ZyXEL Communications 802.11g ADSL 2+ 4-Port Security Gateway HW-D Series manuel d'utilisation

P-662H/HW -D Series 802.1 1g ADSL 2+ 4-Port Security Gateway User ’ s Guide V ersion 3.40 Edition 1 7/2006[...]

[...]

P-662H/HW-D Series User ’s Guide Copyright 3 Copyright Copyright © 2006 by ZyXEL Communications Corpo ration. The contents of this publication may not be reprod uced in any part or as a wh ole, transcribed, stored in a retrieval system, tran slated into any language, or transmitted in any form or by any means, el ectronic, mech anical , magnetic[...]

P-662H/HW-D Series User’s Guide 4 Certifications Certifications Federal Communications Commissi on (FCC) Interference St atement This device complies with Part 15 of FCC rul es. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference rece ived, includin[...]

P-662H/HW-D Series User ’s Guide Certifications 5 ZyXEL Communications Corp ora tion declared that P-662H/HW -D is limited in CH1~1 1 from 2400 to 2483.5 MHz by specified firmware cont rolled in USA. Viewing Certifications 1 Go to www .zyxel.com 2 Select your product from t he drop-down list box on the Zy XEL home page to go to that product'[...]

P-662H/HW-D Series User’s Guide 6 Safety Warnings Safety W arnings For your safety , be sure to read and fo llow all warning notices and instructions. • T o reduce the risk of fire, use only No. 26 A WG (American W ire Ga uge) or lar ger telecommunication line cord. • Do NOT open the device or un it. Opening or removing covers can expose you [...]

P-662H/HW-D Series User ’s Guide ZyXEL Limited Warranty 7 ZyXEL Limited W arranty ZyXEL warrants to the original en d user (purchaser) that this product is free from any defects in materials or workmansh ip for a period of up to two years from the date of purchase. During the warranty period, and upon proof of purchase, should the product have in[...]

P-662H/HW-D Series User’s Guide 8 Customer Suppo rt Customer Support Please have the following information r eady when you contact customer support. • Product model and serial number . • W arranty Information. • Date that you received your de vice. • Brief description of the problem and the steps yo u took to solve i t. METHOD LOCATION SU[...]

P-662H/HW-D Series User ’s Guide Customer Support 9 +” is the (prefix) number you enter to make an interna tional telephone call. NORWAY support@zyxel.no +47-22-80-61-80 www .zyxel.no ZyXEL Communications A/S Nils Hansens vei 13 0667 Oslo Norway sales@zyxel.no +47-22-80-61-81 POLAND info@pl.zyxel.com +48 (22) 333 8250 www .pl.zyxel.com ZyXEL Co[...]

P-662H/HW-D Series User’s Guide 10 Customer Suppo rt[...]

P-662H/HW-D Series User ’s Guide Table of Contents 11 T able of Content s Copyright .................................................. .......................................... ...................... 3 Certifications ............................................ .......................................... ...................... 4 Safety W arnings [...]

P-662H/HW-D Series User’s Guide 12 Table of Contents 2.4.6 S tatus: VPN S tatus ........................... ................... .................... .................. 59 2.4.7 S tatus: Packet S tatistics .............. ................... ................... .................... .....60 2.4.8 Changing Login Password ........... ... .............[...]

P-662H/HW-D Series User ’s Guide Table of Contents 13 5.3.1.2 V ariable Bit Rate (VBR) .... ................... ................... ....................... ..89 5.3.1.3 Unspecif ied Bit Rate (UBR) ....... ....................... ................... ............ 90 5.4 Zero Configuration Internet Access .............. .................... ........[...]

P-662H/HW-D Series User’s Guide 14 Table of Contents 7.3 Wireless Performance Overview ............... ....................... ................... .............126 7.3.1 Quality of Service (QoS) ........ .................... ...................... .................... ...126 7.4 Additional Wireles s T erms ............... ....................... [...]

P-662H/HW-D Series User ’s Guide Table of Contents 15 9.3 NA T General Setup .................. ....................... ................... ................... ..........160 9.4 Port Forwarding ............... .................... ................... ................... .................... ...161 9.4.1 Default Server IP Address .. ..............[...]

P-662H/HW-D Series User’s Guide 16 Table of Contents 1 1.3 Rule Logic O verview ............... ................... ....................... ................... ..........182 1 1.3.1 Rule Checklist ...................... ....................... ................... .................... ...182 1 1.3.2 Security Ramificati ons ................ .......[...]

P-662H/HW-D Series User ’s Guide Table of Contents 17 13.4 Configuring T rusted Computers ....... ............. ................... ................... ..........213 Chapter 14 Content Access Control .......................... .......................................... .................. 215 14.1 Content Access Control O verview .................[...]

P-662H/HW-D Series User’s Guide 18 Table of Contents 16.2.2 ESP (Encapsulating Security Payl oad) Protoc ol ..... ................... ..........239 16.3 My IP Address .................. .................... ................... ....................... ................ 240 16.4 Secure Gateway Address .... ................... ................... ...[...]

P-662H/HW-D Series User ’s Guide Table of Contents 19 17.12.1 T rusted Remote Host Certificate Fingerprints .............. ....................... 282 17.13 T rusted Remote Hosts Import ....... ......... .................... ................... ............. 283 17.14 T rusted Remote Host Certificate Deta ils .......................... ..........[...]

P-662H/HW-D Series User’s Guide 20 Table of Contents 21.1.2 Remote Management and NA T ..... ....................... ...................... ..........310 21.1.3 System Timeout ......... ................... ................... ....................... ............. 310 21.2 WWW ............... .................... ...................... ...........[...]

P-662H/HW-D Series User ’s Guide Table of Contents 21 Chapter 25 T ools ..... .......................................... ..................................................... .................. 345 25.1 Firmware Upgrade .... ................... .................... ................... ................ ..........345 25.2 Configuration Screen . ...[...]

P-662H/HW-D Series User’s Guide 22 Table of Contents Macintosh OS X ..................... .................... ................... ................... ...................... 383 Linux .................... ................... .................... ................... ....................... .................. 38 4 Appendix E IP Addresses and Subnet[...]

P-662H/HW-D Series User ’s Guide Table of Contents 23 Appendix J Boot Commands ........................... ........................................... ............................ 425 Appendix K Firewall Commands ...................................................... ....................................... 427 Appendix L NetBIOS Filter Commands .[...]

P-662H/HW-D Series User’s Guide 24 Table of Contents[...]

P-662H/HW-D Series User ’s Guide List of Figure s 25 List of Figures Figure 1 ZyXEL Device Internet Access Applic ation ....... ....................... ................... .......... 46 Figure 2 ZyXEL Device LAN-t o-LAN Applicati on Example .... ...................... ....................... 46 Figure 3 Firewall Application ......................[...]

P-662H/HW-D Series User’s Guide 26 List of Figures Figure 39 Bandwidth Management Wizard: G eneral Information .................... ................... 81 Figure 40 Bandwidth Management Wizard: Conf iguration .. ................... ...................... ....... 82 Figure 41 Bandwidth Management Wizard: Comp lete ........ ................... ....[...]

P-662H/HW-D Series User ’s Guide List of Figure s 27 Figure 82 How NA T Works ........ ................... ....................... ................... ................... .......... 158 Figure 83 NA T Application With IP Alias ...... ... .................... ................... ................... .......... 159 Figure 84 NA T General ...........[...]

P-662H/HW-D Series User’s Guide 28 List of Figures Figure 125 Encryption and Decryption ............ ............. ................... .................... ................ 234 Figure 126 IPSec Architecture ........ ................... .................... ................... ................... ....... 235 Figure 127 T ransport and T un nel Mode[...]

P-662H/HW-D Series User ’s Guide List of Figure s 29 Figure 168 SNMP Management Model ........ ...... .......... ................... .................... ................ 314 Figure 169 Remote Management: SNMP .......... .......... ................... .................... ................ 316 Figure 170 Remote Management: DNS .......... .........[...]

P-662H/HW-D Series User’s Guide 30 List of Figures Figure 21 1 Java (Sun) ........ ....... ................... ................... .................... ................... ............. 361 Figure 212 Internet Options Security ........... ............. ................... .................... ................... 362 Figure 213 Security Setting Ac[...]

P-662H/HW-D Series User ’s Guide List of Figure s 31 Figure 254 Personal Certificate Import Wizard 3 ...................... ................... .................... ... 416 Figure 255 Personal Certificate Import Wizard 4 ...................... ................... .................... ... 416 Figure 256 Personal Certificate Import Wizard 5 .......[...]

P-662H/HW-D Series User’s Guide 32 List of Figures[...]

P-662H/HW-D Series User ’s Guide List of Tables 33 List of T ables T able 1 ADSL S tandards .......................... ................... ................... ....................... ............. 42 T able 2 Front Panel LED s . ................... ....................... ................... ....................... ............. 47 T able 3 Web C[...]

P-662H/HW-D Series User’s Guide 34 List of Tables T able 39 Wireless: S tatic WEP Encryption ........ ....................... ................... ....................... 130 T able 40 Wireless: WP A(2)-PSK .............. ................................................................ .......... 131 T able 41 Wireless: WP A(2) ............... ...[...]

P-662H/HW-D Series User ’s Guide List of Tables 35 T able 82 Content Access Control: General: Web Site Filter . ...................... .................... ... 222 T able 83 Content Access Control: General: Diagno se ................... .................... ................ 227 T able 84 Content Access Control: User Profiles .....................[...]

P-662H/HW-D Series User’s Guide 36 List of Tables T able 125 Remote Management: WWW ........... ....................... ....................... ................... 31 1 T able 126 Remote Management: T elnet ............................... ................... ....................... ... 312 T able 127 Remote Management: FTP .............. ........[...]

P-662H/HW-D Series User ’s Guide List of Tables 37 T able 168 Net BIOS Filter Default Settings ............... ................... ....................... ................ 434 T able 169 Abbreviations Used in the Example In ternal SPTGEN Screens T able ........... ... 439 T able 170 Menu 1 General Setup (SMT Menu 1) .... ................... .....[...]

P-662H/HW-D Series User’s Guide 38 List of Tables[...]

P-662H/HW-D Series User ’s Guide Preface 39 Preface Congratulations on your p urchase of the P-662H/HW -D series 802.1 1g W ireless ADSL 2+ 4- port Gateway . P-662H-D has a 4-port switch that allows you t o connect up to 4 computers to the ZyXEL Device without purchasing a switc h/hub. P-662HW -D comes with built-in IEEE 802.1 1 g wireless capabi[...]

P-662H/HW-D Series User’s Guide 40 Preface User Guide Feedback Help us help you. E-mail all User Guide-related comments, questions or suggestions for improvement to techwriters@zyxel.com.tw or send regular mail to The T echnical Writi ng T eam, ZyXEL Communications Corp., 6 Inno vatio n Road II, Science-Based Industrial Park, Hsinchu, 300, T aiwa[...]

P-662H/HW-D Series User ’s Guide Chapter 1 Getting To Know Your ZyXEL Device 41 C HAPTER 1 Getting T o Know Y our ZyXEL Device This chapter describes the key features and applications of your ZyXEL Device . 1.1 Introducing the ZyXEL Device Y our ZyXEL Device integrates high-speed 10 /100Mbps auto-negotiating LAN interface(s ) and a high-speed ADS[...]

P-662H/HW-D Series User’s Guide 42 Chapter 1 Getting To Kn ow Your ZyXEL Device High Speed Internet Access The ZyXEL Device is an ADSL router co mpatible with th e ADSL/ADSL2/ADSL2+ standards. Maximum data rates attainable for each standard are shown in the next table. Note: If your ZyXEL Device does not support Annex M, t he maximum ADSL2/2+ ups[...]

P-662H/HW-D Series User ’s Guide Chapter 1 Getting To Know Your ZyXEL Device 43 LAN/DMZ Interface The ZyXEL Device provides a LAN port that can function as a virtual DeMilitarized Zone (DMZ) port. Public servers (W eb, FTP , etc.) a ttached to the DMZ port are visible to the outside world (while still being protected from DoS (Denial of Service) [...]

P-662H/HW-D Series User’s Guide 44 Chapter 1 Getting To Kn ow Your ZyXEL Device Dynamic DNS Support W ith Dynamic DNS support, you can have a sta tic hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. Y ou must register for this service with a Dynamic DNS service provide[...]

P-662H/HW-D Series User ’s Guide Chapter 1 Getting To Know Your ZyXEL Device 45 1.1.1.1 P-662HW Wireless Features Wireless LAN The ZyXEL Device supports the IEEE 802.1 1g st andard, which is fully compatible with the IEEE 802.1 1b standard, meanin g that you can have both IEEE 802.1 1b and IEEE 802.11 g wireless clients in the same wireless netwo[...]

P-662H/HW-D Series User’s Guide 46 Chapter 1 Getting To Kn ow Your ZyXEL Device 1.1.2.1 Internet Access The ZyXEL Device is the ideal high-speed Internet access solution. Y our ZyXEL Device supports the TCP/IP protocol, which the Internet uses exclusively . It is compatible with all major ADSL DSLAM (Digital Subscriber Line Access Multiplexer) pr[...]

P-662H/HW-D Series User ’s Guide Chapter 1 Getting To Know Your ZyXEL Device 47 Figure 3 Firewall Application 1.1.4 Front Panel LEDs Figure 4 P-662H Front Pan el Figure 5 P-662HW Front Panel The following table describes the Lights. Table 2 Front Panel LEDs LED COLOR ST ATUS DESCRIPTION PWR/SYS Green On The ZyXEL Device is receiving p ower and fu[...]

P-662H/HW-D Series User’s Guide 48 Chapter 1 Getting To Kn ow Your ZyXEL Device Refer to the Quick S tart Guide for in formation on hard ware connections. WLAN (P- 662HW only) Green On The Zy XEL Device is ready , but is not sending/recei ving data through the wireless LAN. Blinking The ZyXEL Device is sending/receiving data through the wireless [...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 49 C HAPTER 2 Introducing the W eb Configurator This chapter describes how to access and navigate the web configurator . 2.1 W eb Configurator Overview The web configurator is an HTML-based mana gement interface that allows easy ZyXEL Device setup and management via Inte[...]

