000 User’s Guide 69 Note: Enter the Internet access in formation exactly as given to you by your ISP . Figure 37 Internet Access: Ethernet Encapsulation • Encapsulation : This displays the type of Internet connection you are configu ring. • First WAN Interface : This is the number of the in ter[...]

Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 1000 U ser’s Guide 70 4.1.3 Internet Access: PPPoE Note: Enter the Internet access in formation exactly as given to you by your ISP . Figure 38 Internet Access: PPPoE Encapsulation 4.1.3.1 ISP Parameters • T ype the PPPoE Service Name from your service provider . PPPoE uses a service name to id[...]

Chapter 4 Installa tion Setup Wizard ZyWALL USG 1000 User’s Guide 71 4.1.3.2 W AN IP Address Assignment s • WAN Interface : This is the name of the interfac e that will conne ct wit h your ISP . • Zone: This is the se curity zone to wh ic h thi s int er face and Inter net co nnection will belong . • IP Address : Enter your (s tatic) public [...]

Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 1000 U ser’s Guide 72 • CHAP/PAP - Y our ZyW ALL accepts either CHAP or P AP when requested by the remote no de . • CHAP - Y our ZyW ALL accepts CHAP onl y . • PAP - Y our Z yWALL accept s PAP onl y . • MSCHAP - Y our Z yWALL accept s MSCHAP only . • MSCHAP-V2 - Y our Z yWALL acc epts M[...]

Chapter 4 Installa tion Setup Wizard ZyWALL USG 1000 User’s Guide 73 4.1.6 Internet Access Se tup - Second W AN Interface If you se lected I have two ISPs , after you configure the First WAN Interface , you can configure the Second WAN Interface . The screens for configuring the second WAN interf ace are simil ar to the first (see Section 4.1.1 o[...]

Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 1000 U ser’s Guide 74 Note: If you have not already do ne so, you can register your ZyW ALL with myZyXEL.com and activate trials of services like IDP . Click Next and us e the foll owing screen to perform a basic registrati on (see Section 4.2 on page 74 ). If you w ant to do a more detailed regi[...]

Chapter 4 Installa tion Setup Wizard ZyWALL USG 1000 User’s Guide 75 • Select existing myZyXEL.com account if you already have an account at myZ yXEL.com and enter your user name and password in the fields below to register your Z yWALL. •E n t e r a User Name for your myZ yXEL.com account. Us e from six to 20 alphanumeric characters (a nd th[...]

Chapter 4 Ins ta llat ion Setu p Wizard ZyWALL USG 1000 U ser’s Guide 76[...]

ZyWALL USG 1000 User’s Guide 77 C HAPTER 5 Quick Setup 5.1 Quick Setup Overview The W e b Configurator's qu ick setup wizards hel p you configur e Internet and VPN connection settings. This chapt er pro vid es informa t io n on configu r in g the quick setup screens in the W eb Configur ator . See the feature-specific chapters in this User?[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 78 5.2 W AN Interface Quick Setup Click WAN Interface in the main Quick Setup screen to open the WAN Interface Quick Setup Wizard Welcome screen. Use these screens to configure an interface to co nnect to the internet. Click Next . Figure 45 W AN Interface Quick Setup Wizard 5.2.1 Choose an Ethe[...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 79 Otherwise, choose PPPoE or PPTP for a dial-up connection according to the information from y our ISP . Figure 47 W AN Interface Setup: S tep 2 The screens v ary depending on what encapsulation t ype you use. Refer to i n f or ma t i o n pr ov i d e d b y yo ur IS P t o k n o w w ha t t o e n t[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 80 • IP Address Assignment : Select Auto If y our ISP did not assign you a fix ed IP address. Select Static If the ISP assigned a fixed IP address. 5.2.4 W AN and ISP Connection Settings Use this screen to configure the ISP an d WAN interface settings. This screen is read-only if you set th e [...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 81 Authentication Ty p e Use the drop-down list box to select an authentication protocol for outgoing calls. Options are: CHAP/PAP - Y our Z y WALL accepts either CHAP or P AP when requested by this remote node. CHAP - Y our Z y WALL accepts CHAP only . PAP - Y our ZyW ALL accepts PAP only . MSCH[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 82 5.2.5 Quick Setup Interface Wizard: Summary This screen displa ys the WAN i nterface’ s setting s. Figure 50 Interface Wizard: Su mmary W AN (PPTP Shown) The following table describes t he labels in this screen. First DNS Server Second DNS Server These fields only display for an interface w[...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 83 5.3 VPN Quick Setup Click VPN Setup in the main Quick Setup screen to open the VPN Setup Wizard Welcome screen. The VPN wizard creates corresponding VPN connection and VPN gateway settings and ad dress objects that you can use later in configur ing more VPN connec ti ons or other features. Cli[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 84 5.4 VPN Setup Wizard: W izard T ype A VPN (Virtual Private Network) tunnel is a secure connecti on to another computer or network. Use this screen to select wh ich type of VPN connection you wan t to configure. Figure 52 VPN Setup Wizard: Wizard T ype Express : Use this wizard to create a VPN[...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 85 5.5 VPN Express Wizard - Scenario Click the Express radio button as shown in Figure 52 on page 84 to display the following screen. Figure 53 VPN Express Wizard: S tep 2 Rule Name : T ype the name used to identify thi s VPN connection (and VPN gateway) . Y ou may use 1-31 alphanum eric char act[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 86 5.5.1 VPN Express Wizard - Configuration Figure 54 VPN Express Wizard: S tep 3 • Secure Gateway : If Any displa ys in this field, it i s not configurable for the chosen scenario. If this field is conf i gurable, enter the W AN IP address or domain name of the remote IPSec devi ce (secure ga[...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 87 5.5.2 VPN Express Wizard - Summary This screen provides a read-only summary of the VPN tunnel’ s configuration and also commands that you can copy and paste into another ZLD-based Z yW ALL’ s command line interface to configure it. Figure 55 VPN Express Wizard: S tep 4 • Rule Name : Iden[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 88 5.5.3 VPN Express Wizard - Finish Now you can use the VPN tunnel. Figure 56 VPN Express Wizard: S tep 6 Note: If you have not already do ne so, use t he myZyXEL.com link and register you r ZyW ALL with myZyXEL.com and activate trials of services like IDP . Click Close to exit the wizard.[...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 89 5.5.4 VPN Advanced Wizard - Scenario Click the Advanced radio button as shown in Figure 52 on p age 84 to di spla y the following screen. Figure 57 VPN Advanced Wizard: Scenario Rule Name : T ype the name used to identify thi s VPN connection (and VPN gateway) . Y ou may use 1-31 alphanum eric[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 90 • Remote Access (Client R ole) - Choose this to connect to an IPSec server . Thi s Z yWALL is the cli ent (dial-in user) and can initiate the VPN tunnel. 5.5.5 VPN Advanced Wizard - Phase 1 Settings There are two phases to every IKE (Internet K ey Exchange) negotiation – phase 1 (Authenti[...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 91 that uses a 168-bit k ey . As a result, 3DES is more secure than DES. It also requires more processing power , result ing in increased latency and decreased throughput. AES128 uses a 128-bit ke y and is faster than 3DES. AES 192 uses a 192-bit ke y and AES256 uses a 256- bit key . • Authenti[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 92 5.5.6 VPN Advanced Wizard - Phase 2 Phase 2 in an IKE uses the SA t hat was established in phase 1 t o negotiate SAs for IPSec. Figure 59 VPN Advanced Wizard: S tep 4 • Active Protocol : ESP is compatible with NA T , AH is not. • Encapsulation : Tunn el is com p atible w it h NA T , Trans[...]

Chapter 5 Quick Setup ZyWALL USG 1000 User’s Guide 93 • Nailed-Up : This displays for the site-to-si te and remote access client role scenarios. Select this to have the Z y W ALL automatically renegot iate the IPSec SA when the SA l ife time expires. 5.5.7 VPN Advanced Wizard - Summary This is a read-only summary of the VPN tunnel settings. Fig[...]

Chapter 5 Quick Setup ZyWALL USG 1000 U ser’s Guide 94 5.5.8 VPN Advanced Wizard - Finish Now you can use the VPN tunnel. Figure 61 VPN Wizard: S tep 6: Advanced Note: If you have not already do ne so, you can register your ZyW ALL with myZyXEL.com and activate trials of services like IDP . Click Close to exit the wizard.[...]

ZyWALL USG 1000 User’s Guide 95 C HAPTER 6 Configuration Basics This information is provided to help yo u configure the ZyW ALL effectively . Some of it is helpf u l wh en you are ju st gettin g st a r t e d . So m e of it is provided for your reference when you configure various features in the Z yW ALL. • Section 6.1 on page 95 introduces the[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 96 objects whenever the interface’ s IP addres s settings change . For example, if you change an Ethernet interf ace’ s IP address, the Z y WALL automatically updates the rules or settings that use the interf ace-based, LAN subnet ad dress object. Y ou can use the Configuratio[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 97 6.2.1 Interface T ypes There are man y types of interfaces in th e Z yWALL. In addition to being used in various features, i nterfaces also describe the network that is direct ly connected to the ZyW ALL. • Ethernet interfaces are the foundation for defi ni ng oth er interfaces [...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 98 6.2.2 Default Interface and Zone Configuration This section introduces the Z yWALL’ s default zone member ph ysical interfaces and the default configuration of those interfac es. The following figure uses letters to denote public IP addresses or part of a priv ate IP address.[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 99 6.3 T erminology in the ZyW ALL This section highlights some differences in terminology or organization between the ZLD-based Z yWALL and ot her routers, particularly Z yNOS routers. T able 14 ZLD ZyWALL Terminology That is Different Than ZyNOS ZYNOS FEATURE / T ERM ZLD ZYW ALL FE[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 100 6.4 Packet Flow Here is the order in which the Z yW A LL applies its features and checks. Figure 64 Packet Flow 6.4.1 ZLD 2.20 Packet Flow Enhancement s ZLD version 2.20 has been enhanced to simplif y configurat ion. The packet flow has been changed as follows: • Automatic S[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 101 • Y ou do not need to set up policy routes for 1:1 NA T entries. • Y ou can create Many 1:1 NA T entries to translate a r ange of priv ate network addresses to a r ange of public IP addresses • Static an d dynamic ro utes have th eir own cate gory . Even wi th these chan ge[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 102 2 Policy Routes : These are the user-configured policy routes. Configure policy routes to send packets through the ap propriate interface or VPN tunnel. See Chapter 15 on page 347 for more on policy routes. 3 1 to 1 and Many 1 to 1 NAT : These are the 1 to 1 NA T and many 1 to[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 103 Z yWALL stops checking the packets against the NA T table and moves on to bandwidth management. Figure 66 NA T T able Checking Flow 1 SNA T defined in the policy routes . This was already in ZLD 2.1x. 2 1 to 1 SNA T (including Many 1 to 1) is also included in the NA T table. 3 NA[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 104 6.5.1 Feature This provides a brief description. See the appropriate chapter(s) in this Us er’s Guide for more information about any feature. Example: This provi des a simple example to show you how to configure this feature. The example is usually ba sed on the network topo[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 105 subscription to update the anti -virus and IDP/ap plication patrol signatures Y ou must have Internet access to myZ yXEL.com. 6.5.4 Interface See Section 6.2 on page 96 for background information. Note: When you create an interfa ce, there is no security ap plied o n it until you[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 106 Example: Y ou h a ve a n F TP s e r ve r co n n ec t e d to ge4 (in the DMZ zone). Y ou want to limit the amount of FTP tr affic that goes out from the FTP server through y our WAN c on n e c t io n . 1 Create an address object for t he FTP server ( Object > Ad dress ). 2 C[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 107 6.5.8 Zones See Section 6.2 on page 96 for background information. A zone is a group of interfaces and VPN tunnels. T he Zy WALL uses zones, not interfaces, in man y security settings, such as fire w all rules and remote management. Z ones cannot overlap. Eac h interface and VPN [...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 108 1 Click Configuration > Network > NAT to configure th e NA T entry . Add an entry . 2 Name the entry . 3 Select the W AN interface that the FTP traffic is to come in through. 4 Specify the public WAN IP address where the Z yW ALL will receiv e the FTP pack ets. 5 In the [...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 109 6.5.12 ALG The Z yWALL’ s Appl ication Layer Gatewa y (ALG) allows V oIP and F TP applications to go through NA T on the ZyW ALL. Y o u can also specify additional si gnaling port numbers. 6.5.13 Auth. Policy Use authentication polic ies to contro l who can access the network. [...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 11 0 3 Click Configuration > Firewall to go to the firew all configur ation. 4 Select from the DMZ zone t o the LAN1 zone, and add a firewall rule using the items you ha ve configured. • Y ou don’ t need to specify the schedule or the user . •I n t h e Source field, selec[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 111 6.5.17 L2TP VPN Use L2TP VPN to let remote users use the L2TP and IPSec cli ent softw are includ ed with their computers’ operati ng systems to securely connect to the network behind the Z yWALL. Example: See Chapter 8 on page 171 . 6.5.18 Application Patrol Use application pat[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 11 2 6.5.19 Anti-V irus Use anti-v irus to detect and tak e action on viruses. Y ou must subscribe to use anti-vi rus. Y ou can subscribe using the Licensing > Registration screens or one of the wizards. 6.5.20 IDP Use IDP to detect and tak e action on malicious or suspici ous [...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 11 3 2 Create a schedule for the work day ( Configuration > Object > Schedule ). 3 Click Configuration > Anti-X > Content Filter > Filter Profile . Click the Add icon to go to the sc reen where you ca n configure a category-based profil e. 4 Name the profile and enable[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 11 4 6.6 Object s Objects store information and are ref erenced by other features. If you up date this informat ion in resp onse to changes, th e Zy WALL automatically propagates the change through the features that use the o bjec t. Move yo ur cu rsor ove r a configur ation objec[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 11 5 If you want to force us ers to log in to the ZyW ALL before the Z yWALL routes traffic for them, you might have to configure prerequis ites first. 6.7 System This section introduces some of the management featu res in the Z yW ALL. Use Host Name to configure the system and domai[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 11 6 2 Create an address object for t he administr ator’s computer ( Configuration > Object > Ad dress ). 3 Click Configuration > System > WWW to configure the HT TP management access. Enable HT TPS an d ad d an administrator service control entry . • Select the ad[...]

Chapter 6 Configu ra tio n Bas ics ZyWALL USG 1000 User’s Guide 11 7 Always use Maintenance > Shut down > Shut down or the shutdown command before you turn off the Zy W ALL or remove the power . Not doing so can cause the firm ware to become corrupt. MENU ITEM(S) Maintenance > Shutdo wn[...]

Chapter 6 Con figu ra tio n Bas i cs ZyWALL USG 1000 U ser’s Guide 11 8[...]

ZyWALL USG 1000 User’s Guide 11 9 C HAPTER 7 Tutorials Here are examples of using the W eb Conf igurator to set up features in the Zy WA L L . S e e a l s o Chapter 8 on page 171 for an example of configuring L2TP VPN. Note: The tuto rials featured h ere require a basic u nd ers t a nd i ng of c onn ecting to and using the W eb Configur ator , se[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 120 • Y ou want to be able to apply security settings s pecifically for all VPN tunnels so you create a new VPN zone. Figure 67 Ethernet In terface, Port Grouping, and Zone Configuration Example 7.1.1 Configure a W AN Ethernet Interface Y ou need to assign the Z yWALL’ s ge2 interface a static[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 121 1 Click Configuration > Network > Zone and then the Add icon. 2 Enter VPN as the name, select Default_L2TP_VPN_Connection a n d m o ve i t t o the Member box and clic k OK . Figure 69 Configura tion > Network > Zone > W AN Edit 7.1.3 Configure Port Grouping Here is how to combine[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 122 3 Click Dashboar d , and look at the Interface Status Summary . Ethe rnet interface ge4 has a status of Port Group Up if it is connect ed or Port Group Down if it is not connected. Ethernet i nterfaces ge5 has a Status of Port Group Inactive . Figure 71 Dashboard: Inter face S t atus Summary A[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 123 4 Enable the interface and add it to a z one. It is highly recommended that you set the Zone to WAN to apply your W AN zone security settings t o this 3G connection. Leaving Zone set to none has the Z yW ALL not apply any securit y settings to the 3G connection. Enter the PIN Code provided by t[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 124 This way t he Z yWALL can automatically balance the tr affic load amongst the available W AN connections to enhance over all network throughput. Plus, if a WAN connection goes down, the Z yW ALL still sends traf fic through the remaining W AN connections. F or a simple test, disconnect all of [...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 125 1 Click Configuration > Network > Interface > Ethernet and double-click t he ge2 entry . Enter the a vailable bandwidth (1000 kbps) in t he Egress Bandwidth field. Click OK . Figure 76 Configura tion > Network > Interface > Ethernet > Edit (ge2) 2 Re peat the process to set[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 126 2 Name the tru n k a nd se t the Load Balancing Algorithm field to Weighted Round Robin . Add ge2 and enter 2 in the Weight column. Add ge3 and enter 1 in the Weight column. Click OK . Figure 77 Configura tion > Network > Interface > T runk > Add[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 127 3 Select the trunk as the defaul t trunk and click Apply . Figure 78 Configura tion > Network > Interface > T runk 7.4 How to Set Up an IPSec VPN T unnel This example shows how to use the IPSec VPN configuration screens to create the following VPN tunnel, see Section 5.4 on page 84 for[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 128 In this example, the Z yW ALL is router X (1.2.3.4), and the remote IPSec router is router Y (2.2.2.2). Create the VPN tunnel between Z yW ALL X ’s L AN s ub n et (192.168.1.0/24 ) and the LAN subnet behind peer IPSec router Y (172 .16.1.0/ 24). 7.4.1 Set Up the VPN Gateway The VPN gateway m[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 129 7.4.2 Set Up the VPN Connection The VPN con ne ction mana ge s the IPSec SA. Y ou have to set up th e ad dr ess objects for the local network and remote net work before you can set up th e VPN connection. 1 Click Configuration > Object > Address . Click the Add icon. 2 Give the new addres[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 130 4 Enable the VPN connection an d na me it (“VPN_CONN_EXAMPLE”). Under VPN Gateway select Site-to-site and the VPN ga teway ( VPN_GW_EXAMPLE ). Under Policy , select LAN_SUBNET for the local network and VPN_REMOTE_SUBNET for the remote. Click OK . Figure 82 Configura tion > VPN > IPSe[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 131 7.5 How to Configure a Hub-and-spoke IPSec VPN Without a VPN Concentrator A hub-and-spok e IPSec VPN connects IP Sec VPN tunnels to form one secure network. This reduces the number of VPN connections th at you have to set up and maintain in the network. He re is an example of a hub-and-spoke VP[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 132 • My Address: 10.0.0.1 • P eer Gatew ay Address: 10.0.0.2 VPN Connection (VPN T unnel 1): • Local P olicy: 192.168.168.0~192.168.169.255 • Remote P olicy:1 92.168.167.0/255.255.255.0 • Disable Policy Enforce ment VPN Gateway (VPN T unnel2): • My Address: 10.0.0.1 • P eer Gatew ay[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 133 • T o have al l Internet access from the spoke routers to go t hrough the VPN tunnel, set the VPN rul es in the spoke routers to use 0.0.0.0 (any) as the remote IP address. • Y our firewall rules can still block VPN packets. • If the USG ZyW ALLs’ VPN tunnels are member s of a single zo[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 134 7.6.1 Set Up User Account s Set up one user account for each user a ccount in th e RA D IUS server . If it is possible to export user names from the RADIUS server to a text file, then y ou might create a script to creat e the user accounts instead. This example uses the W eb Configurator . 1 C[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 135 2 Enter the n ame of the grou p that is used i n T a ble 20 on page 133 . In this example, it is “Finance” . Then, select User/Leo and click the right arrow to move him to the Member list. This example only has one member in this group, so cl ic k OK . Of course you could add more members l[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 136 1 Click Configuration > Object > AAA Server > RADIUS . Double-click the radius entry . Configure the RADIUS server’ s address authentication port (1812 if you were not told otherwise), key , and click Apply . Figure 86 Configura tion > Object > AAA Server > RADIUS > Add [...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 137 Note: The users will have to lo g in using the W eb Configurator login screen befo re they can use HTTP or MSN. Figure 88 Configura tion > Object > User/Group > Setting > Add (Force Use r Authentication Policy) When the users try to brow se the web (or use an y HT TP/HT TPS applicat[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 138 1 Click Configuration > AppPatrol . If application patrol and b andwidth management are not enabled, enable them, and click Apply . Figure 89 Configura tion > AppPatrol > General 2 Click the Common tab and double-clic k the http entry . Figure 90 Configura tion > AppPatrol > Com[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 139 3 Double-click the Defau lt policy . Figure 91 Configura tion > AppPatrol > Common > http 4 Change the access to Dr op because you do n ot want any one except authoriz ed user groups to browse the web. Click OK . Figure 92 Configura tion > AppPatrol > Common > http > Edit D[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 140 5 Click the Add icon in the policy list. In the ne w policy , select one of the user groups that is allowed to browse the web and set the corresponding bandwidth restriction in the Inbound and Outbound fiel ds. Click OK . R epeat this process to add exceptions for all the other user grou ps th[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 141 2 Give the schedule a descriptive name. Set up the d ays (Monday through Friday) and the times (8:30 - 18:00) when Sal es is allowed to use MSN. Click OK . Figure 94 Configura tion > Object > Schedule > Add (Recur ring) 3 Fol low the steps in Section 7.6.4 on page 137 to set up the app[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 142 2 Click the Add icon again and create a rule for one of the user groups that is allowed to access the DMZ. Figure 96 Configura tion > Firewall > Add 3 Re peat this proc ess to set up firewall rules for the other user groups that are allowed to access the DMZ. 7.7 How to Use a RADIUS Serv[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 143 1 Click Configuration > Object > AAA Server > RADIUS . Double-click the radius entry . Besides configuring the RADIUS server’ s address, authentication port, and key; set the Group Membership Attribute fiel d to the attri but e that the Z yW ALL is to check t o determine to which gro[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 144 2 Now you add ext -group-user user objects t o identify groups based on the group identifier values. Set up one user account for each group of user account s in the RADIUS server . Click Configuration > Object > User/Group > User . Click the Add icon. Enter a user name and set the Use[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 145 • Select Endpoint must have Personal Firewall installed and move the K asper sk y Internet Sec uri ty en tries to th e allowed list (you can double-click an entry to move it). • Select Endpoint must have Anti-Virus softwa re installed and move the K aspersk y Internet Sec uri ty an d Kasper[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 146 Repeat as needed to create endpoint secu rity objects for other Windows operating system versions. 7.8.2 Configure the Authentication Policy Click Configuration > Auth. Policy > Add to open the En dpoint Security Edit screen. Use this screen to configure an authentication p olicy to use [...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 147 4 T urn on authentication policy and click Apply . Figure 101 Configuration > Au th. Policy The following figure shows an error me ssage example when a user’ s computer does not meet an endpoint securi ty object’ s requirements. Click Close to return to the login screen. Figure 102 Examp[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 148 user access (logging into SSL VPN for example). See Chapter 50 on page 783 for more on service control. The T o-Z yWALL firewall rules apply to any ki nd of HTTP or HT TPS connection to the Z yWALL . They do not distinguish between administrator management access and user access. If you conf i[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 149 4 Select the new rule and click the Add icon. Figure 105 Configur ation > System > WWW (First Example Admin Service Rule Configured) 5 In the Zone field select ALL and set the Action to Deny . Click OK . Figure 106 Configuration > System > WWW > Service Control Rule Edit[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 150 6 Click Apply . Figure 107 Configuration > System > WWW (Sec ond Example Ad min Service Rule Configured) Now administr ator access to the W eb Conf igur at or can only come from the LAN zone. Non-admin users can still use HTTPS to log into the Z yW ALL from any of the Z yWALL’ s zones [...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 151 for ge2 IP address 10.0.0.8 t o a H.323 de vice located on the LAN and using IP address 192.168.1.56. Figure 108 W AN to LAN H.323 Peer-to-peer Calls Example 7.10.1 T urn On the ALG Click Configuration > Network > ALG . Select Enable H.323 ALG and Enable H.323 tran sformations and click A[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 152 1 Use Configuration > Object > Address > Add to create an address object for the public W AN IP address (called W AN_IP-for -H323 here). Then use it again to create an address object for the H.323 de vice’ s private LAN IP address (called LAN_H323 here). Figure 1 10 Create Ad dress [...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 153 2 Click Configuration > Network > NAT > Add. Configure a name for the rule (W AN-LAN_H323 here). Y ou want the LAN H.323 device to receive peer-to-peer calls from the W AN and also be able to initiate calls to t he WAN so you set the Classification to NAT 1:1 . Set the Incoming Interfa[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 154 1 Click Configuration > Firewall > Add . In the From field select W AN. In the To field select LAN. Configure a name for the rule (WAN-to-LAN_H323 here). Set the Destination to the H.323 device’ s LAN IP address object ( LAN_H323 ). LAN_H323 is the destination because the ZyW ALL appli[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 155 7.1 1.1 Create the Address Object s Use Configuration > Object > Address > Add to create the addr ess obje cts. 1 Create a host address object named DMZ_HT TP for the HT TP server’ s priv ate IP address of 192.168.3.7. Figure 1 14 Creating the Address Object for the HTTP Server’s P[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 156 • K eep Enable NAT Loopback selected to allow users connected to other interfaces to ac ce ss the HTTP server (see NA T Loopback on page 393 for details). Figure 1 16 Creating the NA T Entry 7.1 1.3 Set Up a Firewall Rule The firewall blocks traffi c from the W AN zone to the DMZ zone by def[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 157 1 Click Configuration > Firewall > Add . Set the From field as WAN and the To field as DMZ . Set the Destination to the HT TP serv er’s DMZ IP address object ( DMZ_HTTP ). DMZ_HTTP is the destination because the Z yW ALL applies NA T to traffic before applying the firewal l rule. Set th[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 158 address 1.1.1.2 that you wi ll use on the ge3 interface and map to the IPPBX’ s privat e IP address of 192.168.3.7. The local SIP clients are on the LAN. Figure 1 18 IPPBX Example Network T opology[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 159 7.12.1 T urn On the ALG Click Configuration > Network > ALG . Select Enable SIP ALG and Enable SIP Transformations and click Apply . Figure 1 19 Configuration > Network > ALG 7.12.2 Create the Address Object s Use Configuration > Object > Address > Add to create the addr es[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 160 2 Create a host address object named IPPB X -Publi c for the public W AN IP address 1.1.1.2. Figure 121 Creating the Public IP Address Object 7.12.3 Setup a NA T Policy for the IPPBX Click Configuration > Network > NAT > Add. • Configure a name for the rule (WAN-DMZ_IPPBX here). •[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 161 •C l i c k OK . Figure 122 Configu ration > Network > NA T > Add 7.12.4 Set Up a W AN to DM Z Firewall Rule for SIP The firewall blocks traffi c from the W AN zone to the DMZ zone by default so you need to create a firew all rule to allow the pu blic to send SIP traffic to the IPPBX.[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 162 1 Click Configuration > Firewall > Add . Set the From field as WAN and the To field as DMZ . Set the Destination to the IPPBX’ s DMZ IP address objec t ( DMZ_SIP ). IPPBX_DMZ is the desti nation be caus e the ZyW ALL applies NA T to traffic before applying the firewal l rule. Set the A[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 163 1 Click Configuration > Firewall > Add . Set the From field as DMZ and the To field as LAN . Set the Destination to the IPPBX’ s DMZ IP address object ( DMZ_SIP ). Set the Source to IPPBX_DMZ . Leave the Access field to allow and click OK . Figure 124 Configuration > Fi rewall > A[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 164 7.13.2 Configure the Policy Route Now you need to configure a policy r out e that has the ZyW ALL use the range of public IP addresses as the source address for W AN to LAN tr affic. Click Configuration > Netw ork > Routing > Add . Although adding a descri ption is optional, it is rec[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 165 An Ethernet switch connects both Z yW ALLs’ ge1 interfaces to the LAN. Whichever Z yWALL is functioning as the master uses the default gatewa y IP address of the LAN computers (192.168.1.1) for its ge 1 interface and the static public IP address (1.1.1.1) for its ge2 interface. If Z yWA LL A [...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 166 7.14.2 Configure Device HA on the Master ZyW ALL 1 Log into Z yW ALL A (the master) and click Configuration > Device HA > Active - Passive Mode . Double-click ge1 ’s e n t r y . 2 Configure 192.168.1.3 as the Management IP and 255.255.255.0 as the Manage IP Subnet Mask . Click OK . Fig[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 167 4 Click the General tab. T urn on device HA and cl ick Apply . Figure 131 Configur ation > Device HA > General: Master ZyW ALL Example 7.14.3 Configure the Backup ZyW ALL 1 Connect a computer to ZyW ALL B ’s ge1 interface and log into i ts W eb Configurator . Connect Z yWALL B to the In[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 168 4 Set the Device Role to Backup . Activ ate monitoring for the ge1 and ge2 interfaces. Set the Synchronization Server Address to 192.168.1.1, the Port to 21, and the Password to “m ySyncP assword” . Select Auto Synchronize and set the Interval to 60. Click Apply . Figure 133 Configu ration[...]

Chapter 7 Tutorials ZyWALL USG 1000 User’s Guide 169 hour). If Z yW ALL A fails or l oses its ge1 or ge2 connection, Z yW ALL B functions as the master . 7.14.5 Check Y our Device HA Setup 1 T o m ake s ur e Zy WAL L B copied Z yW ALL A ’ s setting s, yo u can log into Z yW ALL B ’s management IP address (192.168.1.5) and check the configurat[...]

Chapter 7 Tutorials ZyWALL USG 1000 U ser’s Guide 170[...]

ZyWALL USG 1000 User’s Guide 171 C HAPTER 8 L2TP VPN Example Here is how to crea te a b asi c L2 T P V PN tunnel. 8.1 L2TP VPN Example This example uses the following setti ngs in creating a basic L 2TP VPN tunnel. Figure 135 L2TP VPN Example • The Z yW ALL has a static IP address of 172.16.1.2 for the ge2 interface. • The remote user has a d[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 172 • Configure the My Address setting. This example uses interface ge2 with static IP address 172.16.1. 2. Note: If it is possible that the remote user’s public IP address could be in the same subnet as the specified My Address , cli ck Configure > Network > Routing > Policy R[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 173 8.3 Configuring the Default L2TP VPN Connection Example 1 Click Configuration > VPN > Network > IPSec VPN to open the screen that lists the VPN connections. Double-click the Default_L2TP_VPN_Connection entry . 2 Click the Show Advanced Settings button. Configure and enforce the[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 174 3 Select the Default_L2TP_VPN_Connection entry and click Activate and then Apply to turn on the entry . Figure 139 Configu ration > VPN > IPSec VPN > VPN Connect ion (Enable) 8.4 Configuring the L2TP VPN Settings Example 1 Click Configuration > VPN > L2TP VPN and configur[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 175 • The other fields are l eft to the defaults in this example, click Apply . Figure 140 Configu ration > VPN > L2TP VPN Example 8.5 Configuring L2TP VPN in Windows V ist a, XP , or 2000 The following sections cover how to configure L2TP in remote user computers using Windows Vist[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 176 2 Select Connect to a workplace and click Next . Figure 141 Set up a connection or network: Chose a connection type 3 Select Use my Internet connection (VPN) . Figure 142 Connect to a workpla ce: How do you want to connect?[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 177 4 Enter the domain name or W AN IP add ress configured as the My Addr ess in the VPN gateway config uration that the Z yWALL is using for L2TP VPN (172.16.1.2 in this example). For t h e Destination Name , enter L2TP to ZyWALL . Select Don’t connect now, just set it up so I can connec[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 178 6 Click Close . Figure 145 Connect to a workpla ce: The connection is ready to use 7 In the Network and Sharing Center screen, click Connect to a network . Right- click the L2TP VPN connec tion and select Properties . Figure 146 Connect L2TP to ZyW ALL[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 179 8 Click Security , select Advanced (custom settings) and click Settings . Figure 147 Connect L2TP to ZyW ALL: Security 9 Set Data encryption to Optional encryption (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PA P ) and clear a[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 180 inside it. The L2TP tunnel i tself does no t need encryption sinc e it is inside th e encrypted IPSec VPN tunnel. Figure 149 Connect ZyW ALL L2TP: Security > Advanced > W arning 11 Click Networ king . Set the Type of VPN to L2TP IPSec VPN and click IPSec Settings . Figure 150 L2TP[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 181 13 Select the L2TP VPN connection and click Connect . Figure 152 L2TP to ZyW ALL Properties: Networking 14 Enter the us er name and password of your Z yW ALL user account. Click Connect . Figure 153 Connect L2TP to ZyW ALL[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 182 15 A window appears while the user name and password are verified and notifies you when the connection is establi shed. Figure 154 Connecting t o L2TP to ZyW ALL 16 If a window appears asking you to select a locat ion for the network, you can select Work if you want your comput er to be[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 183 17 After the network location has been set, click Close . Figure 156 Set Network L ocation Successful 18 After the connection is up a connecti on icon displays in your system tra y . Click it and then the L2TP connection to open a status screen. Figure 157 Connection System T ray Icon[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 184 19 Click the L2TP connection’ s View status link to open a status screen. Figure 158 Network an d Sharing Center 20 Click Detail s to see the address that you received is from the L2TP range you specified on the Z yW ALL (192.168.10.10-192.168.10.20) . Figure 159 ZyW ALL-L2TP S tatus:[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 185 8.5.2 Configuring L2TP in Windows XP In Windows XP do the following to establi sh an L2TP VPN connection. 1 Click Start > Control Panel > Network Conne ctions > New Connection Wizard . 2 Click Next in the Welcome screen. 3 Select Connect to the network at my workplace and click[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 186 5 Ty p e L2TP to ZyWALL as the Company Name . Figure 162 New Connection Wizard: Connection Name 6 Select Do not dial the initial connection and cl ick Next . Figure 163 New Connection Wizard: Public Network[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 187 7 Enter the domain name or W AN IP add ress configured as the My Addr ess in the VPN gateway config uration that the Z yWALL is using for L2TP VPN (172.16.1.2 in this example). Figure 164 New Connection Wizard: VPN Ser ver Selection 8 Click Finish . 9 The Connect L2TP to ZyWALL screen a[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 188 10 Click Security , select Advanced (custom settings) and click Settings . Figure 166 Connect L2TP to ZyW ALL: Security 11 Select Optional encryption (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of the other [...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 189 12 Click IPSec Settings . Figure 168 L2TP to ZyW ALL Properties > Security 13 Select the Use pr e-shared key f or authentication check bo x and enter the pre- shared key used in the VPN gate way configur ation that the ZyW ALL is using for L2TP VPN. Click OK . Figure 169 L2TP to ZyW [...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 190 14 Click Networ king . Select L2TP IPSec VPN as the Ty pe of VPN . Click OK . Figure 170 L2TP to ZyW ALL Properties: Networking 15 Enter the us er name and password of your Z yW ALL account. Click Connect . Figure 171 Connect L2TP to ZyW ALL 16 A window appears while the user name and p[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 191 18 Click Detail s to see the address that you received is from the L2TP range you specified on the Z yW ALL (192.168.10.10-192.168.10.20) . Figure 173 ZyW ALL-L2TP S tatus: Det ails 19 Access a se rver or ot her n etwork resourc e b ehi nd th e Z yWALL to make sure your access works. 8.[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 192 3 Select HKEY_LOCAL_MACHINESys temCurre ntControlSetServicesRasmanP arameters . Figure 175 Regist ry Key 4 Right- click Parameters and select New > DWORD Value . Figure 176 New DWORD V alue 5 Enter ProhibitIpSec as the name. And mak e sure the Data displays as 0’ s. Figure 177[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 193 8.5.3.2 Configure the Windows 2000 IPSec Policy After you hav e created the registry entr y and restarted the computer , use these directions to configure an IPSec policy for the computer to use. 1 Click Start > Run . T ype mmc and click OK . Figure 178 Run mm c 2 Click Console > [...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 194 3 Click Add > IP Security Policy Management >Add > Finish . Click Close > OK . Figure 180 Add > IP Security Policy Manageme nt > Finish 4 Right- click IP Security Policies on Local Machine and click Create IP Security Policy . Click Next in the welcome screen. Figure 1[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 195 5 Name the IP security policy L2TP to ZyWALL , and click Next . Figure 182 IP Se curity Policy: Name 6 Clear the Activate the defa ult response rule check box and clic k Next . Figure 183 IP Se curity Policy: Request for Secure Communication[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 196 7 Leave the Edit Properties check b ox selected and cli ck Finish . Figure 184 IP Se curity Policy: Completing the IP Security Policy Wizard 8 In the properties dialog bo x, click Add > Next . Figure 185 IP Se curity Policy Properties > Add[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 197 9 Select This rule does no t specify a tunnel and click Next . Figure 186 IP Se curity Policy Properties: T unnel Endpoin t 10 Select All network connections and click Next . Figure 187 IP Se curity Policy Properties: Network T ype[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 198 11 Select Use this string to protect th e key exchange (preshared key) , type password in the text box, and cli ck Next . Figure 188 IP Se curity Policy Properties: Authentication Method 12 Click Add . Figure 189 IP Se curity Policy Properties: IP Filter List[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 199 13 Ty p e ZyWALL WAN_IP in the Name field. Clear the Use Add Wizard check box and click Add . Figure 190 IP Se curity Policy Properties: IP Filter List > Add 14 Configure the following in the Addressing tab. Select My IP Address in the Source address drop-down list box. Select A spec[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 200 15 Configure the following in the Filter Properties window’ s Protocol tab. Set the protocol t ype to UDP from port 1701. Select To any port . Click Apply , OK, and then Close . Figure 192 Filter Properties: Pro tocol 16 Select ZyWALL WAN_IP and click Next . Figure 193 IP Se curity Po[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 201 17 Select Require Security and click Next . Then click Finish and Close . Figure 194 IP Se curity Policy Properties: IP Filter List 18 In the Console window , right-click L2TP to ZyWALL and select Assign . Figure 195 Console: L2TP to ZyW ALL Assign 8.5.3.3 Configure the Wind ows 2000 Ne[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 202 1 Click Start > Settings > Network and Dial-up connections > Make New Connection . In the wizard welcome screen, click Next . Figure 196 S tart New Connection Wizard 2 Select Connect to a private network through the Internet and clic k Next . Figure 197 New Connection Wizard: N[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 203 4 Select For all users and click Next . Figure 199 New Connection Wizard: Connection Availability 5 Name the connection L2TP to ZyWALL and click Finish . Figure 200 New Connection Wizard: Naming the Connection 6 Click Proper ties . Figure 201 Connect L2TP to ZyW ALL[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 204 7 Click Security and select Advanced (custom settings) and click Settings . Figure 202 Connect L2TP to ZyW ALL: Security 8 Select Optional encryption allowed (connect even if no encryption) and the Allow these protocols radio button. Select Unencrypted password (PAP) and clear all of th[...]