P-662H/HW-D Series User’s Guide 50 Chapter 2 Introducing the Web Configurator only . Click Login to proceed to a screen asking you to change your password or click Cancel to revert to the default password. Figure 6 Password Screen 6 If you entered the user password, skip the next two steps and refer to Section 2.4.2 on page 55 for more informatio[...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 51 Note: If you do not replace th e certificate, the following screen appears every time you log in. Figure 8 Replace Factory Default Certificate 8 Select Go to Wizard setup and click Apply to display the wizard main screen. Otherwise, select Go to Advanced setup and cli[...]

P-662H/HW-D Series User’s Guide 52 Chapter 2 Introducing the Web Configurator 2.3.1 Using the Reset Button 1 Make sure the POWER LED is on (not blinking). 2 Press the RESET button for 10 seconds or until the POWER LED begins to blink an d then release it. When the POWER LED begins to blink, the defaults have been restored and the ZyXEL Device res[...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 53 Note: Click the icon (located in the top right corner of most screens) to view embedded help. T able 3 Web Con figurator Screen s Summary LINK/ICON SUB-LINK FUNCTION Wizard INTERNET/ WIRELESS SETUP Use these screens for initial co nfiguration inclu ding general setup,[...]

P-662H/HW-D Series User’s Guide 54 Chapter 2 Introducing the Web Configurator Threshold Use this scre en to configure the th reshold for DoS attacks. Anti Virus Packet Scan Use this screen to change your Packet Scan settings. Registration Use this screen to register , activate or update your anti-virus services. Content Filter Keyword Use this sc[...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 55 2.4.2 St atus Screen The following summarizes how to navigate the web configurator from the St a t u s screen. Some fields or links are not available if yo u entered the user password in the login password screen (see Figure 6 on page 50 ). Remote MGMT WWW Use this sc[...]

P-662H/HW-D Series User’s Guide 56 Chapter 2 Introducing the Web Configurator Figure 1 1 S tatus Screen The following table describes the labels shown in the St a t u s scre en. Table 4 Status Screen LABEL DESCRIPTION Refresh Interval Select a number of seconds or None from the drop-down list box to refresh all screen statistics automatically at [...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 57 VPI/VCI This is the Virtual Path Identifier and Vi rtual Channel Identifier that you entered in the Wizard or WA N screen. LAN Informatio n IP Address This is the LAN port IP address. IP Subnet Mask This is the LAN port IP subnet mask. DHCP This is the W AN port DHCP [...]

P-662H/HW-D Series User’s Guide 58 Chapter 2 Introducing the Web Configurator 2.4.3 St atus: Any IP T able Click the Any IP T able hyperlink in the St a t u s scree n. The Any IP table shows current read- only information (including the IP address and the MAC address) of all network devices that use the Any IP feature to communicate with the ZyXE[...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 59 Figure 13 S tatus: WLAN S tatus The following table describes the labels in this screen. 2.4.5 St atus: Bandwid th S t atus Select the Bandwidth S tatus hyperlink in the St a t u s scre en. V iew the bandwidth usage of the LAN, W AN and WLAN co nfigured bandwidth rul [...]

P-662H/HW-D Series User’s Guide 60 Chapter 2 Introducing the Web Configurator Figure 15 S tatus: VPN S tatus The following table describes the labels in this screen. 2.4.7 St atus: Packet St atistics Click the Packet S tatistics hyperlink in the St a t u s screen. Read-only information here includes port status and packet specific statisti cs. Al[...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 61 Figure 16 S tatus: Packet S tati stics The following table describes th e fields in this screen. Table 8 S tatus: Pack et S tatistics LABEL DESCRIPTION System Monitor System up T ime This is the elapsed time the system has been up. Current Date/T ime This field displa[...]

P-662H/HW-D Series User’s Guide 62 Chapter 2 Introducing the Web Configurator 2.4.8 Changing Login Password It is highly recommended that you periodic ally change the password for accessing the ZyXEL Device. If you didn’t change the default o ne after you logged in or you want to chang e to a new password again, then click Maintenance > Syst[...]

P-662H/HW-D Series User ’s Guide Chapter 2 Introducing the Web Configur ator 63 The following table describes th e fields in this screen. T able 9 System General: Password LABEL DESCRIPTION Old Password T ype the default password or the existing password you us e to access the system in this field. New Password T ype the new password in this fiel[...]

P-662H/HW-D Series User’s Guide 64 Chapter 2 Introducing the Web Configurator[...]

P-662H/HW-D Series User ’s Guide Chapter 3 Wizard Setup for Internet Acces s 65 C HAPTER 3 W izard Setup for Internet Access This chapter provides informatio n on the W izard Setup screens for Internet access in the web configurator . 3.1 Introduction Use the W izard Setup screens to configure your system for Internet access with the information [...]

P-662H/HW-D Series User’s Guide 66 Chapter 3 Wiz ard Setup for In ternet Access Figure 19 Wizard: Welcome 3 The wizard attempts to detect whic h W AN connection type you are using. If the wizard detects your connection type and your ISP uses PPPo E or PPPoA, go to Section 3.2.1 on page 67 . The screen varies depending on t he connection type you [...]

P-662H/HW-D Series User ’s Guide Chapter 3 Wizard Setup for Internet Acces s 67 Figure 21 Auto Detection: Failed 3.2.1 Automatic Detection 1 If you have a PPPoE or PPPoA connection, a scr een displays prompting you to enter your Internet account information. Enter the us ername, password and/or service name exactly as provided. 2 Click Next and s[...]

P-662H/HW-D Series User’s Guide 68 Chapter 3 Wiz ard Setup for In ternet Access Figure 23 Internet Access Wizard Setup: ISP Parameters The following table describes the fields in this screen. T able 10 Internet Access W izard Setup: ISP Parameters LABEL DESCRIPTION Mode From the Mode drop-down list box, select Routing (default) if your ISP a llow[...]

P-662H/HW-D Series User ’s Guide Chapter 3 Wizard Setup for Internet Acces s 69 2 The next wizard screen varies depending on wh at mode and encapsulatio n type you use. All screens shown are with routing mode. Configure the fields and click Next to continue. See Section 3.3 on page 7 2 for wireless connection wizard setup Figure 24 Internet Conne[...]

P-662H/HW-D Series User’s Guide 70 Chapter 3 Wiz ard Setup for In ternet Access The following table describes the fields in this screen. Figure 26 Internet Connection with ENET ENCAP The following table describes the fields in this screen. Table 12 Internet Conn ection with RFC 1483 LABEL DESCRIPTION IP Address This field is available if you sele[...]

P-662H/HW-D Series User ’s Guide Chapter 3 Wizard Setup for Internet Acces s 71 Figure 27 Internet Connection with PPPoA The following table describes the fields in this screen. • If the user name and/or password you ente red for PPPoE or PPPoA connection are not correct, the screen displays as shown next. Click Back to Username and Password se[...]

P-662H/HW-D Series User’s Guide 72 Chapter 3 Wiz ard Setup for In ternet Access Figure 28 Connection T est Failed-1 • If the following screen displays, check if your account is activated or click Restart the Internet/Wir eless Setup Wizard to verify your In ternet access settings. Figure 29 Connection T est Failed-2. 3.3 Wireless Connection Wiz[...]

P-662H/HW-D Series User ’s Guide Chapter 3 Wizard Setup for Internet Acces s 73 Figure 30 Connection T est Success ful 2 Use this screen to activate the wireless LAN and OTIST . Click Next to continue. Figure 31 Wireless LAN Setup Wizard 1[...]

P-662H/HW-D Series User’s Guide 74 Chapter 3 Wiz ard Setup for In ternet Access The following table describes the labels in this screen. 3 Configure your wireless settin gs in this screen. Click Next . Figure 32 Wireless LAN Setup Wizard 2 T able 15 Wireless LAN Setup Wizard 1 LABEL DESCRIPTION Active Select the check box to turn o n the wireless[...]

P-662H/HW-D Series User ’s Guide Chapter 3 Wizard Setup for Internet Acces s 75 The following table describes the labels in this screen. Note: The wireless stations and ZyXEL Device must use the sa me SSID, channel ID and WEP encryption key (if WEP is enabled), WP A-PSK (if WP A-PSK is enabled) for wireless communicatio n. 4 This screen varies de[...]

P-662H/HW-D Series User’s Guide 76 Chapter 3 Wiz ard Setup for In ternet Access Figure 33 Manually assign a WP A key The following table describes the labels in this screen. 3.3.3 Manually assign a WEP key Choose Manually assign a WEP key to setup WEP Encryption parameters. Figure 34 Manually assign a WEP key T able 17 Manually assign a WP A key [...]

P-662H/HW-D Series User ’s Guide Chapter 3 Wizard Setup for Internet Acces s 77 The following table describes the labels in this screen. 5 Click Apply to save your wireless LAN settings. Figure 35 Wireless LAN Setup 3 6 Use the read-only summary table to check whet her what you have configured is correct. Click Finish to complete and save the wiz[...]

P-662H/HW-D Series User’s Guide 78 Chapter 3 Wiz ard Setup for In ternet Access Figure 36 Internet Access and WLAN Wizard Se tup Complete 7 Launch your web browser and navigate to www .zyxel.com. Internet access is just the beginning. Refer to the rest of this guide for more detailed inform ation on the complete range of ZyXEL Device features. If[...]

P-662H/HW-D Series User ’s Guide Chapter 4 Bandwidth Management Wiza rd 79 C HAPTER 4 Bandwid th Management Wizard This chapter shows you how to configure basic bandwidth management using th e wizard screens. 4.1 Introduction Bandwidth management allows y ou to control the amount of b andwidth going out through the ZyXEL Device’ s W AN port and[...]

P-662H/HW-D Series User’s Guide 80 Chapter 4 Bandwidth Man agement Wizard 4.3 Bandwid th Management Wizard Setup 1 After you enter the password to access the web configurator , select Go to Wizard setup and click Apply . Otherwise, click the wizard icon ( ) in the top right corner of the web configurator to display the wiza rd main screen. Figure[...]

P-662H/HW-D Series User ’s Guide Chapter 4 Bandwidth Management Wiza rd 81 Figure 38 Wizard: Welcome 3 Activate bandwidth management and select to allocate bandwidth to packets based on the services. Figure 39 Bandwidt h Management Wizard: General In formation The following fields describe the label in this screen. T able 20 Bandwidth Management [...]

P-662H/HW-D Series User’s Guide 82 Chapter 4 Bandwidth Man agement Wizard 4 Use the second wizard screen to select the se rvices that you want to apply bandwidth management and select the priorities that you want to apply to the services listed. Figure 40 Bandwidt h Management Wizard: Configuration The following table describes the labels in this[...]

P-662H/HW-D Series User ’s Guide Chapter 4 Bandwidth Management Wiza rd 83 5 Follow the on-screen instructions and click Finish to complete the wizard setup and save your configuratio n. Figure 41 Bandwid th Management Wizard: Comple te Apply Click Apply to save your changes back to the ZyXEL Device. Exit Click Exit to close the wizard screen wit[...]

P-662H/HW-D Series User’s Guide 84 Chapter 4 Bandwidth Man agement Wizard[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 85 C HAPTER 5 W AN Setup This chapter describes how to configure W AN settings. 5.1 W AN Overview A W AN (W ide Area Network) is an outside conn ection to another network or the Intern et. 5.1.1 Encap sulation Be sure to use the encapsulat ion method required by your ISP . The ZyXE L Device sup[...]

P-662H/HW-D Series User’s Guide 86 Chapter 5 WAN Setup By implementing PPPoE directly on the ZyXEL Device (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the ZyXEL Device does that part of the task. Furthermore, with NA T , all of the LANs’ computers will have access. 5.1.1.3 PPPoA PPPoA [...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 87 5.1.4 IP Address Assignment A static IP is a fixed IP that your ISP gives you. A dynamic IP is not fixed; the ISP assigns you a different one each time. The Si ngle User Account feature can be enabled or disabled if you have either a dynamic or static IP . Howeve r the encapsulation method a[...]

P-662H/HW-D Series User’s Guide 88 Chapter 5 WAN Setup 5.2 Metric The metric represents the "cost of transmissi on". A router determines the best route for transmission by choosing a path with the lowest "cost". RI P routing u ses hop count as the measurement of cost, with a minimum of "1" for directly connected netw[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 89 Maximum Burst Size (MBS) is the maximum numb er of cells that can be sent at the PCR. After MBS is reached, cell rates fall below SCR until cell rate averages to the SCR again. At this time, more cells (up to the MBS) can be sent at the PCR again. If the PCR, SCR or MBS is set to the default[...]

P-662H/HW-D Series User’s Guide 90 Chapter 5 WAN Setup The VBR-nR T (non real-time V ariable Bit Rate) ty pe is used with bursty connections that do not require closely controlled delay and delay variation. It is commonly used for " bursty" traffic typical on LANs. PCR and MBS define the burst levels, SCR defines the minimum level. An e[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 91 Figure 43 Internet Conne ction (PPPoE) The following table describes the labels in this screen. Table 22 Internet Connection LABEL DESCRIPTION General Name Enter the name of your Internet Service Provider , e.g., MyISP . This information is for identification purpose s only . Mode Select Rou[...]

P-662H/HW-D Series User’s Guide 92 Chapter 5 WAN Setup 5.5.1 Configuring Advance d Internet Connection T o edit your ZyXEL Device's ad vanced W AN settings, click the Advanced Setup button in the Internet Connection screen. The screen appears as shown. Virtual Circuit ID VPI (Virtual Path Iden tifier) an d VCI (Virtual Channel Id entifier) d[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 93 Figure 44 Advanced Internet Connection The following table describes the labels in this screen. Table 23 Advanced Inte rnet Connection LABEL DESCRIPTION RIP & Multicast Setup RIP Direction R IP (Routing Information Protocol , RFC 1058 and RFC 1389) allows a router to exchange ro uting in[...]

P-662H/HW-D Series User’s Guide 94 Chapter 5 WAN Setup 5.6 Configuring More Connections This section describes the protocol-independent parameters for a remote network. They are required for placing calls to a remote gate way and the network behind it across a W AN connection. When you use the W AN > Internet Connection screen to set up Intern[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 95 Figure 45 More Connections The following table describes the labels in this screen. 5.6.1 More Connections Edit Click the edit icon in the More Con nections screen to configure a connection . Table 24 More Connections LABEL DESCRIPTION # This is the index number of a connection. Active This [...]

P-662H/HW-D Series User’s Guide 96 Chapter 5 WAN Setup Figure 46 More Connections Edit The following table describes the labels in this screen. Table 25 More Connections Edit LABEL DESCRIPTION Active Select the check box to activate or clear the check box to deactivate this connection. Name Enter a unique, descriptive name of up to 13 ASCII chara[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 97 Multiplexing Select the method of multiple xing used by your ISP from the drop-down list. Choices are VC or LLC . By prior agreement, a protocol is assigned a specific vi rtual circuit , for example, VC1 will carry IP . If you select VC, specify separate VPI and VCI numbers for each prot oco[...]

P-662H/HW-D Series User’s Guide 98 Chapter 5 WAN Setup 5.6.2 Configuring More Connections Advanced Setup T o edit your ZyXEL Device's ad vanced W AN settings, click the Advanced Setup button in the Mor e Connections Edit screen. The screen appears as shown. Figure 47 More Connections Advanced Setup The following table describes the labels in[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 99 5.7 T raffic Redirect T raffic redirect forwards traffic to a backup gateway when the ZyXEL Device cannot connect to the Internet. An example is shown in the figure below . Figure 48 T raffic Redirect Example The following network topology allows you to avoid triangle route security issues w[...]

P-662H/HW-D Series User’s Guide 100 Chapter 5 WAN Setup Figure 49 T raf fic Redirect LAN Setup 5.8 Configuring W AN Backup T o chang e your ZyXEL Device’ s W AN bac kup settings, click WA N > W AN Backup Setup . The screen appears as shown.[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 101 Figure 50 W A N Backup Setup The following table describes the labels in this screen. Table 27 W AN Backup Setup LABEL DESCRIPTION Backup T ype Select the method that the ZyXEL Device uses to check the DSL connection. Select DSL Li nk to have the ZyXEL Device check if the connection to the [...]

P-662H/HW-D Series User’s Guide 102 Chapter 5 WAN Setup 5.9 W AN Backup Advanced Screen T o change yo ur ZyXEL Device’ s W AN backu p advanced settings, click WA N > W AN Backup Setup > Advanced Setup . The screen appears as shown. T imeout T ype the number of seconds (3 recommended) for your ZyXEL Device to wait for a ping response from [...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 103 Figure 51 W A N Backup Advanced Setup The following table describes the labels in this screen. Table 28 W AN Backup Advanced Setup LABEL DESCRIPTION Authentication Ty p e Use the drop-down list box to select an auth entication protocol for outgoin g calls. Options are: CHAP/P AP - Y our ZyX[...]

P-662H/HW-D Series User’s Guide 104 Chapter 5 WAN Setup Advanced Modem Setup Click the Edit button to display the Advanced Modem Setup screen and edit the details of your dial backup setup. TCP/IP Options Metric This field sets t his route's priority among the three ro utes the ZyXEL Device uses (normal, traffic redirect and dial backup). T [...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 105 5.10 Dial Backup Modem Setup Click Edit in the WA N > W AN Backup Setup > Advanced Setup screen to configure the advanced modem settings. Connect on Demand Select Connect on Demand when you don't want the connection up all the time and specify an idle time -out in the Max Idle Ti[...]

P-662H/HW-D Series User’s Guide 106 Chapter 5 WAN Setup Figure 52 W A N Dial Backup Modem Setup The following table describes the labels in this screen. Table 29 W AN Dial Backup Modem Setup LABEL DESCRIPTION A T Command St r i n g s Dial T y pe the A T Command string to make a call. Example: atdt Drop T ype the A T Command string to drop a call.[...]

P-662H/HW-D Series User ’s Guide Chapter 5 WAN Setup 107 Retry Interval T ype a number of seconds for the ZyXEL Device to wait before trying another call after a call has failed. This applies before a phon e number is blacklisted. Example: 10 Drop Timeout T ype the number of seconds for the ZyXEL Device to wait before dropping the DTR signal if i[...]

P-662H/HW-D Series User’s Guide 108 Chapter 5 WAN Setup[...]

P-662H/HW-D Series User ’s Guide Chapter 6 LAN Setup 109 C HAPTER 6 LAN Setup This chapter describes how to configure LAN settings. 6.1 LAN Overview A Local Area Network (LAN) is a shared comm unication system to which many computers are attached. A LAN is a computer network lim ited to the immediate area, usually the same building or floor of a [...]

P-662H/HW-D Series User’s Guide 110 Chapter 6 LAN Se tup 6.1.2 DHCP Setup DHCP (Dynamic Host Configuration Protocol , RFC 2131 and RFC 2132) allows indiv idual clients to obtain TCP/IP configuration at start-up from a server . Y ou can configure the ZyXEL Device as a DHCP server or disable it. When configured as a server , the ZyXEL Device provid[...]

P-662H/HW-D Series User ’s Guide Chapter 6 LAN Setup 111 6.1.4 DNS Server Address Assignment Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because wit hout it, you must k now the IP address of a computer before you can access it. There are two ways that an I[...]

P-662H/HW-D Series User’s Guide 112 Chapter 6 LAN Se tup 6.2.1.1 Private IP Addresses Every machine on the Internet must ha ve a unique address. If your network s are isolated from the Internet, for example, only between your two branch of fices, you can assign any IP addresses to the hosts without problems. However , the Internet Assigned Number[...]

P-662H/HW-D Series User ’s Guide Chapter 6 LAN Setup 113 6.2.3 Multicast T raditionally , IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of host s on the networ k - not everybody and not just 1. IGMP (Internet Grou[...]

P-662H/HW-D Series User’s Guide 114 Chapter 6 LAN Se tup Figure 54 Any IP Example The Any IP fe ature does n ot apply to a computer using either a dynami c IP address or a static IP address tha t is in the sa me subnet as the ZyXEL De vice’ s IP address. Note: Y ou must enable NA T/SUA to use the Any IP feature on the ZyXEL Device. 6.2.4.1 How [...]

P-662H/HW-D Series User ’s Guide Chapter 6 LAN Setup 115 After all the routing information is updated, the computer can access the ZyXEL Device and the Internet as if it is in th e same subnet as the ZyXEL Device. 6.3 Configuring LAN IP Click LAN to open the IP screen. See Section 6.1 on page 109 for background information. Figure 55 LAN IP The f[...]

P-662H/HW-D Series User’s Guide 116 Chapter 6 LAN Se tup Figure 56 Advanced LAN Setup The following table describes the labels in this screen. Table 31 Advanced LA N Setup LABEL DESCRIPTION RIP & Multicast Setup RIP Direction Select the RIP direction from None , Both , In Only and Out Only . RIP V ersion Select the RIP version from RIP-1 , RI[...]

P-662H/HW-D Series User ’s Guide Chapter 6 LAN Setup 117 6.4 DHCP Setup Use this screen to configure th e DNS server information that the ZyXEL Device sends to the DHCP client devices on the LAN. Figure 57 DHCP Setup The following table describes the labels in this screen. Table 32 DHCP Setup LABEL DESCRIPTION DHCP Setup DHCP If set to Server , y[...]

P-662H/HW-D Series User’s Guide 118 Chapter 6 LAN Se tup 6.5 LAN Client List This table allows you to assign IP addresses on the LAN to specific individual computers based on their MAC Addresses. Every Ethernet device has a unique MAC (Med ia Access Control) addre ss. The MAC address is assigned at the factory and consists of six pairs of hexadec[...]

P-662H/HW-D Series User ’s Guide Chapter 6 LAN Setup 119 The following table describes the labels in this screen. 6.6 LAN IP Alias IP alias allows you to partition a physical network into dif fer ent logical networks over the same Ethernet interface. The ZyXEL Device s upports three logical LA N interfaces via its single physical Ethernet interfa[...]

P-662H/HW-D Series User’s Guide 120 Chapter 6 LAN Se tup Figure 59 Physical Network & Partitioned Logical Networks T o change your ZyXEL Device ’ s IP alias settings, click Network > LAN > IP Alias . The screen appears as shown. Figure 60 LAN IP Alias The following table describes the labels in this screen. T able 34 LAN IP Alias LABE[...]

P-662H/HW-D Series User ’s Guide Chapter 6 LAN Setup 121 RIP Direction RIP (Routing Information Protocol , RFC 1058 and RFC 1389) all ows a router to exchange routing informatio n with other routers. The RIP Direction field cont rols the sending and receiving of RIP packe ts. Select the RIP direction from Both / In Only / Out Only / None . When s[...]

P-662H/HW-D Series User’s Guide 122 Chapter 6 LAN Se tup[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 123 C HAPTER 7 W ireless LAN This chapter discusses how to configure the wire less network settings in your ZyXEL Device. This chapter applies to the P-662HW-D models only . 7.1 Wireless Network Overview T h e foll o w i ng fig u re pr o vi d es a n e x a m p l e o f a w i r e le s s n e t w[...]

P-662H/HW-D Series User’s Guide 124 Chapter 7 Wireless LAN • Every device in the same wireless networ k must use security compatible with the AP . Security stops unauthorized devices from using the wireless network. It can also protect the information that is sent in the wireless network. 7.2 Wireless Security Overview The following sections in[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 125 For wireless networks, there are two typical plac es to store the user names and passwords for each user . • In the ZyXEL Device: this feature is called a local user database or a local database. • In a RADIUS server: this is a server u sed in businesses mo re than in homes. If your [...]

P-662H/HW-D Series User’s Guide 126 Chapter 7 Wireless LAN Note: It is recommended that wireless networks u se WP A-PSK , WP A , or stronger encryption. IEEE 802.1x and W EP encryption are better than non e at all, but it is still possible for unauthorized wireless devices to figure out the orig inal information pretty quickly . It is not possibl[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 127 7.4 Additional Wireless T erms The following table describes wireless networ k terms and acronyms used in the ZyXEL Device. 7.5 General Wireless LAN Screen Note: If you are configuring the ZyXEL Devi ce from a computer connected t o the wireless LAN and you change the ZyXEL Device ’s S[...]

P-662H/HW-D Series User’s Guide 128 Chapter 7 Wireless LAN Figure 62 Wireless LAN: General The following table describes the general wireless LAN labels in this screen. See the rest of this chapter for informa tion on the other labels in this screen. Table 37 Wireless LAN: General LABEL DESCRIPTION Active Wireless LAN Click the check box to activ[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 129 7.5.1 No Security Select No Security to allow wireless stations to commun icate with the access points without any data encryption. Note: If you do not enable an y wireless security on your ZyXEL Device, your network is accessible to any wireless network ing device tha t is within range.[...]

P-662H/HW-D Series User’s Guide 130 Chapter 7 Wireless LAN Figure 64 Wireless: S tatic WEP Encryption The following table describes the wireless LAN security labels in this screen. 7.5.3 WP A(2)-PSK In order to configure and enable WP A(2)-PSK authentication; click Network > Wir eless LAN to display the Ge neral screen. Select WP A-PSK or WP A[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 131 Figure 65 Wireless: WP A(2)-PSK The following table describes the wireless LAN security labels in this screen. Table 40 Wireless: WPA(2)-PSK LABEL DESCRIPTION Security Mode Choose WP A-PSK or WP A2-PSK from the drop-down list box. WP A Compatible Th is check box is available only when yo[...]

P-662H/HW-D Series User’s Guide 132 Chapter 7 Wireless LAN 7.5.4 WP A(2) Au thentication Screen In order to configure and enable WP A(2) Authentication; click the Wireless LAN link un der Network to display the Wir eless screen. Select WP A or WP A2 from the Security Mode list. Figure 66 Wirele ss: WP A(2) Group Key Update T imer (In Seconds) The[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 133 The following table describes the wireless LAN security labels in this screen. Table 41 Wireless: WPA(2) LABEL DESCRIPTION WP A Compatible This check box is available only when you select WP A2-PSK or WP A2 i n the Security Mode field. Select the check box to have both WP A2 and WP A wir[...]

P-662H/HW-D Series User’s Guide 134 Chapter 7 Wireless LAN 7.5.5 Wireless LAN Advanced Setup T o configure advanced wi reless settings, click the Advanced Setup button in the General screen. The screen appears as shown. Figure 67 Advanced The following table describes the labels in this screen. Cancel Click Cancel to reload the previous configura[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 135 7.6 OTIST In a wireless network, the wireless clients mu st have the same SSID and security settings as the access point (AP) or wireless router (we wi ll refer to both as “AP” here) in order to associate with it. T raditionally th is meant that you ha d to configure the settings on [...]

P-662H/HW-D Series User’s Guide 136 Chapter 7 Wireless LAN 7.6.1.1 AP Click the Wir eless LAN link under Network and then the OTIST tab. The following screen displays. Figure 68 OTIST The following table describes the labels in this screen. Table 43 OTIST LABEL DESCRIPTION Setup Key T ype an OTIST Setup Key of exactly eight ASC II characters in l[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 137 7.6.1.2 Wireless Client Start the ZyXEL utility and click the Adapter tab. Select the OTIST check box, enter the same Setup Key as your AP’ s and cl ick Save . Figure 69 Example Wireless Client OTIST Screen Y es! If you want to configure your ow n WP A-PSK and have OTIST use that WP A-[...]

P-662H/HW-D Series User’s Guide 138 Chapter 7 Wireless LAN 7.6.2 St arting OTIST Note: Y ou must click Star t in the AP OTIST web configurator screen and in the wireless client(s) Adapter screen all within three minutes (at the time of writing). Y ou can start OTIST in the wireless client s and AP in any order bu t they must all be within range a[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 139 Figure 74 S tart OTIST? 2 If an OTIST -enabled wireless client los es its wireless connection for more than ten seconds, it will search for an OTIST -enabled AP for up to one minute. (If you manually have the wireless client search for an OT IST -enabled AP , there is no timeout; click C[...]