Chapter 8 L2TP VPN Exampl e ZyWALL USG 1000 User’s Guide 205 9 Click Networ king and select Laye r 2 Tunneling Protocol ( L2TP) from the drop-down list box. Click OK . Figure 204 Connect L2TP to ZyW ALL: Networking 10 Enter your user name and p assword and click Co nnect . It may take up to one minute to establish the connection and register on t[...]

Chapter 8 L2TP VPN Example ZyWALL USG 1000 U ser’s Guide 206 12 Click Detail s and scroll down to see the addre ss that you recei v ed is from the L2TP range you specified on the Z yW ALL (192.168.10.10-192.168.10.20). Figure 207 L2TP to ZyW ALL S t atus: Deta ils 13 Access a se rver or ot her n etwork resourc e b ehi nd th e Z yWALL to make sure[...]

207 P ART II Technical Reference[...]

208[...]

ZyWALL USG 1000 User’s Guide 209 C HAPTER 9 Dashboard 9.1 Overview Use the Dashboard screens to check status information about the Z yWALL. 9.1.1 What Y ou Can Do in this Chapter Use the Dashboard screens for the following. •U s e t h e m a i n Dashboard screen (see Section 9.2 on page 209 ) to see the Z yWALL’ s general device information, s[...]

Chapter 9 Das hb o ar d ZyWALL USG 1000 U ser’s Guide 210 interface status in widgets that you can re-arrange to suit y our needs. Y ou can also collapse, refresh, and close individual widgets. Figure 208 Dashboard The following table describes t he labels in this screen. T able 21 Dashboard LABEL DESCRIPTION Widget Setting (A) Use this link to r[...]

Chapter 9 D as hb oa rd ZyWALL USG 1000 User’s Guide 21 1 The following front and rear panel labels display when you hover y our cursor over a connected interface or slot. Name This field displays the name of each interface. Slot This field displays the name of each extension slot. Device This field displays the name of the device connected to th[...]

Chapter 9 Das hb o ar d ZyWALL USG 1000 U ser’s Guide 212 Model Name This field displays the model name of this Z yWALL. Serial Number This field displays the serial number of this Z yWALL. MAC Address Ran g e This field displays the MAC addresses used by the Z yWALL. Each physical port has one MAC address. The first MAC address is assigned to ph[...]

Chapter 9 D as hb oa rd ZyWALL USG 1000 User’s Guide 213 Status This field displays the current status of each interface. The possible values depend on what type of interface it is. F or Ethernet interfaces: Inactive - The Ethernet interface is disabled. Down - The Ethernet interface is enabled but not connected. Speed / Duplex - The Ethernet int[...]

Chapter 9 Das hb o ar d ZyWALL USG 1000 U ser’s Guide 214 Action Use this field to get or to update the IP address for the interface. Click Renew to send a new DHCP request to a DHCP server . Click the Connect icon to hav e the ZyW ALL try to connect a PPP oE/PPTP interface or the auxiliary interface. If the interface cannot use one of these ways[...]

Chapter 9 D as hb oa rd ZyWALL USG 1000 User’s Guide 215 Boot Status This field displays details about the Z yWALL’ s startup state. OK - The Z yWALL started up successfully . Firmware update OK - A firmware update was successful. Problematic configuration after firmware update - The application of the configuration failed after a firmware upgr[...]

Chapter 9 Das hb o ar d ZyWALL USG 1000 U ser’s Guide 216 9.2.1 The CPU Usage Screen Use this screen to look at a chart of the ZyW ALL’ s recent CPU usage. T o access this screen, click CPU Usage in the dashboard. Figure 209 Dashboard > CPU Usage The following table describes t he labels in this screen. Signature Name The signature name iden[...]

Chapter 9 D as hb oa rd ZyWALL USG 1000 User’s Guide 217 9.2.2 The Memory Usage Screen Use this screen to look at a chart of the Z yWALL’ s recent memory (RAM) usage. T o access this screen, click Memory Usage in the dashboard. Figure 210 Dashboard > Memory Usage The following table describes t he labels in this screen. T able 23 Dashboard &[...]

Chapter 9 Das hb o ar d ZyWALL USG 1000 U ser’s Guide 218 9.2.3 The Session Usage Screen Use this screen to look at a chart of the Z yW ALL’ s recent tr affic session usage. T o access this screen, click Session Usage in the dashboard. Figure 21 1 Dashboard > Session Usage The following table describes t he labels in this screen. T able 24 D[...]

Chapter 9 D as hb oa rd ZyWALL USG 1000 User’s Guide 219 9.2.4 The VPN S t atus Screen Use this screen to look at the VPN tunnels that are currently establi shed. T o access this screen, click VPN Status in the das hboard. Figure 212 Dashboard > VPN S tatus The following table describes t he labels in this screen. 9.2.5 The DHCP T able Screen [...]

Chapter 9 Das hb o ar d ZyWALL USG 1000 U ser’s Guide 220 The following table describes t he labels in this screen. 9.2.6 The Number of Login Users Screen Use this screen to look at a list of the users current ly logged into the Z yW ALL. T o access this screen, click the dashboard’ s Number of Login Users icon. Figure 214 Dashboard > Number[...]

Chapter 9 D as hb oa rd ZyWALL USG 1000 User’s Guide 221 The following table describes t he labels in this screen. T able 27 Dashboard > Number of Login Users LABEL DESCRIPTION # This field is a sequential v alue and is not associated with any entry . User ID This field displays the user name of each user who is currently logged in to the ZyW [...]

Chapter 9 Das hb o ar d ZyWALL USG 1000 U ser’s Guide 222[...]

ZyWALL USG 1000 User’s Guide 223 C HAPTER 10 Monitor 10.1 Overview Use the Monitor screens to check stat us and st at i sti cs in formation. 10.1.1 What Y ou Can Do in this Chapter Use the Monitor screens for the foll owi ng. •U s e t h e System Status > Port Statistics screen (see Section 10.2 on page 224 ) to look at pack et statist ics fo[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 224 •U s e t h e VPN Monitor > L2TP over IPSec screen (see Section 10.13 on page 249 ) to display and manage the Z yWAL L ’ s connected L2TP VPN sessions. •U s e t h e Anti-X Statistics > Anti-Virus screen (see Section 10.14 on page 250 ) to start or stop data collection and view vir[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 225 The following table describes t he labels in this screen. T able 28 Monitor > System S t atus > Port S t atistics LABEL DESCRIPTION P oll Interval Enter how often you want this window to be updated automatically , and click Set Interval . Set Interval Click this to set the Poll Interval th[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 226 10.2.1 The Port S t atistics Graph Screen Use this screen to look at a line gr aph of packet statistics for each ph ysical port. T o access this screen, click Port Statistics in the Status screen and then the Switch to Graphic View Button . Figure 216 Monitor > System S tatus > Port S [...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 227 10.3 Interface S t atus Screen This screen lists all of the Z yWALL’ s interfaces and gives packet statistics for them. Click Monitor > System Status > Inter face Status to access this screen. Figure 217 Monitor > System S tatus > Interface S tatus Each field is desc ribed in the f[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 228 Name This field displa ys the name of ea ch interface. If there is a Expand icon (plus-sign) next to the name, click this to look at the status of virtual interfaces on top of this interface. P ort This field displays the physical port number . Status This field displays the current status o[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 229 IP Addr/ Netmask This field displays the current IP address and subnet mask assigned to the interface. If the IP address and subnet mask are 0.0.0.0, the interface is disabled or did not rece ive an IP address and subnet mask via DHCP . If this interface is a member of an ac tive virtual router [...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 230 10.4 The T raffic S t atistics Screen Click Monitor > System Status > T r aff ic Statistics to display the Traffic Statistics screen. This screen provides basic information about the following for example: • Most- visited W eb sites and the number of times each one w a s visited. Thi[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 231 There is a l imit on th e number of recor ds shown i n the repo rt. Pl ease see T able 32 on page 233 for more information. The foll owing table describes the labels in this screen. T able 31 Monitor > System S t atus > Traffic Statistics LABEL DESCRIPTION Data Collection Collect Statistic[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 232 The following table displays the maximum number of records shown in the report, the byt e count limit, a nd the h it coun t limit. These fields are available when the Traffic Type is Service/Por t . # This field is the r ank of each record. The protocols and service ports are sorted by the a[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 233 10.5 The Session Monitor Screen The Session Mo nitor screen displays information about acti ve ses sions for debugging or statistical analysis. It is not poss ible to manage sessions in this screen. The fo llowing info rmation is dis pl ayed . • User who started the session • Protocol or ser[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 234 The following table describes t he labels in this screen. T able 33 Monitor > System S t atus > Session Monitor LABEL DESCRIPTION View Select how you want the information to be displa yed. Choices are: sessions by users - display all activ e sessions grouped by user sessions by service[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 235 10.6 The DDNS S t atus Screen The DDNS Status screen shows the status of the Z yW ALL’s DDNS d omain names. Click Monitor > System Stat us > D DNS Status to open the following scree n. Figure 220 Monitor > System S tatus > DDNS S t atus The following table describes t he labels in [...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 236 10.7 IP/MAC Binding Monitor Click Moni tor > System S t atus > IP/MAC Binding to open the IP/MAC Binding Monitor screen. This screen lis ts the devices that hav e received an IP address from Z yW ALL interf aces with IP/MAC binding enabled and hav e ever est ablished a session with the[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 237 10.8 The Login Users Screen Use this screen to look at a list of the users current ly logged into the Z yW ALL. T o access this screen, click Monitor > System S t atus > Login Users . Figure 222 Monitor > System S tatus > Login Users The following table describes t he labels in this [...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 238 10.9 Cellular S t atus Screen This screen displays y our 3G connection status. click Monitor > System Status > Cellular Status to display this scre en. Figure 223 Monitor > System S tatus > Cellular S tatus The following table describes t he labels in this screen. T able 37 Monit[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 239 Status No device - no 3G device is connected to the ZyW ALL. Device detected - displays when you connect a 3G device. Device error - a 3G device is connected but there is an error . Probe device fail - the Z yW ALL’ s test of the 3G device failed. Probe device ok - the Z yWA LL’s test of the[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 240 10.10 Application Patrol S t atistics This screen displays a bandwi dth usage graph and stati stics for selected protocols. Click Monitor > AppPatrol Statistics to open the following screen. 10.10.1 Application Patrol S t atistics: General Setup Use the top of the Monitor > AppPatrol S[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 241 10.10.2 Application Patrol S t atistics: Bandwid th St atistics The middle of the Monitor > AppPatrol S t atistics screen displays a bandwidth usage line gr aph for th e selected protocols. Figure 225 Monitor > AppPatrol S tatistics: Bandwid th S tatistics • The y -axis represents the am[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 242 10.10.3 Application Patrol St atistics: Protocol St atistics The bottom of the Monitor > AppPatrol Statistics screen displays statistics f or each of the selected protocols. Figure 226 Monitor > AppPatrol S tatistics: Protocol S tatistics The following table describes t he labels in th[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 243 10.10.4 Application Patrol S t atistics: Individual Protocol S t atistics by Rule The bottom of the Monitor > AppPatrol Statistics screen displays statistics f or each of the selected protocols. Click a service’ s name to disp lay this screen with statistics for each of the service’ s app[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 244 The following table describes t he labels in this screen. 10.1 1 The IPSec Monitor Screen Y ou can use the IPSec Monitor screen to display and to manage acti ve IPSec SAs. T o access this screen, clic k Monitor > VPN Monitor > IPSec . The following T able 40 Monitor > AppPatrol S t [...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 245 screen appears. Click a column’ s heading cell to sort the table entries by that column’s criteria. Click the headin g cell aga in to re verse the so rt order . Figure 228 Monitor > VPN Monitor > IPSec Each field is desc ribed in the followi ng table. T able 41 Monitor > VPN Monitor[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 246 10.1 1.1 Regular Expressions in Searching IPSec SAs A question mark (?) lets a single char acte r in the VPN connecti on or policy name vary . F or example, use “a?c” (without the quotation marks) to specify abc, acc and so on. Wildcards (*) let multi ple VPN connection or policy names m[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 247 10.12 The SSL Connection Monitor Screen The Z yW ALL keeps tr ack of the users who are currentl y logged into the VPN SSL client portal. Click Monitor > VPN Monitor > SSL to display the user list. Use this screen to do the fol lowing: • View a list of activ e SSL VPN connec tions. • Lo[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 248 10.13 L2TP over IPSec Session Monitor Screen Click Monit or > VPN Monitor > L2TP over IPSec to open the following screen. Use this screen to disp lay and mana ge the Z yW ALL’ s connected L2TP VPN sessions. Figure 230 Monitor > VPN Monitor > L2TP over IPSec The following table [...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 249 10.14 The Anti-V irus S t atistics Screen Click Monitor > Anti-X Statistics > Anti-Virus to displa y the following screen. This screen displays anti- virus stat istics. Figure 231 Monitor > Anti-X S tatistics > Anti-V irus: Virus Name The following table describes t he labels in this[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 250 The statistics displa y as follows when y ou display the top entri es by source. Figure 232 Monitor > Anti-X S tatistics > Anti-V irus: Source IP The statistics displa y as follows when y ou display the top entri es by destination. Figure 233 Monitor > Anti-X S tatistics > Anti-V[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 251 10.15 The IDP S t atistics Screen Click Monitor > Anti-X Statistics > IDP to display the followi ng screen. This screen displays IDP (Intrusi on Detect ion and Prevention) statist ics. Figure 234 Monitor > Anti-X S tatistics > IDP: Signature Name The following table describes t he la[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 252 The statistics displa y as follows when y ou display the top entri es by source. Figure 235 Monitor > Anti-X S tatistics > IDP: Source The statistics displa y as follows when y ou display the top entri es by destination. Figure 236 Monitor > Anti-X S tatis tics > IDP: Destination[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 253 10.16 The Content Filter S t atistics Screen Click Monitor > Anti-X Statistics > Content Filter to displa y the foll owing screen. This screen disp lays content filter statisti cs. Figure 237 Monitor > Anti-X S tatistics > Content Filter The following table describes t he labels in t[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 254 10.17 Content Filter Cache Screen Click Monitor > Anti-X Statistics > Content Filter > Cache to display the Content Filter Cache screen. Use this screen to view and configure your Z yWALL ’s URL caching. Y ou can also configure how long a categori zed web site address remains in t[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 255 Y ou can remove individual entries from the cache. When y ou do this, the Z yW ALL queries the external content filtering da tabase the next time someone tries to access that web site. This allows you to check whether a web site’ s category has been changed. Click a column’ s heading cell to[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 256 Category This field shows whether access to the web site’ s URL was blocked or allowed. Click the column heading to sort the entries. P oint the triangle up to display the blocked URLs before the URLs to which access w as allowed. P oint the triangle down to display the URLs to which acces[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 257 10.18 The Anti-S p am S t atistics Screen Click Monitor > Anti-X Statistics > Anti-Spam to disp lay the following screen. This screen displays sp am statistics. Figure 239 Monitor > Anti-X S tatistics > Anti-S pam The following table describes t he labels in this screen. T able 48 Mo[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 258 Spam Mails This is the number of e-mails that the Z yW ALL has determined to be spam. Spam Mails Detected by Black List This is the number of e-mails that matched an entry in the Z yW ALL’ s anti- spam black list. Spam Mails Detected by DNSBL The Z yWALL can check the sender and relay IP a[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 259 10.19 The Anti-S p am St atus Screen Click Monitor > Anti-X Statistics > Anti-Spam > Status to display the Anti- Spam Status scre en. Use the Anti-Spam Status screen to see how many e-mail sessions the anti- spam feature is scanning an d statisti cs for the DNSBLs. Figure 240 Monitor &g[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 260 10.20 Log Screen Log messages are stored in two separate logs, one for regular log messages and one for debugging messages. In the regu lar log, you can look at all the log messages by selecting All Logs , or you can select a specific category of log messages (for example, firewall or user).[...]

Chapter 10 Monitor ZyWALL USG 1000 User’s Guide 261 The following table describes t he labels in this screen. T able 50 Monitor > Log LABEL DESCRIPTION Show Filter / Hide Filter Click this button to show or hide the filter settings. If the filter settings are hidden, the Display , Email Log Now , Refresh , and Clear Log fie lds are a vaila b l[...]

Chapter 10 M o nito r ZyWALL USG 1000 U ser’s Guide 262 The W eb Configur ator sav es the f ilter settings if you leave the View Log screen and return to it later . Priority This field displays the priority of the log message. It has the same range of values as the Priority field above. Category This field displays the log that generated the log [...]

ZyWALL USG 1000 User’s Guide 265 C HAPTER 11 Registration 1 1.1 Overview Use the Configura tion > Licensing > Registratio n screens to register y our Z yWALL and manage its service subscript ions. 1 1.1.1 What Y ou Can Do in this Chapter •U s e t h e Registration screen (see Section 11.2 on page 267 ) t o register your Z yWALL with myZ yX[...]

Chapter 11 Re g istr at ion ZyWALL USG 1000 U ser’s Guide 266 Subscription Services A vailable on the ZyW ALL Y ou can have the ZyW ALL use anti- virus, IDP/AppP atrol (Intrusi on Detection and Prevention and application patrol ), and cont ent filtering subscripti on services. Y ou can also purchase and enter a license key to hav e the Z yW ALL u[...]

Chapter 11 Registration ZyWALL USG 1000 User’s Guide 267 1 1.2 The Registration Screen Use this screen to regi ster your Z y W ALL with m yZ yXEL.com and activ ate a service, such as content filtering. Click Configuration > Licensing > Registration in the navigation panel to op en the screen as shown next. Figure 242 Configu ration > Lic[...]

Chapter 11 Re g istr at ion ZyWALL USG 1000 U ser’s Guide 268 Confirm Password Enter the password again for confirmation. E-Mail Address Enter your e-mail address. Y ou can use up to 80 alphanumeric characters (periods and the underscore are also allowed) without spaces. Country Select your country from the drop-dow n box list. T rial Service Act[...]

Chapter 11 Registration ZyWALL USG 1000 User’s Guide 269 Note: If the ZyW ALL is registe red already , this screen is read-only and indicates whether trial services are activated (if any). Y ou can still select th e unchecked trial service(s) to activate it after registra tion. Use the Service screen to update your service subscription sta tus. F[...]

Chapter 11 Re g istr at ion ZyWALL USG 1000 U ser’s Guide 270 The following table describes t he labels in this screen. T able 52 Configuration > Licensing > Registration > Service LABEL DESCRIPTION License Status # This is the entry’s position in the list. Service Thi s lists the services that available on the Z yW ALL. Status This fi[...]

ZyWALL USG 1000 User’s Guide 271 C HAPTER 12 Signature Update 12.1 Overview This chapter shows you how t o update the Z yWALL’ s signature packages. 12.1.1 What Y ou Can Do in this Chapter •U s e t h e Configuration > Licensing > Update > Anti-virus screen ( Section 12.2 on page 272 ) to up date the anti- virus sig natures. See Chapt[...]

Chapter 12 Signature Update ZyWALL USG 1000 U ser’s Guide 272 12.2 The Antivirus Up date Screen Click Configuration > Licensing > Update > Anti-Virus to display th e following screen. Figure 245 Configu ration > Licensing > Update >Anti-V irus The following table describes t he labels in this screen. LABEL DESCRIPTION Signature [...]

Chapter 12 Signature Update ZyWALL USG 1000 User’s Guide 273 12.3 The IDP/AppPatrol Up date Screen Click Configuration > Licensing > Update > IDP/AppPatrol to displa y the following screen. The Z yWALL comes with signatures for th e IDP and application patrol features. These signatures are continually upda ted as new attac k types evolve[...]

Chapter 12 Signature Update ZyWALL USG 1000 U ser’s Guide 274 signatures from my Z yXEL.com (see the Registration screens). Use th e Update IDP /AppPatrol screen to sched ul e or immediat ely download IDP signatures . Figure 246 Configu ration > Licensing > Update > IDP/AppPatrol The following table describes t he fields in this screen. [...]

Chapter 12 Signature Update ZyWALL USG 1000 User’s Guide 275 12.4 The System Protect Up date Screen Click Configuration > Licensing > Update > System Protect to display the following screen. Use this screen to schedule or imme diately download system-protection signatures. The Z yW ALL comes wi th signat ures that it uses to protect it s[...]

Chapter 12 Signature Update ZyWALL USG 1000 U ser’s Guide 276 The following table describes t he fields in this screen. T able 54 Configuration > Licensing > Update > System Protect LABEL DESCRIPTION Signature Information The following fields display information on the current signature set that the Z yWALL is using. Current Ve r si o n [...]

ZyWALL USG 1000 User’s Guide 277 C HAPTER 13 Interfaces 13.1 Interface Overview Use the Interface screens to configure the Z yWALL ’ s interfaces. Y ou can also create interfaces on top of other interfaces. • Ports are the physi cal ports to which you connec t cables. • Interfaces are used within the system operationally . Y ou use them in [...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 278 13.1.2 What Y ou Need to Know Interface Characteristics Interfaces generally have the followi ng characteristics (although not all characteristics apply to each type of interface). • An interface is a logical entit y through which (layer -3) packets pass. • An interface is bound to a[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 279 characteristics. These characteristics are listed in the following table and discussed in more det ail below. * - The format of interface names other than the Et hernet and pp p interface names is strict. Each name consists of 2-4 letters (interface type), followed by a number ( x , limite d [...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 280 * - Y ou cannot set up a PPP interface, virtual Ethernet interface or virtual VLAN interface if the underlying interface is a member of a bridge. Y ou also cannot add an Ethernet interface or VLAN interface to a bridge if the member interface has a virtual interface or PPP interface on t[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 281 13.2.1 Port Grouping Overview Use port grouping to create port group s and to assign physical ports and port groups to Ethernet interfaces . Each physical port is assigned to one Et hernet interface. In port grouping, the Ethernet i nterfaces are called representative interfaces . If y ou ass[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 282 Each section in this screen is described below . 13.3 Ethernet Summary Screen This screen lists ev ery Ethernet interface and virtual interface created on top of Ethernet interfaces. T o access this screen, click Configuration > Network > Interface . Unlike other types of interface[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 283 Figure 249 Configu ration > Network > Interface > Ethernet Each field is desc ribed in the followi ng table. T able 58 Configuration > Network > Interface > Ethernet LABEL DESCRIPTION Edit Double-click an entry or select it and click Edit to open a screen where you can modif[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 284 13.3.1 Ethernet Edit The Ethernet Edit screen lets you configure IP address assignment, interface parameters, RIP set ti ngs, OSPF settings, DHCP settings, connectivit y check, and MAC address settings. T o access this screen, click an Edit icon in the Ethernet Summary screen. (See Secti[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 285 Figure 250 Configuration > Network > Interface > Ethernet > Edit[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 286 This screen’ s fields are desc ribed in the table below . T able 59 Configuration > Network > Interface > Ethernet > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser num ber of configuration fields. Gener[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 287 Use Fixed IP Address This option appears when Interface Properties is Ex ternal or General . Select this if you want to specify the IP address, subnet mask, and gatewa y manually . IP Address Enter the IP address for this interface. Subnet Mask Enter the subnet mask of this interface in dot d[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 288 Check P eriod Enter the number of seconds between connection check attempts. Check Timeout Enter the number of second s to wait for a response before the attempt is a failure. Check F ail To l e r a n c e Enter the number of consecutive failures before the Z yW ALL stops routing through [...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 289 P ool Size Enter the number of IP addresse s to allocate. This number must be at least one and is limited by the interface’s Subnet Mask . For example, if the Subnet Mask is 255.255.255.0 and IP Pool Start Addr ess is 10.10.10.10, the ZyW ALL can allocate 10.1 0.1 0.10 to 10.10.10.254, or 2[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 290 IP Address Enter the IP address to assign to a device with this entry’ s MAC address. MAC Address Enter the MAC address to which to assign this entry’ s IP address. Description Enter a description to help identify this static DHCP entry . Y ou can use alphanumeric and ()+/:=?!*#@$_%-[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 291 13.3.2 Object References When a configur ation screen includes an Object References icon, select a configur ation object and click Object Referenc es to open the Object References screen. Th is s cre en displays which c o nf ig u ration settings refere nc e the selected object. The fi elds sh[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 292 Figure 251 Object References The following table describes l abels that can appear in this screen. 13.4 PPP Interfaces Use PPPoE/PPT P interfaces to connect to your ISP . This way , you do not have to install or manage PPP oE/PPTP software on each computer in the network. T able 60 Objec[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 293 Figure 252 Example: PPPoE/PP TP Interfaces PPP oE/PPTP interfaces are similar to other interfaces in som e ways. They hav e an IP address, subnet mask, and gateway used to make routing decisions; they restrict bandwidth and pack et size; and they can verify the gatew ay is av ailable. There a[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 294 Figure 253 Configuration > Network > Interface > PPP Each field is desc ribed in the table belo w . T able 61 Configuration > Network > Interface > PPP LABEL DESCRIPTION User Configuration / System Default The Z yWALL comes with the (non-remov able) System Default PPP i[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 295 13.4.2 PPP Interface Add or Edit Note: Y ou have to set up an ISP account bef ore you create a PPPoE/PPTP interface. This screen lets you configure a PPPoE or PPTP interface. T o access this screen, click the Add icon or an Edit icon in the PPP Interface screen. Status The activ ate (light bu[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 296 Figure 254 Configuration > Network > Interface > PPP > Add Each field is explained in the following table. T able 62 Configuration > Network > Interface > PPP > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a grea[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 297 Enable Interface Select this to enable this interface. Clear this to disable this interface. Interface Properties Interface Name Specify a name for the interface. It can use alphanumeric char acters, hyphens, and underscores, and it can be up to 11 characters long. Base Interface Select the i[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 298 Interface Pa ra m e t er s Egress Bandwidth Enter the maximum amount of tr affi c, in kilobits per second, the Z yWALL can send through the inte rface to the network. Allowed values are 0 - 1048576. Ingress Bandwidth This is reserved for future use. Enter the maximum amount of tr affi c,[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 299 13.5 Cellular Configuration Screen (3G) 3G (Third Generation) i s a digital, pack et -switched wireless te chnology . Bandwidth usage is optimized as mult iple users sh are the same channel and bandwidth is only allocated to users when they send da ta. It allows fast tr ansfer of voice and no[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 300 If the signal strength of a 3G network is too low , the 3G card may switch t o an av ailable 2.5G or 2.75G network. See the following tab le for a comparison between 2G, 2.5G, 2.75G and 3G of wireless technologies. T o change your 3G W AN settings, c lick Configuration > Network > [...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 301 Figure 255 Configuration > Network > Interface > Cellular The following table describes t he labels in this screen. 13.5.1 Cellular Add/Edit Screen T o change your 3G settings, click Configuration > Network > Interface > Cellular > Add (or Edit ). In the pop-up window tha[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 302 Figure 256 Configur ation > Network > Interface > Cellular > Add[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 303 The following table describes t he labels in this screen. T able 65 Configuration > Network > Interface > Cellular > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configur ation fields. General Settin[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 304 Dial String Enter the dial string if your ISP pro vides a string, which would include the APN, to initialize the 3G card. Y ou can enter up to 63 ASCII printable characters. Spaces are allowed. This field is av ailable only when you insert a GSM 3G card. Authentication Ty p e The Z yWALL[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 305 Egress Bandwidth Enter the maximum amount of tr affic, in kilobits per second, the Z yWALL can send through the interface to the n etwork. Allowed values are 0 - 1048576. This setting is used in W AN load balancing and bandwidth management. Ingress Bandwidth This is reserved for future use. E[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 306 Get Automatically Select this option If your ISP did not assign you a fixed IP address. This is the default selection. Use Fixed IP Address Select this option If the ISP assigned a fixed IP address. IP Address Enter the cellular interface’ s WAN IP address in this field if you selected[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 307 Data Budget Select this and specify how much downstream and/or upstream data (in Mega bytes) can be transmitted via the 3G conn ection within one month. Select Download to set a limit on the downstream traffic (from the ISP to the Z yWALL). Select Upload to set a limit on the upstream traffic[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 308 13.6 VLAN Interfaces A Virtual Local Area Network (VLAN) divides a physical network into multiple logical networks. The standard is defined in IEEE 802.1q. Figure 257 Example: Before VLAN In this examp le, there are two phy s ical networks and three departments A , B , and C . The physic[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 309 Each VLAN is a separate network wit h se par ate IP addresses, subnet masks, and gateways . Each VLAN also has a unique iden tification number (ID). The ID is a 12- bit v alue that is stored in the MAC head er . The VLANs are connected to switches, and the switches are connected to th e route[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 310 They restrict bandwidth and pack et size . They can provide DHCP services, and they can verify th e ga teway is available. 13.6.1 VLAN Summary Screen This screen lists every VLAN interface and virtual interface created on top of VLAN interfaces. T o access this screen, click Configuratio[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 31 1 13.6.2 VLAN Add/Edit This screen lets you configure IP ad dress assignment, interface bandwidth parameters, DHCP setti ngs , and connectivit y check for each VLAN interface. T o access this screen, click the Add icon at the top of the Add column or click an Edit icon next to a VLAN interface[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 312 Figure 260 Configur ation > Network > Interface > VLAN > Edit[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 313 Each field is explained in the following table. T able 67 Configuration > Network > Interface > VLAN > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser num ber of configuration fields. General Settings Enable In[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 314 Metric Enter the priority of the gateway (if any) on this interface. The Z yWALL decides which gatewa y to use based on this priority . The lower the number , the higher the priority . If two or more gateways have the same priority , the ZyW ALL uses the one that was configured first. In[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 315 DHCP Select what type of DHCP service the Z yW ALL provides to the network. Choices are: None - the ZyW ALL does not provide any DHCP services. There is already a DHCP serv er on the network. DHCP Relay - the Z yWALL ro utes DHCP requests to one or m ore DHCP servers you specify . The DH CP s[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 316 Lease time Specify how long each computer can use the information (especially the IP address) before it has to request the information again. Choices are: infinite - select this if IP addresses never expire days, hours, and minutes - select this to enter how long IP addresses are valid. [...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 317 OSPF Setting See Section 16.3 on page 365 for more information about OSPF . Area Select the area in which this interface belongs. Select None to disable OSPF in this interface. Priority Enter the priority (between 0 and 255) of this interface when the area is looking for a Designated Router ([...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 318 13.7 Bridge Interfaces This section introduces brid ges and bri dge interfaces and then explains the screens for bridge interfaces. Bridge Overview A bridge creates a connection between two or more network segments at the layer-2 (MAC address) level. In the follo wing example, bridge X c[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 319 If computer B responds to computer A, bridge X records the source address 0B:0B:0B:0B:0B:0B and port 4 i n the table. It also looks up 0A:0A:0A:0A:0A:0A in the table and sends the pack et to port 2 accordingly . Bridge Interface Overview A bridge interface creates a software br idge between t[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 320 13.7.1 Bridge Summary This screen lists every bridge interface and vi rtual interface created on top of bridge interfaces. T o access t his screen, click Configuration > Network > Interface > Bridge . Figure 261 Configur ation > Network > Interface > Bridge Each field i[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 321 13.7.2 Bridge Add/Edit This screen lets you configure IP ad dress assignment, interface bandwidth parameters, DHCP setti ngs , and connectivit y check for each bridge interface. T o access this screen, click the Add icon at the top of the Add column in th e Bridge Summary screen, or click an [...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 322 Figure 262 Configur ation > Network > Interface > Bridge > Add[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 323 Each field is desc ribed in the table belo w . T able 72 Configuration > Network > Interface > Bridge > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser num ber of configuration fields. General Settings Enable I[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 324 Gateway This field is enabled if you select Use Fixed IP Address . Enter the IP address of the gateway . The Z yWALL sends packets to the gatewa y when it does not know how to route the packet to its destination. The gateway should be on the same network as the interface. Metric Enter th[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 325 IP P ool Start Address Enter the IP address from which the ZyW ALL begins allocating IP addresses. If you want to assign a static IP address to a specific computer , click Add Static DHCP . If this field is blank, the Pool Size must also be blank. In this case, the Z yW ALL can assign ev ery [...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 326 Add Click this to create a new entry . Edit Select an entry and click this to be able to modify it. R emo v e Select an entry and click this to delete it. # This field is a sequential value, and it is not associated with a specific entry . IP Address Enter the IP address to assign to a d[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 327 13.8 Auxiliary Interface This section introduces the auxil iary interf ace and then explains the screen for it. 13.8.1 Auxiliary Interface Overview Use the auxiliary interface to dial ou t from the Z yW ALL’ s auxiliary port. F or example, yo u might use this int e rface as a backup WAN int[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 328 Figure 263 Configuration > Network > Interface > Auxiliary Each field is desc ribed in the table belo w . T able 73 Configuration > Network > Interface > Auxiliary LABEL DESCRIPTION General Settings Enable Interface Select this to turn on the auxiliary dial up interface[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 329 13.9 V irtual Interfaces Use virtual interfaces to tell th e Z yW ALL where to route pack ets. Virtual in terfaces can also be used in VPN gatewa ys (see Chapter 25 on page 441 ) and VRRP groups (see Chapter 39 on page 667 ). Virtual interfaces can be created on top of Ethernet interfaces, VL[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 330 cannot change the MTU. The vi rtual in terface uses the same MTU that the underlying interface uses. Unlike other interfaces, virtual interfaces do not provide DHCP services, and they do not veri fy that the gatew ay is a vailable. 13.9.1 V irtual Interfaces Add/Edit This screen lets yo [...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 331 13.10 Interface T echnical Reference Here is more detailed information about interfaces on the Z yW ALL. IP Address Assignment Most interfaces have an IP address and a subnet mask. This information is used to create an entry in the routi ng table. Figure 265 Example: Entry in the Routing T ab[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 332 For example, if the Z yW ALL gets a pa cket with a destination address of 100.100.25.25, it routes the packet to interface ge1. If the Z yW ALL gets a pack et with a destination address of 200.200.200.200, it routes the pack et to interface ge2. In most interfaces, you can enter the IP a[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 333 • Egress bandwidth sets the amount of traffic the Z yWALL s ends out through the interface to the network. • Ingress bandwidth sets the amount of tr affic the Z yW ALL allows in throug h the interface from the network. 1 If you set the bandwidt h restrictions ve ry high, you effectively r[...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 334 • IP address - If the DHCP client’s MAC address is in the ZyW ALL’ s static DHCP table, the interface assig ns the corresponding IP address. If not, the interface assigns IP addresses from a pool, define d by the starting address of the pool and the pool size. The Z yWALL cannot as[...]

Chapter 13 Interfaces ZyWALL USG 1000 User’s Guide 335 PPPoE/PPTP Overview P o int -to-P oint Protocol over Ethernet (PPP oE, RFC 2516) and P oint -to-Point T unneling Protocol (PPTP , RFC 2637) are usually us ed to connect two computers over phone lines or broadband connectio ns. PPP oE is often used with cable modems and DSL connections. It pr [...]

Chapter 13 In te r fac es ZyWALL USG 1000 U ser’s Guide 336[...]

ZyWALL USG 1000 User’s Guide 337 C HAPTER 14 Trunks 14.1 Overview Use trunks for W AN tr affic load balancing to increase ov erall network throughput and reliability . Load balancing divides tr affic loads between multipl e interfaces. This allows y ou to improve quality of service and maximiz e bandwidth utilization for multiple ISP links. Maybe[...]

Chapter 14 T run k s ZyWALL USG 1000 U ser’s Guide 338 14.1.2 What Y ou Need to Know • Add WAN interfaces to trunks to have multiple connections share the traffi c load. • If one W AN interface’ s connection goes down, the Z yW ALL sends traffic through another member of the trunk. • For example, you connect one W AN inte rface to one ISP[...]

Chapter 14 Trunks ZyWALL USG 1000 User’s Guide 339 2 The Z yWALL is using activ e/active load balanci ng. So when LAN user A tries to access something on the server , the request goes out through ge3. 3 The server finds that the request comes from ge3’ s IP address instead of ge2’ s IP address and rejects the request. If link sticking had bee[...]

Chapter 14 T run k s ZyWALL USG 1000 U ser’s Guide 340 Since W AN 2 has a smaller load balancing index (meaning that it is less utiliz ed than WAN 1), the Zy WALL will send the subsequent new session tr affic through WAN 2 . Weighted Round Robin The W eighted R ound R obin (WRR ) algorithm is best suited for situat ions when the bandwidths set fo[...]

Chapter 14 Trunks ZyWALL USG 1000 User’s Guide 341 interface. This fully utilizes the bandwidth of the first interface to reduce Internet usage fees and avoi d overloading the interface. In this example figure, the upper threshol d of the first int erface is set to 800K. The Z yWALL sends network tr affic of new sessions that exceed this limit to[...]

Chapter 14 T run k s ZyWALL USG 1000 U ser’s Guide 342 14.2 The T runk Summary Screen Click Configuration > Netw ork > Interface > Trun k to open the Trunk screen. This screen lists th e configured trunks and the load balancing al gorithm that each is configur ed to use. Figure 270 Configu ration > Network > Interface > T runk T[...]

Chapter 14 Trunks ZyWALL USG 1000 User’s Guide 343 14.3 Configuring a T runk Click Configuration > Netw ork > Interface > Trun k and then the Add (or Edit ) icon to open the Trunk Edit screen. Use this screen to create or edit a WAN trunk entry . Figure 271 Configu ration > Network > Interface > T run k > Add (or Edit) Enable[...]

Chapter 14 T run k s ZyWALL USG 1000 U ser’s Guide 344 Each field is desc ribed in the table belo w . T able 80 Configuration > Network > Interface > T runk > Add (or Edit) LABEL DESCRIPTION Name This is read-only if you are editin g an existing trunk. When adding a new trunk, enter a descriptive name for this trunk. Y ou ma y use 1-3[...]

Chapter 14 Trunks ZyWALL USG 1000 User’s Guide 345 14.4 T runk T echnical Reference Round Robin Load Balancing Algorithm Ro und R obin scheduli ng services qu eues on a rotating basis and i s activated only when an interface has more traffic than i t can handle. A queue is given an amount of bandwidth irrespec tive of the incoming tr affic on tha[...]

Chapter 14 T run k s ZyWALL USG 1000 U ser’s Guide 346[...]

ZyWALL USG 1000 User’s Guide 347 C HAPTER 15 Policy and Static Routes 15.1 Policy and S t atic Routes Overview Use policy routes and static rout es to ov erride the Z yW ALL’ s default routing behavior in order to send packets throug h the appropriate interface or VPN tunnel. For example, the next figure shows a computer ( A ) c onnected to the[...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 348 •U s e t h e Static Route screens (see Section 15.3 on page 357 ) to list and configure static routes . 15.1.2 What Y ou Need to Know Policy Routing T raditionally , routing is based on the destination address only and the Z yW ALL takes the sho rtest path to forward a pack [...]

Chapter 15 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 349 Policy Routes V ersus St atic Routes • Policy routes are more flexible tha n static routes. Y ou can select m o re cr i ter ia for the tr affic to match and can also use schedules , NA T , and bandwidth management. • Policy routes are only used within the Z yWALL itself . S[...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 350 Finding Out More • See Section 6.5.6 on page 105 for related information on the policy route screens. • See Section 7. 13 on page 163 for an example of creating a policy route for using multiple static public W AN IP addresses for LAN t o WAN tr affic. • See Section 15.4[...]

Chapter 15 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 351 The following table describes t he labels in this screen. T able 81 Configuration > Network > Routing > Policy Route LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configur ation fields. Enable[...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 352 DSCP Code This is the DSCP value of incoming packets to which this policy route applies. any means all DSCP v alues or no DSCP marker . default means traffic with a DSCP value of 0. This is usually best effort traffic The “ af ” entries stand for Assured For war ding. The [...]

Chapter 15 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 353 15.2.1 Policy Route Edit Screen Click Configuration > Netw ork > Routing to open the Policy Route screen. Then click the Add or Edit icon to open the Policy Route Edit screen. Use this screen to configure or e dit a policy route. Figure 274 Configu ration > Network >[...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 354 Incoming Select where the pack ets are coming from; any , an interface, a tunnel, an SSL VPN, or the Z yW ALL itself . For an interface, a tunnel, or an SSL VPN, you also need to select the indi vidual interface, VPN tunnel, or SSL VPN connection. Source Address Se lect a sour[...]

Chapter 15 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 355 VPN T unnel This field displays when you select VPN Tunnel in the Type field. Select a VPN tunnel through which the packets are sent to the remote network that is connected to the ZyW ALL directly . Auto Destination Address This field displays when you select VPN Tunnel in the [...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 356 Source Network Address T ranslation Select none to not use NA T for the route. Select outgoing-interface to use the IP address of the outgoing interface as the source IP address of the packets that matches this route. If you select outgoin g-interface , you can also configure [...]

Chapter 15 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 357 15.3 IP S t atic Route Screen Click Configuration > Network > Routing > Static Route to open the Static Route screen. This screen displa ys the configured static routes. Configure static routes to be able to use R IP or OSPF to propagate the rout ing information to oth[...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 358 The following table describes t he labels in this screen. 15.3.1 S t atic Route Add/Edit Screen Select a static route index number and click Add or Edit . The screen shown next appears. Use this screen to configure the required info rmation for a static route. Figure 276 Confi[...]

Chapter 15 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 359 15.4 Policy Routing T echnical Reference Here is more detailed information about some of the features you can configure in policy routing. NA T and SNA T NA T (Network Address T ranslation - NA T , RFC 1631) is the tr anslation of the IP address in a packet in one network to a [...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 360 following twelve DSCP encodi ngs from AF11 through AF43. The decimal equiv alent is listed in br ackets. Port T riggering Some services use a dedicated r ange of ports on the client side and a dedicated rang e of ports on the server side. With re gular port forwarding, y ou se[...]

Chapter 15 Policy and Sta tic Routes ZyWALL USG 1000 User’s Guide 361 3 Computer A and game server 1 are connected to ea ch ot her until the connection is closed or times out. Any other computers (such as B or C ) cannot connect to remote server 1 using the s ame port triggering rule as computer A unless they are using a different next hop (gatew[...]

Chapter 15 Policy an d Static Routes ZyWALL USG 1000 U ser’s Guide 362[...]

ZyWALL USG 1000 User’s Guide 363 C HAPTER 16 Routing Protocols 16.1 Routing Protocols Overview Routing protocols give the Z yWALL rout ing information about the network from other routers. The Z yWALL stores this rout ing information in the routing table it uses to make rout in g decision s. In tu rn, the ZyW ALL can also u s e rout in g protocol[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 U ser’s Guide 364 16.2 The RIP Screen RIP (R outing Information Protocol, RFC 1058 and RFC 1389) allows a device to exchange routing information with other rout ers. RIP is a vector -space routing protocol, and, like most such protocols, it uses hop count to decide which route is the shortest. Unfortun[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 User’s Guide 365 The following table describes t he labels in this screen. 16.3 The OSPF Screen OSPF (Open Shortest P ath First, RFC 2328) is a link -state protocol designed to distribute routing informatio n within a group of networ ks, called an Autonomous T able 87 Configuration > Network > Ro[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 U ser’s Guide 366 System (AS). OSPF offers some adv antag es over v ector-space routing protocols like RIP . • OSPF supports variable-lengt h subnet masks, which can be set up to use av ailable IP addresses more efficiently . • OSPF filters and summarizes routing in formation, which reduces the siz[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 User’s Guide 367 Each type of area is illust rated in the following figure. Figure 279 OSPF: T ypes of Areas Thi s OSP F AS con sis ts o f fo ur a rea s, a rea s 0- 3. A rea 0 is always the ba ckbo ne. In this example, areas 1, 2, and 3 are all conn ected to it. Area 1 is a normal area. It has routing [...]

Chapter 16 Routing Protocols ZyWALL USG 1000 U ser’s Guide 368 • An Autonomous System Bounda ry Router (ASBR) exchanges routing information with routers in network s outside th e OSPF AS. This is called redistribution in OSPF . • A backbone router (BR) has at least one interface with area 0. By default, every router in area 0 is a backbone ro[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 User’s Guide 369 to logically connect the area to t he backbo ne. This is illustr ated in the foll owing example. Figure 281 OSPF: V irtual Link In this example, area 100 does not hav e a direct connection to the backbone. As a result, you should set up a virtual link on both ABR in area 10. The virtua[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 U ser’s Guide 370 Click Configuration > Network > Routing > OSPF to open the following screen. Figure 282 Configuration > Ne twork > Routin g > OSPF The following table describes the labels in this screen. See Secti on 16.3.2 on page 372 for more information as well. T able 89 Configu[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 User’s Guide 371 T ype Select how OSPF calculates the cost associated with routing information from static routes. Choices are: Type 1 and Type 2 . Type 1 - cost = OSPF AS cost + external cost ( Metric ) Type 2 - cost = external cost ( Metric ); th e OSPF A S cost i s ignore d. Metric T yp e the extern[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 U ser’s Guide 372 16.3.2 OSPF Area Add/Edit Screen The OSPF Area Add/Edit screen allows you to create a new area or edit an existing one. T o access this scr een, go to the OSPF summary screen (see Section 16.3 on page 365 ), and click either the Add icon or an Edit icon. Figure 283 Configuration > [...]

Chapter 16 Routing Protocols ZyWALL USG 1000 User’s Guide 373 16.3.3 V irtual Link Add/Edit Screen The Virtual Link Add/Edit screen allows you to create a new virtual link or edit an existing one. When the OS PF add or edit screen (see Section 16.3.2 on page Te x t Authentication Ke y This field is available if the Authenticati on is Text . T ype[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 U ser’s Guide 374 372 ) has the T ype set to Normal, a Virtual L ink table displays. Click either the Ad d icon or an entry and the Edit icon to di splay a screen lik e the following. Figure 284 Configuration > Netwo rk > Routing > OSPF > Add > Ad d The following table describes t he lab[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 User’s Guide 375 Authentication T ypes Authentication is used to guar antee the in tegrity , but not the confidentiality , of routing updates. The tr ansmitting router uses its k ey to encrypt the original message into a smaller messag e, and the smaller message is tr ansmitted with the original messag[...]

Chapter 16 Routing Protocols ZyWALL USG 1000 U ser’s Guide 376[...]

ZyWALL USG 1000 User’s Guide 377 C HAPTER 17 Zones 17.1 Zones Overview Set up zones to configure network securit y and network policies in the Z yW ALL. A zone is a group of interfaces and/or VP N tunnels. The Z yW ALL uses zo nes instead of interfaces in ma ny security and poli c y settings, such as firewall rul es, Anti- X, and remote managemen[...]

Chapter 17 Z o ne s ZyWALL USG 1000 U ser’s Guide 378 17.1.2 What Y ou Need to Know Effect s of Zones on Different T ypes of T raffic Z ones effectiv ely divide tr affic into three ty pes--intr a-z one traffic , inter- zone traffic, and extr a-zone tr affic--which are affected differen tly by zone-based security and policy settings. Intra-zone T [...]

Chapter 17 Zones ZyWALL USG 1000 User’s Guide 379 17.2 The Zone Screen The Zone screen provides a summary of all zones. In addition, this screen allows you to add, ed it, and remo v e zones. T o acces s this screen, c lick Conf iguration > Network > Zone . Figure 286 Configu ration > Network > Zone The following table describes t he l[...]

Chapter 17 Z o ne s ZyWALL USG 1000 U ser’s Guide 380 17.3 Zone Edit The Zone Edit screen allows you to add or edit a z one. T o access this screen, go to the Zone screen (see Section 17.2 on page 379 ), and click the Add icon o r an Edit icon. Figure 287 Network > Zo ne > Add The following table describes t he labels in this screen. T able[...]

ZyWALL USG 1000 User’s Guide 381 C HAPTER 18 DDNS 18.1 DDNS Overview Dynamic DNS (DDNS) services let you use a domain name with a dynamic IP address. 18.1.1 What Y ou Can Do in this Chapter •U s e t h e DDNS screen (see Section 18.2 on page 382 ) to view a list o f the configured DDNS domain names and their details. •U s e t h e DDNS Add/Edit[...]

Chapter 18 DDNS ZyWALL USG 1000 U ser’s Guide 382 Note: Record your DDNS account’s user name, p assword, and domain name to use to configure the ZyW ALL. After , you configur e th e Z yW ALL, it aut o matically sends updated IP addresses to the DDNS service provider , which help s redirect traffic accordingly . Finding Out More See Section 6.5.[...]

Chapter 18 DDNS ZyWALL USG 1000 User’s Guide 383 Primary Interface/IP This field displays the interface to use for updating the IP address mapped to the domain name followed by how the Z yWALL determines the IP address for the domain name. from interface - The IP address comes from the specified interface. auto detected - The DDNS server checks t[...]

Chapter 18 DDNS ZyWALL USG 1000 U ser’s Guide 384 18.2.1 The Dynamic DNS Add/Edit Screen The DDNS Add/Edit screen allows you to add a domain name to the ZyW ALL or to edit the configuration of an existing domain name. Click Configuratio n > Network > DDNS and then an Add or Edit icon to open this screen. Figure 289 Configu ration > Netwo[...]

Chapter 18 DDNS ZyWALL USG 1000 User’s Guide 385 Username T ype the user name used when you registered your domain name. Y ou can use up to 31 alphanumeric characters and the u nderscore. Spaces are not allowed. For a Dynu DDNS entry , this user name is the one you use for logging into the service, not the name record ed in your personal informat[...]

Chapter 18 DDNS ZyWALL USG 1000 U ser’s Guide 386 IP Address The options av ailable in this field vary by DDNS provider . Interface - The Z yW ALL uses the IP address of the specified interface. This option appears when y ou sele ct a specific interface in the Backup Binding Address Interface field. Auto - The DDNS server checks the source IP add[...]

ZyWALL USG 1000 User’s Guide 387 C HAPTER 19 NAT 19.1 NA T Overview NA T (Network Address T ranslation - NA T , RFC 1631) is the tr anslation of the IP address of a host in a packet. For exampl e, the source address of an out going packet, used within one network is change d to a different IP address known within another network. Use Network Addr[...]

Chapter 19 NA T ZyWALL USG 1000 U ser’s Guide 388 19.1.2 What Y ou Need to Know NA T is also known as virtual server , port forwarding, or port tr anslation. Finding Out More • See Section 6.5.10 on page 107 for related information on the se screens. • See Section 19.3 on page 393 for technic al background information rel ated to these screen[...]

Chapter 19 NAT ZyWALL USG 1000 User’s Guide 389 Rem o v e T o remove an entry , select it and click Remove . The Z yWALL confirms you w ant to remove it before doing so. Activate T o turn on an entry , select it and click Activate . Inactivate T o turn off an entry , select it and click Inactivate . # This field is a sequential v alue, and it is [...]

Chapter 19 NA T ZyWALL USG 1000 U ser’s Guide 390 19.2.1 The NA T Add/Edit Screen The NAT Add/Edit screen lets you create new NA T rules and edit existing ones. T o open this window , open the NAT summary screen. (See Section 19.2 on page 388 .) Then, click on an Add icon or Edit icon to open the following screen. Figure 292 Configu ration > N[...]

Chapter 19 NAT ZyWALL USG 1000 User’s Guide 391 Classification Select what kind of NA T this rule is to perf orm. Virtual Server - This mak es computer s on a priv ate netw ork behind the Z yWALL a vailable to a public network outside the ZyW ALL (like the Internet). 1:1 NAT - If the priv ate network server will initiate sessions to the outside c[...]

Chapter 19 NA T ZyWALL USG 1000 U ser’s Guide 392 Mapped IP Subnet/Range This field displays for Many 1:1 NAT . Select to which translated destination IP address subnet or IP address range this NA T rule forwards packets. The original and mapped IP address subnets or ranges must have the same number of IP addresses. Po r t M a p p i n g Ty p e Us[...]

Chapter 19 NAT ZyWALL USG 1000 User’s Guide 393 19.3 NA T T echnical Reference Here is more detailed information about NA T on the Z yWALL. NA T Loopback Suppose a NA T 1:1 rule maps a public IP address to the private IP address of a LAN SMTP e-mail server to g ive W AN users access. NA T loopback allows other users to also use the rule’ s orig[...]

Chapter 19 NA T ZyWALL USG 1000 U ser’s Guide 394 For examp le, a LAN user’ s computer at IP address 192.168.1. 89 queries a public DNS server to resolve the SMTP server ’ s domain name (xxx.LAN-SMTP .com in this example) and gets the SMTP serv er’s mapped public IP address of 1.1.1.1. Figure 293 LAN Computer Queries a Public DNS Server The[...]

Chapter 19 NAT ZyWALL USG 1000 User’s Guide 395 SMTP server replied directly to the LAN us er without the tr affic going through NA T , the source would not match the original destination address whi ch would cause the LAN user’s comput er to shut down the session. Figure 295 LAN to LAN Return T raffic 192.168.1.21 LAN 192.168.1.89 Source 1.1.1[...]

Chapter 19 NA T ZyWALL USG 1000 U ser’s Guide 396[...]

ZyWALL USG 1000 User’s Guide 397 C HAPTER 20 HTTP Redirect 20.1 Overview HT TP redirect forw ards the client’ s HT TP request (ex cept HT TP traffic destined for the Z yWALL) to a web pro xy server . In the following example, proxy server A is connected to the DMZ interface. When a cl ient connected to the LAN zone wants to open a web page, its[...]

Chapter 20 HTT P Red ire ct ZyWALL USG 1000 U ser’s Guide 398 20.1.2 What Y ou Need to Know Web Proxy Server A proxy serv er helps client devices make in direct requests to access the Internet or outside network resources/services. A pr oxy server can act as a firewall or an ALG (applicati on layer gatew ay) between th e priv ate network and the [...]

Chapter 20 HTTP Redirect ZyWALL USG 1000 User’s Guide 399 • a application patrol rule to allow HT TP traf fic between ge4 and ge2 . • a policy route to forw ard HT TP traffi c from proxy serv er A to the Internet. Finding Out More See Section 6.5.11 on page 108 for related information on these scree ns. 20.2 The HTTP Redirect Screen T o confi[...]

Chapter 20 HTT P Red ire ct ZyWALL USG 1000 U ser’s Guide 400 20.2.1 The HTTP Redirect Edit Screen Click Networ k > HTTP Redi rect to open the HTTP Redirect screen. Then click the Add or Edit icon to open the HTTP Redirect Edit screen where you can configure the rule. Figure 298 Network > HTTP Redirect > Edit The following table describe[...]

ZyWALL USG 1000 User’s Guide 401 C HAPTER 21 ALG 21.1 ALG Overview Application Laye r Gateway (ALG) al lows the following applications to oper ate properly through the Z yWALL’ s NA T . • SIP - Session Initiation Protocol (SIP) - An application-la yer protocol that can be used to create voice and multimedia sessions over Internet. • H.323 -[...]

Chapter 21 ALG ZyWALL USG 1000 U ser’s Guide 402 21.1.2 What Y ou Need to Know Application Layer Gateway (ALG), NA T an d Firewall The Z yWALL can function as an Applicat ion Layer Gatew ay (ALG) to all ow certain NA T un-friendly applications (such as SIP) to operate properly through the Z yWALL ’s NA T and firewall. The Z yW ALL dynamically c[...]

Chapter 21 ALG ZyWALL USG 1000 User’s Guide 403 • There should be only one SIP serv er (t otal) on the ZyW ALL’ s private networks. Any other SIP servers must be on the WAN. So for example y ou could hav e a Back -to-Back User Ag ent such as the IPPBX x6004 or an asterisk PBX on the DMZ or on the LAN bu t no t on both. • Using the SIP AL G [...]

Chapter 21 ALG ZyWALL USG 1000 U ser’s Guide 404 can receive incoming calls from t he Internet, LAN IP addresses B and C can still make calls out to t he Internet. Figure 301 V oIP Calls from the W AN with Multiple Outgoin g Calls V oIP with Multiple W AN IP Addresses With multiple W AN IP addresses on th e Z yWALL, you can configure different fi[...]

Chapter 21 ALG ZyWALL USG 1000 User’s Guide 405 • See Section 21.3 on page 407 for ALG background/technical information. 21.1.3 Before Y ou Begin Y ou must also configure the firewall and enabl e NA T in the ZyW ALL to allow sessions initiated from the W AN. 21.2 The ALG Screen Click Configuration > Network > A LG to open the ALG screen. [...]

Chapter 21 ALG ZyWALL USG 1000 U ser’s Guide 406 The following table describes t he labels in this screen. T able 101 Configuration > Network > ALG LABEL DESCRIPTION Enable SI P ALG T urn on the SIP ALG to detect SIP traffic and help build SIP sessions through the Z yW ALL’ s NA T . Enabling the SIP ALG also allows you to use the applicat[...]

Chapter 21 ALG ZyWALL USG 1000 User’s Guide 407 21.3 ALG T echnical Reference Here is more detailed information about t he Application Layer Gatew ay . ALG Some applications cannot operate through NA T (a re NA T un-friendly) because they embed IP addres ses and port number s in their packets’ data payload. The Z yWALL examines and uses IP addr[...]

Chapter 21 ALG ZyWALL USG 1000 U ser’s Guide 408 connections to the second (passive) int erf ace when the acti ve interface’ s connection goes down. When the active in terface’ s connection fails, the client needs to re-initialize the co nnection through the second interface (that was set to passive) in ord er to have the connection go throug[...]

ZyWALL USG 1000 User’s Guide 409 C HAPTER 22 IP/MAC Binding 22.1 IP/MAC Binding Overview IP address to MAC address binding helps en sure that only the i ntended devices get to use privileg ed IP addresses. The Z yWALL uses DHCP to assign IP addresses and records to MAC address it assigned each IP address. The Z yW ALL then checks incoming connect[...]

Chapter 22 IP/MAC Binding ZyWALL USG 1000 U ser’s Guide 410 22.1.2 What Y ou Need to Know DHCP IP/MAC address bindings are based on the Z yW ALL’ s dynamic and stati c DHCP entries. Interfaces Used With IP/MAC Binding IP/MAC address bindings are grouped by interface. Y ou can use IP/M AC binding with Ethernet, b ridge, and VLAN int erfaces . Y [...]

Chapter 22 IP/MAC Binding ZyWALL USG 1000 User’s Guide 41 1 22.2.1 IP/MAC Binding Edit Click Configuration > Network > IP/MAC Binding > Edit to open the IP/ MAC Binding Edit screen. Use this screen to configure an interface’ s IP to MAC address binding settings. Figure 306 Configur ation > Network > IP/MAC Binding > Edit The f[...]

Chapter 22 IP/MAC Binding ZyWALL USG 1000 U ser’s Guide 412 22.2.2 S t atic DHCP Edit Click Configuration > Network > IP/MAC Binding > Edit to open the IP/ MAC Binding Edit screen. Click the A dd or Edit icon to open the following screen. Use this screen to configure an interface’ s IP to MAC address binding settings. Figure 307 Config[...]

Chapter 22 IP/MAC Binding ZyWALL USG 1000 User’s Guide 413 The following table describes t he labels in this screen. 22.3 IP/MAC Binding Exempt List Click Configuration > Network > IP /MAC Binding > Exempt List to o p e n t he IP/MAC Binding Exempt List screen. Use this scree n to configure ranges of IP addresses to which the Z yW ALL do[...]

Chapter 22 IP/MAC Binding ZyWALL USG 1000 U ser’s Guide 414 End IP Enter the last IP address in a range of IP addresses for which the ZyW ALL does not apply IP/MAC binding. Add icon Click the Add icon to add a new entry . Click the Remove icon to delete an entry . A window displays asking you to confirm that you w ant to delete it. Apply Click Ap[...]

ZyWALL USG 1000 User’s Guide 415 C HAPTER 23 Authentication Policy 23.1 Overview Use authentication polic ies to contro l who can access the network. Y ou can authenticate users (require them to lo g in) and even perform Endpoint Security (EPS) checking to make sure users’ computers comply with defined corporate policies before they can access [...]

Chapter 23 Auth en tic at ion Policy ZyWALL USG 1000 U ser’s Guide 416 23.1.2 What Y ou Need to Know Authentication Policy and VPN Authentication polici es are applied based on a tr affic flow’ s source and destination IP addresses. If VPN tr affic matches an authentication pol icy’ s sour ce and destination IP addresses, the user must pass a[...]

Chapter 23 Authentication Policy ZyWALL USG 1000 User’s Guide 417 Click Configuration > Auth. Policy to display the screen. Figure 310 Configuration > Au th. Policy[...]

Chapter 23 Auth en tic at ion Policy ZyWALL USG 1000 U ser’s Guide 418 The following table giv es an overview of the objects you can configure. T able 106 Configuration > Auth. Policy LABEL DESCRIPTION Enable Authentication P olicy Select this to turn on the authentication policy feature. Exceptional Services Use this table to list services th[...]

Chapter 23 Authentication Policy ZyWALL USG 1000 User’s Guide 419 23.2.1 Creating/Editing an Authentication Policy Click Configuration > Auth. Policy and then the Add (or Edit ) icon to open the Endpoint Security Edit screen. Use this screen to configure an authentication policy . Status This icon is lit when the entry is active and dimmed whe[...]

Chapter 23 Auth en tic at ion Policy ZyWALL USG 1000 U ser’s Guide 420 Figure 312 Configuration > Aut h . Policy > Add The following table giv es an overview of the objects you can configure. T able 107 Configuration > Auth. Policy > Add LABEL DESCRIPTION Create new Object Use to configure any new settings objects that you need to use[...]

Chapter 23 Authentication Policy ZyWALL USG 1000 User’s Guide 421 Schedule Select a schedule that defines when the policy applies. Otherwise, select none and the rule is always effective. This is none and not configur able for the default policy . Authentication Select the authentication requirement for users when their tr affic matches this poli[...]

Chapter 23 Auth en tic at ion Policy ZyWALL USG 1000 U ser’s Guide 422[...]

ZyWALL USG 1000 User’s Guide 423 C HAPTER 24 Firewall 24.1 Overview Use the firewall t o block or allow servic es that use static port numbers. Use application patrol (see Chapter 32 on page 521 ) to control services using flexible/ dynamic port numbers. The firewall can al so limit the number of user sessions. This figure shows the Z y WALL’ s[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 424 24.1.2 What Y ou Need to Know St ateful Inspection The Z yWALL has a stateful inspection fi rewall. The Z yW ALL restricts acces s by screening data pack ets ag ainst defined acce ss rules. It al so i nspec ts sessions. F or example, traffi c from one zone is not allo we d unless it is initiat[...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 425 • The Z yW ALL drops most pack ets from the DMZ z one to the Z yW ALL itself , except for DNS and NetBIOS traffic, and gener ates a log. When you configure a firewall rule for pack ets destined for the Z yW ALL itself , make sure it does not c onflict with your service control rule. See Chapt[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 426 traffic blocking to allo w or block VPN tr affic tr ansmitting between the VPN tunnel and other interfaces in the LAN zone. If yo u add the VP N tunnel to a new zone (the VPN zone for example), you can configure rules for VPN traffic between the VPN zone and oth er zo nes or From VPN To -ZyWAL[...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 427 the firewall rule to alwa ys be in effect. The following figure shows the results of this rule. Figure 314 Blocking All LAN to W AN IRC Traf fic Examp le Y our firewall would have the following rules. • The first row blocks LAN access to the IRC service on the WAN. • The second row is the f[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 428 Now you configure a LAN to WAN f irewall rule that allows IRC tr affic from t he IP address of the CEO’ s computer (192.168.1.7 for example) to go to any destination address. Y ou do not need to specify a sch edule since you want the firewall rule to always be in effect. The following fi gur[...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 429 • The first row allows any LAN computer to access the IRC service on the W AN by logging into the Z yW ALL with the CEO’ s user name. • The second row blocks LAN access to the IRC service on the WAN. • The third row is the firew all’ s default policy of allowing all tr affic from the [...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 430 5 The screen for configuring a se rvice object opens. Configure it as follows and click OK . Figure 318 Firewall Example: Create a Service Obje ct 6 Select From WAN and To LAN1 . 7 Enter the name of the firew al l rule. 8 Select Dest_1 is selected for the Destination and Doom is selected as th[...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 431 9 The firewall rule appears in the firewall rule summary . Figure 320 Firewall Example: Doom Rule in Summary 24.2 The Firewall Screen Asymmetrical Routes If an alternate gateway on the LAN has an IP address in the same subnet as the Z yWALL ’ s LAN IP address, return traffic may not go throug[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 432 4 The Z yWALL then sends it to the compu te r on the LAN in Subnet 1 . Figure 321 Using V irtual Interfaces to A void Asymmetrical Routes 24.2.1 Configuring the Firewall Screen Click Configuration > Firewall to open the Firewall screen. Use this screen to enable or disable the firewall and [...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 433 • The ordering of your rules is v ery im portant as rules are applied in sequence. Figure 322 Configuratio n > F irewall The following table describes t he labels in this screen. T able 1 12 Configuration > Firewall LABEL DESCRIPTION General Settings Enable Firewall Select this check bo[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 434 From Z one / To Z o n e This is the direction of travel of packets. Select from which zone the packets come and to which zone they go. Firewall rules are grouped based on the direction of travel of pack ets to which they apply . For example, from LAN to LAN means packets trav eling from a comp[...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 435 24.2.2 The Firewall Add/Edit Screen In the Firewall screen, click the Edit or Add icon to dis p lay the Firewall Rule Edit screen. Figure 323 Configuration > Fi rewall > Add The following table descri bes the labels in this screen. Service This displays the service object to which this fi[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 436 24.3 The Session Limit Screen Click Configuration > Firewall > Session Limit to displa y the Firewall Session Limit screen. Use this screen to limit th e number of concurrent NA T/ firewall sessions a client can use. Y ou can apply a default l imit for all users and Description Enter a d[...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 437 individual limi ts for specific users, addres ses, or both. The individual li mit takes priority if you apply both. Figure 324 Configuration > Firewall > Session Limit The following table descri bes the labels in this screen. T able 1 14 Configuration > Firewall > Session Limit LABE[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 438 24.3.1 The Session Limit Add/Edit Screen Click Configuration > Firewall > Session Limit and the Add or Edit icon to display t he Firewall Session Limit Edit screen. Use this screen to configure rules that define a session li mit for specific users or addresses. Figure 325 Configuration &[...]

Chapter 24 Firewall ZyWALL USG 1000 User’s Guide 439 User Select a user name or user group to which to apply the rule. The rule is activated only when the specified user logs into the system and the rule will be disabled when the user logs out. Otherwise, select any and there is no need for user logging. Note: If you specified an IP address (or a[...]

Chapter 24 Firewall ZyWALL USG 1000 U ser’s Guide 440[...]