P-662H/HW-D Series User’s Guide 140 Chapter 7 Wireless LAN Figure 75 MAC Addres s Filter The following table describes the labels in this menu. Table 44 MAC Address F ilter LABEL DESCRIPTION Active MAC Filter Select the check box to enable MAC ad dress filtering. Filter Action Define the filter action for th e list of MAC addresses in the MAC Add[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 141 7.8 WMM QoS WMM (W i-Fi MultiMedia) QoS (Qua lity of Service) ensures quality of service in wireless networks for multimed ia applications. WMM allows you to prioritize wireless traf fic according to the deliver y requirements of the individual and applications . WMM is a part of the IEE[...]

P-662H/HW-D Series User’s Guide 142 Chapter 7 Wireless LAN 7.8.3 Services The commonly used services and port numbers ar e shown in the following table. Please refer to RFC 1700 for further information about port numbers. Next to the name of the service, two fields appear in brackets. The first field indicat es the IP protocol type (TCP , UDP , o[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 143 Table 46 Commonly Used Ser vices SERVICE DESCRIPTION AIM/New-ICQ(TCP:5190) AOL ’s Internet Messenger service, used as a listening port by ICQ. AUTH(TCP:1 13) Authenticati on protocol used by som e servers . BGP(TCP:179) Border Gateway Protocol. BOOTP_CLIENT(UDP:68) DHCP Cli ent. BOOTP_[...]

P-662H/HW-D Series User’s Guide 144 Chapter 7 Wireless LAN 7.9 QoS Screen The QoS screen by default allows you to au tomatically give a service a priority level according to the T oS value in the IP header of the packets it sends. 7.9.1 T oS (T ype of Service) and WMM QoS T oS defines the DS (Differentiated Service) fiel d in the IP packet header[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 145 Click Network > Wi reless LAN > QoS . The following screen displays. Figure 76 Wireless LAN: QoS The following table describes the fields in this screen. Table 47 Wireless LAN: QoS LABEL DESCRIPTION QoS Enable WMM QoS Select the che ck box to enable W MM QoS on the ZyXEL D evice. W[...]

P-662H/HW-D Series User’s Guide 146 Chapter 7 Wireless LAN 7.9.2 Application Pr iority Configuration T o edit a WMM QoS application entry , click the edit icon under Modify . The following screen displays. Figure 77 Application Priority Configuration The following table describes the fields in this screen. Apply Click Apply to save your changes b[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 147 7.10 Multiple SSID (P-662HW -D Models only) The ZyXEL Device supports multiple SSID which allows you to configure a second wireless network with its own security pa rameters. This means that you can allow two different user groups to be connected to the same access point. Each user grou [...]

P-662H/HW-D Series User’s Guide 148 Chapter 7 Wireless LAN Figure 78 Multiple SSID Network Example In this section the second wireless network is referred to as the “guest wireless network” and user ’ s connecting to this network are referred to as “guests”. Multiple SSID is only configurab le via commands. The next sec tions describe m[...]

P-662H/HW-D Series User ’s Guide Chapter 7 Wireless LAN 149 The following table give s a description of multiple SSID commands. Table 49 Multiple SSID Commands Command Description guestssid <SSID> Use this command to specify the SSID of the guest wireless netw ork. This is the SSID guests have to configure on their wireless clients to conne[...]

P-662H/HW-D Series User’s Guide 150 Chapter 7 Wireless LAN 7.10.2 Multiple SSID Example This example shows how to configure a guest wi reless network with the following parameters. In the following script exampl e all typed co mmands and pa rameters have been bolded. T able 50 Multiple SSID E xam ple Configuration PARAMETER VA L U E SSID guestnet[...]

P-662H/HW-D Series User ’s Guide Chapter 8 DMZ 151 C HAPTER 8 DMZ This chapter describes how to configure the ZyXEL Device’ s DMZ. 8.1 Introduction The DeMilitarized Zone (DMZ) auto-negotiating 10/100 Mbps E thernet port provides a way for public servers (W eb, e-mail, FTP , etc.) to be visible to the outside world (while still being protected [...]

P-662H/HW-D Series User’s Guide 152 Chapter 8 DMZ Figure 79 DMZ The following table describes the labels in this screen. Table 51 DMZ LABEL DESCRIPTION DMZ TCP/IP IP Address T ype the IP address of your ZyXEL Device’s DMZ port in dotted decimal notation. Make sure the IP address is on a separate subnet from the LAN port. IP Subnet Mask The subn[...]

P-662H/HW-D Series User ’s Guide Chapter 8 DMZ 153 8.3 DMZ Public IP Address Example The following figure shows a simple network set up with public IP addresses on the W AN and DMZ and private IP addresses on the LAN. Lowe r case letters represent public IP addresses (like a.b.c.d for example). The LAN port and co nnected computers (A th rough C)[...]

P-662H/HW-D Series User’s Guide 154 Chapter 8 DMZ Figure 80 DMZ Public Addr ess Example 8.4 DMZ Private and Public IP Address Example The following figure shows a network setup with bot h private and public IP addresses on the DMZ. Lower case letters represent public IP addresses (like a.b.c.d for example). The LAN port and connected co mputers ([...]

P-662H/HW-D Series User ’s Guide Chapter 8 DMZ 155 Figure 81 DMZ Private and Public Address Example[...]

P-662H/HW-D Series User’s Guide 156 Chapter 8 DMZ[...]

P-662H/HW-D Series User ’s Guide Chapter 9 Network Address Translatio n (NAT) Screens 157 C HAPTER 9 Network Address T ranslation (NA T) Screens This chapter discusses how to configure NA T on the ZyXEL Device. 9.1 NA T Overview NA T (Network Address Translation - NA T , RFC 1631) is the translation of the IP address of a host in a packet, for ex[...]

P-662H/HW-D Series User’s Guide 158 Chapt er 9 Network Addre ss Translation (NA T) Screens 9.1.2 What NA T Does In the simplest form, NA T changes the sour ce IP address in a packet received from a subscriber (the inside local address) to anothe r (the inside global address) before forwarding the packet to the W AN side. When the resp onse comes [...]

P-662H/HW-D Series User ’s Guide Chapter 9 Network Address Translatio n (NAT) Screens 159 9.1.4 NA T Ap plication The following figure illustrates a possible NA T application, wher e three inside LANs (logical LANs using IP Alias) behind the ZyXEL Devi ce can communicate with three distinct W AN networks. More examples follow at the end of this c[...]

P-662H/HW-D Series User’s Guide 160 Chapt er 9 Network Addre ss Translation (NA T) Screens Port numbers do NOT change for One-to-One and Many-to-Many No Overload NA T mapping types. The following table summarizes these types. 9.2 SUA (Single User Account) V ersus NA T SUA (Single User Account) is a ZyNOS implemen tation of a subset of NA T that s[...]

P-662H/HW-D Series User ’s Guide Chapter 9 Network Address Translatio n (NAT) Screens 161 Figure 84 NA T General The following table describes the labels in this screen. 9.4 Port Forwarding A port forwarding set is a list of inside (behind NA T on the LAN) servers, for ex ample, web or FTP , that you can make visible to the outside world even tho[...]

P-662H/HW-D Series User’s Guide 162 Chapt er 9 Network Addre ss Translation (NA T) Screens Y ou may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server . The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unkn[...]

P-662H/HW-D Series User ’s Guide Chapter 9 Network Address Translatio n (NAT) Screens 163 9.4.3 Configuring Servers Behi nd Port Forwarding (Example) Let's say you want to assign po rts 21-2 5 to one FTP , T elnet and SMTP server ( A in the example), port 80 to another ( B in the example) and assign a default server IP address of 192.168.1.3[...]

P-662H/HW-D Series User’s Guide 164 Chapt er 9 Network Addre ss Translation (NA T) Screens The following table describes th e fields in this screen. 9.5.1 Port Forwarding Rule Edit T o edit a port forwarding rule, c lick the rule’ s edit icon in the Port Forwarding screen to display the screen shown next. Figure 87 Port Forwarding Rule Setup T [...]

P-662H/HW-D Series User ’s Guide Chapter 9 Network Address Translatio n (NAT) Screens 165 The following table describes th e fields in this screen. 9.6 Address Mapping Note: The Address Mapping screen is available only when you select Ful l Feature in the NA T > General screen. Ordering your rules is important because the Zy XEL Device applies[...]

P-662H/HW-D Series User’s Guide 166 Chapt er 9 Network Addre ss Translation (NA T) Screens Figure 88 Address Mapping Rule s The following table describes th e fields in this screen. Table 58 Address Mapp ing Rules LABEL DESCRIPTION # This is the rule index number . Local S tart IP Th is is the starting Inside Local IP Address (ILA). Local IP addr[...]

P-662H/HW-D Series User ’s Guide Chapter 9 Network Address Translatio n (NAT) Screens 167 9.6.1 Address Mapping Rule Edit T o edit an address mapping rule, click the rule’ s edit icon in the Addr ess Mapping screen to display the screen shown next. Figure 89 Edit Address Mapping Rule The following table describes th e fields in this screen. T a[...]

P-662H/HW-D Series User’s Guide 168 Chapt er 9 Network Addre ss Translation (NA T) Screens Edit Details Click this link to go to the Port Forwarding screen to edit a server mappi ng set that you have selected in the Server Mapping Set field. Back Click Back to retu rn to the previous screen. Apply Click Apply to save your changes back to the ZyXE[...]

P-662H/HW-D Series User ’s Guide Chapter 10 Firewalls 169 C HAPTER 10 Firewalls This chapter gives some back ground information on firewa lls and introduces the ZyXEL Device firewall. 10.1 Firewall Overview Originally , the term firewall referred to a construction techni que designed to prevent the spread of fire from one room to another . The ne[...]

P-662H/HW-D Series User’s Guide 170 Chapter 10 Firewalls 10.2.2 Application-level Firewalls Application-level firewalls restrict access by serv ing as proxies for e xternal servers. Since they use programs written for specific Internet servic es, such as HTTP, FTP and tel net, they can evaluate network packets for valid application-sp ecific data[...]

P-662H/HW-D Series User ’s Guide Chapter 10 Firewalls 171 • The LAN (Local Area Network) port attache s to a network of computers, which ne eds security from the outside world. These computer s will have access to Internet services such as e-mail, FTP , and the W orld W ide W e b. However , “inbound access” will not be allowed unless you co[...]

P-662H/HW-D Series User’s Guide 172 Chapter 10 Firewalls 10.4.2 T ypes of DoS Atta cks There are four types of DoS attacks: 1 Those that exploit bugs in a TCP/IP implementation. 2 Those that exploit weaknesses in the TCP/IP specification. 3 Brute-force attacks that flood a network with useless data. 4 IP Spoofing. 5 " Ping of Death " an[...]

P-662H/HW-D Series User ’s Guide Chapter 10 Firewalls 173 Under normal circumstances, the applica tion that initiates a session sends a SYN (synchronize) packet to the receiving server . The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the in itiator responds with an ACK (acknowledgment). After this handsh ake, a c[...]

P-662H/HW-D Series User’s Guide 174 Chapter 10 Firewalls Figure 93 Smurf Attack 10.4.2.1 ICMP V ulnerability ICMP is an error -reporting protocol that works in concert with IP . The following ICMP types trigger an alert: 10.4.2.2 Illegal Commands (NetBIOS and SMTP) The only legal NetBIOS commands are the following - all others are illegal. All SM[...]

P-662H/HW-D Series User ’s Guide Chapter 10 Firewalls 175 10.4.2.3 T raceroute T raceroute is a utility used to determine th e path a packet takes between two endpoints. Sometimes when a packet filter firewall is conf igured incorrectly an at tacker can traceroute the firewall gaining knowledge of the network topology inside the firewall. Often, [...]

P-662H/HW-D Series User’s Guide 176 Chapter 10 Firewalls The previous figure shows the ZyXEL Device’ s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a T elnet session from within the LAN and responses to this request are allowe d. However other T elnet traf fic initiated from the W A[...]

P-662H/HW-D Series User ’s Guide Chapter 10 Firewalls 177 • Allow certain types of traffic from the In ternet to specific hosts on the LAN. • Allow access to a W eb server to everyone but competitors. • Restrict use of certain protocols, such as T elnet, to authoriz ed users on the LAN. These custom rules work by evaluating the networ k tra[...]

P-662H/HW-D Series User’s Guide 178 Chapter 10 Firewalls A similar situation exists for ICMP , except that the ZyXEL Device is even more restrictive. Specifically , only outgoing echoes will allow in coming echo replies, outgoing address mask requests will allow incoming address mask replies, and ou tgoing timestamp requests wi ll allow incoming [...]

P-662H/HW-D Series User ’s Guide Chapter 10 Firewalls 179 10.6.1 Security In General Y ou can never be too careful! Factors outside yo ur firewall, filtering or NA T can cause security breaches. Below are some generalizations about what you can do to minimize the m. • Encourage your co mpany or organization to develop a comprehen sive security [...]

P-662H/HW-D Series User’s Guide 180 Chapter 10 Firewalls 10.7.1 Packet Filtering: • The router filters packets as they pass through the router’ s interface according to the filter rules you designed. • Packet filtering is a powerful tool, yet ca n be complex to configure and maint ain, especially if you need a chain of rules to filter a ser[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 181 C HAPTER 11 Firewall Configuration This chapter shows you how to enable and configure t he ZyXEL Device firewall. 1 1.1 Access Methods The web configurator is, by far , the most co mprehensive firewall configuration tool your ZyXEL Device has to offer . For this reason, it is[...]

P-662H/HW-D Series User’s Guide 182 Chapter 11 Firewall Configuration Note: If you configure firewall rules wit hout a good underst anding of how they work, you might inadvertently introduce securi ty risks to the f irewall and to the protected network. Make sure you test your rules af ter you configure t hem. For example, you may create rules to[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 183 4 Does a rule that allows Internet users acces s to resources on the LAN create a security vulnerability? For example, if FTP ports (TCP 20, 21) are al lowed from the Internet to t he LAN, Internet users may be able to connect to computers with running FTP servers. 5 Does thi[...]

P-662H/HW-D Series User’s Guide 184 Chapter 11 Firewall Configuration 1 1.4.1 LAN to W A N Rules The default rule for LAN to W AN traf fic is that all users on the LAN are allowed non- restricted access to the W AN. When you config ure a LAN to W AN rule, you in essenc e want to limit some or all users from accessing cer tain services on the W AN[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 185 The following table describes the labels in this screen. 1 1.6 Firewall Rules Summary Note: The ordering of your rule s is very import ant as rules are app lied in turn. Refer to Section 10.1 on page 169 for more information. Click Security > Fir ewall > Rules to bring [...]

P-662H/HW-D Series User’s Guide 186 Chapter 11 Firewall Configuration Figure 96 Firewall Rules The following table describes the labels in this screen. Table 65 Firewall Rules LABEL DESCRIPTION Firewall Rules S tora ge S pace in Use This read-only bar shows how much of the ZyXEL De vice's memory for recording firewall rules it is currently u[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 187 1 1.6.1 Configuring Firewall Rules Refer to Section 10.1 on page 169 for more information. In the Rules screen, select an index number and click Add or click a rule’ s Edit icon to display this screen and refer to the following table for information on the labels. Action Th[...]

P-662H/HW-D Series User’s Guide 188 Chapter 11 Firewall Configuration Figure 97 Firewall: Edit Rule[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 189 The following table describes the labels in this screen. Table 66 Firewall: Edit Rule LABEL DESCRIPTION Active Select this option to ena ble this firewall rule. Action for Matched Packet Use the drop-down list box to select what the firewa ll is to do with packets that match [...]

P-662H/HW-D Series User’s Guide 190 Chapter 11 Firewall Configuration 1 1.6.2 Customized Services Configure customized services and port number s not predefined by the ZyXEL Device. For a comprehensive list of port numbers and services, visit the IANA (Internet Assigned Number Authority) website. For further inform ation on these services, please[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 191 1 1.6.3 Configuring A Customized Service Click a rule number in the Firewall Customized Services screen to create a new custom port or edit an existing one. This actio n displays the following screen. Refer to Section 10.1 on page 169 for more information. Figure 99 Firewall:[...]

P-662H/HW-D Series User’s Guide 192 Chapter 11 Firewall Configuration Figure 100 Firewall Example: Rules 3 In the Rules screen, select the index number after that you want to add the rule. For example, if you select “6”, your new rule b ecomes number 7 and the previous rule 7 (if there is one) becomes rule 8. 4 Click Add to display the firewa[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 193 Figure 102 Firewall Example: Edit Ru le: Destination Address 9 Use the Add >> and Remove buttons between A vailable Services and Selected Services list boxes to configure it as follows. Click Apply when you are done. Note: Custom services show up with an “*” before [...]

P-662H/HW-D Series User’s Guide 194 Chapter 11 Firewall Configuration Figure 103 Firewall Example: Edit Rule : Select Customized Services On completing the configuration procedure for this Internet firewall rule, the Rules screen should look like the following. Rule 1 allows a “MyService” connection from the W AN to IP addresses 10.0.0.10 thr[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 195 Figure 104 Firewall Example: Rules: MyService 1 1.8 Predefin ed Services The A vailable Services list box in the Edit Rule screen (see Section 1 1.6.1 on page 187 ) displays all predefined services that the ZyXEL Device already supports. Next to the name of the service, two f[...]

P-662H/HW-D Series User’s Guide 196 Chapter 11 Firewall Configuration H.323(TCP:1720) Net Meeting uses this proto col. HTTP(TCP:80) Hyper T ext Transfer Protocol - a cl ient/server protocol for the wo rld wide web. HTTPS HTTPS is a secured ht tp session of ten used in e-commerce. ICQ(UDP:4000) This is a popular Internet chat program. IPSEC_TRANSP[...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 197 1 1.9 Anti-Probing If an outside user attempts to probe an unsupp orted port on your ZyXEL Device, an ICMP response packet is automatically returned. This allows the ou tside user to know the ZyXEL Device exists. The ZyXEL Device supports anti- probing, which prevents the ICM[...]

P-662H/HW-D Series User’s Guide 198 Chapter 11 Firewall Configuration The following table describes the labels in this screen. 1 1.10 DoS Thresholds For DoS attacks, the ZyXEL Device uses threshol ds to determine when to drop sessions that do not become fully established. These thresholds ap ply globally to all sessions. Y ou can use the default [...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 199 Y ou should make any chan ges to the threshold values b efore you continue configu ring firewall rules. 1 1.10.2 Half-Open Sessions An unusually high number of half-open sessions (either an absolute number or measured as the arrival rate) could indicate that a Denial of Servi[...]

P-662H/HW-D Series User’s Guide 200 Chapter 11 Firewall Configuration 1 1.10.3 Configuring Firewall Thresholds The ZyXEL Device also sends alerts whenever TCP Maximum Incomplete is exceeded. The global values specified for the threshold an d timeout apply to all TCP connections. Click Fir ewall , and Threshold to bring up the next screen. Figure [...]

P-662H/HW-D Series User ’s Guide Chapter 11 Firewall Configurat ion 201 Maximum Incomplete Low This is the number of existing half-open sessions that cau ses the firewall to stop deleting half-open sessions. Th e ZyXEL Device continues to delete half-open re quests as necessary , until the number of exist ing half-open sessions drops below this n[...]

P-662H/HW-D Series User’s Guide 202 Chapter 11 Firewall Configuration[...]

P-662H/HW-D Series User ’s Guide Chapter 12 Anti-Virus Packet Scan 203 C HAPTER 12 Anti-V irus Packet Scan This chapter introduces and shows you how to configure the anti- virus packet scan. 12.1 Overview A computer virus is a small program designed to corrupt and/or alter the operati on of other legitimate programs. A worm is a self-replicating [...]

P-662H/HW-D Series User’s Guide 204 C hapter 12 Anti -Virus Packet Scan For maximum protection, you must ke ep the pattern file up-to-date. 12.2.1 Computer V irus Infection and Prevention The follow de scribes a sim plistic life cycle of a computer viru s. 1 A computer gets a copy of a virus from an un known source (suc h as the Internet, e-mail,[...]

P-662H/HW-D Series User ’s Guide Chapter 12 Anti-Virus Packet Scan 205 This is an Internet file transfer service th at operates on the Internet and over TCP/IP networks. A system running the FTP server acc epts commands from a system running an FTP client. The service allows users to send commands to the serv er for uploading and downloading file[...]

P-662H/HW-D Series User’s Guide 206 C hapter 12 Anti -Virus Packet Scan Click Security > AntiV iru s to display th e configuration screen as shown next. Figure 108 Anti-Virus: Packet Scan The following table describes the labels in this screen. Table 73 Anti-Virus: Packet Scan LABEL DESCRIPTION Packet Scan Configuration Active Select this chec[...]

P-662H/HW-D Series User ’s Guide Chapter 12 Anti-Virus Packet Scan 207 12.5 Registration and Online Up date Use the Registration and V irus Information Update screen to register for and activate the anti-virus packet scan feature on the ZyXEL Devi ce. Y ou can also configure a schedule for the ZyXEL Device to automatically update th e virus patte[...]

P-662H/HW-D Series User’s Guide 208 C hapter 12 Anti -Virus Packet Scan Figure 109 Anti-Virus: Registration an d Virus Information Update The following table describes the labels in this screen. Table 74 Anti-V irus: Registration an d V irus Information Update LABEL DESCRIPTION Registrat ion Y ou must register for the anti-virus serv ice before y[...]

P-662H/HW-D Series User ’s Guide Chapter 12 Anti-Virus Packet Scan 209 12.5.1 Up dating the Anti-Virus Packet Scan Follow the steps below to update the viru s scan on the ZyXEL Device manually . Note: Do not turn of f the ZyXEL Device while the virus scan update is in pro gress! 1 In the Registration and V irus Information Update scree n, click U[...]

P-662H/HW-D Series User’s Guide 210 C hapter 12 Anti -Virus Packet Scan[...]

P-662H/HW-D Series User ’s Guide Chapter 13 Content Filtering 211 C HAPTER 13 Content Filtering This chapter covers how to configure content filtering. 13.1 Content Filtering Overview Internet content filtering allows you to create and enforce Internet access policies tailored to your needs. Content filtering gives you the ab ility to block web s[...]

P-662H/HW-D Series User’s Guide 212 Chapter 13 Content Filtering The following table describes the labels in this screen. 13.3 Configuring the Schedule T o set the days and times for the ZyXEL De vice to perform content filtering, click Security > Content Filter > Schedule . The screen appears as shown. Figure 1 13 Content Filt er: Schedule[...]

P-662H/HW-D Series User ’s Guide Chapter 13 Content Filtering 213 The following table describes the labels in this screen. 13.4 Configuring T rusted Computers T o exclude a range of users on the LAN from content filtering on your ZyXEL Device, click Security > Content Filter > Tr u s t e d . The screen appe ars as shown. Figure 1 14 Content[...]

P-662H/HW-D Series User’s Guide 214 Chapter 13 Content Filtering[...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 215 C HAPTER 14 Content Access Control This chapter gives some backgr ound information on Content Ac cess Control and explains how to get started with the ZyXEL Device Content Access Control. 14.1 Content Access Control Overview Content Access Control (CAC) lets a LA N admini stra[...]

P-662H/HW-D Series User’s Guide 216 Chapter 14 Conten t Access C ontrol 14.2 Activating CAC and Creating User Group s From the main menu click Security > Content Access Control and General to open the configuration screen. Use this screen to activate Content Access Control and set up the four user groups. Note: Y ou must set up all four user g[...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 217 14.2.1 Configuring T ime Schedule T o set up the time schedule for each user group, click Edit under Time in the Content Access Control-General screen. A screen displays as shown next. Service Click Edit to select the services you wish to block access for a user group. Web Bro[...]

P-662H/HW-D Series User’s Guide 218 Chapter 14 Conten t Access C ontrol Figure 1 17 Control Access Control: Gen eral: T ime Scheduling The following table describes the labels in this screen. Table 79 Control Access Control: General: T ime Scheduling LABEL DESCRIPTION T ime Scheduling Select the first radio button to allow everyda y access at the[...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 219 14.2.2 Configuring Services T o customize service s for each user group, click Edit under Services for that user group in the Content Access Control: General screen. Figure 1 18 Content Access Control: General: Services The following table describes the labels in this screen. [...]

P-662H/HW-D Series User’s Guide 220 Chapter 14 Conten t Access C ontrol 14.2.2.1 A vailable Services The A vailable Services list box in the Services screen displays some predefined services tha t the ZyXEL Device supports. The following ta ble shows a list of services that can be configured. Next to the name of the service, two fields appear in [...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 221 MUL TICAST(IGMP:0) Internet Group Multicast Pr otocol is used when sending packets to a specific group of hosts. NEW-ICQ(TCP:5190) An Internet chat progra m. NEWS(TCP :144) A protoc ol for news gr oups . NFS(UDP:2049) Network File System - NFS is a client/server distrib ut ed [...]

P-662H/HW-D Series User’s Guide 222 Chapter 14 Conten t Access C ontrol 14.2.3 Configuring Web Site Filters T o enable content filtering an d to configure URL keyword blocking for a user g roup, click Edit under We b B r o w s i n g in the Content Access Control: General screen. A screen displays as shown next. Figure 1 19 Content Access Control:[...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 223 Log Matched Web Site Select this option to re cord attempt s to access prohibited web pages. Select Blocked Categories Use this section to prevent users from accessing web pages that match the categories that yo u select below . Select All Select this check box to restrict acc[...]

P-662H/HW-D Series User’s Guide 224 Chapter 14 Conten t Access C ontrol Abortion Selecting this category excludes pages that provide info rmation or arguments in favor of or against a bortion, describe abortion procedures, offer help in obtaining or avoiding abortion, or provide information on the ef fects, or lack thereof, of abortion. Arts/Ente[...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 225 Health Sele cting this category excludes pages that provide advice and information on general health such as fitness and well-bei ng, personal health or medical services, drugs, alternative and co mplimentary therapies, medical information about ailments, dentistry , opto metr[...]

P-662H/HW-D Series User’s Guide 226 Chapter 14 Conten t Access C ontrol Society/Lifestyle Selecting this category exclude s p ages providing informati on on matters of daily life. This does n ot include pages relating to entertainment, sport s, jobs, sex or pages promoting alternative lifestyles such a s homosexuality . Personal homepages fall wi[...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 227 14.2.4 T esting Web Site Access Privileges T o check the acce ss restrictions of a web site, click Diagn ose under W eb Browsing in the Content Access Control: General screen. A screen displays as shown next. The ZyXEL Device first checks the web site addr ess for the specifie[...]

P-662H/HW-D Series User’s Guide 228 Chapter 14 Conten t Access C ontrol 14.3 User Account Setup W ith Content Acces s Control, the ZyXEL Device requires LAN users to login with valid username and password before they are allowed to acce ss the Internet. Use the User Profile screen to set up user account s. From the main menu click Security > C[...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 229 14.4 User Online S t atus T o view the online status of each us er , click Security > Content Acc ess Contro l > Online St a t u s to display the screen as shown. Figure 122 Content Access Control: Online S tatus The following table describes the labels in this screen. T[...]

P-662H/HW-D Series User’s Guide 230 Chapter 14 Conten t Access C ontrol 14.5 Content Access Control Logins The following sections describe the user and administrator login experience. 14.5.1 User Login 1 Once the initial configuration is complete, a computer on the network cannot gain Internet access without first lo gging into the ZyXEL Device. [...]

P-662H/HW-D Series User ’s Guide Chapter 14 Content Access Control 231 14.5.2 Administrator Login The administrator can log into the system. • The administrator opens their browser and is directed to the ZyXEL Device user login page (this is the same as the user login). • The administrator enters “admin” as the username a nd the system pa[...]

P-662H/HW-D Series User’s Guide 232 Chapter 14 Conten t Access C ontrol[...]

P-662H/HW-D Series User ’s Guide Chapter 15 Introduction to IPSec 233 C HAPTER 15 Introduction to IPSec This chapter introduces the basics of IPSec VPNs. 15.1 VPN Overview A VPN (V irtual Private Network) provides sec ure communications between sites without the expense of leased site-to-site lines. A secure VP N is a combination of tunneling, en[...]