ZyWALL USG 1000 User’s Guide 441 C HAPTER 25 IPSec VPN 25.1 IPSec VPN Overview A virtual priv ate network (VPN) pro vides secure communications between sit es without the expense of leased site-to-site lines. A s ecure VPN is a combination of tunneling, encryption, aut hentication, access control and auditing. It is used to transport tr affic ove[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 442 •U s e t h e VPN Gateway screens (see Section 25.2.1 on page 446 ) to manage the ZyW ALL’ s VPN gate ways. A VPN gateway specifies th e IPS e c rout ers at either end of a VPN tunnel and the IKE SA settings (phase 1 settings). Y ou can also activat e and deactivate each VPN gateway . •U[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 443 Application Scenarios The Z yW ALL’ s application scenarios make it easier to configure your VPN connection settings. Finding Out More • See Section 6.5.15 on page 110 for related information on the se screens. T able 1 16 IPSec VPN Application Scenario s SITE-TO-SITE SITE-TO-SITE WITH DYN[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 444 • See Section 25.5 on page 469 for IPSec VPN background information. • See Section 5.3 on page 83 for the IPSec VPN quick setup wizard. • See Section 7.4 on page 127 for an exampl e of configuring IPSec VPN. • See Section 7.5 on page 131 for an exampl e of how to configure a hub- and-[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 445 SA). Click a column’ s heading cell to so rt the table entries by that column’ s criteria. Click the heading cell again to reverse the sort order . Figure 328 Configuration > VPN > IPSec VPN > VPN Connection Each field is discussed in the following tabl e. See Secti on 25. 2.2 on [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 446 25.2.1 The VPN Connection Add/Edit (IKE) Screen The VPN Connection Add/Edit Gateway screen allows you to create a new VPN connection policy or edit an existing one. T o access this screen, go to the Configuration > VPN Connection screen (see Section 25.2 on page 444 ), and click either the[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 447 Figure 329 Configuration > VPN > IPSec VPN > VPN Connection > Edit (IKE)[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 448 Each field is desc ribed in the followi ng table. T able 1 18 Configuration > VPN > IPSec VPN > VPN Connection > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields. Create new Object [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 449 P olicy Local P olicy Select the address corresp onding to the local network. Use Create new Object if you need to configure a new one. Re mote Policy Select the address corresp onding to the remote network. Use Create new Object if you need to configure a new one. P olicy Enforcement Clear th[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 450 Encryption This field is applicable when the Active Protocol is ESP . Select which key size and encryption algorithm to use in the IPSec SA. Choices are: NULL - no encryption k ey or algorithm DES - a 56-bit key with the DES encryption algorithm 3DES - a 168-bit key with the DES encryption al[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 451 Check Method Select how the Z yW ALL checks the connection. The peer must be configured to respond to the method you select. Select icmp to have the ZyW ALL regularly ping the address you specify to make sure traffic can still go through the connection. Y ou may need to configure the p eer to [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 452 Inbound T raffic Source NA T This translation hides the source address of computers in the remote network. Source Select the address object that re presents the original source address (or select Create Object to configure a new one). This is the address object for the remote network. The siz[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 453 25.2.2 The VPN Connection Add/Edit Manual Key Screen The VPN Connection Add/Edit Manual Key screen allows you to create a new VPN connection or edit an existing one us ing a manual key . This is useful if you have problems wi th IKE key management . T o access this screen, go to the VPN Connec[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 454 Secure Gateway Address T ype the IP address of the remote IPSec router in the IPSec SA. SPI T ype a unique SPI (Security Par ameter Index) between 256 and 4095. The SPI is used to identify the Z yW ALL during authentication. The Z yW ALL and remote IP Sec router must u se the same SPI. Encaps[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 455 Encryption K ey This field is applicable when you select an Encr yption Algor ithm . Enter the encryption key , which depends on the encryption algorithm. DES - type a unique key 8-32 char acters long 3DES - type a unique key 24-32 char acters long AES128 - type a unique key 16-32 characters l[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 456 25.3 The VPN Gateway Screen The VPN Gateway sum m ary screen displ ays the IPSec VPN gateway polici es in the Z yWALL, as wel l as the Z yWALL’ s addr ess, remote IPSec router’s address, and associated VPN connections for each one. In additi on, it also l ets y ou activ at e and deactiv a[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 457 25.3.1 The VPN Gateway Add/Edit Screen The VPN Gateway Add/Edit scre en allo ws you to create a new VPN gateway policy or edit an existing one. T o access this screen, go to the VPN Gateway summary screen (see Section 25.3 on page 456 ), and click either the Add icon or an Edit icon. Apply Cli[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 458 Figure 332 Configuration > VPN > IPSec VPN > VPN Gateway > Edit[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 459 Each field is desc ribed in the followi ng table. T able 121 Configuration > VPN > IPSe c VPN > VPN Gateway > Edit LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration field s. General Settings VPN [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 460 Pre-Shared Ke y Select this to have the Z yWA LL and remote IPSec router use a pre- shared key (password) to identify each other when they negotiate the IKE SA. T y pe the pre-shared key in the field to the right. The pre- shared key can be • 8 - 32 alphanumeric characters or ,;|`~!@#$%^&am[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 461 Content This field is read-only if the Z yW ALL and remote IPSec router use certificates to identify each other . T ype the identity of the Z yW ALL during authentication. The identity depends on the Local ID Type . IP - type an IP ad dress; if you type 0.0.0.0, the ZyW ALL uses the IP address[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 462 Content This field is disabled if the Peer ID Type is Any . T ype the identity of the remote IPSec router during au thentication. The identity depends on the Peer ID Type . If the Z yWALL and remote IPSec router do not use certificates, IP - type an IP address; see the no te at the end of thi[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 463 Negotiation Mode Select the negotiation mode to use to nego tiate the IKE S A. Choices are Main - this encrypts the Z yW ALL’ s and remote IPSec router’s identities but takes more time to establish the IKE S A Aggressive - this is faster but does not encrypt the identities The Z yWALL and [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 464 NA T T raversal Select this if any of these conditions are satisfied. • This IKE SA might be used to negotiate IPSec SAs that use ESP as the active protocol. • There are one or more NA T routers between the Z yW ALL and remote IPSec router , and these routers do not support IPSec pass-thr[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 465 25.4 VPN Concentrator A VPN concentr ator combines sever al IPSec VPN connections into one secure network. Figure 333 VPN T opologies (Fully Meshed and Hub and S poke) In a fully -meshed VPN topology ( 1 in the figure), there is a VPN connection between every pair of routers. In a hub-and-spok[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 466 • Branch office A ’ s Z yW ALL uses one VPN rule to access both the headquarters (HQ) network and branch office B’ s network. • Branch office B’ s ZyW ALL uses one VPN rule to access br anch of fice A ’ s network only . Branch offi ce B is not permitte d t o access the headquarter[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 467 VPN Connection (VPN T unnel 1): • Local P olicy: 192.168.1.0/255.255.255.0 • Remote P olicy:1 92.168.11.0/255.255.255.0 • Disable Policy Enforce ment VPN Gateway (VPN T unnel 2): • My Address: 10.0.0.1 • P eer Gatew ay Address: 10.0.0.3 VPN Connection (VPN T unnel 2): • Local P oli[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 468 • The local IP addresses configured in the VPN rules should not overlap . • The concentrator must have at least on e separate VPN rule for each spoke. In the local policy , specify the IP addresses of the net works with which the spoke is to be able to hav e a VPN tunnel. This may require[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 469 Concentrator summary screen (see Section 25.4 on page 465 ), and click either the Add icon or an Edit icon. Figure 336 Configu ration > VPN > IPSec VPN > Concentrator > Edit Each field is desc ribed in the followi ng table. 25.5 IPSec VPN Background Information Here is some more de[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 470 IKE SA Overview The IKE SA provides a se cure connecti on between the ZyW ALL and remote IPSec router . It takes sev eral steps t o establish an IKE SA. The neg otiation mode determines how many . There are two negotiation mo des--main mode and aggressiv e mode. Main mode provides better secu[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 471 The Z yWALL sends one or more proposals to the remote IPSec router . (In some devices, you can only set up one propos al.) Each proposal consists of an encryption al gorithm, auth entication algorithm, and DH key group that the Z yWALL wants to use in the IKE SA. The remote IPSec rout er selec[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 472 the longer it takes to encrypt and decr ypt information. For example, DH2 keys (1024 bits) are more secure than DH1 keys (768 b its), but DH2 keys take longer to encrypt and decrypt. Authentication Before the Z yWA LL and remote IPSec router establ ish an IKE SA, they hav e to verify each oth[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 473 Router identity cons ists of ID typ e and content. The ID type can be domain name, IP address, or e-mail address, and the content i s a (properly-formatted) domai n name, IP address, or e-mail address. The content is only used for identification. Any domain name or e-mail address that you ente[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 474 Negotiation Mode There are two negotiati on modes--main mo de and aggressiv e mode. Main mode provides better security , while aggressive mode is faster . Main mode takes six steps to establish an IKE S A. Steps 1 - 2: The Z yW ALL sends it s proposals to the remote IPSec router . The remote [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 475 feature, router X and router Y can establish a VPN tunnel as long as the active protocol is ESP . (Se e Active Protocol on page 476 for more information about active protocols.) If router A does not hav e an IPSec pass-thru or if the activ e protocol is AH, y ou can solve this p roblem by enab[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 476 • The local and peer ID type and content come from the certifi cates. Note: Y ou must set up the certificates for the ZyW ALL and remote IPSec router first. IPSec SA Overview Once the Z yWALL and remote IPSec router have est ablis hed t he IKE S A , th ey can securely negotiate an IPSec SA [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 477 These modes are illustrated below . In tunnel mode, the Z yW ALL uses the active protocol to encaps ulate the entire IP packet. As a result, there are two IP headers: • Outside header: The outside IP header co ntains the IP address of the Z yWALL or remote IPSec router , whichever is the des[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 478 Additional T opics for IPSec SA This section provi des more information about IPSec SA in your Z yW ALL. IPSec SA usi ng Manual Keys Y ou might set up an IPSec SA using manual k eys when you w ant to establish a VPN tunnel quickly , for example, for troubl eshooting. Y ou should only do this [...]

Chapter 25 IPSec VPN ZyWALL USG 1000 User’s Guide 479 Each kind of tr anslation is explained below . The following example is used to help explain each one. Figure 342 VPN Example: NA T for Inbound and Outbound T raffic Source Address in Outbound Packet s (Outbound T raffic, Source NA T) This tr anslation lets the ZyW ALL route pack ets from comp[...]

Chapter 25 IPSec VPN ZyWALL USG 1000 U ser’s Guide 480 • SNA T - the translated sourc e address; a different IP addres s (range of addresses) to hide the original source address. Destination Address in Inbound P ackets (Inbound T raffic, Destin ation NA T) Y ou can set up this trans lation if you want the Z yWALL to forw ard some packets from t[...]

ZyWALL USG 1000 User’s Guide 481 C HAPTER 26 SSL VPN 26.1 Overview Use SSL VPN to allow users to use a web browser for secure remote user login (the remote users do not need a VP N router or VPN client software. 26.1.1 What Y ou Can Do in this Chapter •U s e t h e VPN > SSL VPN > Access Privilege screens (see Section 26.2 on page 484 ) to[...]

Chapter 26 SSL VPN ZyWALL USG 1000 U ser’s Guide 482 Y ou do not have to install additional client software on the remote user computers for access. Figure 343 Network Access Mode: Reverse Proxy Full T unnel Mode In full tunnel mode, a virtual connection is created for remote users with private IP addresses in the same subn et as t he local netwo[...]

Chapter 26 SSL VPN ZyWALL USG 1000 User’s Guide 483 changes through the SSL poli cies that us e the object(s). When you delete an SSL policy , the objects are not remov ed. Y ou cannot delete an object that is refe renced b y an SSL access poli cy . T o delete the object, you must first unassociate th e object from the S SL access policy . Findin[...]

Chapter 26 SSL VPN ZyWALL USG 1000 U ser’s Guide 484 26.2 The SSL Access Privilege Screen Click VPN > SSL VPN to open the Access Privilege screen. This screen lists the configured SSL access policies. Figure 345 VPN > SSL VPN > Access Privilege The following table describes t he labels in this screen. T able 127 VPN > SSL VPN > Acc[...]

Chapter 26 SSL VPN ZyWALL USG 1000 User’s Guide 485 Apply Click Apply to save the settings. R eset Click Reset to discard all changes. T able 127 VPN > SSL VPN > Access Privilege LABEL DESCRIPTION[...]

Chapter 26 SSL VPN ZyWALL USG 1000 U ser’s Guide 486 26.2.1 The SSL Access Policy Add/Edit Screen T o create a new or edit an existing SSL access policy , click the Ad d or Edit icon in the Access Privilege screen. Figure 346 VPN > SSL VPN > Access Privilege > Add/Edit[...]

Chapter 26 SSL VPN ZyWALL USG 1000 User’s Guide 487 The following table describes t he labels in this screen. T able 128 VPN > SSL VPN > Access Privilege > Add/Edit LABEL DESCRIPTION Create new Object Use to configure any new settings objects that you need to use in this screen. Configuration Enable P olicy Select this option to activ at[...]

Chapter 26 SSL VPN ZyWALL USG 1000 U ser’s Guide 488 26.3 The SSL Global Setting Screen Click VPN > SSL V PN and click the Global Setting tab to display the foll owing screen. Use this screen to set the IP a ddress of the Z yW ALL (or a gatewa y device) SSL Application List (Optional) The Selectable Application Objects list displays the name(s[...]

Chapter 26 SSL VPN ZyWALL USG 1000 User’s Guide 489 on your network f or full tunnel mode ac cess, enter access messages or upl oad a custom logo to be displ ayed on the remote user screen. Figure 347 VPN > SSL VPN > Global Setting The following table describes t he labels in this screen. T able 129 VPN > SSL VPN > Global Setting LABE[...]

Chapter 26 SSL VPN ZyWALL USG 1000 U ser’s Guide 490 26.3.1 How to Upload a Custom Logo Fol low the steps below to upload a custom logo to displa y on the remote user SSL VPN screens. 1 Click VPN > SSL VPN and click the Global Setting tab to di splay the configur ati on screen. 2 Click Browse to locate the logo graphic . Make su re the fil e i[...]

Chapter 26 SSL VPN ZyWALL USG 1000 User’s Guide 491 The following shows an example logo on the remote user screen. Figure 348 Example Logo Graphic Display 26.4 Est ablishing an SSL VPN Connection After you hav e configured the S SL VPN settings on the Z yW ALL, use the Z yWALL login screen’ s SSL VPN button to es tablish an SSL VPN connection. [...]

Chapter 26 SSL VPN ZyWALL USG 1000 U ser’s Guide 492 2 SSL VPN connection starts. This may take sever al minutes depending on yo ur network connection. Once the connection is up , you should see the client portal screen. The following shows an example. Figure 350 SSL VPN Client Portal Screen Example If the user account is not set up for SS L VPN [...]

ZyWALL USG 1000 User’s Guide 493 C HAPTER 27 SSL User Screens 27.1 Overview This chapter introduces the remote user S SL VPN screens. The following figure shows a network example where a remote user ( A ) logs into the Z yW ALL from the Internet to access the web serv er ( WWW ) on the local network. Figure 351 Network Exam p le 27.1.1 What Y ou [...]

Chapter 27 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 494 System Requirement s Here are the browser and computer system requirements for remote user access. • Windows 7 (32 or 64-bit), Vista (32 or 64-bit), 2003 (32-bit), XP (32-bit), or 2000 (32-bit) • Internet Explorer 7 and above or Firefox 1.5 and abov e • Using RDP requires Intern[...]

Chapter 27 SSL User Screens ZyWALL USG 1000 User’s Guide 495 1 Open a web browser and enter the web site address or IP address of the Z yW ALL. For examp le, “http://sslvpn.myc ompany .com” . Figure 352 Enter the Address in a We b Browser 2 Click OK or Yes if a security screen displays. Figure 353 Login Security Screen 3 A login screen displa[...]

Chapter 27 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 496 5 Y our computer starts esta blishing a se cure connection to the Z yW ALL after a successful login. Thi s may take up to two minutes. If you get a message about needing Jav a, download and install it and restart y our browser and re-login. If a certificate warning screen displays, cl[...]

Chapter 27 SSL User Screens ZyWALL USG 1000 User’s Guide 497 7 The Z yW ALL tries to install the SecuExtend er client. Y ou may need to click a pop- up to get your browser to allow this. In Internet Explorer , click Install . Figure 357 SecuExtender Blocked by Internet Exp lorer 8 The Z yW ALL tries to run the “ss ltun” applic ation. Y ou may[...]

Chapter 27 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 498 10 If a screen like t he following displays, click Continue Anyway to finish installing the SecuExtender client on y our computer . Figure 360 Hardware Inst allation W arning 11 The Application screen displays showing the list of resources av ailable to you. See Figure 361 on page 499[...]

Chapter 27 SSL User Screens ZyWALL USG 1000 User’s Guide 499 27.3 The SSL VPN User Screens This section describes the main elem ents in the remote us er screens. Figure 361 Remote User Screen The following table describes t he various parts of a remot e user screen. T able 130 Remote User Screen Overview # DESCRIPTION 1 Click on a menu tab to go [...]

Chapter 27 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 500 27.4 Bookmarking the ZyW ALL Y ou can create a bookmark of the ZyW ALL by clicki ng the Add to Favorite icon. This allows you to access the Z yW ALL using the bookmark without having to enter the address every time. 1 In any remote user screen, click the Add to Favorite icon. 2 A scre[...]

Chapter 27 SSL User Screens ZyWALL USG 1000 User’s Guide 501 3 An information screen displays to indicate that t he SSL VPN connection is about to terminate. Figure 364 Logout: Connection T ermination Progress[...]

Chapter 27 SSL User Screen s ZyWALL USG 1000 U ser’s Guide 502[...]

ZyWALL USG 1000 User’s Guide 503 C HAPTER 28 SSL User Application Screens 28.1 SSL User Application Screens Overview Use the Application screen to access web-based applic ations (such as web sites and e-mail) on the network through the SSL VPN conne ct i on. Wh ich appl ic a t ion s you can access depends on the Z yW ALL’ s configur at ion. 28.[...]

Chapter 28 SSL User Application Screens ZyWALL USG 1000 U ser’s Guide 504[...]

ZyWALL USG 1000 User’s Guide 505 C HAPTER 29 SSL User File Sharing 29.1 Overview The File Sharing screen lets you access files on a file server through the SSL VPN connection. 29.1.1 What Y ou Need to Know Use the File Sharing screen to display and access shared files/folders on a fil e server . Y ou can also perform the following actions: • Ac[...]

Chapter 29 SSL Use r File Sharing ZyWALL USG 1000 U ser’s Guide 506 29.2 The Main File Sharing Screen The first File Sharing screen displays the name(s) of the shared folder(s) av ailable. The following figure show s an example with one file share. Figure 366 File Sh aring 29.3 Opening a File or Folder Y ou can open a file if the file extension i[...]

Chapter 29 SS L User File Sh aring ZyWALL USG 1000 User’s Guide 507 3 If an access user name and password ar e requi red, a screen displays as shown in the following figure. Enter the account information and click Login to contin ue. Figure 367 File Sh aring: Enter Access User Name and Password[...]

Chapter 29 SSL Use r File Sharing ZyWALL USG 1000 U ser’s Guide 508 4 A list of files/ fo lders display s . Cl ic k on a file to open i t in a separate browser window . Y ou can also click a folder to access it . For t his example, click on a .doc file t o open the W ord document. Figure 368 File Sh aring: Open a W ord File 29.3.1 Downloading a F[...]

Chapter 29 SS L User File Sh aring ZyWALL USG 1000 User’s Guide 509 29.3.2 Saving a File After you ha ve opened a file i n a web browser , you can save a copy of the file by clicking File > Save As and fo ll ow ing the on-s c reen instructi o ns . Figure 369 File Sh aring: Save a Wor d File 29.4 Creating a New Folder T o create a new folder in[...]

Chapter 29 SSL Use r File Sharing ZyWALL USG 1000 U ser’s Guide 510 29.5 Renaming a File or Folder T o rename a file or f older , click the Rename icon nex t to the file/folder . Figure 371 File Sh aring: Rename A popup window displays. Specify the new na me and/or file exte nsio n in th e field provided. Y ou can enter up to 356 characters. Then[...]

Chapter 29 SS L User File Sh aring ZyWALL USG 1000 User’s Guide 51 1 29.7 Uploading a File Fol low the steps below to upload a file to the file serv er . 1 Log into the remote user screen and click the File Sharing tab. 2 Specify the location and/or name of th e file you w ant to upload. Or click Brows e to locate it. 3 Click Uploa d to send the [...]

Chapter 29 SSL Use r File Sharing ZyWALL USG 1000 U ser’s Guide 512[...]

ZyWALL USG 1000 User’s Guide 513 C HAPTER 30 ZyWALL SecuExtender The Z yWALL aut omatically loads the Z yW ALL SecuExtender client program to your computer after a successful logi n. The Z yW ALL SecuExtender lets you: • Access servers , remote desktops and mana ge files as if you were on the local network. • Use applications like e-mail, fil[...]

Chapter 30 ZyW ALL SecuExtender ZyWALL USG 1000 U ser’s Guide 514 30.2 S t atistics Right- click the Z yW ALL SecuExtender ic on in the system tr ay and s elect Status to open the Status screen. Use this screen to view the ZyW ALL SecuExtender’s statistics. Figure 375 ZyW ALL SecuExtender S tatus The following table describes t he labels in thi[...]

Chapter 30 ZyWALL SecuExtender ZyWALL USG 1000 User’s Guide 515 30.3 V iew Log If you h ave prob lems w ith th e ZyWALL SecuExtender , customer support may request you to pro vide information from the log. Right -click the Z yW ALL SecuExtender icon in the sys tem tr a y and select Log to open a notepad fil e of the Z yWALL SecuExtender’s log. [...]

Chapter 30 ZyW ALL SecuExtender ZyWALL USG 1000 U ser’s Guide 516 connected but not send any traffi c throug h it until y ou right-click the icon and resume the connection. 30.5 S top the Connection Right- click the icon and select Stop Connection to disconnect t he SSL VPN tunnel. 30.6 Uninst alling the ZyW ALL SecuExtender Do the following if y[...]

ZyWALL USG 1000 User’s Guide 517 C HAPTER 31 L2TP VPN 31.1 Overview L2TP VPN let s remote users use the L2TP and IPSec client soft ware includ e d with their computers’ operating systems to secu rely connect to the network behind t he Z yWALL . The remote users do not need their own IPSec gatewa ys or VPN client software. Figure 379 L2TP VPN Ov[...]

Chapter 31 L2T P VPN ZyWALL USG 1000 U ser’s Guide 518 • Use transp ort mode. • Not be a manual key VPN connection. •U s e Pre-Shared Key authentication. • Use a VPN gateway with the Secure Gateway set to 0.0.0.0 if you need to allow L2T P VPN cl ients to connect fro m more than one IP address. Using the Default L2 TP VPN Connection Defau[...]

Chapter 31 L2TP VPN ZyWALL USG 1000 User’s Guide 519 Finding Out More • See Section 6.5.17 on page 111 for related information on the se screens. • See Chapter 8 on page 171 for an example of how to create a basic L2TP VPN tunnel. 31.2 L2TP VPN Screen Click Configuration > VPN > L2TP VPN to open t he following screen. Use this screen to[...]

Chapter 31 L2T P VPN ZyWALL USG 1000 U ser’s Guide 520 VPN Connection Select the IPSec VPN connection the ZyW ALL uses for L2TP VPN. All of the configured VPN connections displa y here, but the one you use must meet the requirements listed in IPSec Configuration R equired for L2TP VPN on page 517 . Note: Modifying this VPN connection (or the VPN [...]

ZyWALL USG 1000 User’s Guide 521 C HAPTER 32 Application Patrol 32.1 Overview Application patrol provides a convenie nt w ay to manage the use of v arious applications on the network. It manages general protocols (for example, HTTP and FTP) and instant messenger (IM), peer-to- peer (P2P), V oice over IP (V oIP), and streaming (RSTP) appl ications[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 522 32.1.2 What Y ou Need to Know If you w ant to use a service, mak e sure both the firew all and application patrol allow the service’ s packets to go through the Z yW ALL. Note: The ZyW ALL checks firewall rules befor e it checks applica tion patrol rules for traffic goin g throu[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 523 numbers for SIP tr affic. Likewise, configuring the SIP ALG to use custom port numbers for SIP tr affic also configures applicati on patrol to use the same port numbers for SIP tr affic. DiffServ and DSCP Marking QoS is used to prioritize s o urce-to-destinat i on traffi c flows. All [...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 524 • The outbound tr affic flows from the connection initiator to the connection responder . • The inbound tr affic flows from the connecti on responder to the connection initiator . For example, a LAN to W AN connection is initiated from LA N and goes to the WAN. • Outbound tr[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 525 Bandwid th Management Priority • The Z yW ALL gives band width to higher -priority tr affic first, until it reaches its configured bandwidth r ate. • Then lower-pri o rit y traffic gets bandwid th. • The Z yW ALL uses a fa irness-based (round-robi n) sc heduler to divide b andwi[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 526 Configured Rate Effect In the following table the configured r ates total less than t he avai lable bandwidth and maximize bandwidth usage is disabled, both servers get t heir configured r ate. Priority Effect Here the configured rates total more than the available bandwidth. Beca[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 527 regardless of its priority , server B gets almost no bandwidth with this configu ration. Finding Out More • See Section 6.5.18 on page 111 for related information on the se screens. • See Section 7.6 on page 133 for an exampl e of how to set up web surfing policies with bandwidth [...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 528 • FTP traffic from the LAN to the DMZ can use more bandwidth since the interfaces support up to 1 Gbps connection s, but it must be the lowest priority and limited so it does not inte rfere with SIP and HT TP tr affic. Figure 385 Application Patrol Bandwid th Management Example [...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 529 • Enable maximi ze bandwidth usage so the SIP tr affic can borrow unus ed bandwidth. Figure 386 SIP Any to W AN Bandwidth Management Example 32.1.3.3 SIP W AN to Any Ba ndwid th Management Example Y ou also create a policy for calls coming in from the SIP server on the WAN. It is th[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 530 32.1.3.5 FTP W AN to DMZ Ba ndwid th Management Example • ADSL supports more downstream than upstream so you al low remote users 300 kbps for uploads to the DMZ F TP serv er (outbound) but only 100 kbps for downloads (inbound). • Third highes t priority (3) . • Disable maxim[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 531 32.2 Application Patrol General Screen Use this screen to enable and d isable applicati on patrol. It also lists the registration st atus and details about the sig nature set the Z yW ALL is using. Note: Y ou must register for the IDP/Ap pPatrol signature service (at least the tria l)[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 532 32.3 Application Patrol Applications Use the application patrol Common , Instant Messenger , Peer to Peer , VoIP , or Streaming screen to manage traf fic of individual applications. Use the Common screen (shown here as an exam ple) to manage traffic of the most commonly used web ,[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 533 Click Configuration > App Patro l > Co mmon to open the following screen. Figure 391 Configur ation > App Patrol > Common The following table describes the labels in this screen. See Secti on 32.3.1 on page 533 for more information as well. 32.3.1 The Application Patrol Ed[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 534 Streaming screen and click an application’ s Edit icon. The screen displayed here is for the MSN instant messenger service. Figure 392 Application Edit The following table describes t he labels in this screen. T able 139 Application Edit LABEL DESCRIPTION Service Enable Service [...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 535 # This field is a sequential value, and it is not associated with a specific entry . Note: The ZyW ALL checks ports in the order they appear in the list. While this sequence does not af fect the function ality , you might improve the performance of the ZyW ALL by putting more commonly[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 536 Access This field displays what the Z yWALL does with packets for this application that match this policy . forward - the Z yWALL routes the pack ets for this application. Drop - the Z yW ALL does not route the packets for this application and does not notify the client of its dec[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 537 32.3.2 The Application Patrol Policy Edit Screen The Application Policy Edit screen allows you to edit a group of settings f or an application. T o access this screen, go to the applicati on patrol Common , Instant Messenger , Peer to Peer , VoIP , or Streaming screen and click an app[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 538 Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Ch ap te r 4 3 o n p ag e 7 17 for details). Otherwise, select none to mak e the policy always effective. User Select a user name or user group to which to apply the[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 539 Action Block For som e applications, you can select individual uses of the application that the policy will have the Z yW ALL block. These fields only apply when Access is set to forwar d . Login - Select this option to block users from logging in to a ser ver for this application. Me[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 540 32.4 The Other Applications Screen Sometimes, the Z yW ALL cannot identify the application. For example, the application might be a new application, or the pack ets might arriv e out of sequence. (The Z yW ALL does not re order pack ets when identifying the application.) The Other[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 541 Click AppPatrol > Other to open the Other ( applicatio ns) screen. Figure 394 AppPatrol > Other The following table describes the labels in this screen. See Secti on 32.4.1 on page 543 for more information as well. T able 141 AppP at rol > Other LABEL DESCRIPTION Add Click th[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 542 Destination This is the destination address or address group for whom this policy applies. If any displays, the policy is effective for every destination. Protocol This is the protocol of the traffic to which this po licy applies. Access This field displays what the Z yWALL does w[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 543 32.4.1 The Other Applications Add/Edit Screen The Other Configuration Add/Edit screen allows you to create a new condition or edit an existing one. T o access this screen, go to the Other Protocol screen (see Section 32.4 on page 540 ), and click either the Add icon or an Edit icon. F[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 544 Schedule Select a schedule that defines when the policy applies or select Create Object to configure a new one (see Ch ap te r 4 3 o n p ag e 7 17 for details). Otherwise, select any to make the policy always effective. User Select a user name or user group to which to apply the p[...]

Chapter 32 Application Patrol ZyWALL USG 1000 User’s Guide 545 Inbound kbps T ype how much inbound bandwidth, in kilobits per second, this policy allows the traffic to use. Inbound refers to the traffic the Z yWALL sends to a connection’ s initiator . If you enter 0 here, this policy does not apply bandw idth management for the matching traffic[...]

Chapter 32 App licat ion Patr ol ZyWALL USG 1000 U ser’s Guide 546 OK Click OK to save your changes back to the Z yW ALL. Cancel Click Cancel to exit this screen without saving your changes. T able 142 AppPatrol > Other > Edit (continued) LABEL DESCRIPTION[...]

ZyWALL USG 1000 User’s Guide 547 C HAPTER 33 Anti-Virus 33.1 Overview Use the Z yWALL’ s anti- virus feature to pr otect y our connected network from virus / spyware infect ion. The Z yW ALL checks tr af fi c going in the direction( s) y ou specif y for signature matches. In the following fi gure the Z yW ALL is set to check tr affic coming fro[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 548 33.1.2 What Y ou Need to Know Anti-Virus Engines Subscribe to signature files for Z yXEL ’ s anti-v irus engine or one powered by K aspersky . When using the trial, you can switch from one engine to the other in the Regi stration screen. After the trial expires, y ou need to purchase an [...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 User’s Guide 549 2 If the packets are not session connection setup packets ( such as SYN, ACK and FIN), the Z yWALL records the sequence of the packets. 3 The scanning engine ch ecks the contents of the packets for virus. 4 If a virus pattern is matched, the Z yW ALL removes the infected portion of the file[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 550 33.1.3 Before Y ou Begin • Before using anti-virus, see Chapter 11 on page 26 5 for how to register for the anti-vir us service. • Y ou may need to customize the zones (in the Network > Zone ) used for the anti-vi rus scanning direction. 33.2 Anti-V irus Summary Screen Click Configu[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 User’s Guide 551 The following table describes t he labels in this screen. T able 143 Configuration > Anti-X > Anti-Virus > Genera l LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a grea ter or lesser number of configuration fields. Enable Anti- Virus a[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 552 Protocol These are the protocols of traffic to scan for viruses. FTP applies to traffic using the T CP port number specified for FTP in the ALG screen. HTTP applies to traffic using T CP ports 80, 8080 and 3128. SMTP applies to traffic using T C P port 25 . POP3 applies to traffic using TC[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 User’s Guide 553 33.2.1 Anti-V irus Policy Add or Edit Screen Click the Add or Edit icon in the Configuration > Anti-X > Anti-Virus > General screen to displa y the configur ation screen as shown next. Figure 398 Configur ation > Anti-X > Anti-Viru s > General > Add The following table [...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 554 Actions When Matched Destroy infected file When you select this check bo x, if a virus pattern is matched, the Z yW ALL overwrites the infected portion of the file (and the rest of the file) with zeros. The un-infected po rtion of the file before a virus pattern was matched goes through un[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 User’s Guide 555 33.3 Anti-V irus Black List Click Configuration > Anti-X > Anti-Virus > Black/White List to displa y the screen shown next. Use the Black List screen to set up the Anti-Virus black (blocked) list of virus file patterns. Click a column’ s heading cell to sort the table entries by [...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 556 The following table describes t he labels in this screen. 33.4 Anti-V irus Black List or White List Add/Edit From the Configuration > Anti-X > Anti-Virus > Black/White List > Black List (or White List ) screen, click the Add icon or an Ed it icon to display the following screen[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 User’s Guide 557 The following table describes t he labels in this screen. 33.5 Anti-V irus White List Click Configuration > Anti-X > Anti-Virus > Black/White List > White List to display the screen shown next. Use the Black/White List screen to set up Anti- Virus black (blocked) and white (allo[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 558 column’ s heading cell to sort t he table en tries by that col umn’s criteria. Click the heading cell again to reverse the sort order . Figure 401 Configuration > Anti-X > Anti-Viru s > Black/White List > White List The following table describes t he labels in this screen. [...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 User’s Guide 559 If Internet Explorer op en s a warning screen ab out a scri pt making Internet Explorer run slowly and the computer ma ybe becoming unresponsiv e, just click No to continue. Cl ick a column’ s heading ce ll to sort the table entries by that column’s criteria. Click the headin g cell aga[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 560 The following table describes t he labels in this screen. T able 148 Configuration > Anti-X > Anti-Virus > Sig nature LABEL DESCRIPTION Signatures Search Select the criteria on which to perform the search. Select By Name from the drop down list box and type th e name or part of th[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 User’s Guide 561 33.7 Anti-V irus T echnical Reference T ypes of Computer Viruses The following table describes some of the common computer vi ruses. Computer Virus Inf ection and Prevention The following describes a simpl e life cycle of a computer virus. 1 A computer gets a copy of a virus from a source s[...]

Chapter 33 Anti- Viru s ZyWALL USG 1000 U ser’s Guide 562 A host-b ased anti- virus (HA V) scanner is often soft ware installed on computers and/or servers in the network. It i nspects files for virus patterns as they are moved i n and out of the hard driv e. However , host- based anti-virus scanners cannot eliminate all viruses for a number of r[...]

ZyWALL USG 1000 User’s Guide 563 C HAPTER 34 IDP 34.1 Overview This chapter introduces pack et inspection IDP (Intrusi on, Detection and Prevention), IDP profiles, binding an IDP prof ile to a tr affic flow , custom signatures and updating signatures. An IDP system can detect malicious or suspicious packets and respond i nstantaneously . IDP on t[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 564 IDP Profiles An IDP profile is a set of related IDP sign atures that y o u can activ ate as a set and configure common log and action s ettings. Y ou can apply IDP profiles to tr affic flowing from one zone to another . For ex ample, appl y the default LAN_IDP p rofile to any tr affic going to the[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 565 34.2 The IDP General Screen Click Configuration > Anti-X > IDP > Ge neral to open this screen. Use this screen to turn IDP on or off , bind IDP profiles to traffic directions, and view registra tion and signature information. Note: Y ou must register in order to use p acket inspection signa[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 566 Re move Select an entry and click this to delete it. Activate T o turn on an entry , select it and click Activate . Inactivate T o turn off an entry , select it and click In activate . Move T o change an entry’s position in the numbered list, select it and click Move to display a field to type a[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 567 34.3 Introducing IDP Profiles An IDP profile is a set of packet inspection signatures. P acket inspection si gnatures examine packet content for malicious data. Pack et inspection applies t o OSI (Open System Int erconnection) layer -4 to lay er-7 contents. Y ou need to subscribe for IDP se rvice in[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 568 34.3.1 Base Profiles The Z yW ALL comes with sever al base profiles. Y o u use base profiles to create new profiles. In the Configuration > Anti-X > IDP > Profile screen, cli c k Add to display the following screen. Figure 404 Base Profiles The following table descri bes this screen. T ab[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 569 34.4 The Profile Summary Screen Select Anti-X > IDP > Profile . Use this screen to: • Add a new profile • Edit an existing prof ile • Delete an existing profile. Click a column’ s heading cell to sort the table entries by that column’ s criteria. Click the heading cell again to rever[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 570 34.5 Creating New Profiles Y ou may want to create a new profile if not all signa tures in a base profile are applicable to your network. In this case y ou should disable non- applicable signatures so as t o improve Z yW ALL IDP proc essing efficiency . Y ou may also f ind that certain signatures [...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 571 34.6 Profiles: Packet Inspection Select Configuration > Anti -X > IDP > Pr ofile and then add a new or edit an existing profile select. P ack et insp ec tion signatures examine the contents of a packet for mal icious data. It oper ates at lay er-4 to lay er-7. 34.6.1 Profile > Group V ie[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 572 The following table describes t he fields in this screen. T able 153 Configuration > Anti-X > IDP > Profile > Group V iew LABEL DESCRIPTION Name This is the name of the profile. Y ou may use 1-31 alphanumeric characters, underscores( _ ), or dashes (-), bu t the first character cannot [...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 573 Action T o edit what action the ZyW ALL tak es when a packet matches a signature, select the signature and use the Action icon. none : Select this action on an individual signature or a complete service group to have the Z yW ALL take no action when a pack et matches the signature(s). drop : Select [...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 574 34.6.2 Policy T ypes This section describes IDP poli cy types, also known as attack types, as c a tegorized in the ZyW ALL. Y ou may refer to these types when categorizing your own custom rules. Log These are the log options. T o ed it this, select an item and use the Log icon. Action This is the [...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 575 34.6.3 IDP Service Group s An IDP service group is a set of re lated packet i nspection signatures. Scan A scan describes the action of searching a network for an exposed service. An attack may then occur once a vulnerability has been found. Scans occur on several network levels. A network scan occu[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 576 The following figure shows the WEB_PHP se rvice group that contains signatures related to attacks on web servers us ing PHP exploits . PH P (PHP: Hypertext Preprocessor) is a serv er-side HTML embedd ed scripting language that allows web developers to build dynamic websites. Logs and actions appl [...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 577 signatures by criteria such as name, ID , severity , attack type, vulner able attack platforms, service category , log options or act ions. Figure 408 Configuration > Ant i -X > IDP > Profile: Q u ery View The following table describes t he fields specific to this screen’ s query view . T[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 578 Severity Search for signatures by severit y level(s). Hold down the [Ctrl] key if you want to make multiple selections. These ar e the sev erities as defi ned in the Z yW ALL. Th e number in brackets is the number you use if using commands . Severe (5): These denote attacks that try to run arbitra[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 579 34.6.5 Query Example This example shows a search with these criteria: • Severity: severe and high • Attac k T ype: DDoS • Platform: Windows 2000 and Wind ows XP computers •S e r v i c e : A n y[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 580 •A c t i o n s : A n y Figure 409 Query Example Search Criteria Figure 410 Query Example Search Result s[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 581 34.7 Introducing IDP Custom Signatures Create custom signatures for new attack s or attacks peculiar to y our network. Custom signatures c an also be sav ed to/f rom y our computer so as to s hare with others. Y ou need so me knowledge of packet header s and attack types to create your own custom si[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 582 34.8 Configuring Custom Signatures Select Configuration > Anti-X > IDP > Cu stom Signature s. The first screen shows a summary of all custom signatures created. Click the SID or Name heading to sort. Click t he Add icon to create a new signature or click the Edit icon to edit an existing [...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 583 Note: The ZyW A LL checks all signatures and contin ues searching even af ter a match is found. If two or more rules have conflicting actions fo r the sa me p acket, then the ZyW ALL applies the more restrictive action ( reject-both, reject-receiver or reject-sender , drop, none in this order). If a[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 584 34.8.1 Creating or Editing a Custom Signature Click the Add icon to c reate a new signature or c lick the Edit icon to edit an existing signature in the screen as shown in Figure 412 on page 583 . A packet must match all items you configur e in this screen before it matches the signature. The more[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 585 T ry to write signatures that target a vulner ability , for example a certain t ype of traffic on certain operating s ystems, instead of a specific exploit. Figure 413 Configur ation > Anti-X > IDP > Custom Signatures > Add/Edit[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 586 The following table describes the fields in this screen. T able 159 Configuration > Anti-X > IDP > Custom Signatures > Ad d/Edit LABEL DESCRIPTION Name T ype the name of your custom signature. Y ou may use 1-31 alphanumeric characters, underscores( _ ), or dashes (-), but the first cha[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 587 Fragmentation A fragmentation flag identifies whether the IP datagr am should be fragmented, not fr agmented or is a reserved bit. Some intrusions can be identified by this flag. Select the check box and then select the flag that the intrusion uses. Fragmentation Offset When an IP datagram is fr agm[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 588 Flow If selected, the signature only ap plies to certain directions of the traffic flow and only to c lients or servers. Select Flow and then select the identifying options. Established : The signatur e only checks for e stablished T CP connections Stateless : The signature is triggered regardless[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 589 P ayload Size This field may be used to check for abno rmally sized packets or for detecting buffer overflows . Select the check box, then select Equal , Smalle r or Greater and then type the payload size. Stream rebuilt packets are not checked regardless of the size of the payload. Add Click this t[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 590 34.8.2 Custom Signature Example Before creating a custom signature, you must first clearly understand the vulnerabilit y . 34.8.2.1 Underst a nd the V ulnerability Check the ZyW ALL logs when the attack oc curs. Use web sites such as Google or Security F ocus t o get as much i nformatio n ab out t[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 591 34.8.2.2 Analyze Packet s Use the packet capture screen (se e Section 53.3 on page 860 ) and a packet analyzer (also known as a network or pr otocol analyzer) such as Wireshark or Ethereal to inv estigate some more. Figure 414 DNS Query Pa cket Details From the details about DNS query you see th at [...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 592 The final custom signature should look like as shown in the following figure. Figure 415 Example Custom Signatu re 34.8.3 Applying Custom Signatures After you create your custom signature, i t becomes avai lable in the IDP service group category in the Configuration > Anti-X > IDP > Profi[...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 593 Y ou can activate the signature, configur e what action to take when a packet matches it and if it should gener ate a log or alert i n a profil e. Then bind the profil e to a zone. Figure 416 Example: Custom Signat ure in IDP Profile 34.8.4 V erifying Custom Signatures Configure th e sig nature to c[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 594 destination port is the service port (53 for DNS in this case) that the attack tries to exploit. Figure 417 Custom Signature Log 34.9 IDP T echnical Reference This section contains some background information on IDP . Host Intrusions The goal of host -based intrusions is to infi ltr ate files o n [...]

Chapter 34 IDP ZyWALL USG 1000 User’s Guide 595 Network Intrusions Network - based intrusions hav e the goal of bringing down a ne twork or networks by attacking computer(s), switch(es), rout er(s) or modem(s). If a LAN switch is compromised for example, then the wh ole LA N is compro mised. Host-based intrusions may be used to cause network - ba[...]

Chapter 34 ID P ZyWALL USG 1000 U ser’s Guide 596 Note: Not all Snort functionality is supported in the ZyW ALL. Same IP sameip T ransport Protocol T ransport Protocol: T CP P ort (In Snort rule header) Flow flow Flags flags Sequen ce Number seq Ack Number ack Window Size window T ransport Protocol: UDP (In Snort rule header) P ort (In Snort rule[...]

ZyWALL USG 1000 User’s Guide 597 C HAPTER 35 ADP 35.1 Overview This chapter introduces ADP (Anomaly De tection and Prev ention), anomaly profiles and applying an ADP profile to a traffic direction. AD P p rot ec ts ag ain st anomalies based on violations of prot ocol standards (RFCs – Requests for Comments) and abnormal flows such as p ort scan[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 598 Protocol Anomalies Protocol anomalies are packets t hat do not comply with the relevant RFC (R equest For Comments). Protocol anomaly detect ion includes HT TP Inspection, T CP Decoder , UDP Decoder and ICMP Decoder . Protocol anomaly rules may be updated when you up load new firmware. ADP Profile[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 599 35.2 The ADP General Screen Click Configuration > Anti-X > ADP > General . Use this screen to turn anomaly detection on or off and apply an omaly profiles to tr affic directions. Figure 418 Configur ation > Anti-X > ADP > General The following table describes t he screens in this s[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 600 35.3 The Profile Summary Screen Use this screen to: • Create a new profile using an existing base profile • Edit an existing prof ile • Delete an existing profile Status The activate (light bulb) icon is lit when the entry is active and dimmed when the entry is inactive. From, T o This is th[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 601 35.3.1 Base Profiles The Z yWALL comes with base profiles. Y ou use base profiles to create new profiles. In the Configuration > Anti-X > ADP > Profile screen, click Add to display the following screen. Figure 419 Base Profiles These are the default base profiles at the ti me of writing. 35[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 602 The following table describes t he fields in this screen. 35.3.3 Creating New ADP Profiles Y o u may want to create a new profile if not all rules in a base profile are app licable to your networ k. In this case you should disable non-applicable rules so as to improve Z yWALL ADP processing effici[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 603 belonging to this profile, mak e sure you hav e clicked OK or Save to save the changes before selecting the Traffic Anomaly tab. Figure 421 Profile s: T raf fic Anomaly[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 604 The following table describes t he fields in this screen. T able 164 Configuration > ADP > Profile > T raffic Anomaly LABEL DESCRIPTION Name This is the name of the ADP profile. Y ou may use 1-31 alphanumeric characters, underscores( _ ), or dashes (-), but the first character cannot be a[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 605 35.3.5 Protocol Anomaly Profiles Protocol anomaly is the third screen in an ADP profile. Protocol anomaly (PA) rules check for protocol compliance against th e relev ant RFC (Request for Comments). Protocol anomaly detection includes HT TP Inspection, T CP Decoder , UDP Decoder , and ICMP Decoder wh[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 606 Figure 422 Profile s: Protocol Anomaly[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 607 The following table describes t he fields in this screen. T able 165 Configuration > ADP > Profile > Protocol Anomaly LABEL DESCRIPTION Name This is the name of the profil e. Y ou may use 1-31 alphanumeric characters, underscores( _ ), or dash es (-), but the first character cannot be a num[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 608 Action T o edit what action the ZyW A LL takes when a packet matches a signature, select the signature and use the Act ion icon. original se tting : Select this action to return each signature in a service group to its previously saved configuration. none : Select this action on an individual sign[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 609 35.4 ADP T echnical Reference This section is divided i nto traff ic anomaly background information and protocol anomaly background information. T raffic Anomaly Background Information The following sections may help you conf igure the traffic anomaly profile screen ( Section 35.3.4 on page 602 ) Po[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 610 Decoy Port Scans Decoy port scans are scans where the atta cker has spoofed the source address. These are some decoy scan types: •T C P D e c o y P o r t s c a n • UDP Decoy P ortscan • IP Decoy P ortscan Distributed Port Scans Distributed port scans are many -to-one port scans. Distributed [...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 61 1 Flood Detection Flood attacks satur ate a network with useless data, use up all av ailable bandwidth, and therefore mak e communi cati ons in the network impossible. ICMP Flood Att ack An ICMP flood is broadcasting many p ings or UDP pack ets so that so much data is sent to the system, that it sl o[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 612 the initiator responds with an ACK (ack nowledgment). After this handshak e, a connection is established. Figure 424 TCP Three-W ay Handshake A SYN flood attack is when an attacker sends a series of SYN packets. Each packet causes the receiver to reply with a SYN- ACK response. The receiv er then [...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 613 UDP Flood Attack UDP is a connection-less protocol and it does not require any connection setup procedure to tr ansfer d ata. A UDP flood at tack is p ossible when an at tack er s ends a UDP packet to a random port on the victim system. When the victim system receives a UDP packet, it wil l determin[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 614 DOUBLE-ENCODING ATT A C K This rule is IIS specific. IIS does two passes through the request URI, doing decodes in each one. In the first pass, IIS encoding (UTF-8 unicode, ASCII, bare byte, and %u) is done. In the second pass ASCII, bare byte, and %u encodings are done. IIS-BACKSLASH- EVASION A T[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 615 WEBROO T -DIRECTORY - TRAV ERSAL A T T ACK This is when a directory traversal tr averses past the web server root directory . This generates much fewer false positives than the directory option, because it doesn’t alert on directory tra versals that stay within the web serv er directory structure.[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 616 DOUBLE-ENCODING ATT A C K This rule is IIS specific. IIS does two passes through the request URI, doing decodes in each one. In the first pass, IIS encoding (UTF-8 unicode, ASCII, bare byte, and %u) is done. In the second pass ASCII, bare byte, and %u encodings are done. IIS-BACKSLASH- EVASION A T[...]

Chapter 35 ADP ZyWALL USG 1000 User’s Guide 617 WEBROO T -DIRECTORY - TRAV ERSAL A T T ACK This is when a directory traversal tr averses past the web server root directory . This generates much fewer false positives than the directory option, because it doesn’t alert on directory tra versals that stay within the web serv er directory structure.[...]

Chapter 35 AD P ZyWALL USG 1000 U ser’s Guide 618 TRUNCA TED-HEADER ATT A C K This is when an ICMP packet is sent which has an ICMP datagram length of less than the ICMP header length. This may cause some applications to crash. TRUNCA TED- TIMEST AMP-HEADER ATT A C K This is when an ICMP packet is sent which has an ICMP datagram length of less th[...]

ZyWALL USG 1000 User’s Guide 617 C HAPTER 36 Content Filtering 36.1 Overview Use the content filtering feature to cont rol access to specific web sites or web content. 36.1.1 What Y ou Can Do in this Chapter •U s e t h e General screens ( Section 36.2 on page 619 ) to configure global content filtering settings, configure co ntent filtering pol[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 618 Content Filtering Profiles A content filtering profile convenient ly stores your custom set tings for the following featur es . • Category -based Bl ocking The Z yWALL can block access to particular categories of web site content, such as po r no g rap hy o r ra ci a l i n t o l e r[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 619 Since the Z yWALL checks the URL ’ s domain name (or IP address) and fil e path separately , it will not fi nd items that go across the two . For exampl e, with the URL www .zyxel.com.tw/news/pressroom.php , the Z yW ALL would find “tw” in t he domain name ( www .zyxel.com.t[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 620 your list of content filter policies , create a denial of access message or specify a redirect URL and check your external we b filtering service regis tration status. Figure 426 Configuration > Ant i-X > Content Filt er > General The following table describes t he labels in [...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 621 Move T o change an entry’ s position in the numbered list, select it and click Move to display a field to type a number for where y ou want to put that entry and press [ENTER] to move the entry to the number that you typed. # This column lists the index numbers of the content fi[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 622 36.3 Content Filter Policy Add or Edit Screen Click Configuration > Anti-X > Content Filter > General > Add or Edit to open the Content Filter Policy screen. Use this screen to configure a content License Status This read-only field displays the status of your content-filt[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 623 filter policy . A content filter policy defi nes which content filter p rofile should be applied, when it should be app lied, and to whose web access it shoul d be applied. Figure 427 Configu ration > Anti-X > Content Filter > General > Ad d l The following table descr[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 624 36.4 Content Filter Profile Screen Click Configuration > Anti-X > Content Filter > Filter Profile to open the Filter Profile screen. A content filter profile de fines to which web se rvices, web sites or web site categories acce ss is to be all owed or denied. Figure 428 Conf[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 625 See Chapter 37 on page 641 for how to view content filtering reports. Figure 429 Configur ation > Anti-X > Content Filter > Filter Profile > Add[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 626 The following table describes t he labels in this screen. T able 170 Configuration > Anti-X > Content Filter > Filter Profile > Add LABEL DESCRIPTION License Status This read-only field displays the status of y our content-filtering database service registration. Not Licen[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 627 Action for Unsafe W eb Pa g es Sele ct Pass to allow users to access web pages that match the unsafe categories that you select below . Select Block to prevent users from accessing web pages that match the unsafe categories that you select below . When external database content fi[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 628 Action When Category Server Is Unav ailable Select Pass to allow users to access any requested web page if the external content filtering database is unav ailable. Select Block to block access to any requested web page if the external content filtering database is unavailable. Select [...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 629 Spyware/Malware Sources This category includes pages which distribute spyware and other malware. Spyware and malw are are defined as software which takes control of y our computer , modifies computer settings, collects or reports personal information, or misrepresents itself by tr[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 630 Nudity This category includes pages containing nude or seminude depictions of the human body . These depictions are not necessarily sexual in intent or effect, but may include pages containing nude paintings or photo galleries of artistic nature. This category also includes nudist or [...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 631 Arts/Entertainment This category incl udes pages that promote and provide information about motion pictures, videos, television, music and programming guides, books, comics, movie theatres, galleries, artists or reviews on entertainment. Business/Economy This category includes pag[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 632 Government/Legal This category includes pages sponsored by or which provide information on government, government agencies and government services such as taxation and emergency services. It also includes pages that discuss or explain laws of various governmental entities. Military Th[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 633 Re ligion This category includes pages that promote and provide information on conventional or unconventional religious or quasi-religious subjects, as well as churches, synagogues, or other houses of worship. It does not include pages containing alternative religions such as Wicc[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 634 Sports/Recreation/ Hobbies This category includes pages that promote or provide information about spectator sports, recreational activities, or hobbies. This includes pages that discuss or promote camping, gardening, and collecting. T ravel This category includes page s that promote o[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 635 Alcohol Sites that promote, offer for sale, glorify , review, or in any w ay advocate the use or creation of alcoholic bever ages, including but not limited to beer , wine , and hard liquors. Pages that sell alcohol as a subset of other products such as restaurants or grocery stor[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 636 36.5.1 Content Filter Blocked and W arning Messages These are the content filtering warnin g messages. The messages f or blocked access are the same but do not include the buttons. Figure 430 Content Filter W arning Messages Placeholders This category includes pages that are under con[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 637 36.6 Content Filter Customization Screen Click Configuration > Anti-X > Content Filter > Filter Profile > Add or Edit > Customization to open the Customization screen. Y ou can cr eate a list of good (allowed) web site addresses and a list of bad (blo cked) web site[...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 638 Allow W eb tr af fic for trusted web sites only When this box is selected, the ZyW ALL blocks W eb access to sites that are not on the Trusted Web Sites list. If they are chosen carefully , this is the most effective way to block objectionable material. Re stricted W eb F eatures Sele[...]

Chapter 36 Co n te nt F ilt ering ZyWALL USG 1000 User’s Guide 639 36.7 Content Filter T echnical Reference This section provi des content filtering background informati on. Forbidden W eb Sites This list displays the forbidden web sites already added. Enter host names such as www .bad-site.com into this text field. Do not enter the complete URL [...]

Chapter 36 Content Filtering ZyWALL USG 1000 U ser’s Guide 640 External Content Filter Server Lookup Procedure The content filter lookup process is described below . Figure 432 Content Filter Lookup Procedure 1 A computer behind the Z yW ALL tries to access a web site. 2 The Z yWALL looks up the web site in its cache. If an attempt to access the [...]

ZyWALL USG 1000 User’s Guide 641 C HAPTER 37 Content Filter Reports 37.1 Overview Y ou can view content filtering reports afte r y ou have activ ated the category -based content filtering sub scription service. See Chapter 11 on page 265 on how t o create a myZ yXEL.com account, register your device and activ ate the subscription services. 37.2 V[...]

Chapter 37 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 642 2 Fill in your myZ yXEL.com account information and click Login . Figure 433 myZyXEL.com: Lo gin[...]

Chapter 3 7 Content Filt er Reports ZyWALL USG 1000 User’s Guide 643 3 A welcome screen displays. Cl ick your Z yWALL’ s model name and/or MAC address under Registered ZyXEL Products (the ZyW ALL 70 is shown as an example here). Y ou can chan ge th e de scriptive name for your Z yWALL using the Rename button in the Service Management screen (se[...]

Chapter 37 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 644 4 In the Service Management screen click Content Filter in the Service Name column to open the content filter reports screens. Figure 435 myZyXEL.com: Service Ma nagement 5 In the Web Filter Home screen, click the Reports tab. Figure 436 Content Filter Reports Main Screen[...]

Chapter 3 7 Content Filt er Reports ZyWALL USG 1000 User’s Guide 645 6 Select items under Global Reports to view the corresponding reports. Figure 437 Content Filter Reports: Report Home 7 Select a time period in the Date Range field, ei ther Allowed or Blocked in the Action Taken field and a category (or enter the user name if you want to view s[...]

Chapter 37 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 646 8 A chart and/or list of requeste d web site categories disp lay in the lower half of the screen. Figure 438 Global Report Scre en Example[...]

Chapter 3 7 Content Filt er Reports ZyWALL USG 1000 User’s Guide 647 9 Y ou can click a category in the Categories report or click URLs in the Report Home screen to see the URLs that were requ es te d. Figure 439 Requested URLs Example[...]

Chapter 37 Content Filter Reports ZyWALL USG 1000 U ser’s Guide 648[...]

ZyWALL USG 1000 User’s Guide 649 C HAPTER 38 Anti-Spam 38.1 Overview The anti-spam feature can mark or disc ard spam (unsolicited commercial or junk e-mail). Use the white list to identify legitimate e-mail. Use t he black list to identify spam e- mail. The ZyW ALL ca n also check e-mail agains t a DNS black l ist (DNSBL) of IP addresses of serve[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 650 Black List Configure black list entri es to identify spam. The black list entries ha ve the Z yWALL classify an y e-mail that is from or forwarded by a specified IP address or uses a specified header field and header v alue as being spam. If an e-mail does not match any of the white list e[...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 651 E-mail Header Buffer Size The Z yW ALL has a 5 K buffer for an individu al e-mail header . If an e-mail’ s header is longer than 5 K, the Z yW ALL only checks up to the first 5 K. DNSBL A DNS Black List (DNSBL) is a serv er that hosts a list of IP addresses known or suspected of having sent[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 652 spam policies. Y ou can also select the action the Z yW ALL takes when the mail sessions threshold is reached. Figure 440 Configu ration > Anti-X > Anti-S pam > General The following table describes t he labels in this screen. T able 172 Configuration > Anti-X > Anti-S p am [...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 653 38.3.1 The Anti-S p am Policy Add or Edit Screen Click the Add or Edit icon in the Configuration > Anti-X > Anti-Spam > General screen to display the configur ation sc reen as shown next. Use this screen to configure an anti-spam policy that cont rols what traffic direction of e-mail[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 654 check, which e-mail protocols to scan, the scanning options, and the action to t ake on spam tr affic. Figure 441 Configu ration > Anti-X > Anti-S pam > General > Add The following table describes t he labels in this screen. T able 173 Configuration > Anti-X > Anti-Virus [...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 655 38.4 The Anti-S p am Black List Screen Click Configuration > Anti-X > Anti-Spam > Black / White L ist to display the Anti-Spam Black List screen. Configure the black li st to identify spam e-mail. Y ou can create blac k list entries based on the sender’s or rela y server’ s IP ad[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 656 specific subject t ext. Click a column’ s heading cell to sort the table entries b y that column’s criteria. Click the headin g cell aga in to re verse the so rt order . Figure 442 Configuration > Anti -X > Anti-S pa m > Black/W hite List > Black List The following table de[...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 657 38.4.1 The Anti-S p am Black or White List Add/Edit Screen In the anti-spam Black List or White List screen, click the Add icon or an Edit icon to displa y the following screen. Use this screen to configure an anti-spam bl ack list entry to identi f y spam e-mail. Y ou can create entries base[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 658 38.4.2 Regular Expressions in Black or White List Entries The following applies for a black or white li st entry based on an e-mail subj ect, e- mail address, or e-mail header v alue. • Use a question mark (?) to let a single char acter v ary . For example, use “a?c” (without the quo[...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 659 38.5 The Anti-S p am White List Screen Click Configuration > Anti-X > Anti-Spam > Black/White List and then the White List tab to displa y the Anti-Spam White List screen. Configure the white list to identify legi timate e-mail. Y ou can create white lis t entries based on the sender[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 660 38.6 The DNSBL Screen Click Configuration > Anti-X > Anti-Spam > DNSBL to display the anti-spam DNSBL screen. Use this screen to co nfigure the Z yWALL to chec k the sender and relay IP addresses in e-mail headers ag ainst DNS (Domain Name Service)-based spam Black Lists (DNSBLs).[...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 661 The following table describes t he labels in this screen. T able 177 Configuration > Anti-X > Anti-S p am > DNSBL LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser num ber of configuration fields. Enable DNS Black List ([...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 662 38.7 Anti-S p am T echnical Reference Here is more detailed anti-spam information. DNSBL • Th e Zy W A L L c he c k s o nl y p ub l i c s en de r a n d relay IP addresses, it does not check private IP addresses. • The Z yW ALL sends a separ ate query (DNS lookup) for each sender or rel[...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 663 Here is an example of an e- mail classified as spam based on DNSBL repl ies. Figure 446 DNSBL S pam Detection Example 1 The Z yW ALL receives an e- mail that was se nt from IP address a.a.a.a and relay ed by a n e- ma il s erve r a t IP ad dre ss b. b.b. b. The Z yWALL send s a separate query[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 664 Here is an example of an e-mail classifi ed as legitimate based on DNSBL replies. Figure 447 DNSBL Legitimate E-mail Detection Example 1 The Z yWALL receives an e-mail that was sent f rom IP address c.c.c.c and rela yed by an e-mail server at IP address d.d.d. d. The Z yW ALL sends a separ[...]

Chapter 38 Anti-Spa m ZyWALL USG 1000 User’s Guide 665 If the Z yW ALL rec eiv es conflic ting DNSBL repli es for an e-mail routing IP address, the Z yWALL classifies the e-mail as spam. Here is an example. Figure 448 Conflicting DN SBL Replies Exam ple 1 The Z yW ALL receives an e-mail that was sent from IP addres s a.b.c.d and relayed by an e-m[...]

Chapter 38 Anti- S pa m ZyWALL USG 1000 U ser’s Guide 666[...]

ZyWALL USG 1000 User’s Guide 667 C HAPTER 39 Device HA 39.1 Overview Device HA lets a backup Z yW ALL ( B ) automatically tak e ov er if the master Zy W A L L ( A ) fails. Figure 449 Device HA Backup T aking Over for the Master 39.1.1 What Y ou Can Do in this Chapter •U s e t h e General screen ( Section 39.2 on page 669 ) t o configure device [...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 668 • Legacy mode allows for more complex relationships between the master and backup Z yW ALLs, such as active- active or using di fferent Z yW ALLs as the master Z yW ALL for individual interfaces. Legacy mode c onfiguration in volves a greater degree of complexity . Activ e-pa ssi ve mode is[...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 669 39.2 Device HA General The Configuration > Device HA General screen lets you enable or disable device HA, and displa ys which device HA mode the Z yW ALL is set to use along with a summary of th e monitored inter fac es . Figure 450 Configur ation > Device HA > General The following [...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 670 39.3 The Active-Passive Mode Screen Virtual Router The master and backup Z y WALL form a single ‘virtual router’ . In the following example, master Z yWALL A and backup Z yW ALL B form a virtual router . Figure 451 V irtual Router Cluster ID Y ou can have multiple ZyW ALL virtual routers [...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 671 B form a virtual router that uses cluster ID 1. Z y WALLs C and D form a virtual router that uses cluster ID 2. Figure 452 Cluster IDs for Multiple Virtual Routers Monitored Interfaces in Acti ve-Passive Mode Device HA Y ou can select which interfaces device HA monitors. If a monitored interf[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 672 192.168.1.5 and Z yW ALL B has its own LAN management IP address of 192.168.1.6. These do not change when Z yWALL B bec omes the master . Figure 453 Manageme nt IP Addresses 39.3.1 Configuring Active-Passive Mode Device HA The Device HA Active-Passive Mode screen lets you configure general ac[...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 673 The following table describes t he labels in this screen. See Section 39.4 on page 675 for more information as well. T able 179 Configuration > Device HA > Active-Pa ssive Mode LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or les[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 674 Monitored Interface Summary This table shows the status of the device HA settings and status of t he Zy WA L L ’s i n t e r f a c e s . Edit Select an entry and click this to be able to modify it. Activate T o turn on an entry , select it and click Activa te . Inactivate T o turn off an ent[...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 675 39.4 Configuring an Active-Passive Mode Monitored Interface The Device HA Active-Passive Mo de Monitored Interface Edit screen lets you enable or disable monitoring of an interface and set the interface’ s management IP address and subnet mask. T o access this screen, click Configuration &g[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 676 A bridge interface’ s device HA settings ar e not retained if y ou del et e the bridge interface. Figure 455 Configuration > Dev ice HA > Active-Passi ve Mode > Edit The following table descri bes the labels in this screen. T able 180 Configuration > Device HA > Active-Pa ssi[...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 677 39.5 The Legacy Mode Screen Virtual Router Redundancy Protocol (VRRP) Legacy mode device HA uses Virtual R out er R edundancy Protoc ol (VRRP) to create redundant backup gatewa ys to ensure that a default g ateway is always available. The Z yW ALL uses a custom VRRP imp lementation and is not[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 678 39.6 Configuring the Legacy Mode Screen The Device HA Legacy Mode screen lets you configure general legacy mode HA settings including link monitoring, co nfigure the VRRP group and synchronize backup Z yW ALLs. T o access this s creen, click Configuration > Device HA > Legacy Mode . Fig[...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 679 R emove Select an entry and click this to delete it. Activate T o turn on an entry , select it and click Activa te . Activating a VRRP group has the Z yW ALL monitor the connection of the group’ s interface. Each interface must have a static IP address and be connected to the same subnet as[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 680 Use the VRRP Group Add/Edit screen to add or edit VRRP groups. • Y ou can only use interfaces that ha ve static IP addresses. In addition, y ou should set the stat ic IP address t o the IP ad dress of the virtual router . • Y ou can only enable one VRRP group for each interface. • Y ou [...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 681 The following table descri bes the labels in this screen. T able 182 Configuration > Device HA > Legacy Mode > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greate r or lesser number of configur ation fields. Enable VRRP Group Sele[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 682 39.7 Device HA T echnical Reference Active-Passive Mode Device HA with Bridge Interfaces Here are two wa ys to avoid a broadcast storm when you connect the bridge interfaces on two Z yWALLs. First Option for Connecting the Bridge Interfaces on T wo ZyW ALLs The first way is to activate d evic[...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 683 1 Make sure the bridge i nterfaces of the master Z yWALL ( A ) and the backup Zy W A L L ( B ) are not connected. 2 Configure the bridge interface on the mast er ZyW ALL, set the bridge interface as a monitored interface, and act ivate device HA. 3 Configure the bridge interface on the back u[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 684 4 Connect the Z yWALLs. Second Option for Connecting the Bridge Interfaces on T wo ZyW ALLs Another option is to disab le the bridge interfaces, connect the bridge interfaces, activ ate device HA, and finally reacti vate the bridge interfaces as shown in the following example. 1 In this case [...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 685 2 Configure a corresponding disabled bridge int erface on the back up Z yWALL. Then set the bridge interface as a monitored interface, and activat e device HA. 3 Enable the bridge interface on the master Z yW ALL and then on the backup Zy WA L L . 4 Connect the Z yWALLs. B A Br0 {ge4, ge5} Br[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 686 Legacy Mode ZyW ALL VRRP Application In VRRP , a virtual router represents a nu mber of Zy WALLs associated with one IP address, the IP address of the default gateway . Each virtual router is identified by a unique 8-bit identifi cation number calle d a Virtual R outer ID (VR ID). In the exam[...]

Chapter 39 Dev ice HA ZyWALL USG 1000 User’s Guide 687 If Z yWALL A becomes a vailable again, Z yW ALL A preempts ZyW ALL B and becomes the master again (the network returns to t he state shown in Figure 458 on page 686 ). Synchronization During synchronizat ion, the master Z yWALL sends the following in formation to the backup Z yW ALL. • Star[...]

Chapter 39 Device HA ZyWALL USG 1000 U ser’s Guide 688[...]

ZyWALL USG 1000 User’s Guide 689 C HAPTER 40 User/Group 40.1 Overview This chapter describes how t o set up user accounts, user groups, and user settings for the Z yWAL L. Y ou can also set up rules that c ontrol when users have to log in to the Z yWALL before the Zy WALL routes traffic for them. 40.1.1 What Y ou Can Do in this Chapter •T h e U[...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 690 Note: The default admin account is alwa ys authenticated locally , regardless of the authentication method setting. (See Chapter 44 on page 723 for more information about authenticat ion methods.) Ext-User Account s Set up an ext-user account if the user is authenti cated by an external [...]

Chapter 40 User/Group ZyWALL USG 1000 User’s Guide 691 See Setting up User Attr ibutes in an External Server on page 7 03 for a lis t of attributes and how to set up the at tributes in an external server . Ext-Group-User Account s Ext-Group-User accounts work are similar to ext -user accounts but allow you to group users by the value of the group[...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 692 40.2 User Summary Screen The User screen provides a summary of all us er accounts. T o access this screen, login to th e W eb Configurator , an d click Config uration > Object > User/Grou p . Figure 460 Configu ration > Object > User/Group The following table describes t he l[...]

Chapter 40 User/Group ZyWALL USG 1000 User’s Guide 693 •- [ d a s h e s ] The first character must be alphabetical (A -Z a- z), an underscore (_), or a dash (- ). Other limitations on user names are: • User names are case-sensitiv e. If you enter a user 'bob' but use 'BOB' when connecting via CIFS or FTP , it will us e the[...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 694 The following table describes t he labels in this screen. T able 185 Configuration > User/Group > User > Add LABEL DESCRIPTION User Name T ype the user name for this user account. Y ou may use 1-31 alphanumeric characters, un derscores( _ ), or dashes (-), but the first characte[...]

Chapter 40 User/Group ZyWALL USG 1000 User’s Guide 695 40.3 User Group Summary Screen User groups consist of access users and other user groups. Y ou cannot put admin users in user groups. The Gr oup screen provides a summar y of all user groups. In addition, this screen allows y o u to add, edi t, and remove user groups. T o access this screen, [...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 696 40.3.1 Group Add/Edit Screen The Group Add/Edit screen allows you to create a new user group or edit an existing one. T o access this screen, go to the Group screen (see Section 40.3 on page 695 ), and click either the Ad d icon or an Edit icon. Figure 463 Configu ration > User/Group [...]

Chapter 40 User/Group ZyWALL USG 1000 User’s Guide 697 40.4 Setting Screen The Setting screen controls default settings, login settings, loc kout settings, and other user settings for the Z yWAL L. Y ou ca n also use this screen to specify when users must log in to the Z yW ALL before it routes tr affic for them. Member List The Member list displ[...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 698 T o access this screen, lo gin to the W eb Configur ator , and click Configuration > Object > User/Group > Setting . Figure 464 Configuration > Obje ct > User/Group > Setti ng The following table descri bes the labels in this screen. T able 188 Configuration > Object[...]

Chapter 40 User/Group ZyWALL USG 1000 User’s Guide 699 User T ype These are the kinds of user account the ZyW ALL supports. • admin - this user can look at and change the configuration of the Z yWALL • limited-admin - this user can look at the conf iguration of the Z yWALL but n ot to change it • user - this user has access to the ZyW ALL?[...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 700 40.4.1 Default User Authenti cation T imeout Settings Edit Screens The Default Authentication Timeout Settings Edit screen allows y ou to set the default au th ent ication time out settin g s for th e selected typ e of us er acc o u nt. These default authentication timeout sett ings also[...]

Chapter 40 User/Group ZyWALL USG 1000 User’s Guide 701 T o access this screen, g o to the Configuration > Obje ct > User/Group > Setting screen (see Section 40.4 on page 697 ), and click one of the Default Authentication Timeout Settings section’s Edit icons. Figure 465 Configuration > Object > User/Group > Setting > Ed it [...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 702 40.4.2 User A ware Login Example Access users cannot use the W eb Configurator to browse the configuration of the Z yWALL . Instead, after access users lo g into the Z y WALL, the following screen appears. Figure 466 W eb Configurator for Non-Admin Users The following table describes t h[...]

Chapter 40 User/Group ZyWALL USG 1000 User’s Guide 703 40.5 User /Group T echnical Reference This section provi des some informat ion on us e rs who use an exte rn al authentication server in order to log in. Setting up User Attributes in an External Server T o set up user attributes, such as reau thentication time, in LDAP or RADIUS servers, use[...]