P-662H/HW-D Series User’s Guide 234 Chapter 1 5 Introduction t o IPSec Figure 125 Encryption an d Decryption 15.1.3.2 Dat a Confidentiality The IPSec sender can encrypt packets befo re transmitting them across a network. 15.1.3.3 Dat a Integrity The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been [...]

P-662H/HW-D Series User ’s Guide Chapter 15 Introduction to IPSec 235 15.2 IPSec Architecture The overall IPSec architect ure is shown as follows. Figure 126 IPSec Architecture 15.2.1 IPSec Algorithms The ESP (Encapsulating Security Payload) Prot ocol (RFC 2406) an d AH (Authentication Header) protocol (RFC 2402 ) describe the packet formats and [...]

P-662H/HW-D Series User’s Guide 236 Chapter 1 5 Introduction t o IPSec Figure 127 T ransport and T unnel Mode IPSec Encapsulation 15.3.1 T ransport Mode Tr a n s p o r t mode is used to protect upper layer prot ocols and only affects the data in the IP packet. In Tr a n s p o r t mode, the IP packet contains the security protoc ol ( AH or ESP ) l[...]

P-662H/HW-D Series User ’s Guide Chapter 15 Introduction to IPSec 237 NA T is incompatible with the AH protocol in both Tr a n s p o r t and T unnel mode. An IPSec VPN using the AH protocol digitally sig ns the outbound packet, both data payload and headers, with a hash value appe nded to the pack et. When using AH protoc ol, packet contents (the[...]

P-662H/HW-D Series User’s Guide 238 Chapter 1 5 Introduction t o IPSec[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 239 C HAPTER 16 VPN Screens This chapter introduces the VPN screens. See the Logs chapter for in formation on viewing logs and the appendix for IPSec log descriptions. 16.1 VPN/IPSec Overview Use the screens documented in this chapter to configure rules for VPN connections and manage VPN con[...]

P-662H/HW-D Series User’s Guide 240 Chapter 16 VP N Screens 16.3 My IP Address My IP Address is the W AN IP address of th e ZyXEL Device. The ZyXEL Device has to rebuild the VPN tunnel if the My IP Address changes after setup. The following applies if this field is configured as 0.0.0.0 : • The ZyXEL Device us es the current ZyXEL Device W AN I[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 241 16.4 Secure Gateway Address Secure Gateway Address is the W AN IP address or domain name of the remote IPSec router (secure gateway). If the remote secure gateway has a static W AN IP address, enter it in the Secure Gateway Address field. Y ou may alternatively enter the remo te secure g[...]

P-662H/HW-D Series User’s Guide 242 Chapter 16 VP N Screens Figure 129 VPN Setup The following table describes the fields in this screen. T able 88 VPN Setup LABEL DESCRIPTION No. This is the VPN policy index number . Click a number to edit VPN policies. Active This field displays whether the VPN policy is active or not. A Ye s si gnifies that th[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 243 16.6 Keep Alive When you initiate an IPSec tunnel with keep alive enabled, the ZyX EL Device automatically renegotiates the tunnel wh en the IPSec SA lifetime period expires (see Section 16.12 on page 252 for more on the IPSec SA lifetime). In ef fe ct, the IPSec tunnel becomes an “alw[...]

P-662H/HW-D Series User’s Guide 244 Chapter 16 VP N Screens 16.7 VPN, NA T , and NA T T raversal NA T is incompatible with the AH protocol in both transport and tunnel mode. An IPSec VPN using the AH protocol dig itally signs the outbound packet, both data paylo ad and headers, with a hash value appended to the packet, but a NA T device between t[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 245 Y* - This is supported in the ZyXEL Device if you enable NA T traversal. 16.8 Remote DNS Server In cases where you want to use domain names to access Intranet servers on a remote network that has a DNS server , you must identify that DNS server . Y ou cannot use DNS servers on the LAN or[...]

P-662H/HW-D Series User’s Guide 246 Chapter 16 VP N Screens W ith main mode (see Section 16.12. 1 on page 253 ), the ID type and content are encrypted to provide identity protection. In th is case the ZyXEL Device can on ly distinguish between up to 12 different incoming SAs that connect from re mote IPSec routers that have dynamic W AN IP addres[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 247 The two ZyXEL Devices in this example ca n complete negotiation and establish a VPN tunnel. The two ZyXEL Devices in this example cann ot complete their negotiation because ZyXEL Device B’ s Local ID type is IP , but ZyXEL Device A ’ s Pe er ID type is set to E-mail . An “ID mismat[...]

P-662H/HW-D Series User’s Guide 248 Chapter 16 VP N Screens Figure 132 Edit VPN Policies The following table describes the fields in this screen. T able 94 Edit VPN Policies LABEL DESCRIPTION IPSec Setup Active Select this check box to activate this VPN policy . This option determines whethe r a VPN rule is applied before a packet leaves the fire[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 249 NA T T raversal This function is availab le if the VPN protocol is ESP . Select this check box if you want to set up a VPN tunnel when there are NA T routers between the ZyXEL Devi ce and remo te IPSec router . The remote IPSec router must also enable NA T traversal, and the NA T routers[...]

P-662H/HW-D Series User’s Guide 250 Chapter 16 VP N Screens Remote Remote IP addresses must be static and correspond to the remote IPSec router's configured local IP addresses. The remote fields do not apply when th e Secure Gateway IP Address field is configured to 0.0.0.0 . In this case only the remote IPSec router can initiate the VPN. T [...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 251 Peer ID T ype Select IP to identify the remote IPSe c router by its IP address. Select DNS to identify the remote IPSec router by a domain name. Select E-mail to identify the remote IPSec router by an e-mail address. Content The configuration of the peer content depends on the peer ID ty[...]

P-662H/HW-D Series User’s Guide 252 Chapter 16 VP N Screens 16.12 IKE Phases There are two phases to every IKE (Internet Key Exchange) ne gotiation – phase 1 (Authentication) and ph ase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA and the second one uses that SA to negotiate SAs for IPSe c. Figure 133 T wo Phases to Set Up the IPS[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 253 • Authenticate the connection by entering a pre-shared key . • Choose an encryption algorithm. • Choose an authentication algorithm. • Choose a Dif fie-Hellman public-key cry ptography key grou p ( DH1 or DH2 ) . • Set the IKE SA lifetime. This field allows you to determin e ho[...]

P-662H/HW-D Series User’s Guide 254 Chapter 16 VP N Screens 16.12.2 Diffie-Hellman (DH) Key Groups Diffie-Hellman (DH) is a publi c -key cryptography protocol tha t allows two parties to establish a shared secret over an unsecured communications channel. Diff ie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 - DH1[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 255 Figure 134 Advanced VPN Policies The following table describes the fields in this screen. T able 95 Advanced VPN Policies LABEL DESCRIPTION VPN - IKE Protocol Enter 1 for ICMP , 6 for TCP , 1 7 for UDP , etc. 0 is the default and signifies any protocol. Enable Replay Detection As a VPN s[...]

P-662H/HW-D Series User’s Guide 256 Chapter 16 VP N Screens Negotiati on Mode Select Main or Aggressiv e from the drop-down list box. Multiple SAs connecting through a secure gateway must have the same negotiation mode . Pre-Shared Key T ype your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE [...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 257 16.14 Manual Key Setup Manual key managemen t is useful if you have problems with IKE key mana gement. 16.14.1 Security Parameter Index (SPI) An SPI is used to distinguish dif ferent SAs te rminating at the same de stination and using the same IPSec protocol. This data allows for the mul[...]

P-662H/HW-D Series User’s Guide 258 Chapter 16 VP N Screens Figure 135 VPN: Manual Key The following table describes the fields in this screen. Table 96 VPN: Manual Key LABEL DESCRIPTION IPSec Setup Active Select this check box to activate this VPN policy . Name T ype up to 32 characters to ide ntify this VPN policy . Y ou may use any character ,[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 259 DNS Server (for IPSec VPN) If there is a private DNS server that se rvices the VPN, type its IP address here. The ZyXEL Device a ssigns this additional DNS server to the Zy XEL Device 's DHCP clients that have IP addresses in this IPSec rule's range of lo cal addresses. A DNS s[...]

P-662H/HW-D Series User’s Guide 260 Chapter 16 VP N Screens 16.16 V iewing SA Monitor Click Security , VPN and Monitor to open the SA Moni tor screen as shown. Use this screen to display and ma nage active VPN co nnections . A Security Association (SA) is the group of se cu rity settings related to a specific VPN tunnel. This screen displays acti[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 261 When there is outbound traffic b ut no inbound tr affic, the SA times out automatically after two minutes. A tunnel with no outb ound or inbound traf fic is "idle" and does not timeo ut until the SA lifetime period expires. See Section 16. 6 on page 243 on keep alive to have th[...]

P-662H/HW-D Series User’s Guide 262 Chapter 16 VP N Screens The following table describes the fields in this screen. 16.18 T elecommuter VPN/IPSec Examples The following examples show how multiple telecommuters can make VPN connections to a single ZyXEL D evice at head quarters. The te lecommuters use IPSec routers with dynamic W AN IP addresses.[...]

P-662H/HW-D Series User ’s Guide Chapter 16 VPN Screens 263 16.18.2 T elecommuters Usin g Unique VPN Rules Example In this example the telecommuters (A, B and C in the figure) use IPSec routers with domain names that are mapped to their dynamic W AN IP addresses (use Dynamic DNS to do this). W ith aggressive negotiation mode (see Section 16.12.1 [...]

P-662H/HW-D Series User’s Guide 264 Chapter 16 VP N Screens 16.19 VPN and Remote Management If a VPN tunnel uses T elnet, FTP , WWW , then you shou ld configure remote managemen t ( Remote Management ) to allow access for that service. Table 100 T elecommuters Using Uniq ue VPN Rules Example T ELECOMMUTERS HEADQUARTERS All T ele commuter Rules: A[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 265 C HAPTER 17 Certificates This chapter gives background in formation about public-key certificates and explains how to use them. 17.1 Certificates Overview The ZyXEL Device can use certificates (also ca lled digital IDs) to authenticate users. Certificates are based on public -private ke[...]

P-662H/HW-D Series User’s Guide 266 Chapter 17 Certificates A certification path is the hierarchy of certif ication authority certificates that validate a certificate. The ZyXEL Device does not trust a ce rtificate if any certificate on its path has expired or been revoked. Certification authorities maintain directory ser vers with databases of v[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 267 Use the Directory Servers screen to configure a list of addresses of directory servers (that contain lists of valid and revoked certificates). 17.4 My Certificates Click Security > Certificates > My Certificates to open the My Certificates screen. This is the ZyXEL Device’ s sum[...]

P-662H/HW-D Series User’s Guide 268 Chapter 17 Certificates T ype This field displays what kind of certificate this is. REQ represents a certification request an d is not yet a valid certificate. Send a certification request to a certification authority , wh ich then issues a certificate. Use the My Certificate Import screen to import the certifi[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 269 17.5 My Certificate Import Click Security > Certificates > My Certificates and then Import to open the My Certificate Import screen. Follow the instructions in this sc reen to save an e xis ting certificate to the ZyXEL Device. Note: Y ou can only import a certificate that matches[...]

P-662H/HW-D Series User’s Guide 270 Chapter 17 Certificates The following table describes the labels in this screen. 17.6 My Certificate Create Click Se curity > Certificates > My Certificates > Cr eate to open the My Certificate Create screen. Use this screen to have the ZyXEL Device create a self-signed certificate, enroll a certificat[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 271 The following table describes the labels in this screen. T able 103 My Certificate Create LABEL DESCRIPTION Certificate Name T ype up to 31 ASCII characters (not includ ing sp aces ) to identify this certifi cate. Subject Information Use these fields to record information that iden tifi[...]

P-662H/HW-D Series User’s Guide 272 Chapter 17 Certificates After you click Apply in the My Certificate Create screen, you see a screen that tells you the ZyXEL Device is generating the self-signe d certificate or certification request. After the ZyXEL Device successfully enrolls a ce rtificate or generates a certification request or a self-signe[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 273 Figure 144 My Certificate Details[...]

P-662H/HW-D Series User’s Guide 274 Chapter 17 Certificates The following table describes the labels in this screen. Table 104 My Certificate Details LABEL DESCRIPTION Name This field displays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this certifica te. Y ou may use any characte[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 275 17.8 T rusted CAs Click Security > Certificates > T rusted CAs to open the T rusted CAs screen. This screen displays a summary list of certificates of the certification authorities that you ha ve set the ZyXEL Device to accept as trusted. The ZyXEL De vice accepts any valid certif[...]

P-662H/HW-D Series User’s Guide 276 Chapter 17 Certificates Figure 145 T rusted CAs The following table describes the labels in this screen. Table 105 T rusted CAs LABEL DESCRIPTION PKI S torage S pace in Use This bar displays the percentage of the Zy XEL Device’s PKI storage space that is currently in use. The bar turns from green to red when [...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 277 17.9 T rusted CA Import Click Security > Certificates > T rusted CAs to open the T rusted CAs screen and then click Import to open the T rusted CA Import screen. Follow the instructions in this screen to save a trusted certification authority’ s certificate to the ZyXEL Device. [...]

P-662H/HW-D Series User’s Guide 278 Chapter 17 Certificates 17.10 T rusted CA Det ails Click Security > Certificates > T rusted CAs to open the T rusted CAs screen. Click the details icon to open the T rusted CA Details screen. Use this screen to view in-depth information about the certification authority’ s certif icate, change the certi[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 279 The following table describes the labels in this screen. Table 107 T rusted CA Details LABEL DESCRIPTION Name This field disp lays the identifying name of this certificate. If you want to change the name, type up to 31 characters to identify this key cert ificat e. Y ou may us e any cha[...]

P-662H/HW-D Series User’s Guide 280 Chapter 17 Certificates 17.1 1 T rusted Remote Host s Click Security > Certificates > T rusted Remote Hosts to open the T rusted Remote Hosts screen. This screen displays a list of the certificates of peers that you trust but which are not signed by one of the certification authorities on the T rusted CAs[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 281 Figure 148 T rusted Remote Hosts The following table describes the labels in this screen. Table 108 T rusted Remote Hosts LABEL DESCRIPTION PKI S torage S pace in Use This bar displays th e percentage of the Zy XEL Device’s PKI storage space that is currently in use. The bar turns fro[...]