Chapter 40 Us er /G ro up ZyWALL USG 1000 U ser’s Guide 704[...]

ZyWALL USG 1000 User’s Guide 705 C HAPTER 41 Addresses 41.1 Overview Address objects can represent a single IP address or a r ange of IP addresses. Address groups are composed of addr ess objects and other address groups. 41.1.1 What Y ou Can Do in this Chapter •T h e Address screen ( Section 41.2 on page 705 ) provides a summary of al l addres[...]

Chapter 41 Add re sse s ZyWALL USG 1000 U ser’s Guide 706 • RANGE - a range address is defined by a Starting IP Address and an Ending IP Address . • SUBNET - a network address is defined by a Network IP address and Netmask subnet mask. The Address screen provides a summary of all addresses in the Z yWALL. T o access this screen, click Configu[...]

Chapter 41 Addresses ZyWALL USG 1000 User’s Guide 707 41.2.1 Address Add/Edit Screen The Configuration > Address Add/Edit screen allows you to create a new address or edit an existing one. T o access this screen, go to t he Address screen (see Section 41.2 on page 705 ), and click either the Add icon or an Edit icon. Figure 470 Configu ration [...]

Chapter 41 Add re sse s ZyWALL USG 1000 U ser’s Guide 708 41.3 Address Group Summary Screen The Address Group screen provides a summary of all address groups. T o access this screen, click C onfiguration > Object > Address > Address Group . Click a column’ s heading cell to sort t he table en tries by that col umn’s criteria. Click t[...]

Chapter 41 Addresses ZyWALL USG 1000 User’s Guide 709 41.3.1 Address Group Add/Edit Screen The Address Group Add/Edit screen allows you to create a new addres s group or edit an existing one. T o access this screen, go to the Address Group screen (see Section 41.3 on page 708 ), and click either the Add icon or an Edit icon. Figure 472 Configu ra[...]

Chapter 41 Add re sse s ZyWALL USG 1000 U ser’s Guide 710[...]

ZyWALL USG 1000 User’s Guide 71 1 C HAPTER 42 Services 42.1 Overview Use service objects to define T CP applications, UDP applicat ions, and ICMP messages. Y ou can also create service groups to refer to mul tiple service objects in other features. 42.1.1 What Y ou Can Do in this Chapter •U s e t h e Service screens ( Section 42.2 on page 712 )[...]

Chapter 42 Serv ice s ZyWALL USG 1000 U ser’s Guide 712 Both TCP and UDP use ports to identify the source and destination. Each port is a 16-bit number . Some port numbers hav e b een standardized and are used by low- level system processes; man y othe rs have no particular meaning. Unlike T CP and UDP , Internet Control Message Protocol (ICMP , [...]

Chapter 42 Services ZyWALL USG 1000 User’s Guide 713 entries by that col umn’s criteria. Click the heading cell again to reverse the sort order . Figure 473 Configu ration > Object > Service > Service The following table describes t he labels in this screen. T able 196 Configuration > Object > Service > Service LABEL DESCRIPTI[...]

Chapter 42 Serv ice s ZyWALL USG 1000 U ser’s Guide 714 42.2.1 The Service Add/Edit Screen The Service Add/Edit screen allows you to create a new service or edit an existing one. T o access this screen, go to the Service scre en (see Section 42.2 on page 712 ), and click either the Ad d icon or an Edit icon. Figure 474 Configu ration > Object [...]

Chapter 42 Services ZyWALL USG 1000 User’s Guide 715 T o access this screen, l og in to the W eb Confi gurator , and cli ck Configuration > Object > Service > Service Group . Figure 475 Configu ration > Object > Service > Service Group The following table describes the labels in this screen. See Secti on 42.3.1 on page 716 for m[...]

Chapter 42 Serv ice s ZyWALL USG 1000 U ser’s Guide 716 42.3.1 The Service Group Add/Edit Screen The Service Group Add/Edit screen allows you to create a new service group or edit an existing one. T o access this screen, go to the Service Group screen (see Section 42.3 on page 714 ), and click either the Add icon or an Edit icon. Figure 476 Confi[...]

ZyWALL USG 1000 User’s Guide 717 C HAPTER 43 Schedules 43.1 Overview Use schedules to set up one-time and recurring schedules for policy routes, firewall rul es, application patrol, and co ntent filtering. The Z yW ALL supports one- time and recurring schedules. One-time schedules are effective only once, while recurring schedul es us ually repea[...]

Chapter 43 Sc he du le s ZyWALL USG 1000 U ser’s Guide 718 Finding Out More • See Section 6.6 on page 114 for rel ated informat ion on these screens. • See Section 50.3 on page 785 for information about the Z yW ALL’ s current date and time. 43.2 The Schedule Summary Screen The Schedule summary screen provides a summ ary of all schedules in[...]

Chapter 43 Sc hedules ZyWALL USG 1000 User’s Guide 719 43.2.1 The One-T ime Schedule Add/Edit Screen The One-Time Schedule Add/Edit screen allows you to define a one-ti me schedule or edit an existing one. T o access this screen, go to the Schedule screen (see Section 43.2 on page 718 ), and click either the Add icon or an Edit icon i n the One T[...]

Chapter 43 Sc he du le s ZyWALL USG 1000 U ser’s Guide 720 43.2.2 The Recurring Schedule Add/Edit Screen The Recurring Schedule Add/Edit screen allows you to defi ne a recurring schedule or edit an existing one. T o access this screen, go to the Schedule screen Date Time StartDate Specify the year , month, and day when the schedule begins. Year -[...]

Chapter 43 Sc hedules ZyWALL USG 1000 User’s Guide 721 (see Section 43.2 on page 718 ), and click either the Add icon or an Edit icon i n the Recurring se ct ion. Figure 479 Configu ration > Object > Schedule > Edit (Recurring) The Year , Month , and Day columns are not used in recurring sched ules and are disabled in this screen. The fo[...]

Chapter 43 Sc he du le s ZyWALL USG 1000 U ser’s Guide 722[...]

ZyWALL USG 1000 User’s Guide 723 C HAPTER 44 AAA Server 44.1 Overview Y ou can use a AAA (Authentication, Authori zation, Accounting) server t o provide access control to your network. The AAA serv er can be a Acti ve Directory , LDAP , or RADIUS server . Use the AAA Server screens to create and manage objects that contain settings for using AAA [...]

Chapter 44 AAA Server ZyWALL USG 1000 U ser’s Guide 724 44.1.2 RADIUS Server RADIUS (Remote Authentication Dial- In User Service) authentication is a popular protocol used to au thenticate use rs by me ans of an external server instead of (or in addition to) an internal device user database that is l imited to the memory capacity of the d evice. [...]

Chapter 44 AAA Server ZyWALL USG 1000 User’s Guide 725 •U s e t h e Configuration > Object > AAA Serv er > RADIUS screen ( Section 44.3 on page 729 ) to configure the default extern al RADIUS server to use for user authentication. 44.1.5 What Y ou Need T o Know AAA Servers Supported by the ZyW ALL The following lists the types of authe[...]

Chapter 44 AAA Server ZyWALL USG 1000 U ser’s Guide 726 organizational boundaries. The following figure shows a basic directory structure branchi ng from countries to organizations to organization al units to individuals. Figure 482 Basic Direc tory S tru cture Distinguished Name (DN) A DN uniquely identifies an entry in a directory . A DN consis[...]

Chapter 44 AAA Server ZyWALL USG 1000 User’s Guide 727 • See Section 7.7 on page 142 for an example of how to use a RADIUS server to authenticate user acco unts based on groups. 44.2 Active Directory or LDAP Server Summary Use the Active Directory or LDAP screen to manage the list of AD or LDAP servers the Zy W ALL can use in authenticati ng us[...]

Chapter 44 AAA Server ZyWALL USG 1000 U ser’s Guide 728 following screen. Use this screen to create a new AD or LDAP entry or edit an existing one. Figure 484 Configura tion > Object > AAA Server > Active Directory (or LDAP) > Ad d The following table describes t he labels in this screen. T able 204 Configuration > Object > AAA [...]

Chapter 44 AAA Server ZyWALL USG 1000 User’s Guide 729 44.3 RADIUS Server Summary Use the RADIUS screen to manage the list of RADIUS servers the Z yW ALL can use in authenticating users. Base DN Specify the directory (up to 127 alphanumerical characters). For example, o=ZyXEL, c=US . Use SSL S elect Use SSL to establish a secure connection to the[...]

Chapter 44 AAA Server ZyWALL USG 1000 U ser’s Guide 730 Click Configuration > Object > AAA Server > RADIUS to display the RADIUS screen. Figure 485 Configuration > Object > AAA Server > RADIUS The following table describes t he labels in this screen. T able 205 Configuration > Object > AAA Server > RADIUS LABEL DESCRIPT[...]

Chapter 44 AAA Server ZyWALL USG 1000 User’s Guide 731 44.3.1 Adding a RADIUS Server Click Configuration > Object > AAA Server > RADIUS to display the RADIUS screen. Click the Add icon or an Edit icon to disp lay the followi ng screen. Use this screen to create a new AD or LDAP entry or edit an existing one. Figure 486 Configuration >[...]

Chapter 44 AAA Server ZyWALL USG 1000 U ser’s Guide 732 Timeout S pecify the timeout period (betwee n 1 and 300 seconds) before the Z yWALL disconn ects from the RADIUS server . In this case, user authentication fails. Search timeout occurs when either the user information is not in the RADIUS server or the RADIUS server is down. K ey Enter a pas[...]

ZyWALL USG 1000 User’s Guide 733 C HAPTER 45 Authentication Method 45.1 Overview Authentication method objects set ho w the ZyW ALL authentica te s HTTP/HT TPS clients, peer IPSec routers (extended au thentication ), and L2 T P V PN clients. Configure auth en tication me th od obje cts to have the ZyW ALL use the loc a l us er database, and/or th[...]

Chapter 45 Auth en tic ation Method ZyWALL USG 1000 U ser’s Guide 734 3 Select Server Mode and select an auth entication method object from the drop- down list box. 4 Click OK to sav e the settings. Figure 487 Example: Using Authentication Method in VPN 45.2 Authentication Method Object s Click Configuration > Object > Auth. Method to disp [...]

Chapter 45 Authentication Method ZyWALL USG 1000 User’s Guide 735 45.2.1 Creating an Authentication Method Object Follow the steps below to create an au thenticati on me thod object. 1 Click Configuration > Object > Auth. Method . 2 Click Add . 3 Specify a descriptiv e name for identi fication purpos es in the Name field. Y ou may use 1-31 [...]

Chapter 45 Auth en tic ation Method ZyWALL USG 1000 U ser’s Guide 736 7 Click OK to sav e the settings or click Cancel to discard all changes and return to the previous screen. Figure 489 Configuration > O bj e ct > Auth. Method > Ad d The following table describes t he labels in this screen. T able 208 Configuration > Object > Aut[...]

Chapter 45 Authentication Method ZyWALL USG 1000 User’s Guide 737 Add icon Click Add to add a new entry . Click Edit to edit the settings of an entry . Click Delete to delete an entry . OK Click OK to sa ve the changes. Cancel Click Cancel to discard the changes. T able 208 Configuration > Object > Auth. Method > Add (continued) LABEL DE[...]

Chapter 45 Auth en tic ation Method ZyWALL USG 1000 U ser’s Guide 738[...]

ZyWALL USG 1000 User’s Guide 739 C HAPTER 46 Certificates 46.1 Overview The Z yWALL can use certificates (also call ed digital IDs) to authenticate us ers. Certificates are based on public-priv ate k ey pairs. A certificate contains the certificate owner’ s identity and public k ey . Certificates provide a way to exchange public keys fo r u s e[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 740 2 Tim keeps the private key and makes the pu blic key op enly av ailable. This means that anyone who receives a message seeming to come from Tim c an read it and verify whether it is really from him or not. 3 Tim uses his priv ate key to sign the message and s ends it to Jenny . 4 Jenny re[...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 741 Factory Default Certificate The Zy W ALL gener ates its own unique self -s igned certific ate when you first turn it on. This cert if i cat e is referred to in the GUI as the fa ctory defau lt ce rtificate. Certificate File Format s Any certificate that you w ant to import has to be in one [...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 742 2 Make sure that the certificat e has a “. cer” or “.crt” file name extension. Figure 490 Remote Ho st Certi fica tes 3 Double-click the certificate’ s icon to open the Certificate window . Click the Details tab and scroll down to the Thumbprint Algorithm and Thumbprint fields. F[...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 743 46.2 The My Certificates Screen Click Configuration > Object > Ce rtificate > My Certificates to open the My Certificates screen. This is th e Z yWALL’ s summa r y l ist of certificat es and certification requests. Figure 492 Configu ration > Object > Certificate > My Ce[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 744 46.2.1 The My Certificates Add Screen Click Configuration > Object > Cert ificate > My Certificates and then the Add icon to open the My Certificates Add screen. Use this screen to have the T ype This field displays what kind of certificate this is. REQ represents a certification [...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 745 Z yWALL create a self-si gned certificate, enroll a certificate with a certification authority or gener ate a certification request. Figure 493 Configu ration > Object > Certificate > My Certificates > Add[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 746 The following table describes t he labels in this screen. T able 210 Configuration > Object > Certificate > My Certificates > Add LABEL DESCRIPTION Name T ype a name to identify this certificate. Y ou can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’ ,.=- characters[...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 747 Create a certification request and save it locally for later manual enrollment Select this to have the Z yWALL gener ate and store a request for a certificate. Use the My Certificate Details screen to view the certification request and copy it to send to the certification authority . Copy t[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 748 If you confi gu red the My Certificate Create screen to hav e the Zy WALL enroll a certificate and the certificate enrol lment is not successful, y ou see a screen with a Return button that take s you back to the My Certificate Create screen. Click Return and check your information in the [...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 749 46.2.2 The My Certificates Edit Screen Click Configuration > Object > Cert ificate > My Certificates and then the Edit icon to open the My Certificate Edit screen. Y ou can use this screen to view in-depth certificate information an d change the certificate’ s name. Figure 494 Co[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 750 The following table describes t he labels in this screen. T able 21 1 Configuration > Object > Certificate > My Certificates > Edit LABEL DESCRIPTION Name This field displays the identifying name of this certificate. Y ou can use up to 31 alphanumeric and ;‘~!@#$%^&()_+[][...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 751 K ey Algorithm This field displays the type of algorithm that was used to generate the certificate’s k ey pair (the Z yWALL uses RS A encryption) and the length of the key set in bits (1024 bits for example). Subject Alternative Name This field displays the ce rtificate owner‘s IP addre[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 752 46.2.3 The My Certificates Import Screen Click Configuration > Object > Certific ate > My Certificates > Import to open the My Certificate Import screen. F ollow the instructions in this screen to save an exi sting certificate to t he Z yWALL. Note: Y ou can import a certificat[...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 753 46.3 The T rusted Certificates Screen Click Co nfiguration > Object > Cert ificate > Truste d Certificates to open the Trusted Certificates screen. This screen d isplays a summary list of certificates that yo u have s et th e ZyW ALL to acce pt as trusted. The ZyW ALL also accepts [...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 754 46.3.1 The T rusted Certificates Edit Screen Click Configuration > Object > Cert ificate > Trusted Certificates and then a certificate’ s Edit icon to open the Trusted Certificates Edit screen. Use this screen to view in-depth information about the certifica t e, ch an ge the ce[...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 755 authority’ s list of revo k ed certificates befo re trusting a certificate issued by the certification authority . Figure 497 Configu ration > Object > Certificate > T rusted Certificates > Edit[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 756 The following table describes t he labels in this screen. T able 214 Configuration > Object > Certificate > T rusted Certificates > Edit LABEL DESCRIPTION Name This field displays the identifyin g name of this certificate. Y ou can change the name. Y ou can use up to 31 alphanu[...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 757 T ype This field displays general inform ation about the certifica te. CA-signed means that a Certification Authority signed the certificate. Self-signed means that the certificate’ s owne r signed the certificate (not a certification authority). X.509 means that this certificate was crea[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 758 46.3.2 The T rusted Certificates Import Screen Click Configuration > Object > Certificat e > Trusted Certificates > Import to open the Trusted Certifica tes Import screen. Follow the inst ructions in this screen to save a trusted certificate to the Z yW ALL. Note: Y ou must rem[...]

Chapter 46 Certificates ZyWALL USG 1000 User’s Guide 759 The following table describes t he labels in this screen. 46.4 Certificates T echnical Reference OCSP OCSP (Online Certificate Stat us Protocol) allows an application or device to check whether a certificate is v alid. With OC SP the Z yWALL c hecks the status of individual certificates ins[...]

Chapter 46 Certificates ZyWALL USG 1000 U ser’s Guide 760[...]

ZyWALL USG 1000 User’s Guide 761 C HAPTER 47 ISP Accounts 47.1 Overview Use ISP accounts to manage Internet Se rvice Prov ider (ISP) account information for PPPoE/PPTP interfaces. An ISP account is a profile of settings for Internet access using PPP oE or PPTP . Finding Out More • See Section 13.4 on page 292 for information about PPP oE/PPTP i[...]

Chapter 47 IS P Accoun ts ZyWALL USG 1000 U ser’s Guide 762 The following table describes t he labels in this screen. See the ISP Accou nt Ed it section below for more information as well. 47.2.1 ISP Account Edit The ISP Account Edit screen lets you add i nformation about new accounts and edit inform ation about existing ac coun ts. T o open this[...]

Chapter 47 IS P Accoun ts ZyWALL USG 1000 User’s Guide 763 The following table describes t he labels in this screen. T able 217 Configuration > Object > ISP Account > Edit LABEL DESCRIPTION Profile Name This field is read-only if you ar e editing an existing account. T ype in the profile name of the ISP account. The profile name is used [...]

Chapter 47 IS P Accoun ts ZyWALL USG 1000 U ser’s Guide 764 Compression Select On button to turn on stac compression, and select Off to turn off stac compression. Stac compression is a data compression technique capable of compressing data by a factor of about fou r . Idle Timeout This value specifies the number of seconds that must elapse withou[...]

ZyWALL USG 1000 User’s Guide 765 C HAPTER 48 SSL Application 48.1 Overview Y ou use S S L application objects in S SL VPN. Configure an SSL application object to specify the t ype of application and the address of t he local computer , server , or web site SSL us ers are to be able to access. Y ou can apply one or more SSL application objects in [...]

Chapter 48 SSL Application ZyWALL USG 1000 U ser’s Guide 766 Remote Desktop Connections Use SSL VPN to allow remote users to ma nage LAN computers. Depending on the functions supported by the remote deskto p softw are, they can install or remove software, run progr ams, change set tings, an d open, copy , create, and delete files. This is useful [...]

Chapter 48 SSL Application ZyWALL USG 1000 User’s Guide 767 2 Click the Add button and select Web Application in the Ty pe field. In the Server Type field, select Web Server . Enter a descriptive name in t he Display Name field. For example, “CompanyIntranet” . In the Address field, enter “http:// info” . Select Web Page Encryption to pre[...]

Chapter 48 SSL Application ZyWALL USG 1000 U ser’s Guide 768 The following table describes t he labels in this screen. 48.2.1 Creating/Editing a W eb-based SSL Application Object A web-based application all ows remote user s to access an application via standard web browsers. T o configure a web-based application, click the Ad d or Edit button in[...]

Chapter 48 SSL Application ZyWALL USG 1000 User’s Guide 769 The following table describes t he labels in this screen. T able 219 Configuration > Object > SSL Application > Add/Edit: Web Applica tion LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings This displays for VNC or RDP type web application objects. Click this button[...]

Chapter 48 SSL Application ZyWALL USG 1000 U ser’s Guide 770 48.2.2 Creating/Editing a File Sharing SSL Application Object Y ou can specify the name of a folder on a file server (Li nux or Windows) which remote users can access. R emote users can access files using a standard web browser and files are displa yed as links on the screen. T o config[...]

Chapter 48 SSL Application ZyWALL USG 1000 User’s Guide 771 The following table describes t he labels in this screen. T able 220 Configuration > Object > SSL Application > Add/Edit: File Sh aring LABEL DESCRIPTION Create new Object Use this to configure any new settings objects that you need to use in this screen. Object T ype Select Fil[...]

Chapter 48 SSL Application ZyWALL USG 1000 U ser’s Guide 772[...]

ZyWALL USG 1000 User’s Guide 773 C HAPTER 49 Endpoint Security 49.1 Overview Use Endpoint Security (EPS), also known as endpoi nt control, to make sure users’ computers comply with defined corpor ate policies before they can access the network or an SSL VPN tunnel. After a su ccessful user authenticati on, a user’ s computer must meet the end[...]

Chapter 49 End po int Secu rity ZyWALL USG 1000 U ser’s Guide 774 49.1.1 What Y ou Can Do in this Chapter Use the Configuration > Object > Endpoint Security screens ( Sect ion 49.2 on page 775 ) to create and manage endpoint securit y objects. 49.1.2 What Y ou Need to Know What End point Security Can Check The settings endpoint securi ty ca[...]

Chapter 49 Endpoint Security ZyWALL USG 1000 User’s Guide 775 49.2 End point Security Screen The Endpoint Security screen displays the endpoi nt security objects you have configured on the Z yWALL. Click Configuration > Obje ct > E nd point Security to display the screen. Figure 507 Configuration > O bject > Endpoint Security The foll[...]

Chapter 49 End po int Secu rity ZyWALL USG 1000 U ser’s Guide 776 Apply Click this button to save your changes to the Z yW ALL. R eset C lick this button to return the screen to its last -saved settings. T able 221 Configuration > Object > End point Security (continued) LABEL DESCRIPTION[...]

Chapter 49 Endpoint Security ZyWALL USG 1000 User’s Guide 777 49.3 End point Security Add/Edit Click Configuration > Object > Endpo int Security and then the Add (or Edit ) icon to open the Endpoint Security Edit screen. Use this screen to configure an endpoint secu rity object.[...]

Chapter 49 End po int Secu rity ZyWALL USG 1000 U ser’s Guide 778 Figure 508 Configuration > O bject > Endpoint Secu rit y > Add[...]

Chapter 49 Endpoint Security ZyWALL USG 1000 User’s Guide 779 The following table giv es an overview of the objects you can configure. T able 222 Configuration > Object > End point Security > Add LABEL DESCRIPTION Show Advance Settings / Hide Advance Settings Click this button to display a greater or lesser number of configuration fields[...]

Chapter 49 End po int Secu rity ZyWALL USG 1000 U ser’s Guide 780 Checking Item - Personal Firewall If you selected Windows as the operating system, you can select whether or not the user’s computer is required to have personal firew all softw are installed. Move the permitted personal firewalls from the Available list to the Allowed Personal F[...]

Chapter 49 Endpoint Security ZyWALL USG 1000 User’s Guide 781 Checking Item - File Information If you selected Windows or Linux as the oper ating system, you can use this table to check details of specific files on the user’s computer . Use the Operation field to set whether the size or version of the file on the user’s computer has to be equ[...]

Chapter 49 End po int Secu rity ZyWALL USG 1000 U ser’s Guide 782[...]

ZyWALL USG 1000 User’s Guide 783 C HAPTER 50 System 50.1 Overview Use the system screens to configure general Z yW ALL settings. 50.1.1 What Y ou Can Do in this Chapter •U s e t h e System > Host Name screen (see Section 50.2 on page 784 ) to configure a unique name for the ZyW ALL in your network. •U s e t h e System > Date/Tim e scree[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 784 • Connect an external seri al modem to the AUX port to provid e a management connection in case the Z yW ALL’ s ot her W AN connections are down. Use the System > Dial-in Mgmt. screen (see Section 50.11 on page 827 ) to configure the external serial modem. • V antage CNM (Centr alized [...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 785 50.3 Date and T ime For ef fective scheduling and logg ing, the Z yWAL L system time must be accurat e. The Z yWALL’ s Real Time Chip (R TC) k eeps track of the time and date. There is also a software mechan is m to set the time m a nu ally or get the current time and date from an ex ternal ser[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 786 Manual Select this radio button to en ter the time and date manually . If you configure a new time and date, time zone and daylight sa ving at the same time, the time zone and daylight saving will affect the new time and date you entered. When you enter the time settings manually , the Z yWALL [...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 787 50.3.1 Pre-defined NTP T ime Servers List When you turn on the Z yW ALL for the firs t time, the date and time start at 2003- 01-01 00:00:00. The Z yW ALL then attempts to synchronize with one of the following pre-defined list of Netw ork Time Protocol (NTP) time servers. The Z yWALL continues to[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 788 50.3.2 T ime Server Synchronization Click the Synchronize Now button to get the time and date from the t ime server you specified in the Time Server Address field. When the Please Wait... screen a ppears, you may have to wait up to one minute. Figure 51 1 Synchronization in Process The Current [...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 789 5 Under Time and Date Setup , enter a Time Server A ddress ( T able 225 on page 787 ). 6 Click Apply . 50.4 Console Port S peed This section shows you how to set the cons ole port speed when you connect to the Z yWALL via the console port using a terminal emulation program. See Ta b l e 2 o n pag[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 790 50.5.1 DNS Server Address Assignment The Z yWALL can get the DNS server ad dresses in the following w ays. • The ISP tells you the DNS serv er addresses, usually in the form of an info r matio n sh e e t, wh e n you si gn up. I f yo ur IS P give s you DN S serve r addresses, manually enter th[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 791 The following table describes t he labels in this screen. T able 227 Configuration > System > DNS LABEL DESCRIPTION Address/PTR Rec o r d This record specifies the mapping of a Fully-Qualified Domain Name (FQDN) to an IP address. An FQDN consists of a host and domain name. For ex ample, www[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 792 DNS Serv er This is the IP address of a DN S server . This field displays N/A if you have the Z yW ALL get a DNS server IP address from the ISP dynamically but the specified interface is not active. Query Via This is the interface through whic h the Z yWALL sends DNS queries to the entry’ s D[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 793 50.5.3 Address Record An address record contains the mapping of a Fully-Qua lified Domain Name (FQDN) to an IP address. An FQDN consists of a host and domain name. F or example, www .zyxel.com is a fully qualified domain name, where “www” is the ho st, “zyxel” is the second-level domain, [...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 794 The following table describes t he labels in this screen. 50.5.6 Domain Zone Forwarder A domain zone forwarder contains a DNS server’s IP address. The Z yW ALL can query the DNS server to resolve domain zones for features like VPN, DDNS and the time server . A domain z one is a full y qualifi[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 795 The following table describes t he labels in this screen. 50.5.8 MX Record A MX (Mail eXchange) record indicat es whic h host is respons ibl e for the mail for a particular domain, that is, c ontrols where mail is sent for that domain. If you do not configure proper MX records for your domain or [...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 796 50.5.9 Adding a MX Record Click the Add icon in the MX Record table to add a MX record. Figure 516 Configuration > Syste m > DNS > MX Record Add The following table describes t he labels in this screen. 50.5.10 Adding a DNS Service Control Rule Click the Add icon in the Service Control[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 797 The following table describes t he labels in this screen. 50.6 WWW Overview The following figure shows secure and insecure management of the Z yW ALL coming in from the W AN. HT TPS and SSH access are secure. HT TP , T elnet, and dial-in management access are not secure. Figure 518 Secure and Ins[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 798 • See T o-Z yW ALL Rules on page 424 for more on T o-ZyW ALL firewall rules. • See Section 7.9 on page 147 for an example of configuring service control to block administr ator HT TPS access from all z ones except the LAN. T o stop a service from accessing the Z yW ALL, clear Enable in the [...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 799 It relies upon certificates, p ublic keys, and priv ate keys (see Chapter 46 on page 739 for more information). HT TPS on the Z yW ALL is used so that you can securely access the Z yW ALL using the W eb Configurator . The SSL protocol specifi es that the HTTPS serv er (the Z y W ALL) must alwa ys[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 800 Note: Admin Service Contro l deals with management access (to the W eb Configurator). User Service Control deals with user access to the ZyW A LL (logging into SSL VPN for example). Figure 520 Configur ation > System > WWW > Service Control The following table describes t he labels in [...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 801 Server P ort The HTTPS server listens on port 443 by default. If you change the HT TPS server port to a different number on the ZyW ALL, for example 8443, then you must notify people who need to acce ss the Z yW ALL W eb Configurator to use “https://Z yWALL IP Address: 8443 ” as the URL. Auth[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 802 HT TP Enable Select the check box to allow or disallo w the computer with the IP address that matches the IP address(es) in the Serv ice Con trol table to access the Z yW ALL W eb Configur ator using HT TP connections. Server P ort Y ou may change the server port number for a service if needed,[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 803 50.6.5 Service Control Rules Click Add or Edit in the Service Cont rol table in a WWW , SSH , Telnet , FTP or SNMP screen to add a service control rule. Figure 521 Configur ation > System > Service Control Rule > Edit The following table describes t he labels in this screen. 50.6.6 Custo[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 804 also customize the page that di splays after an access user l ogs into the W eb Configurator to access network servi ces like the In ternet. See Chapter 40 on page 689 for more on access user accounts. Figure 522 Configu ration > System > WWW > Login Page[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 805 The following figures identify the p arts you can customize in the login and access pages. Figure 523 Login Page Customization Figure 524 Access Page Customization Y ou can specify colors in one of the followi ng ways: Logo Ti t l e Message Note Message Background (last line of text) (color of al[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 806 •C l i c k Color to displa y a screen of web-safe colo rs from which to choose. • Enter the name of the desired color . • Enter a pound sig n (#) followed by the six -digit hexadecimal number that represents the desired color . F or example, use “#000000” for black. • Enter “rgb?[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 807 50.6.7 HTTPS Example If you hav e n’t changed the default HT TP S port on the ZyW ALL, then i n your browser enter “https://Z yW ALL IP Addre ss/” as the web site address where “Z yWALL IP Address” is the IP address or domain name of the Z yWALL y ou wish to access. 50.6.7.1 Internet Ex[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 808 50.6.7.2 Net scape Na vigator W arning Messages When you attempt to access the Z yWALL HT TPS server , a Website Certified by an Unknown Authority scre en p ops up as king if yo u tr ust the server certificate. Click Examine Certificate if you w ant to verif y that the certificate is from the Z[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 809 • The issuing certificat e authority of the Z yW ALL’ s HT TPS server certificate is not one of the browser’s trusted certificate authorities. The issuing certificate authorit y of the Z yW ALL's f actory defaul t certificate is the Z yW ALL itself since the certificate is a self -sign[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 810 Apply for a certificate from a Certificatio n Au thority (CA) that is trusted by the Z yWALL (see the Z yW ALL’ s Trusted C A We b C o n f i g u ra t o r sc r e e n ) . Figure 529 ZyW ALL Trusted CA Screen The CA sends you a package containing the CA ’s trusted certificate(s), your personal[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 81 1 50.6.7.5.2 Installing Y our Personal Certificate(s) Y ou ne ed a password in advance. The CA may issue the password or you may have to specify it during th e enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to the one shown next 1 Click Next to[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 812 3 Enter the password g iven to yo u by the CA. Figure 533 Persona l Certificate Import Wizard 3 4 Have the wizard determine where the ce rtificate should be sav ed on your computer or se le ct Place all certificates in the following store and choose a different location. Figure 534 Persona l Ce[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 813 5 Click Finish to complet e the wi zard and begin the import process. Figure 535 Persona l Certificate Import Wizard 5 6 Y ou should see the following scre en when the certificate is correctly installed on your com put er . Figure 536 Persona l Certificate Import Wizard 6 50.6.7.6 Using a Certifi[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 814 2 When Authenticate Client Certificates is selected on the Z yW ALL, the following screen asks you t o select a personal cert ificate to send to th e ZyW ALL. This screen displays ev en if you only ha ve a si ngle certificate as in the example. Figure 538 SSL Client Authentication 3 Y ou next s[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 815 SSH is a secure communication protocol t hat combines authentication and data encryption to provide secure encryp ted communication between two hosts over an unsecured network. In the following figure , computer A on the Internet uses SSH to securely connect to the WAN port of the Z yW ALL for a [...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 816 2 Encryption Method Once the identification is v erified, both the client and server must agree on the type of encryption method t o use. 3 Authentication and Data T r ansmission After the identification i s verified and da ta encryp tion activ ated, a sec ure tunnel is established between the [...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 817 Note: It is recommended that you disable T elnet and FTP when you configure SSH for secure connections. Figure 542 Configuration > Syst em > SSH The following table describes t he labels in this screen. T able 235 Configuration > System > SSH LABEL DESCRIPTION Enable Select the check [...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 818 50.7.5 Secure T elnet Using SSH Examples This section shows two examples usin g a command interface and a gr aphical interface SSH client progr am to remotely access the Z yW ALL. The configurati on and connection steps are similar for most S SH client prog r ams. R efer to your S SH client pro[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 819 Enter the password to log in to the Z yW ALL. The CLI screen displays next. 50.7.5.2 Example 2: Linux This section describes how to access the Z yW ALL using the OpenSSH client program t hat comes with most Linux dis tributions. 1 T est whether the SSH service is a vailable on the Z yWALL. Enter [...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 820 50.8.1 Configuring T elnet Click Configuration > System > TELNET to configure your Z yWALL for remote T elnet access. Use this screen to specify from whi ch zones T elnet can be used to manage the Z yW ALL. Y ou can also speci fy from which IP ad dresses the access can come. Figure 546 Co[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 821 50.9 FTP Y ou can upload and download the Z yWALL’ s firmware a nd configuration files using FTP . T o use this feature , your computer must have an FTP client. Please see Chapter 52 on page 847 for more information about firmw are and configuration files. 50.9.1 Configuring FTP T o change your[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 822 be used to access the Z yW ALL. Y ou can also specify from which IP addresses the access can come. Figure 547 Configu ration > System > FTP The following table describes t he labels in this screen. T able 237 Configuration > System > FTP LABEL DESCRIPTION Enable Select the check box[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 823 50.10 SNMP Simple Network Manageme nt Protocol is a protocol used for ex changing management information between network de vices. Y our ZyW ALL supports SNMP agent functionality , which allows a manager stat ion to manage and monitor the Z yW ALL through the network. The Z yW ALL supports SNMP v[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 824 and version two (SNMPv2c). The next fi gure illustrates an SNMP management operation. Figure 548 SNMP Manageme nt Model An SNMP managed network consists of two main types of component: agents and a manager . An agent is a management software module that resides in a ma naged de vice (the Z yWAL[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 825 • GetNext - Allows the manager to retriev e the next object v ariable from a table or list within an agent. In SNMPv1, when a manager wants to retriev e all elements of a table from an agent, it initiates a Get operat ion, followed by a series of GetNext oper ations. • Set - Allows the manage[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 826 settings, including from which z ones SNMP can be used to access the Z y W ALL. Y ou can also specify from whi ch IP addresses the access can come. Figure 549 Configuration > Sy st em > SNMP The following table describes t he labels in this screen. T able 239 Configuration > System >[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 827 50.1 1 Dial-in Management Connect an external serial modem t o the AUX port to provi de a management connection in case the Z yW ALL’ s other WA N connections are down. This is like an auxiliary interface, except it is used fo r management connections coming in to the Zy W A L L i n s t e a d o[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 828 Hang Up check box is selected, the Z yW ALL uses this hardware signal to force the WAN device to hang up, in addition to i ssuing the drop command ATH . Response Strings The response strings tell t he Zy WALL th e tags, or labels, immediat ely preceding the various call parameters sent f rom th[...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 829 50.12 V ant age CNM V antage CNM (Centr alized Network Management) i s a browser-based global management solution that allows an admi nistr ator from any lo cation to easily configure, manage, monitor and troubleshoot Z yXEL devices located worldwide. See the V antage CNM User's Guide for de[...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 830 50.12.1 Configuring V antage CNM V antage CNM is disabled on th e devi ce by default. Click Configuration > System > Vantage CNM to configure your device’ s V antage CNM setti ngs. Figure 551 Configu ration > System > V antage CNM The following table describes t he labels in this [...]

Chapter 50 System ZyWALL USG 1000 User’s Guide 831 Tr a n s f e r Protocol Select whether the V antage CNM sessions should use regular HT TP connections or secure HT TPS connections. Note: HTTPS is recommended. The V antage CNM server must u se the same setting. Device Management IP Select Auto to have the Z yW ALL allow V antage CNM sessions to [...]

Chapter 50 Sy stem ZyWALL USG 1000 U ser’s Guide 832 50.13 Language Screen Click Configuration > Sys tem > Language to open the following screen. Use this screen to select a d isplay language for the Z yW ALL’ s W eb Configurator screens. Figure 552 Configu ration > System > Language The following table describes t he labels in this[...]

ZyWALL USG 1000 User’s Guide 833 C HAPTER 51 Log and Report 51.1 Overview Use these screens to configure da ily reportin g an d log sett in gs. 51.1.1 What Y ou Can Do In this Chapter •U s e t h e Email Daily Report screen ( Section 51.2 on page 833 ) to config ure where and how to send daily reports and what reports to s end. •U s e t h e Ma[...]

Chapter 51 Log and Report ZyWALL USG 1000 U ser’s Guide 834 Click Configuration > Log & Report > Email Daily Report to displa y the following screen. Configure this screen to have t h e ZyW ALL e - mail yo u sys t em statistics ev ery day . Figure 553 Configur ation > Log & Report > Email Daily Report[...]

Chapter 51 Log and Report ZyWALL USG 1000 User’s Guide 835 The following table describes t he labels in this screen. 51.3 Log Setting Screens The Log Setting screens control log messages and alerts. A log message stores the info rmation for viewing ( for exam ple, in the View L og tab) or regular e- mailing later , and an alert is e-mailed immedi[...]

Chapter 51 Log and Report ZyWALL USG 1000 U ser’s Guide 836 The Log Setting tab also controls what information is saved in each log. Fo r the system log, you can also specify which log messages are e-mailed, where they are e-mailed, and how often they are e-mailed. For alerts, the Log Settings tab controls which ev ents gener ate alerts and where[...]

Chapter 51 Log and Report ZyWALL USG 1000 User’s Guide 837 51.3.2 Edit System Log Settings The Log Settings Edit screen controls the detailed settings for each log in the system log (which includes th e e-mail profiles). Go to the Log Settings Summary screen (see Section 51.3.1 on page 836 ), and cl ick the system log Edit icon. # This field is a[...]

Chapter 51 Log and Report ZyWALL USG 1000 U ser’s Guide 838 Figure 555 Configu ration > Log & Report > Log Setting > Edit (Syste m Log)[...]

Chapter 51 Log and Report ZyWALL USG 1000 User’s Guide 839 The following table describes t he labels in this screen. T able 245 Configuration > Log & Report > Log Setting > Edit (System Log ) LABEL DESCRIPTION E-Mail Se rv er 1/2 Active Sele ct this to send log messages and alerts according to the information in this section. Y ou sp[...]

Chapter 51 Log and Report ZyWALL USG 1000 U ser’s Guide 840 E-mail Server 1 Use the E-Mail Server 1 drop-down list to change the settings for e-mailing logs to e-mail server 1 for all log categories. Using the System Log drop-down list to disable all logs overrides your e-mail server 1 settings. enable normal logs (green check mark) - e-mail log [...]

Chapter 51 Log and Report ZyWALL USG 1000 User’s Guide 841 Active Sele ct this to activate log consolidation. Log consolidation aggregates multiple log messages th at arrive within the specified Log Consolidation Interval . In the View Log tab , the text “[count= x ]” , where x is the number of original log messages, is appended at the end of[...]

Chapter 51 Log and Report ZyWALL USG 1000 U ser’s Guide 842 51.3.3 Edit Remote Server Log Settings The Log Settings Edit screen controls the detailed settings for each log in the remote server (syslog). Go to the Log Settings Summary screen (see Section 51.3.1 on page 836 ), and click a remote serv er Edit icon. Figure 556 Configu ration > Log[...]

Chapter 51 Log and Report ZyWALL USG 1000 User’s Guide 843 The following table describes t he labels in this screen. T able 246 Configuration > Log & Report > Log Setting > Edit (Remote Server) LABEL DESCRIPTION Log Settings for Remote Server Active Select this check box to send log information according to the information in this se[...]

Chapter 51 Log and Report ZyWALL USG 1000 U ser’s Guide 844 51.3.4 Active Log Summary Screen The Active L og Summary screen allows you to vi ew and to edit what information is included in the system log, e-mail profiles, and remote servers at the same time. It does not let y ou change other lo g settings (for exampl e, where and how often log inf[...]

Chapter 51 Log and Report ZyWALL USG 1000 User’s Guide 845 The following table describes t he fields in this screen. T able 247 Configuration > Log & Report > Log Setting > Active Log Summary LABEL DESCRIPTION System log Use the System Log drop-down list to change the log settings for all of the log categories. disable all logs (red [...]

Chapter 51 Log and Report ZyWALL USG 1000 U ser’s Guide 846 Syst em log Select whi ch events y ou want to log by Log Category . There are three choices: disable all logs (red X) - do not log any information from this category enable normal logs (green checkmark) - create log messages and alerts from this category enable normal logs and debug logs[...]

ZyWALL USG 1000 User’s Guide 847 C HAPTER 52 File Manager 52.1 Overview Configuration files d efine the Z yW ALL’ s settings. Shell scrip ts are files of commands that you can store on the Z y W ALL and run when you need them. Y ou can apply a configuration file or run a sh ell script without the Z yW ALL restarting. Y ou can store multiple con[...]

Chapter 52 File Manager ZyWALL USG 1000 U ser’s Guide 848 These files have the same syntax, which is also identical to the way y ou run CLI commands manually . An example is shown below . While configur ation files and shell scri pts hav e the same syntax, the Z yW ALL applies configur ation files differently than it runs shell scripts. This is e[...]

Chapter 52 File Manager ZyWALL USG 1000 User’s Guide 849 Y our configuration files or shell scri pts can use “exit” or a command line consisting of a single “! ” to have the Z yW ALL exit sub c ommand mode. Note: “exit” or “!'” must follow sub commands if it is to make the ZyW ALL exit sub command mode. Line 3 in the followin[...]

Chapter 52 File Manager ZyWALL USG 1000 U ser’s Guide 850 52.2 The Configuration File Screen Click Maintenance > File Manager > Configuration File to open the Configuration File screen. Use the Configuration File screen to store, run, and name configur at ion files. Y ou can also download configur ation files from the Z yWALL to y our compu[...]

Chapter 52 File Manager ZyWALL USG 1000 User’s Guide 851 The following table describes t he labels in this screen. T able 249 Maintenance > File Manager > Configuration File LABEL DESCRIPTION Ren a m e Use this button to change the label of a configur ation file on the ZyW ALL. Y ou can only rename manually saved configur ation files. Y ou [...]

Chapter 52 File Manager ZyWALL USG 1000 U ser’s Guide 852 Copy Use this button to sav e a duplicate of a configuration file on the ZyW ALL. Click a configuration file’ s row to select it and click Copy to open the Copy File screen. Figure 561 Maintenan ce > File Manager > Configuration F ile > Copy Specify a name for the duplicate conf[...]

Chapter 52 File Manager ZyWALL USG 1000 User’s Guide 853 Apply Use this button to have the Z yW ALL use a specific configur ation file. Click a configuration file’ s row to select it and click Apply to have th e Z yWALL use that configuration file. Th e Z yWALL does not have to restart in order to use a different configurat ion file, although y[...]

Chapter 52 File Manager ZyWALL USG 1000 U ser’s Guide 854 52.3 The Firmware Package Screen Click Maintenance > File Manager > Firmware Package to open the Firmware Package screen. Use the Firmware Package screen to check your current firmware version and upload firmw are to the ZyW ALL. File Name This column displays the label that identifi[...]

Chapter 52 File Manager ZyWALL USG 1000 User’s Guide 855 Note: The Web Configurator is the recommended method for uploading firmware. Y ou only need to use the comma nd line interface if you need to recover the firmware. See the CLI Reference Guide for how to d etermine if you need to recover the firmware and how to recover it. Find the firm ware[...]

Chapter 52 File Manager ZyWALL USG 1000 U ser’s Guide 856 After you see the Firmware Upload in Process screen, wait two minu tes befor e logging in to the ZyW ALL a ga i n . Figure 564 Firmware Upload In Process Note: The ZyW ALL automatically reboot s after a successful uploa d. The Z yWALL automatically restarts causi ng a temporary network d i[...]

Chapter 52 File Manager ZyWALL USG 1000 User’s Guide 857 Note: Y ou should include write commands in your script s. If you do not use the write command, the changes will be lost when the ZyW ALL rest arts. Y ou could use multiple write commands in a long script. Figure 567 Maintenance > F ile Manager > Shell Script Each field is desc ribed [...]

Chapter 52 File Manager ZyWALL USG 1000 U ser’s Guide 858 Copy Use this button to save a duplicate of a shell script file on the Z yWALL. Click a shell script file’ s row to select it and click Copy to open the Copy File screen. Figure 569 Maintenance > File Ma nager > Shell Script > Copy Specify a name for the duplicate file. Use up t[...]

ZyWALL USG 1000 User’s Guide 859 C HAPTER 53 Diagnostics 53.1 Overview Use the diagnostics screen s for troubleshooting. 53.1.1 What Y ou Can Do in this Chapter •U s e t h e Maintenance > Diagnostics screen (see Sect ion 53.2 on page 859 ) to generate a file containing the ZyW ALL’s configur ation and diagnostic information if you need to [...]

Chapter 53 Diagnostics ZyWALL USG 1000 U ser’s Guide 860 The following table describes t he labels in this screen. 53.3 The Packet Capture Screen Use this screen to capture network traffi c going throu gh th e Z yWALL’ s interface s. Studying these packet captures may help you i dentify network problems. Click Maintenance > Diagnostics > [...]

Chapter 53 Diagnostics ZyWALL USG 1000 User’s Guide 861 The following table describes t he labels in this screen. T able 253 Maintenance > Diagnostics > Packet Capture LABEL DESCRIPTION Interfaces Enabled interfaces (except for virtual interfaces) appear under Available Interfaces . Select interfaces for which to capture packets and click t[...]

Chapter 53 Diagnostics ZyWALL USG 1000 U ser’s Guide 862 53.3.1 The Packet Capture Files Screen Click Maintenance > Diagnostics > Packet Capture > Files to open the packet capt ure files screen. This screen lists the files of pack et captures the Z yWALL has performed. Y ou can download the files to your computer where you can study them[...]

Chapter 53 Diagnostics ZyWALL USG 1000 User’s Guide 863 53.3.2 Example of V iewing a Packet Capture File Here is an example of a packet capture file viewed in the Wire shark packet analyzer . Notice that the size of fr ame 15 on the wire is 1514 bytes while the captured size is only 1500 bytes. The Z yWALL t runcated the fr ame because the captur[...]

Chapter 53 Diagnostics ZyWALL USG 1000 U ser’s Guide 864[...]

ZyWALL USG 1000 User’s Guide 865 C HAPTER 54 Reboot 54.1 Overview Use this to restart the device (for example, if the device beg ins behaving erratically). See also Secti on 1.5 on page 41 for information on d ifferent ways to start and stop the Z yWALL. 54.1.1 What Y ou Need T o Know If you applied changes in the W eb config urator , these were [...]

Chapter 54 Reboot ZyWALL USG 1000 U ser’s Guide 866[...]

ZyWALL USG 1000 User’s Guide 867 C HAPTER 55 Shutdown 55.1 Overview Use this to shutdown t he device in preparat ion for disconnecting the power . See also Section 1.5 on page 41 for information on different w ays to start and stop the Zy WA L L . Always use Maintenance > Shut down > Shut down or the shutdown command before you turn off the[...]

Chapter 55 Shu tdo wn ZyWALL USG 1000 U ser’s Guide 868[...]

ZyWALL USG 1000 User’s Guide 869 C HAPTER 56 Troubleshooting This chapter offers some suggestions to solv e problems you might encounter . • Y ou can also refer to the logs (see Chapter 10 on page 261 ). F or individual log descriptions, Append ix A on pa ge 899 . For the ord er in which the Z yW ALL applies its features and chec ks, see Secti [...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 870 • If you ’ve fo rgot t en th e ZyW ALL’s IP ad dres s, you ca n u se th e comm ands through the consol e port to check it. C onnect your compu ter to the CONSOLE port using a console cable. Y our computer should hav e a terminal emul ation communications program (such as Hype[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 871 I downloaded updated anti-virus or IDP/application patrol signatures. Why has the ZyW ALL not re-booted yet? The Zy WALL does not have to reboot when you upload new signatures. The content filter categor y service is not working. • Make sure y our Z yWALL has the cont en t filter cate[...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 872 • The format of interface names other than the Eth ernet interface names is ver y strict. Each name consists of 2-4 letters (interface ty pe), followed by a number (x, limited by the maximum number of ea ch type of interface). For exampl e, VLAN interfaces are vlan0, vl an1, vlan[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 873 created a cellular interfac e but cannot connect through it. • Make sure y ou have a compatible 3G device inst alled or connected. See Chapter 57 on page 891 for details. • Make sure you ha ve the cellular interface enabled. • Make sure the cellular interface has the corr ect user[...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 874 The ZyW ALL’s performance slowed down af ter I configured ma ny new application patrol entries. The Z yW ALL checks the ports and condi tions configured in application patrol entries in the order they appear in the list . While thi s sequence does not affect the functionality , y[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 875 IDP is dropping traffic that matches a rule that says no ac tion should be taken. The Z yW ALL checks all signatures and co ntinues searching even after a match is found. If two or more rules have conflicti ng actions for the same packet, then the Z yWALL applies the more restrictiv e a[...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 876 the default routing and SNA T beha vior for an interface with the Interface Type set to Internal or External . The ZyW ALL is not applyi ng a policy route’s port triggering settings. Y ou also need to create a firewall rule to allow an inco ming service. I cannot get Dynamic DNS [...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 877 Make s u re yo u have t he F TP A LG en able d . The ZyW ALL keep s resetting the connection. If an alternate gateway on the LAN has an IP address in the same subnet as the Z yWALL ’ s LAN IP address, return traffic may not go through the Z yW ALL. This is called an asymmetrical or ?[...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 878 • The Z yW ALL and remote IPSec router must use t he same active protocol. • The Z yW ALL and remote IPSec router must use the same encapsulation. • The Z yW ALL and remote IPSec router must use t he same SPI. • If the sites are/w ere previously connec te d using a leased l[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 879 • Make sure you have configured L2TP correctly on the remote user computers. See Section 8.5 on page 175 for examples. • Make sure you confi gured an appropriate policy route on the Z yWALL. • Make sure there is not a firewall be tween the Z yW ALL and the remote users. • If it [...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 880 I logged into the SSL VP N but cannot see some of the resource links. Av ailable resource links vary depending on the SSL application object’ s configu ration. I logged into the SSL VPN but cannot perform some actions in the File Sharing screen. The actions that you can perform i[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 881 However , you need to manually edit any a ddress objects for your LAN that are not based on the interface. I configured application patrol to allo w and manage access to a specific service but access is blocked. • If you w ant to use a service, make sure both the firew all and applica[...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 882 • Each monitored interface must hav e a static IP address and be connected to the same subnet as the corresponding interf ace on the backup or master Z yW ALL. • If you have multiple Z yW ALL virtual routers on your network, use a different cluster ID to identify eac h vi rt ua[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 883 Y ou cannot put the de fault admin account into any user group. I cannot get the device HA synchronization to work. Only Z yW ALLs of the same model and firmw are version can synchroniz e. Device HA synchronization is not wo rking for subscription services. Subscribe to services on the [...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 884 • Binary PKCS#7: This is a standard that defines the general syntax f or data (including digital signatures) that may be encrypted. A PKCS #7 file is used to transfer a public k ey certificate. The private k ey is not included. The ZyW ALL currently allows the importation of a PK[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 885 The ZyW ALL’ s traffic throug hput rate decreased after I started collecting traf fic statistics. Data collection may d ecrease the Z yWALL’ s tr affic throughput r ate. I can only see newer logs. Older logs are missing. When a log reaches the maxi mum number of log messages, new lo[...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 886 The packet capture screen’ s File Size sets a maximum size limit for the total combined size of all the capture files on the Z yW ALL, including any existi ng capture files and an y new capture fil es y ou generate. If y ou ha ve existi ng capture files you may need to set this s[...]

Chapter 56 Trou bleshooting ZyWALL USG 1000 User’s Guide 887 56.2 Getting More T roubleshooting Help Search for support information for your model at www .zyx el.com for more troubleshooting suggestions.[...]

Chapter 56 Tro u blesh oo tin g ZyWALL USG 1000 U ser’s Guide 888[...]

ZyWALL USG 1000 User’s Guide 891 C HAPTER 57 Product Specifications The followin g s pe cificatio ns are subj ect to change without notice. See Chapter 2 on page 43 for a gener al overvi ew of key feat ures. This table provides b asic device specifications. This table p r ov ides hardware s pe cificati o ns . T able 255 Default Login Information [...]

Chapter 57 Product Specifications ZyWALL USG 1000 U ser’s Guide 892 This table gives detail s about the Z yWAL L’ s features. Operating Environment T emperature: 0 C to 40 C Humidity: 5% to 90% (non-condensing) Storage Environment T emperature: -30 C to 60 C Humidity: 5% to 90% (non-condensing) MTBF Mean Time Between F ailures: 51,61 1 hours Di[...]

Chapter 57 Product Specifications ZyWALL USG 1000 User’s Guide 893 Firewall ACL Rules 5,000 5000 5000 Maximum Session Limit per Host Rul es NA 1000 1000 APPLICATION PATROL Maximum Rules for Other Protocols 64 64 64 Maximum Rules for Each Protocol 64 64 64 A l l o w e d P o r t s N AN A8 D e f a u l t P o r t s 888 USER PROFILES Maximum Local User[...]

Chapter 57 Product Specifications ZyWALL USG 1000 U ser’s Guide 894 Number of T runks (system default) NA NA 1 Maximum Number of T runks (user created) 128 128 128 VPN Maximum Number of VP N T unnels 1000 1000 1000 Maximum Number of VPN Concentrators 32 32 32 CERTIFICATES Certificate Buffer Size 3 84K 384K 384K BUILT-IN SERVICES A record 1024 102[...]

Chapter 57 Product Specifications ZyWALL USG 1000 User’s Guide 895 Maximum Number of Content Filter Profiles 64 64 64 Maximum Number of F orbidden Domain Entries 256 per profile 256 per profile 256 per profile Maximum Number of T rusted Domain Entries 256 per profile 256 per profile 256 per profile Maximum Numb er of Keywords that Can Be Blocked [...]

Chapter 57 Product Specifications ZyWALL USG 1000 U ser’s Guide 896 The following table, which is not exhaust ive, lists standards referenced by Z yW ALL features. Maximum SSL VPN Connections 5 without a license 50 with license 5 without a license Licenses come in 25, 50 or 250 seats 5 without a license Licenses come in 25, 50 or 250 seats OTHERS[...]

Chapter 57 Product Specifications ZyWALL USG 1000 User’s Guide 897 57.1 3G PCMCIA Card Inst allation Only insert a compatible 3G card. Slide th e connector end of the card into the slot. Note: Do not force, bend or twist the card. Used by Time service RFCs 3339 Used by T elnet service RFCs 318, 854, 14 13 Used by SIP ALG RFCs 3261, 3264 DHCP rela[...]

Chapter 57 Product Specifications ZyWALL USG 1000 U ser’s Guide 898[...]

ZyWALL USG 1000 User’s Guide 899 A PPENDIX A Log Descriptions This appendix provides descript ions of example log message s for the ZLD-based Z yWA LLs. The logs do not all apply to all of the ZLD-based Z yWALL s. Y ou will not necessecarily see al l of th ese logs in your de vice. T able 259 Content Filter Logs LOG MESSAGE DESCRIPTION Content fi[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 900 T able 261 Blocked Web Site Logs LOG MESSAGE DESCRIPTION %s :%s The rating server responded that the web site is in a specified category and access was blocked according to a content filter profile. 1st %s: website host 2nd %s: website category %s: Unrated The rating server r esponde[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 901 %s: Proxy mode is detected The system detected a proxy connection an d blocked access according to a profile. %s: website host %s: Forbidden Web si te The web site is in forbidden web site list. %s: website host %s: Keyword blocking The web content matched a user defined keyword. %s: we[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 902 Black List checking has been activated. The anti-spam black list has been turned on. Black List checking has been deactivated. The anti-spam black list has been turned off . Black List rule %d has been added. The anti-spam black list rule with the specified index number (%d) has been[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 903 T able 263 SSL VPN Logs LOG MESSAGE DESCRIPTION %s %s from %s has logged in SSLVPN A user has logged into SSL VPN. The first %s is the type of user account. The second %s is the user’s user name. The third %s is the name of the service the u ser is using (HT TP or HTTPS). %s %s from %[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 904 The %s address-object is wrong type for 'network' in SSL Policy %s. The listed address object (first %s ) is not the right kind to be specified as a network in the listed SSL VPN policy (second %s). The SSL VPN policy %s has been changed 'ip- pool' value. The IP p[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 905 %s %s is accessed. sent=<bytes> rcvd=<bytes> The listed SSL VPN access was used to send and receive the listed numbers of bytes. The first %s is the type of SS L VPN access (web application, file sharing, or network extension). The second %s is the name of the application. T[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 906 T able 264 L2TP Over IPSec Logs LOG MESSAGE DESCRIPTION The configuration of L2TP over IPSec has been changed. The L2TP over IPSec configur ation has been modified. L2TP over IPSec may not work since Crypto Map %s using Manual Key. L2TP over IPSec does not support manual key manageme[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 907 The Z ySH logs deal with internal system errors. T able 265 ZySH Logs LOG MESSAGE DESCRIPTION Invalid message queue. Maybe someone starts another zysh daemon. ZySH daemon is instructed to reset by %d 1st:pid num System integrity error! Group OPS cannot close property group cannot close [...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 908 Can't remove %s 1st:zysh list name Table OPS %s: cannot retrieve entries from table! 1st:zysh table name %s: index is out of range! 1st:zysh table name %s: cannot set entry #%d 1st:zysh table name,2st: zysh entry num %s: table is full! 1st:zysh table name %s: invalid old/new ind[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 909 T able 266 ADP Logs LOG MESSAGE DESCRIPTION from <zone> to <zone> [type=<type>] <message> , Action: <action>, Severity: <severity> The Z yWALL detected an an omaly in traffic tr aveling between the specified zones. The <type> = {scan-detection(&[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 910 T able 267 Anti-Virus Logs LOG MESSAGE DES CRIPTION Initializing Anti-Virus signature reference table has failed. The Z yWALL failed to initialize the anti-virus signatures due to an internal error . Reloading Anti-Virus signature database has failed. The Z yWALL failed to reload the[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 91 1 AV signature update has failed. Can not update last update time. The anti-virus signatur es update did not succeed. AV signature update has failed. (Replacement failure) Anti-virus signatures update failed because th e ZyW ALL was not able to replace the old set of anti- virus signatur[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 912 Anti-Virus rule %d has been modified. The anti-virus rule of the specified number has bee n changed. Anti-Virus rule %d has been inserted. An anti-virus rule has been inserted. %d is the number of the new rule. Anti-Virus rule %d has been appended. The anti-virus rule with the listed[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 913 T able 268 User Logs LOG MESSAGE DES CRIPTION %s %s from %s has logged in ZyWALL A user logged into the ZyW ALL. 1st %s: The type of user account. 2nd %s: The user ’ s user name. 3rd %s: The name of the servi ce the user is using (HT TP , HTTPS, F T P , T eln e t, SSH , or c onsol e).[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 914 Failed login attempt to ZyWALL from %s (login on a lockout address) A login attempt came from an IP address that the Z yWALL has locked out. %u.%u.%u.%u: the source address of the user’ s login attempt Failed login attempt to ZyWALL from %s (reach the max. number of user) The Z yWA[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 915 Registration has failed. Because of lack must fields. The device received an incomplete response from the myZ yXEL.com serv er and it caused a parsing error for the device. %s:Trial service activation has failed:%s. T rail service activation failed for the specifi ed service, an error m[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 916 Do device register. The device started device registration. Do trial service activation. The device started tr ail service activation. Do standard service activation. The device started standard service activ ation. Do expiration check. The device started the service expiration day c[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 917 Device has latest signature file; no need to update The device already has the latest version of the signature file so no update is needed. Connect to update server has failed. The device cannot connect to the update server . Wrong format for packets received. The device cannot parse th[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 918 Get server response has failed. The device sent packets to the server , but did not receive a response. The root cause may be that the connection is abnormal. Expiration daily- check has failed:%s. The daily check for service expiration failed, an error m essage returned by the MyZyX[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 919 Self signed certificate. V erification of a server’s certificate failed because it is self- signed. Self signed certificate in certificate chain. V erification of a serv er ’s certificate failed because there is a self-signed certificate in the server’s certificate chain. Verify p[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 920 Enable IDP engine succeeded. The device turned on the IDP engine. Disable IDP engine succeeded. The device turned off the IDP engine. IDP service is not registered. IDP will not be activated. The IDP service could has not been turned on and the IDP signatures will not be updated beca[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 921 Add custom signature error: signature <sid> is over length. An attempt to add a custom IDP signature failed because the signature’s contents were too long. Edit custom signature error: signature <sid> is over length. An attempt to edit a custom IDP signature failed because[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 922 from <zone> to <zone> [type=<type>] <message> , Action: <action>, Severity: <severity> The Z yWALL detected an intrusion in tr affic trav eling between the specified zones. The <type> = {scan-detection(<attack>) | flood- detection(<a[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 923 Duplicate sid <sid> in import file at line <linenum>. The listed signature ID is duplicated at the listed line number in the signature file. IDP rule <num> has been deleted. The listed IDP rule has been removed. IDP rule <num> has been moved to <num>. The I[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 924 Protocol %s has been enabled. The listed protocol has been turned on in the application patrol. Protocol %s has been disabled. The listed protocol has been turned off in the application patrol. Classification mode of protocol %s has been modified to portless. The device will now use [...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 925 T able 272 IKE Logs LOG MESSAGE DESCRIPTION Peer has not announced DPD capability The remote IPSec router has not announced its dead peer detection (DPD) capability to this device. [COOKIE] Invalid cookie, no sa found Cannot find SA accordin g to the cookie. [DPD] No response from peer.[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 926 [SA] : Tunnel [%s] Phase 1 invalid protocol %s is the tunnel name. When nego tiating Phase-1, the packet was not a ISKAMP pack et in the protocol field. [SA] : Tunnel [%s] Phase 1 invalid transform %s is the tunnel name. When negotiating Phase-1, the transform ID w as invalid. [SA] :[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 927 Could not dial manual key tunnel "%s" %s is the tunnel name. The manual k ey tunnel cannot be dialed. DPD response with invalid ID When receiving a DPD response with invalid ID ignored. DPD response with no active request When receiving a DPD re sponse with no active query . I[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 928 VPN gateway %s was enabled %s is the gatewa y name. An administrator enabled the VPN gateway . XAUTH fail! My name: %s %s is the my xauth name. This indicates that m y name is inv alid. XAUTH fail! Remote user: %s %s is the remote xauth name. This indicates that a remote user’s nam[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 929 Get outbound transform fail When outgoing packet need to be transformed, the engine cannot obtain the transform context. Inbound transform operation fail After encryption or hardware accelerated processing, the hardware acceler ator dropped a packet (resource shortage, corrupt packet, i[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 930 Firewall %s %s rule %d was %s. 1st %s is from zone, 2nd %s is to zone, %d is the index of the rule 3rd %s is appended/inserted/modified Firewall %s %s rule %d has been moved to %d. 1st %s is from zone, 2nd %s is to zone, 1st %d is the old index of the rule 2nd %d is the new index of [...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 931 The policy route %d uses empty user group! Use an empty object group. %d: the policy route rule number The policy route %d uses empty source address group! Use an empty object group. %d: the policy route rule number The policy route %d uses empty destination address group! Use an empty [...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 932 HTTPS port has been changed to port %s. An administrator ch anged the port number for HT TPS. %s is port number HTTPS port has been changed to default port. An administrator chan ged the po rt number for HT TPS back to the default (443). HTTP port has changed to port %s. An administr[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 933 Console baud has b een reset to %d. An administrator changed the console port baud r ate back to the default (115200). %d is default baud rate DHCP Server on Interface %s will not work due to Device HA status is Stand-By If interface is stand-by mode for de vice HA, DHCP server can&apos[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 934 DNS access control rule %u has been moved to %d. An administrator mo ved the rule %u to index %d. %u is previous index %d variable is current index The default record of Zone Forwarder have reached the maximum number of 128 DNS servers. The default record DNS servers is more than 128[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 935 Access control rule %u of %s was modified. An access control rule was modified successfully . %u is the index of the access control rule. %s is HT TP/HT TPS/SSH/SNMP/FTP/TELNET . Access control rule %u of %s was deleted. An access control rule was removed successfully . %u is the index [...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 936 DHCP Server executed with cautious mode disabled DHCP Server ex ecuted with cautious mode disabled. Received packet is not an ARP response pack et A packet was received but it is not an ARP response packet. Receive an ARP response The device received an ARP response. Receive ARP resp[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 937 Device is rebooted by administrator! An administr ator restarted the device. Insufficient memory. Cannot allocate system memory . Connect to dyndns server has failed. Cannot connect to members.dyndns.org to update DDNS. Update the profile %s has failed because of strange server response[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 938 Update the profile %s has failed because the feature requested is only available to donators. Update profile failed because the feature requested is only av ailable to donators, %s is the profile name. Update the profile %s has failed because of error response. Update profile failed [...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 939 The profile %s has been paused because the HA interface of VRRP status was standby. The profile is paused by Device-HA, because the VRRP status of that HA iface is standby , %s is the profile name. Update the profile %s has failed because HA interface was link- down. DDNS profile cannot[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 940 T able 279 Connectivity Check Logs LOG MESSAGE DESCRIPTION Can't open link_up2 Cannot recove r routing status which is link -down. Can not open %s.pid Cannot open connectivity check process ID file. %s: interface name Can not open %s.arg Cannot open configuration file for connec[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 941 Can't use MULTICAST IP for destination The connectivity check process can't use multicast address to check link -status. The destination is invalid, because destination IP is broadcast IP The connectivity check process can't use broadcast address to check link -status. Ca[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 942 %s file not existed, Skip syncing it fo r %s There is no file to be synchronized from the Master when syncing a object (A V/AS/IDP/Certificate/System Configuration), But in fact, there should be something in the Master for the device to synchronize with, 1st %s: The syncing object, 2[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 943 Device HA authentication type for VRRP group %s maybe wrong. A VRRP group’ s Authentication T ype (Md5 or IPSec AH) configuration ma y not match between the Backup and the Master . %s: The name of the VRRP group. Device HA authenticaton string of text for VRRP group %s maybe wrong. A [...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 944 T able 281 Routing Protocol Logs LOG MESSAGE DESCRIPTION RIP on interface %s has been stopped because Device-HA binds this interface. Device-HA is currently running on the interface %s, so all the local service have to be stopped including RIP . %s: Interface Name RIP on all interfac[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 945 RIP md5 authentication id and key have been deleted. RIP md5 authentication id and key have been deleted. RIP global version has been deleted. RIP global version has been deleted. RIP redistribute OSPF routes has been disabled. RIP redistribute OSPF routes has been disabled. RIP redistr[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 946 Invalid OSPF virtual- link %s authentication of area %s. Virtual-link %s authentication has been set to same- as-area but the area has invalid authen tication co nf iguration. %s: Virtual-Link ID Invalid OSPF md5 authentication on interface %s. Inv alid OSPF md5 authentication is set[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 947 Register SIP ALG signal port=%d failed. SIP ALG apply signal port failed. %d: Po rt number Register H.323 ALG extra port=%d failed. H323 ALG apply additional signal port failed. %d: Po rt number Register H.323 ALG signal port=%d failed. H323 ALG apply signal port failed. %d: Po rt numbe[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 948 SCEP enrollment "%s" successfully, CA "%s", URL "%s" The device used SCEP to enroll a certificate. 1st %s is a request name, 2nd %s is the CA name, 3rd %s is the URL . SCEP enrollment "%s" failed, CA "%s", URL "%s" The devic[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 949 Export X509 certificate "%s" from "Trusted Certificate" successfully The device exported a x509 format certificate from T rusted Certificates. %s is the certificate request name. Export X509 certificate "%s" from "My Certificate" failed The device[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 950 25 Database method failed due to timeout. 26 Database method failed. 27 P ath was not verified. 28 Maximum path length reached. T able 284 Interface Logs LOG MESSAGE DESCRIPTION Interface %s has b een deleted. An administrator deleted an in terface. %s is the interface name. AUX Inte[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 951 Interface %s is enabled. An administrator enabled an in terface. %s: interface name. Interface %s is disabled. An administrator disabled an interface. %s: interface name. %s MTU > (%s MTU - 8), %s may not work correctly. An administrator configured a PPP interface, PPP interface MTU [...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 952 Interface %s connect failed: MS-CHAP authentication failed. MS-CHAP authentication failed (the server must support MS- CHAP and verify that the authentication failed, this does n ot include cases where the server does not support MS-CHAP). %s: interface name. Interface %s connect fai[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 953 "SIM card has been successfully unlocked by PUK code on interface cellular%d. Y ou entered the correct PUK code and unlocked the SIM card for the cellular device associated with the listed cellular interface (%d). "Incorrect PUK code of interface cellular%d. Please check the P[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 954 "Cellular device [%s %s] has been removed from %s. The cellular device (identified by its manufacturer and model) has been removed from the specified slot. Interface cellular%d required authentication password.Please set password in cellular%d edit page. Y ou need to manually en[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 955 T able 287 Force Authentication Logs LOG MESSAGE DESCRIPTION Force User Authentication will be enabled due to http server is enabled. Force user authentication will be turned on because HT TP server was turned on. Force User Authentication will be disabled due to http server is disabled[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 956 T able 289 DHCP Logs LOG MESSAGE DESCRIPTION Can't find any lease f or this client - %s, DHCP pool full! All of the IP addresses in the DHCP pool are already assigned to DHCP clients, so there is no IP address to give to the listed DHCP client. DHCP server offered %s to %s(%s) T[...]

Appendix A Log Descriptions ZyWALL USG 1000 User’s Guide 957 T able 291 IP-MAC Binding Logs LOG MESSAGE DESCRIPTION Drop packet %s- %u.%u.%u.%u- %02X:%02X:%02X:%02 X:%02X:%02X The IP-MAC binding feature dr opped an Ethernet packet. The interface the packet came in through and the sender’s IP address and MAC address are also shown. Cannot bind i[...]

Appendix A Log Descrip tio ns ZyWALL USG 1000 U ser’s Guide 958[...]

ZyWALL USG 1000 User’s Guide 959 A PPENDIX B Common Services The following table lists some commonl y-used services and their associated protocols and port numbers. F or a comprehe nsiv e list of p ort numbers, ICMP type/ code numbers and services , visit the IANA (Internet Assigned Number Authority) web site. • Name : This is a short, descrip [...]

Appendix B Com mon Servic es ZyWALL USG 1000 U ser’s Guide 960 ESP (IPSEC_TUNNEL) User -Defined 50 The IPSEC ESP (Encapsulation Security Protocol) tunneling protocol uses this service. FINGER TCP 79 Finger is a UNIX or Internet related command that can be used to find out if a user is logged on. FTP TCP TCP 20 21 File T ransfer Program, a progr a[...]