P-662H/HW-D Series User’s Guide 282 Chapter 17 Certificates 17.12 V erifying a T rusted Remote Host’ s Certificate Certificates issued by certific ation authorities have the certificat ion authority’ s signature for you to check. Self-sig ned certificates only ha ve th e signature of the host itself. This means that you must be very careful w[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 283 V erify (over the phone for example) that the remote host has the sa me information in the Thumbprint Algorithm and Thumbprint fields. 17.13 T rusted Remote Host s Import Click Security > Certificates > T rusted Remote Hosts to open the T rusted Remote Hosts screen and then click [...]

P-662H/HW-D Series User’s Guide 284 Chapter 17 Certificates Figure 152 T rusted Remote Hos t Det ails[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 285 The following table describes the labels in this screen. Table 110 T rusted Remote Host Details LABEL DESCRIPTION Name Th is field displays the identifyin g name of this certificate. If you wan t to change the name, type up to 31 characters to id entify this key certificate. Y ou may us[...]

P-662H/HW-D Series User’s Guide 286 Chapter 17 Certificates 17.15 Directory Servers Click Security > Certificates > Dir ectory Servers to open the Directory Servers screen. This screen display s a summary list of directory se rvers (that contain lists of valid and revoked certificates) that have been save d into the ZyXEL Device. If you dec[...]

P-662H/HW-D Series User ’s Guide Chapter 17 Certificates 287 Figure 153 Directory Servers The following table describes the labels in this screen. 17.16 Directory Server Add or Edit Click Security > Certificates > Dir ectory Servers to open the Directory Servers screen. Click Add (or the details icon) to open the Dir ectory Server Add scree[...]

P-662H/HW-D Series User’s Guide 288 Chapter 17 Certificates Figure 154 Directory Server Add The following table describes the labels in this screen. T able 1 12 Directory Server Add LABEL DESCRIPTION Directory Service Setting Name T ype up to 31 ASCII characters (spaces ar e not permitted) to identify this directory server . Access Protocol Use t[...]

P-662H/HW-D Series User ’s Guide Chapter 18 Static Rout e 289 C HAPTER 18 S t atic Route This chapter shows you how to configure static routes for your ZyXEL Device. 18.1 S t atic Route Each remote node specifies only the network to which the gateway is di rectly connected, and the ZyXEL Device has no know ledge of the networks beyo nd. For insta[...]

P-662H/HW-D Series User’s Guide 290 Chapter 18 Static Route Figure 156 S tatic Route The following table describes the labels in this screen. 18.2.1 S t atic Route Edit Select a static route index numb er and click Edit . The screen shown next appears. Use this screen to configure the required information for a static route. T able 1 13 S tatic R[...]

P-662H/HW-D Series User ’s Guide Chapter 18 Static Rout e 291 Figure 157 S tatic Route Edit The following table describes the labels in this screen. T able 1 14 S tatic Route Edit LABEL DESCRIPTION Active This field allows you to activa te/deactivate this st atic route. Route Name Enter the name of the IP static route. Leave this field blank to d[...]

P-662H/HW-D Series User’s Guide 292 Chapter 18 Static Route[...]

P-662H/HW-D Series User ’s Guide Chapter 19 Bandwidth Managemen t 293 C HAPTER 19 Bandwid th Management This chapter contains information about configuri ng bandwidth management, editing rules and viewing the ZyXEL Device’ s band width management logs. 19.1 Bandwid th Management Overview ZyXEL ’ s Bandwidth Management allows you to specif y b[...]

P-662H/HW-D Series User’s Guide 294 Chapter 19 Bandwidth Management Figure 158 Subnet-based Ba ndwidt h Management Example 19.4 Application and Subnet-based Bandwid th Management Y ou could also create bandwidth clas ses based on a combination of a subnet and an application. The following exam ple table shows bandwidth alloca tions for applicatio[...]

P-662H/HW-D Series User ’s Guide Chapter 19 Bandwidth Managemen t 295 19.5.2 Fairness-based Scheduler The ZyXEL Device divides bandwidth equally among bandwidth classes when using the fairness-based scheduler; thus preventing one ba ndwidth class from using all of the interface’ s bandwidth. 19.6 Maximize Bandwid th Usage The maximize bandwi dt[...]

P-662H/HW-D Series User’s Guide 296 Chapter 19 Bandwidth Management 19.6.2 Maximize Ba ndwid th Usage Example Here is an example of a ZyXEL Device that has maximize bandwidth usage enabled on an interface. The following table shows each ba nd width class’ s bandwidth budget. The classes are set up based on subnets. The interface is set to 10240[...]

P-662H/HW-D Series User ’s Guide Chapter 19 Bandwidth Managemen t 297 • Research requires more bandwidth but only gets its budgeted 2048 kbps because all of the unbudgeted and unu sed bandwidth goes to the higher priority sales and marketing classes. 19.6.2.2 Fairness-based Allotment of Unused and Unbudgeted Bandwid th The following table shows[...]

P-662H/HW-D Series User’s Guide 298 Chapter 19 Bandwidth Management Figure 159 Bandwidth Ma nagement: Summary The following table describes the labels in this screen. Table 120 Media Bandwid th Management: Su mmary LABEL DESCRIPTION Interface These read -only labels repres ent the physical interfaces. Select an interface’s check box to enable b[...]

P-662H/HW-D Series User ’s Guide Chapter 19 Bandwidth Managemen t 299 19.8 Bandwid th Management Rule Setup Y ou must use the Bandwidth Management Summary screen to enable bandwidth management on an interface before yo u can configure rules for that interface. Click Advanced > Bandwidth MGMT > Rule Setup to open the following screen. Figure[...]

P-662H/HW-D Series User’s Guide 300 Chapter 19 Bandwidth Management 19.8.1 Rule Configuration Click the Edit icon or select User Defined from the Serv ice drop-down list in the Rule Setup screen to configure a bandwidth management ru le. Use bandwidth rules to allocate specific amounts of bandwidth capacity (bandwidth budget s) to specific applic[...]

P-662H/HW-D Series User ’s Guide Chapter 19 Bandwidth Managemen t 301 The following table describes the labels in this screen. Table 122 Bandwidth Management Rule Configuration LABEL DESCRIPTION Rule Configurati on Active Select this check box to have the ZyXEL Device apply this bandwidth management rule. Enable a bandwidth management rule to giv[...]

P-662H/HW-D Series User’s Guide 302 Chapter 19 Bandwidth Management The following table describes common services with their associated port numbers. 19.9 Bandwid th Monitor T o view the ZyXEL Device’ s ba ndwidth usage and allotments, click Advanced > Bandwidth MGMT > Mon itor . The screen appears as shown. Select an interface from the d[...]

P-662H/HW-D Series User ’s Guide Chapter 19 Bandwidth Managemen t 303 Figure 162 Bandwidth Ma nagement: Monitor[...]

P-662H/HW-D Series User’s Guide 304 Chapter 19 Bandwidth Management[...]

P-662H/HW-D Series User ’s Guide Chapter 20 Dynamic DNS Setup 305 C HAPTER 20 Dynamic DNS Setup This chapter discusses how to configure your ZyXEL Device to use Dynamic DNS. 20.1 Dynamic DNS Overview Dynamic DNS allows you to update your curre nt dynamic IP address with one or many dynamic DNS services so that anyone can c ont act you (in NetMe e[...]

P-662H/HW-D Series User’s Guide 306 Chapter 2 0 Dynamic DNS Setup Figure 163 Dynamic DNS The following table describes th e fields in this screen. Table 124 Dynamic DNS LABEL DESCRIPTION Dynamic DNS Setup Active Dynamic DNS Select this check box to use dynamic DNS. Service Provider This is the name of your Dyn amic DNS service provider . Dynamic [...]

P-662H/HW-D Series User ’s Guide Chapter 20 Dynamic DNS Setup 307 Dynamic DNS server auto detect IP Address Select this option only when there are one or more NA T routers between the ZyXEL Device and the DDNS server . This feat ure has the DDNS server automatically detect and use the IP address of th e NA T router that has a public IP address. N[...]

P-662H/HW-D Series User’s Guide 308 Chapter 2 0 Dynamic DNS Setup[...]

P-662H/HW-D Series User ’s Guide Chapter 21 Remote M anagement Configuratio n 309 C HAPTER 21 Remote Management Configuration This chapter provides information on config uring remote management. 21.1 Remote Management Overview Remote management allows you to determ ine which services/protocols can access which ZyXEL Device interface (if any) from[...]

P-662H/HW-D Series User’s Guide 310 Chapter 21 Remote Ma nagement Configuration • The IP address in the Secured Client IP field does not match th e client IP address. If it does not match, the ZyXEL Device will disconnect the session immediately . • There is already another rem ote management session with an equal or higher priority running. [...]

P-662H/HW-D Series User ’s Guide Chapter 21 Remote M anagement Configuratio n 311 The following table describes the labels in this screen. 21.3 T elnet Y ou can configure your ZyXEL Device for remote T elne t access as shown next. The administrator uses T elnet from a computer on a remote network to access the ZyXEL Device. Figure 165 T elnet Con[...]

P-662H/HW-D Series User’s Guide 312 Chapter 21 Remote Ma nagement Configuration Figure 166 Remote Mana gement: T elnet The following table describes the labels in this screen. 21.5 Configuring FTP Y ou can upload and download the ZyXEL Devi ce’ s firmware and configuration files using FTP , please see the chapter on firmware and configuration f[...]

P-662H/HW-D Series User ’s Guide Chapter 21 Remote M anagement Configuratio n 313 Figure 167 Remote Mana gement: FTP The following table describes the labels in this screen. 21.6 SNMP Simple Network Management Protocol (SNM P) i s a protocol u sed for exch anging management information b etween network devices. SNMP is a member of the TCP/IP prot[...]

P-662H/HW-D Series User’s Guide 314 Chapter 21 Remote Ma nagement Configuration Figure 168 SNMP Managemen t Model An SNMP managed network consis ts of two main types of comp onent: agen ts and a man ager . An agent is a management software module that resi des in a managed device (the ZyXEL Device). An agent translates the local manageme nt infor[...]

P-662H/HW-D Series User ’s Guide Chapter 21 Remote M anagement Configuratio n 315 21.6.2 SNMP T raps The ZyXEL Device will send traps to the SNMP manager when any on e of the following events occurs: 21.6.3 Configuring SNMP T o chang e your ZyXEL Device’ s SNMP settin gs, click Advanced > Remote MGMT > SNMP . The screen appears as shown. [...]

P-662H/HW-D Series User’s Guide 316 Chapter 21 Remote Ma nagement Configuration Figure 169 Remote Mana gement: SNMP The following table describes the labels in this screen. Table 129 Remote Mana gement: SNMP LABEL DESCRIPTION SNMP Port Y ou may change the server port number fo r a service if needed, however you must use the same port number in or[...]

P-662H/HW-D Series User ’s Guide Chapter 21 Remote M anagement Configuratio n 317 21.7 Configuring DNS Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa. Refer to the chapter on LAN for background information. T o change your ZyXEL Device’ s DNS settings, click Advanced > Remote MGMT > DNS . [...]

P-662H/HW-D Series User’s Guide 318 Chapter 21 Remote Ma nagement Configuration If an outside user attempts to probe an unsupp orted port on your ZyXEL Device, an ICMP response packet is automatically returned. This allows the ou tside user to know the ZyXEL Device exists. Y our ZyXEL Device supports anti- probing, which prevents the ICMP respons[...]

P-662H/HW-D Series User ’s Guide Chapter 21 Remote M anagement Configuratio n 319 21.9 TR-069 TR-069 is a protocol that de fines how your ZyXEL Device can be managed via a management server such as ZyXEL ’ s V antage CNM Acce ss. An administrator can use CNM Access to remotely set up the ZyXEL device, modify settings, perform firmware upgrad es[...]

P-662H/HW-D Series User’s Guide 320 Chapter 21 Remote Ma nagement Configuration periodicEnable [0:Disable/ 1:Enable] Whether or not the device must periodical ly send information to CNM Access. It is recommen ded to set this value t o 1 in order for the ZyXEL Device to send information to CNM Access. informInterval [sec] The duration in second s [...]

P-662H/HW-D Series User ’s Guide Chapter 22 Universa l Plug-and-Play (UPnP) 321 C HAPTER 22 Universal Plug-and-Play (UPnP) This chapter introduces the UPnP feature in the web configura tor . 22.1 Introducing Universal Plug and Play Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer n[...]

P-662H/HW-D Series User’s Guide 322 Chapter 22 Univer sal Plug-and-Play (UPnP) 22.1.3 Cautions with UPnP The automated nature of NA T traversal applications in establishing their own services and opening firewall ports ma y present network security issues. Network information and configuration may also be obtained and modifi ed by users in some n[...]

P-662H/HW-D Series User ’s Guide Chapter 22 Universa l Plug-and-Play (UPnP) 323 The following table describes the fields in this screen. 22.3 Inst alling UPnP in Windows Example This section shows ho w to install UPnP in W indows Me and W indows XP . Inst alling UPnP in Windows Me Follow the steps below to inst all the UPnP in W indows Me. 1 Clic[...]

P-662H/HW-D Series User’s Guide 324 Chapter 22 Univer sal Plug-and-Play (UPnP) Figure 174 Add/Remove Programs: Wind ows Setup: Communication 3 In the Communications window , select the Universal Plug and Play check box in the Components selection box. Figure 175 Add/Remove Programs: Wind ows Setup: Communication: Component s 4 Click OK to go back[...]

P-662H/HW-D Series User ’s Guide Chapter 22 Universa l Plug-and-Play (UPnP) 325 Inst alling UPnP in Windows XP Follow the steps below to install the UPnP in Windows XP . 1 Click St a r t and Contr ol Panel . 2 Double-click Network Connections . 3 In the Network Connections window , click Advanced in the main menu and select Optional Networking Co[...]