Appendix B Common Services ZyWALL USG 1000 User’s Guide 961 PPTP TCP 1723 Point -to-P oint T unneling Protocol enables secure transfer of data ov er public networks. This is the control channel. PPTP_TUNNEL (GRE) User -Defined 47 PPTP (P oint -to-Point T unneling Protocol) enables secure transfer of data over public networks. This is the data cha[...]

Appendix B Com mon Servic es ZyWALL USG 1000 U ser’s Guide 962 TFTP UDP 69 T rivial File T ransfer Protocol is an Internet file transfer protocol similar to FTP , but uses the UDP (User Datagram Protocol) r ather than TCP (T ransmission Control Protocol). VDOLIVE TCP 7000 Another videoconferencing solution. T able 293 Commonly Used Services (cont[...]

ZyWALL USG 1000 User’s Guide 963 A PPENDIX C Displaying Anti-V irus Alert Messages in Windows With the anti- virus packet s can, when a virus is detected, you can have the Z yW ALL displa y an alert message on Miscrosoft Windows-based computers. If the log shows that virus files are b eing dete cted but your Miscrosoft Windows- based computer is [...]

Appendix C Dis playing Anti-Virus Alert Messages in Windows ZyWALL USG 1000 U ser’s Guide 964 2 Select the Messenge r service and click Start . Figure 581 Windows XP: S tarting the Messenger Service 3 Close the window when you are done. Windows 2000 1 Click Start > Settings > Control Panel > Administrative Tools > Services . Figure 58[...]

Appendix C Displaying Anti-Virus Alert Messages in Windows ZyWALL USG 1000 User’s Guide 965 2 Select the Messenge r service and click Start Service . Figure 583 Windows 2000 : S t arting the Messenger Service 3 Close the window when you are done. Windows 98 SE/Me For Windows 98 SE/Me, you must open the WinPopup window in order t o view real-time [...]

Appendix C Dis playing Anti-Virus Alert Messages in Windows ZyWALL USG 1000 U ser’s Guide 966 1 Right- click on the program t ask bar and click Properties . Figure 585 WIndows 98 SE: Program T ask Bar 2 Click the Start Menu Programs tab and click Advanced .. . Figure 586 Windows 98 SE: T ask Bar Properties 3 Double-click Programs and click StartU[...]

Appendix C Displaying Anti-Virus Alert Messages in Windows ZyWALL USG 1000 User’s Guide 967 4 Right- click in the StartUp pane and click New , Shortcut . Figure 587 Windows 98 SE: S tartUp 5 A Create Shortcut wi ndow displays. Enter “wi npopup” in the Command line field and click Next . Figure 588 Windows 98 SE: S tartup: Create Shortcut[...]

Appendix C Dis playing Anti-Virus Alert Messages in Windows ZyWALL USG 1000 U ser’s Guide 968 6 Specify a nam e for the shortcu t or ac ce pt the defa ul t and c lic k Finish . Figure 589 Windows 98 SE: S tartup: Select a T itle for the Program 7 A shortcut is created i n the StartUp pane. Restart the computer when prompted. Figure 590 Windows 98[...]

ZyWALL USG 1000 User’s Guide 969 A PPENDIX D Importing Certificates This appendix shows you how to import public k ey certificates into your web browser . Public key certificates are used by web br owsers to ensure that a secure web site is legitimate. When a certificate authorit y such as V eriSign, Comodo , or Network Solutions, to name a few ,[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 970 1 If your device’ s W eb Configurator is set to use SSL certificati on, then the first time you browse to i t you are presented with a certificati on error . Figure 591 Internet Explorer 7: Cert ification Error 2 Click Continue to this website (not recommended) . Figure 592 Int[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 971 4 In the Certificate dialog bo x, click Install Certificate . Figure 594 Internet Explorer 7: Cert ificate 5 In the Certificate Import Wizard , click Next . Figure 595 Internet Explorer 7: Cert ificate Import Wizard[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 972 6 If you w ant Internet E xplorer to Automatically select certificate store based on the type of certificate , click Next again and then go to step 9. Figure 596 Internet Explorer 7: Cert ificate Import Wizard 7 Otherwise, se lect Place all certificates in the following store and[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 973 8 In the Select Certificate Store dialog box, choose a location in which to sa ve the certificate and then clic k OK . Figure 598 Internet Explorer 7: Select Certificate S tore 9 In the Completing the Certificate Import Wizard screen, click Finish . Figure 599 Internet Explorer 7[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 974 10 If you are presented with another Security Warning , c lick Yes . Figure 600 Internet Explorer 7: Security W arning 11 Finally , click OK when presented with the successful certificate installation message. Figure 601 Internet Explorer 7: Cert ificate Import Wizard 12 The next[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 975 Inst alling a St and-Alone Certific ate File in Internet Explorer Rather t han browsing to a Z yXEL W eb Co nfigurator and installing a public key certificate when prompted, y ou can install a stand- alone certific ate file if one has been issued to you. 1 Double-click the public[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 976 1 Open Internet Explorer and click Tools > Internet Options . Figure 605 Internet Explorer 7: T ools Menu 2 In the Internet Options dialog box, cl ick Content > Certificates . Figure 606 Internet Explorer 7: I nternet Options[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 977 3 In the Certificates dialog box, click the Trusted Root Certificates Authorities tab, select the certificat e that yo u w ant to delete, and then click Remove . Figure 607 Internet Explorer 7: Cert ificates 4 In the Certificates confirmation, click Yes . Figure 608 Internet Expl[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 978 6 The next time you go to the web site that issued the public k ey certificate you just removed, a certification error appears. Firefox The following example uses Mozilla Firefox 2 on Windows XP Professional; however , the screens can also apply to Firefox 2 on all platforms. 1 I[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 979 3 The certificate is stored and you ca n now connect securely to the W eb Configurator . A sealed padlock appears in the address bar , which you can click to open the Page Info > Security windo w to view the web page’ s security informat ion. Figure 61 1 Firefox 2: Page Info[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 980 1 Open Firefox and click Tools > Options . Figure 612 Firefox 2: T ools Menu 2 In the Options dialog bo x, cli ck Advanced > Encryption > View Certifica t es . Figure 613 Firefox 2: Options[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 981 3 In the Certificate Manager dialog box, cl ick Web Si tes > Import . Figure 614 Firefox 2: Cert ificate Manager 4 Use the Select File dialog bo x to locate the certificate and then click Op en . Figure 615 Firefox 2: Select File 5 The next time you visit the web site, click t[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 982 Removing a Certificate in Firefox This section shows y ou how to remove a public key certificate in Fi refox 2. 1 Open Firefox and click Tools > Options . Figure 616 Firefox 2: T ools Menu 2 In the Options dialog bo x, cli ck Advanced > Encryption > View Certifica t es .[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 983 3 In the Certificate Manager dialog box, select the Web Sites tab , select the certificate that you w ant to remove, and then click Delete . Figure 618 Firefox 2: Cert ificate Manager 4 In the Delete Web Site Certificates dialog bo x, cli ck OK . Figure 619 Firefox 2: Delete W eb[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 984 1 If your device’ s W eb Configurator is set to use SSL certificati on, then the first time you browse to i t you are presented with a certificati on error . 2 Click Install to accept the certi ficate. Figure 620 Opera 9: Certificate signer not found 3 The next time you visit t[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 985 Inst alling a St and-Alone Ce rtificate File in Opera Rather t han browsing to a Z yXEL W eb Co nfigurator and installing a public key certificate when prompted, y ou can install a stand- alone certific ate file if one has been issued to you. 1 Open Opera and click Tools > Pre[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 986 2 In Preferences , click Advanced > Security > Manage certificates . Figure 623 Opera 9: Prefer ences[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 987 3 In the Certificates Manager , click Authorities > Import . Figure 624 Opera 9: Certificate manager 4 Use the Import certificate dialog box to locate the certificate and then click Open. Figure 625 Opera 9: Import certif icate[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 988 5 In the Install authority certificate dialog box, c lick Ins tall . Figure 626 Opera 9: Inst all authority certificate 6 Next, click OK . Figure 627 Opera 9: Inst all authority certificate 7 The next time you visit the web site, click the padlock in the address bar to open the S[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 989 1 Open Opera and click Tools > Preferences . Figure 628 Opera 9: T ools Menu 2 In Preferences , Advanced > Security > Manage certificates . Figure 629 Opera 9: Prefer ences[...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 990 3 In the Certificates manager , sele ct the Authorities tab, select th e certificat e that you wan t to r emove , and th en c l i ck Delete . Figure 630 Opera 9: Certificate manager 4 The next time you go to the web site that issued the public k ey certificate you just removed, a[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 991 2 Click Continue . Figure 631 Konquero r 3.5: Server Authentication 3 Click Forever when prompted to accept the certificate. Figure 632 Konquero r 3.5: Server Authentication 4 Click the padlock in the addr ess bar to open the KDE SSL Information window and view the web page’ s [...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 992 Inst alling a St and-Alone Ce rtificate File in Konqueror Rather t han browsing to a Z yXEL W eb Co nfigurator and installing a public key certificate when prompted, y ou can install a stand- alone certific ate file if one has been issued to you. 1 Double-click the public key cer[...]

Appendix D Importi ng Certificates ZyWALL USG 1000 User’s Guide 993 3 The next time you visit the web site, click the padlock in the address bar to open the KDE SSL Inf ormation window to view the web page’ s security details. Removing a Certificate in Konqueror This section shows y ou how to remove a public k ey certificate in K onqueror 3.5. [...]

Appendix D Importing Certificates ZyWALL USG 1000 U ser’s Guide 994 4 The next time you go to the web site that issued the public k ey certificate you just removed, a certification error appears. Note: There is no confirmation wh en you remove a certificate authority , so be absolutely certain you want to go through with it before clicking the bu[...]

ZyWALL USG 1000 User’s Guide 995 A PPENDIX E Open Sof tware Announcement s End-User License Agreement for “ZyW ALL USG 1000” WARNING: Z y XEL Communications Co rp. IS WILLING TO LICENSE THE SOFTWARE T O YOU ONL Y UPON THE CONDITION THA T Y OU ACCEPT ALL OF THE TERMS CONT AINED IN THIS LICENSE AG REEMENT . PLEASE READ THE TERMS CAREFULL Y BEFO[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 996 Y ou may not remove an y proprietary notice of Z yXEL or any of its licensors from any copy of the Softw are or Documentation. 4.R estrictions Y ou may not publish, display , disclose, sel l, rent, lease, modify , store, loan, distribute, or create deriv ative works of the S[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 997 6.No W arranty THE SOFTWARE IS PROVIDED "AS IS." T O THE MAXIMUM EXTENT PERMITTED BY LAW , Z yXEL DISCLAIMS ALL WAR RANTIES OF ANY KIND , EITHER E XPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMIT A TION, IMPLIED W ARRANTIES OF MERCHANT ABILITY AND FITNESS FOR A PA R T[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 998 9.Audit Rights Z yXEL SHALL HAVE THE RIGHT , A T ITS OWN EXPENSE, UPON REASONABLE PRIOR NOTICE, T O PERIODICALL Y INSPECT AN D AUDIT Y OUR RECORDS T O ENSUR E YOUR COMPLIANCE WITH THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT . 10.T ermination This License Agreement is [...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 999 bridge-utils 0.9.5. http://linux-n et.osdl.org/in dex.php/Bridge dhcpcd-1.3.2 2-pl4 1.3.22-pl4 http://www .phystech.com/download/ ppp-2.4.2 2.4.2 http://ppp.sam ba.org/ppp/index.html pptp-1.7.0 1.7.0 http://pptpclient.s ourceforge.net/ rp-pppoe-3.5 3.5 http://www .r oaringpe[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1000 Notice Information herein is subject to change without notice. Comp anies, names, and data used in exampl es herein are fictit ious unless otherwise noted. No part may be reproduced or transmi tted in any fo rm or by any means, electronic or mechanical, for an y purpose, ex[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1001 PPP License Copyright (c) 1993 The Austr alian National University . All rights reserved. Re distribution and use in source and binary forms are permitted provided that the above copyri ght notice and this par agrap h are duplicated in all such forms and that any documentat[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1002 All rights reserved. Re di stribution and use in source and bina ry forms, with or without modification , are permitted provided that the following conditions are met: 1.R edistributions of source code must retain the abov e copyright notice, this list of conditions and the[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1003 This Product includes expat-1.95.6 softw are under the Expat License Expat License Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd P ermission is hereby granted, free of ch arge, to an y person obtaining a copy of this software and associ ated documentat[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1004 •This license is compatible with The GN U General Pu blic License, V ersion 2 This is j ust like a Simple Permissive lic ense, bu t it requ ires that a copyri ght noti ce be main ta ined. ________________________________________ P ermission is hereby granted, free of ch a[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1005 2. R edistributions in binary form must reproduce the above copyright notice, this list of conditions and the following d isclaimer in the documentation and/or other materials provided with the dis tribution. 3. All adve rtising materials mentioning fe atures or use of t hi[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1006 be it the RC4, RS A, lhash, DES, etc. , code; not just the S SL code. The SSL documentation included with this distribu tion i s covered by the same copyright terms except that the hol der is Tim Huds on (tjh@cryptsoft.com). Copyright remains Eric Y oung's, and as su c[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1007 This Product includes libevent -1.1a and xinetd-2.3.14 softw are under the a 3- clause BSD License a 3-clause BSD-style license This is a Free Software Li cense •This license is compatible with The GN U General Pu blic License, V ersion 1 •This license is compatible wit[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1008 * Neither the name of [original copyright holder] nor the names of its cont ributors may be used to endors e or promote products deriv ed from this software without specific prior written permission. THIS SOF TW ARE IS PROVIDED BY THE COPYRIGH T HOLDERS AND CONTRIBUTORS &qu[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1009 DIRECT , INDIRECT , OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHA TSOEVER RESUL TING FROM LOS S OF USE, DA T A OR PROFITS , WHETHER IN AN ACTION OF CONTRACT , NEGLIGENCE OR O THER T OR TIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1010 P ermission to use, copy , modify , and distri bute this softw a re for any purpose with or without fee is hereby gr anted, provided that th e above copy ri ght notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS " AND ISC DISCL[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 101 1 "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by th e copyrigh t owner that is granting the Licen[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1012 "Contributor" shall mean Lice nsor and any individual or Legal Entit y on behalf of whom a Contribution has been receiv ed by Licensor and subsequently incorporated wi thin the W ork. 2. Gr ant of Copyright Li cense. Subject to the terms and condit ions of this Li[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1013 attribution notices within Deriv ative W orks that Y ou distribute, alongside or as an addendum to the NO TICE text from the W ork, provided that such additional attribution notices cannot be construed as modifyin g t he L ic e ns e. Y ou m ay add Y our own copyright statem[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1014 Contributor harmless for any liabili ty incurred by , or claims asserted against, such Contributor by reason of your accepting an y such warr anty or additional liability . END OF TERMS AND CONDITIONS Ve r s i o n 1 . 1 Copyright (c) 1999-2003 The Apache Softw are Foundat i[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1015 USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POS SIBILITY OF SUCH DAMAGE. This software consis ts of voluntary contrib utions made by many individ uals on behalf of the Apache Softw are Found ati on. F or more inform ation on the Apache Software F oundation, please see <[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1016 guarantee y our freedom to share and chan ge free software--to mak e sure the software is free fo r all its use rs . This license, the Lesser Gener al Public License, appl ies to some specially designated softw are packages--typica lly libraries--of the Free Softw are Found[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1017 Most GNU software, including so me libraries, is cov ered by the ordinary GNU General Publi c License. This lic ense, th e GNU Lesser Gener al Public Licen s e , applies to certain des ignated libraries, and is quite different from the ordinary General Public License. W e u[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1018 0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under t he terms of this Lesser Gener al Public License (al so called "this License&[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1019 still operates, and performs whatever part of its purpose remains meaningful. (For example, a function in a li brary to comp ute square roots has a purpose that is entirely well-defined indepe ndent of the application. Therefore, Subsection 2d requires that any applicat ion[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1020 "work that uses the Library". Such a work, in isolation, is not a derivati v e work of the Libr ary , and therefore falls outside the scope of this Lic ense. However , linking a "work that uses the Libr ary" with the Li brary creates an executable that i[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1021 version is interface-compatible with the version that the work was made with. c) Accompany the work with a written offer , v a lid for at least three years, to giv e the same user the materials specified in Subs ection 6a, above, for a charge no more than the cost of perfor[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1022 10. Each time you redi stribute the Libr ar y (or any work base d on the Library), the recipient automatically recei ves a license from the original licensor to copy , distribute, li nk with or modify the Li br ary subject to these terms and c onditions. Y ou may not impose[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1023 Library does not specify a license version number , you may choose any version ever published by the Fr ee Softw are Foundation. 14. If you wish t o incorpor ate parts of th e Libr ary into other free progr ams whose distribution conditions are incompati ble with th ese, wr[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1024 pcmcia-cs-3.2.8, lib eeprog, mgetty -1.1.35, gmp-4.1, msmtp-1. 4.12 and libqsearch 0.8 software under GPL license. GNU GENERAL PUBLIC LICENSE V ersion 2, June 1991 Copyright (C) 1989, 1991 Free Software F oundation, Inc. 59 T emple Place - Suite 330, Boston, MA 02111-1307, [...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1025 the software. Also, for each author's protec tion and ours, we want to make certain that everyone unde rs tan ds that there is no warr anty for this free software. If the software is modified by someone else an d p assed on, we want its recip ients to know that what th[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1026 b) Y ou must cause any work that you distribute or publish, that in whole or in part contains or is deriv ed from the Progra m or any part thereof , to be licensed as a whole at no charge to all third p art ies under the terms of this License. c) If the modified program nor[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1027 source code means all the source code for all modules it contains, plus any associated interface definition fi les, plus the scripts used to control compil ation and i n s tall at ion of th e ex ecutable. Ho wev e r , as a special exception, the source code distributed need[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1028 whole is intended to apply in other circum stances. It is not the purpose of this section to induce you to infringe any pate nts or other property right c l aim s or to contest vali dity of an y such claims; this section has the sole purpose of protecting the integrity of t[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1029 DEFECTIVE, YOU ASSUME THE COST OF ALL NECESS ARY SERVICING, REP AIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LA W OR AGREED T O IN WRITING WILL ANY COPYRIGHT HOLDER, OR AN Y OT HER P ARTY WHO MA Y MODIFY AND/ OR REDISTRIB UTE THE PROGRAM AS PERMIT TED AB[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1030 means a mechanism generally accept ed in the software dev elopment community for the el ectronic tr ansfer of data. 1.5. "Executable" means Covered Code in an y form other than Source Code. 1.6. "Initial Dev eloper" means the individual or entity identif[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1031 1.11. "Source Code" means the preferred form of the Co vered Code for making modifications to it, includ in g all modu les it conta i ns, plus an y associated interfac e definition files, scripts used to control compilati on and in stallation of an Ex ecutable, or[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1032 Subject to third party intellect ual property claims, each Contributor hereby gr ants Y ou a world-wide, royalty -free, non-exclusive license under intellectual propert y rights (other than patent or tradem ark) Licensable by Contributor , to use, reproduce, modify , di spl[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1033 made av ailable via Electronic Distribution Mechanism, must remain av ailable for at least twelv e (12) months after the date it initially became available, or a t least six (6) months after a subsequent version of that particular Modi fic ation has been made av ailable to [...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1034 Y ou must duplicate the noti ce in Exhibit A in each file of the Source Code. If it is not possible to put such notice in a particul ar Source Code file due to its stru cture, then Y ou must include su ch notice in a location (such as a relevant directory) where a user woul[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1035 regulation then Y ou mus t: (a) com ply with the term s of th is L icen se to the maximum extent possible; and (b) descri be the limitations and the code they affect. Such description must be included in the legal file described in Section 3.4 and must be included with all [...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1036 (not the initial developer or any other contributor) assume the cost of any necessary servicing, repair or correction. This disclaimer of warr anty constitutes an essential part of this license. No use of any cov e red code is authoriz ed hereunder except under this di scla[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1037 granted by Y ou or any distributor hereun der prior to ter mination shall survive terminatio n. 9. Limitation of liability Under no circumstances and under no legal theory , whe ther tor t (including negligence), contr act, or otherwise, shal l you, the initial develop er ,[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1038 As between Initial Developer and the Contributors, each party is responsible for claims and damages arisi ng, directly or indirectly , out of i ts utilization of ri ghts under this License and Y ou agree to work with Initial Developer and Contributors to distribute such res[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1039 NOTE : The text of this Exhibit A ma y differ slightly from the t ext of the notices in the Source Code files of the Original Code . Y ou should use the text of this Exhibit A rather t han the text found in the Original Code Source Cod e for Y our Modifications. This Produc[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1040 USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POS SIBILITY OF SUCH DAMAGE. This Product includes libxml2-2. 6.8, Prototype 1.6. 0 and persis t -js-0.1. 0 softw are under the MIT License The MIT License Copyright (c) <year> <copyright holders> P ermission is hereb[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1041 Re distribution and us e of this software and assoc iated documentation("Softw are"), wi th or wit hout modification, are permitted provid ed that the following conditi ons are met: 1. R edistributions in source form must retain copyright statements and notices, 2[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1042 Copyright 1999-2003 The OpenLD AP F oundation, R edwood City , California, USA. All Rights R eserved. P ermi ssion to copy and distribute v erbatim copies of this document is gr anted. This Product includes gd-2.0.36RC1 softw are under the below License P o rt ions copyrigh[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1043 use of gd. If you have questions, ask. "D erived works" incl udes all progr ams that utilize the library . Credit must be gi ven in user- accessible documentation. This software is pro vided "AS IS." The copyrig ht holders disclaim all warr anties, eithe[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1044 Copyright (C) 1999, 2000, 2002 Aladdi n Enterprises. All right s reserved. This software is provided 'as-is', wi thou t an y express or implied warr anty . In no event will the aut hors be held liable for any damages arising from the use of this software. P ermiss[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1045 3. This notice may not b e removed or altered from an y source distribution. COPYRIGHT NOTICE, DISCLAIMER, and LICENSE: * * If you modify libpng you may insert additional notices immediatel y following * this sentence. * * libpng versions 1. 2.6, August 15, 2004, through 1.[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1046 * There is no w arranty against interference with y our enjoyment of the * libr ary or against infringeme nt. There is no w arranty that our * efforts or the libr ary will fulfill any of your parti cular purposes * or needs. This library is provided with all fa ults, and th[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1047 * Greg R oelofs * T om T anner * * libpng versions 0. 5, May 1995, through 0.88, January 1996, are * Copyright (c) 1995, 1996 Guy Eric Schalnat, Group 42, Inc. * * F or the purposes of this copyri ght and license, "Contributing Authors" * is defined as the followi[...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1048 * to the following restrictions: * * 1. The origin of this source code must not be misrepresented. * * 2. Altered ve rsions must be plainly marked as such and * must not be misrepresented as being the original source. * * 3. This Copy ri gh t n otice may not be re m oved or[...]

Appendix E Open Softwar e Announcements ZyWALL USG 1000 User’s Guide 1049 2. R edistributions in binary form must reproduce the above copyright notice, this list of conditions and the following d isclaimer in the documentation and/or other materials provided with the dis tribution. 3. Neither the name of the project nor th e names of its cont ri [...]

Appendix E Open Software Announcements ZyWALL USG 1000 U ser’s Guide 1050 P AR TICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUT ORS BE LIABLE FOR ANY DIRE CT , INDIRECT , INCIDENT AL, SPECIAL, EXEMPLARY , OR CONSEQUENTIAL DAMAGE S (INCLUDIN G, BUT NOT LIMITED TO , PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,[...]

ZyWALL USG 1000 User’s Guide 1051 A PPENDIX F Legal Information Copyright Copyright © 2010 by Z yXEL Communications Corpor ation. The contents of this publication ma y not be reproduced in any part or as a whole, transcrib ed, stored in a retriev al syst em, tr anslated into an y language , or transmitted in an y form or by any me ans, electroni[...]

Appendix F Legal Information ZyWALL USG 1000 U ser’s Guide 1052 • This device may not cause harmful interference. • This dev ice must acc e pt any interf eren ce received, including interference that may cause undesired operations. This device has been tested and found to comply with the limits for a Clas s B digital device pursuant to P art [...]

Appendix F Legal Information ZyWALL USG 1000 User’s Guide 1053 Notices Changes or modifications not expressly appro ved by the party responsible for compliance could v oid the user's authority to oper ate the equipment. This Class B digital appar atus complies wi th Canadian ICES-003. Cet appareil numérique de la classe B est conforme à la[...]

Appendix F Legal Information ZyWALL USG 1000 U ser’s Guide 1054 T o obtain the services of this w arr ant y , contac t your vend or . Y o u may also r efe r to the warrant y policy for the region in wh ich you bought the devic e at http:// www .zyxel.com/ web/support_warr anty_info.php . Registration Re gister your product online t o receive e-ma[...]

Index ZyWALL USG 1000 User’s Guide 1055 Index Symbols Numerics 1 to 1 NA T 102 1 to 1 SNA T 103 3322 Dynamic DNS 381 3DES 471 3G 122 3G see also cellular 299 A AAA Base DN 726 Bind DN 726 , 729 directory structure 725 Distinguished Name, see DN DN 726 , 727 , 729 , 730 password 729 port 728 , 731 search time limit 729 SSL 729 AAA server 723 AD 72[...]

Index ZyWALL USG 1000 U ser’s Guide 1056 and SNMP 827 and SSH 818 and T elnet 821 and VPN connections 444 and WWW 803 HOST 705 RANGE 706 SUBNET 706 types of 705 where used 11 4 address record 793 admin user troubleshooting 883 admin users 689 multiple logins 700 see also users 689 ADP 597 base profiles 598 , 60 1 configuration o v erv iew 112 fal[...]

Index ZyWALL USG 1000 User’s Guide 1057 real-time alert message 965 registration status 552 scanner types 561 signatures 558 statistics 250 trial service activation 268 troubleshooting 871 , 874 troubleshooting signatures update 870 updating signatures 272 virus 548 virus types 561 white list 554 , 558 Windows 98/Me requirements 965 worm 548 Apac[...]

Index ZyWALL USG 1000 U ser’s Guide 1058 truncated-options 615 truncated-timestamp-header 616 TTC P - d e te c t e d 615 types of 574 u-encoding 614 undersize-len 615 undersize-offset 615 UTF-8-encoding 614 virus 548 , 575 worm 575 Authenex Strong Authentication System (ASAS ) 724 authentication in IPSec 450 LDAP/AD 725 server 723 authentication [...]

Index ZyWALL USG 1000 User’s Guide 1059 bridge interfaces 278 , 319 and virtual interfaces of members 319 basic characteristics 279 effect on routing table 319 member interfaces 319 virtual 329 bridges 318 broadcast storm troubleshooting 882 buffer overflow 575 buffer overflow attacks 57 5 C CA and certificates 740 CA (Certificate Authority), see[...]

Index ZyWALL USG 1000 U ser’s Guide 1060 computer names 289 , 315 , 325 , 334 , 520 computer virus 548 infection and prevention 561 see also virus concurrent e-mail sessions 259 , 652 configuration information 859 object-based 95 overview 103 web-based SSL application example 766 configuration file troubleshooting 885 configuration files 847 at r[...]

Index ZyWALL USG 1000 User’s Guide 1061 D dashboard 53 , 55 , 209 Data Encryption Standard, see DES Data T erminal Ready , see DTR date 785 daylight savings 786 DDNS 381 backup mail exchanger 386 configuration o v erv iew 107 mail exchanger 386 prerequisites 107 service providers 381 status 236 troubleshooting 876 DDoS attacks 574 Dead Peer Detec[...]

Index ZyWALL USG 1000 U ser’s Guide 1062 file structure 725 directory trav ersal attack 613 directory trav ersals 613 disclaimer 5 , 1051 Distinguished Name (DN) 726 , 727 , 72 9 , 730 Distributed Denial of Service (DDoS) attacks 574 distributed port scans 610 DN 726 , 727 , 729 , 730 DNS 789 address records 793 domain name forwarders 794 domain [...]

Index ZyWALL USG 1000 User’s Guide 1063 basic characteristics 279 virtual 329 Ethernet ports 33 , 35 default settings 36 examples (tutorials) 11 9 exceptional services 418 experimental-options attack 615 extended authentication and VPN gateways 444 IKE SA 475 external interface 100 , 286 external modems 327 , 873 ext-group 142 ext-user troublesho[...]

Index ZyWALL USG 1000 U ser’s Guide 1064 FTP 821 additional signaling port 407 ALG 401 and address groups 823 and address objects 823 and certificates 822 and zones 823 signaling port 407 troubleshooting 877 with T ransport Layer Security (TLS) 822 full tunnel mode 47 , 482 , 488 Fully-Qualified Domain Name, see FQDN G gateway policy , see VPN ga[...]

Index ZyWALL USG 1000 User’s Guide 1065 action 573 , 608 alerts 572 and services 712 applying custom signatures 592 base profiles 564 , 56 8 configuration o v erv iew 112 custom signature example 590 custom signatures 581 false negatives 570 false positives 570 inline profile 570 log options 572 , 574 , 605 , 608 monitor profile 570 packet inspec[...]

Index ZyWALL USG 1000 U ser’s Guide 1066 and layer-3 virtualization 27 8 and NA T 391 and physical ports 96 , 278 and policy routes 355 and static routes 359 and VPN gateways 444 and VRRP groups 677 and zones 96 , 278 as DHCP relays 333 as DHCP servers 333 , 784 auxiliary , see also auxiliary interface. backup, see trunks bandwidth management 332[...]

Index ZyWALL USG 1000 User’s Guide 1067 Perfect F orward Secrecy 45 0 PFS 450 phase 2 settings 449 policy enf orcement 449 remote access 448 remote IPSec router 441 remote network 441 remote policy 449 replay detection 448 SA life time 449 SA moni tor 245 SA see also IPSec SA 476 see also VPN site-to-site with dynamic peer 448 static site-to-site[...]

Index ZyWALL USG 1000 U ser’s Guide 1068 remote user configuration 175 session monitor 249 troubleshooting 879 where used 111 WINS 520 LAN interface 33 IP address 33 LAND attack 612 lastgood.conf 850 , 854 Layer 2 T unneling Protocol Virtual Private Network, see L2TP VPN 517 LDAP 723 and users 690 Base DN 726 Bind DN 726 , 729 directory 723 direc[...]

Index ZyWALL USG 1000 User’s Guide 1069 main routing table 102 main window 60 maintenance menu 60 malware 629 managed web pages 627 management access troubleshooting 884 management access and device HA 668 Management Information Base (MIB) 824 , 825 managing bandwidth 523 manual key IPSec 448 Many 1 to 1 NA T 102 mapping ports 33 MD5 471 memory u[...]

Index ZyWALL USG 1000 U ser’s Guide 1070 NetBIOS Broad c ast over IP Sec 448 Name Server , see NBNS . NetBIOS Name Server , see N BNS NetMeeting 408 see also H.323 Netscape Navigator 51 network access mode 46 full tunnel 47 , 482 reverse proxy 46 , 481 Network Address T ranslation, see NA T network list, see SSL 488 network policy , see VPN conne[...]

Index ZyWALL USG 1000 User’s Guide 1071 offset attack 615 request-uri-directory attack 614 P P1 33 P1~P8 LEDs 40 P2P (Peer-to-peer) 574 attacks 574 see also Peer-to-peer packet flow 100 inspection signatures 567 , 571 scan 548 , 965 statistics 224 statistics graph 226 packet capture 860 example 863 files 862 troubleshooting 886 packet captures do[...]

Index ZyWALL USG 1000 U ser’s Guide 1072 port sweep 610 port translation, see NA T port triggering 360 and firewall 356 , 876 and policy routes 356 and service groups 356 and services 356 troubleshooting 876 ports 33 Po st Office Protocol, see POP 650 power module 892 changing 887 connecting 889 disconnecting 887 power off 42 , 867 power on 42 PP[...]

Index ZyWALL USG 1000 User’s Guide 1073 regular expressions 247 reject (IDP) both 573 , 608 receiver 573 , 608 sender 573 , 608 related documentation 3 Relativ e Distinguished Name (RDN) 726 , 727 , 729 , 730 remote access IPSec 448 R emote Authentication Dial- In User Service, see RADIUS remote desktop connections 766 R emote Desktop Protocol se[...]

Index ZyWALL USG 1000 U ser’s Guide 1074 SCEP (Simple Certificate Enrollment Protocol) 747 schedule troubleshooting 883 schedules 717 and content filtering 617 , 61 8 and current date/time 717 and firewall 421 , 436 , 538 , 541 , 544 and policy routes 354 , 535 , 538 , 541 , 544 one-time 717 recurring 717 types of 717 where used 11 4 screen resol[...]

Index ZyWALL USG 1000 User’s Guide 1075 and firewall 403 and R TP 408 media inactivity timeout 406 signaling inactivity timeout 406 signaling port 406 troubleshooting 876 site map 61 SMTP 650 smurf attack 61 1 SNA T 103 , 359 default 103 , 343 troubleshooting 876 SNMP 823 , 824 agents 824 and address groups 827 and address objects 827 and zones 8[...]

Index ZyWALL USG 1000 U ser’s Guide 1076 access policy 482 configuration o v erv iew 110 full tunnel mode 47 , 482 network access mode 46 prerequisites 11 0 remote desktop connections 766 reverse proxy mode 46 , 481 see also SSL 481 troubleshooting 880 weblink 766 where used 111 stac compression 764 starting the Z yWALL 41 , 42 startup-config.con[...]

Index ZyWALL USG 1000 User’s Guide 1077 port numbers 712 portscan 609 portsweep 610 RST 610 SYN (synchronize) 61 1 SYN flood 61 1 window size 588 technical reference 207 Te l n e t 819 and address groups 821 and address objects 821 and zones 821 with SSH 818 terminology differences bandwidth management 99 NA T 99 with other products 99 with Zy NO[...]

Index ZyWALL USG 1000 U ser’s Guide 1078 PPP 872 PWR 869 RADIUS server 882 routing 876 schedules 883 security settings 871 shell scripts 885 SIP 876 SNA T 876 SSL 880 SSL V PN 880 throughput rate 885 VLAN 873 VPN 879 VPN concentrator 879 zipped files 874 truncated-address-header attack 615 truncated-header attack 615 , 616 truncated-options attac[...]

Index ZyWALL USG 1000 User’s Guide 1079 user portal links 765 logo 490 see SSL user screens 493 , 499 user sessions, see sessions user SSL screens 493 , 499 access methods 493 bookmarks 500 certificates 494 login 494 logout 500 required information 494 system requirements 494 User’s Guide 31 user-aw are 133 users 689 access, see also access use[...]

Index ZyWALL USG 1000 U ser’s Guide 1080 see also ALG 402 VPN 441 active protocol 476 and NA T 474 and the firewall 425 basic troubleshooting 877 hub-and-spoke, see VPN concentrator IKE SA, see IKE SA IPSec 441 IPSec SA proposal 471 security associations (SA) 442 see also IKE SA see also IPSec 441 see also IPSec SA see also L2TP VPN 441 status 21[...]

Index ZyWALL USG 1000 User’s Guide 1081 and authentication method objects 802 and certificates 801 and zones 803 see also HTTP , HT TPS 148 , 79 9 Z zipped files troubleshooting 874 zones 96 , 377 and firewall 424 , 434 and FTP 823 and interfaces 96 , 377 and SNMP 827 and SSH 818 and T elnet 821 and VPN 96 , 377 and WWW 803 block intra- zone traf[...]