P-662H/HW-D Series User’s Guide 326 Chapter 22 Univer sal Plug-and-Play (UPnP) Figure 178 Networking Services 6 Click OK to go back to the W indows Optional Networking Component Wizard window and click Next . 22.4 Using UPnP in Windows XP Example This section shows yo u how to use the UPnP feature in W indows XP . Y ou must already have UPnP inst[...]

P-662H/HW-D Series User ’s Guide Chapter 22 Universa l Plug-and-Play (UPnP) 327 Figure 179 Network Connections 3 In the Internet Connection Properties window , click Settings to see the port mappings there were automatically created. Figure 180 Internet Connection Properties[...]

P-662H/HW-D Series User’s Guide 328 Chapter 22 Univer sal Plug-and-Play (UPnP) 4 Y ou may edit or delete the port mappings o r click Add to manually add port mappings. Figure 181 Internet Connection Properties: Adva nced Settings Figure 182 Internet Connection Proper ties: Adva nced Settings: Add 5 When the UP nP-enabled device is disconn ected f[...]

P-662H/HW-D Series User ’s Guide Chapter 22 Universa l Plug-and-Play (UPnP) 329 Figure 183 System T ray Icon 7 Double-click on the icon to display yo ur curr ent Internet co nnection sta tus. Figure 184 Internet Connection S tatus Web Configurator Eas y Access W ith UPnP , you can acc ess the web-based configurator on the ZyXEL Device without fin[...]

P-662H/HW-D Series User’s Guide 330 Chapter 22 Univer sal Plug-and-Play (UPnP) Figure 185 Network Connections 4 An icon with the description for e ach UPnP-enabled device displays unde r Local Network . 5 Right-click on the icon for your ZyXEL Device an d select Invoke . The web configurator login screen displays.[...]

P-662H/HW-D Series User ’s Guide Chapter 22 Universa l Plug-and-Play (UPnP) 331 Figure 186 Network Connections: My Network Places 6 Right-click on the icon for your ZyXEL Device and select Pr operties . A properties window displays with basic info rmation about the ZyXEL Device. Figure 187 Network Connections: My Networ k Places: Properties: Exam[...]

P-662H/HW-D Series User’s Guide 332 Chapter 22 Univer sal Plug-and-Play (UPnP)[...]

P-662H/HW-D Series User ’s Guide Chapter 23 System 333 C HAPTER 23 System Use this screen to configure the ZyXEL Device’ s time and date settings. 23.1 General Setup 23.1.1 General Setup and System Name General Setup contains administrative and system-related information. System Name is for identification purposes. However , because some ISPs c[...]

P-662H/HW-D Series User’s Guide 334 Chapter 23 Syst em Figure 188 System General Setu p The following table describes the labels in this screen. T able 134 System General Setup LABEL DESCRIPTION General Setup System Name Choose a descriptive name for identification purposes. It i s recommended you enter your computer’s “Compu ter name” in t[...]

P-662H/HW-D Series User ’s Guide Chapter 23 System 335 23.2 T ime Setting T o change yo ur ZyXEL Device’ s time and date, click Maintenance > System > Time Setting . The screen appears as shown. Use this screen to configure the ZyXEL Device’ s time based on your local time zone. Figure 189 System T ime Setting Admin Password In addition[...]

P-662H/HW-D Series User’s Guide 336 Chapter 23 Syst em The following table describes th e fields in this screen. Table 135 System T ime Setting LABEL DESCRIPTION Current T ime and Date Current T ime This field displays the ti me of your ZyXEL Device. Each time you reload this page, the ZyXEL Device synch ronizes the time with the time server . Cu[...]

P-662H/HW-D Series User ’s Guide Chapter 23 System 337 S tart Date Configu re the day and time when Da ylight Saving Time start s if you selected Enable Daylight Saving . The o'clock field uses the 24 hour fo rmat. Here are a couple of examples: Daylight Saving Time st arts in most p arts of the United S tates on the first Sunday of April. E[...]

P-662H/HW-D Series User’s Guide 338 Chapter 23 Syst em[...]

P-662H/HW-D Series User ’s Guide Chapter 24 Logs 339 C HAPTER 24 Logs This chapter contains inform ation about configuring genera l log settings and viewing the ZyXEL Device’ s logs. Refer to the append ix for example log message explanations. 24.1 Logs Overview The web confi gurator allows you to choose which categories of events and/or alerts[...]

P-662H/HW-D Series User’s Guide 340 Chapter 24 Logs Figure 190 V iew Log The following table describes th e fields in this screen. 24.3 Configuring Log Settings Use the Log Settings screen to configure to where the Zy XEL Device is to send logs; the schedule for when the ZyXEL Device is to send the logs and which logs and/or immediate alerts the [...]

P-662H/HW-D Series User ’s Guide Chapter 24 Logs 341 Alerts are e-mailed as soon as they happen. Logs may be e-ma iled as soon as the log is full. Selecting many alert and/or log categories (especially Access Control ) may result in many e- mails being sent. Figure 191 Log Settings The following table describes the fields in this screen. Table 13[...]

P-662H/HW-D Series User’s Guide 342 Chapter 24 Logs Send Log T o The ZyXEL Device sends logs to the e-mail addr ess specified in this field. If this field is left blank, the ZyXEL Device does not send logs via e-mail. Send Alerts T o Alerts are real-time notifications that are sent as soon as an event, such as a DoS attack, system error , or forb[...]

P-662H/HW-D Series User ’s Guide Chapter 24 Logs 343 24.4 SMTP Error Messages The following table lists common SMTP errors. 24.4.1 Example E-mail Log An "End of Log" message displays for each ma il in which a complete log has been sent. The following is an example of a log sent by e-mail. • Y ou may edit the subject title. • The dat[...]

P-662H/HW-D Series User’s Guide 344 Chapter 24 Logs[...]

P-662H/HW-D Series User ’s Guide Chapter 25 Tools 345 C HAPTER 25 To o l s This chapter describes how to upload new firm ware, manage configuration and restart your ZyXEL Device. 25.1 Firmware Upgrade Find firmware at www .zyxel.com in a file that (usually) uses the system model name with a.bin extension, for example, "ZyXEL Device .bin"[...]

P-662H/HW-D Series User’s Guide 346 Chapter 25 Tools Note: Do NOT turn off th e ZyXEL Device while firmware upload is in pro gress! After you see the Firmware Upload in Pr ogr ess screen, wait two minutes before logging into the ZyXEL Device again. Figure 194 Firmware Uplo ad In Progress The ZyXEL Device automatically restarts in this time causin[...]

P-662H/HW-D Series User ’s Guide Chapter 25 Tools 347 Figure 196 Error Message 25.2 Configuration Screen Click Maintenance > T ools > Configuration . Information related to fact ory defaults, backup configuration, and rest oring configuration appears as sho wn next. Figure 197 Configuration 25.2.1 Backup Configuration Backup configuration a[...]

P-662H/HW-D Series User’s Guide 348 Chapter 25 Tools 25.2.2 Restore Configuration Restore configuration allows you to upload a new or previously saved configuration file from your computer to your ZyXEL Device. Note: Do not turn of f the ZyXEL Device while configu ration file upload is in progress After you see a “Restore Configuration successf[...]

P-662H/HW-D Series User ’s Guide Chapter 25 Tools 349 Figure 200 Configuration Restore Er ror 25.2.3 Back to Factory Default s Pressing the Reset button in this section clears al l user-e ntered configuration information and returns the ZyXEL Device to its factory defaults. Y ou can also press the RESET button on the rear pa nel to reset the fact[...]

P-662H/HW-D Series User’s Guide 350 Chapter 25 Tools[...]

P-662H/HW-D Series User ’s Guide Chapter 26 Diagnostic 351 C HAPTER 26 Diagnostic These read-only screens display information to help you identify problems with the ZyXEL Device. 26.1 General Diagnostic Click Maintenance > Diagnostic to open the screen shown next. Figure 202 Diagnostic: General The following table describes th e fields in this[...]

P-662H/HW-D Series User’s Guide 352 Chapter 26 Diagnostic 26.2 DSL Line Diagnostic Click Maintenance > Diagnostic > DSL Line to open the screen shown next . Figure 203 Diagnostic: DSL Line The following table describes th e fields in this screen. Table 142 Diagnostic: DSL Line LABEL DESCRIPTION A TM S tatus Click this button to view A TM st[...]

P-662H/HW-D Series User ’s Guide Chapter 27 Troubleshooting 353 C HAPTER 27 T roubleshooting This chapter covers potential proble ms and the corresponding remedi es. 27.1 Problems St arting Up the ZyXEL Device 27.2 Problems with the LAN Table 143 Troubleshooting Startin g Up Your ZyXEL Device PROBLEM CORRECTIVE ACTION None of the LEDs turn on whe[...]

P-662H/HW-D Series User’s Guide 354 Chapter 27 Troublesh ooting 27.3 Problems with the W AN Table 145 Troubleshooting the WAN PROBLEM CORRECTIVE ACTION The DSL LED is off. Check the telephone wire and connection s between the ZyXEL Device DSL port and the wall jack. Make sure that the telephone company has checked your phone line and set it up fo[...]

P-662H/HW-D Series User ’s Guide Chapter 27 Troubleshooting 355 27.4 Problems Accessi ng the ZyXEL Device 27.4.1 Pop-up Windows, Ja vaScript s and Java Permissions In order to use the web configurator you need to allow: • W eb browser pop-up windows fro m your device. • JavaScripts (enabled by default). • Java permissions (enabled by defaul[...]

P-662H/HW-D Series User’s Guide 356 Chapter 27 Troublesh ooting Figure 204 Pop-up Blocker Y ou can also check if po p-up blocking is disabled in the Pop-up Blocker section in the Privacy tab. 1 In Internet Explorer , select To o l s , Internet Options , Privacy . 2 Clear the Block pop-ups check box in the Pop-up Block er section of the screen. Th[...]

P-662H/HW-D Series User ’s Guide Chapter 27 Troubleshooting 357 Figure 206 Internet Options 3 T ype the IP address of your device (the web page that you do not want to have blocked) with the prefix “http://”. For example, http://192.168.1.1. 4 Click Add to move the IP address to the list of Allowed sites .[...]

P-662H/HW-D Series User’s Guide 358 Chapter 27 Troublesh ooting Figure 207 Pop-up Blocker Settings 5 Click Close to return to the Privacy screen. 6 Click Apply to save this setting. 27.4.1.2 JavaScript s If pages of the web configura tor do not display properly in Intern et Explorer , check that JavaScripts are allowed. 1 In Internet Explorer , c[...]

P-662H/HW-D Series User ’s Guide Chapter 27 Troubleshooting 359 Figure 208 Internet Options 2 Click the Custom Level... button. 3 Scroll down to Scripting . 4 Under Active scripting make sure that Enable is selected (the default). 5 Under Scripting of Java applets make sure that Enable is sele cted (the default). 6 Click OK to clos e the window .[...]

P-662H/HW-D Series User’s Guide 360 Chapter 27 Troublesh ooting Figure 209 Security Settings - Java Scripting 27.4.1.3 Java Permissions 1 From Internet Explorer , click To o l s , Internet Options and then the Security tab. 2 Click the Custom Level... button. 3 Scroll down to Microsoft VM . 4 Under Java permissions make sure that a safety level i[...]

P-662H/HW-D Series User ’s Guide Chapter 27 Troubleshooting 361 Figure 210 Security Settings - Java 27.4.1.3.1 JA V A (Sun) 1 From Internet Explorer , click To o l s , Internet Options and then the Advanced tab. 2 make sure that Use Java 2 for <applet> u nder Java (Sun) is selected. 3 Click OK to clos e the window . Figure 21 1 Java (Sun)[...]

P-662H/HW-D Series User’s Guide 362 Chapter 27 Troublesh ooting 27.4.2 ActiveX Controls in Internet Explorer If ActiveX is disabled, you will not be able to download ActiveX cont rols or to use T rend Micro Security Services. Make sure that ActiveX controls are allowed in Internet Explorer . Screen shots for Internet Explorer 6 are sh own. Steps [...]

P-662H/HW-D Series User ’s Guide Chapter 27 Troubleshooting 363 Figure 213 Security Setting ActiveX Controls[...]

P-662H/HW-D Series User’s Guide 364 Chapter 27 Troublesh ooting[...]

P-662H/HW-D Series User ’s Guide Appendix A Product Specifications 365 A PPENDIX A Product S pecifications See also the Introduction ch apter for a general overv iew of the key features. S pecification T ables Table 147 Device Default IP Address 192.168.1 .1 Default Subnet Mask 255.255 .255.0 (24 bits) Default Password 1 234 DHCP Pool 192.168.1.3[...]

P-662H/HW-D Series User’s Guide 366 Product Specifications Table 148 Firmware ADSL S tandards Multi-Mode standard (ANSI T1.413,Issu e 2; G .dmt(G .992.1); G .lite(G992.2)). ADSL2 G . dmt.bis (G .992 .3) ADSL2 G . lite.bis (G .992.4) ADSL2+ (G .992.5) Reach-Extended ADSL (RE ADSL) SRA (Seamless Rate Adaptation) Auto-negotiating rate adaptation ADS[...]

P-662H/HW-D Series User ’s Guide Appendix A Product Specifications 367 Wireless (P-662HW only) IEEE 802.1 1g Compliance Wireless g+ technology Frequency Range: 2.4 GHz Advanced Orthogonal Frequency Divisio n Multiplexing (OFDM) Data Rates: 108Mbps and Auto Fallback Wired Equivalent Privacy (WEP) Data Encryption 64/128/256 bit. WLAN bridge to LAN [...]

P-662H/HW-D Series User’s Guide 368 Product Specifications[...]

P-662H/HW-D Series User ’s Guide Appendix B About ADSL 369 A PPENDIX B About ADSL Introduction to DSL DSL (Digital Subscriber Line) te chnology enhances the data ca pacity of the existing twisted- pair wire that runs betwee n the local telephone co mpany switching of fi ces and most homes and offices. While the wire itself can handle higher frequ[...]

P-662H/HW-D Series User’s Guide 370 Appendix B About ADSL 2 Because your line is dedicated (not shared ), transmission speed s between you and the device to which you con nect at your service provider are not af fected by other users. W ith cable modems, transmission sp eeds drop significa ntly as mo re users go on-line because the line is shared[...]

P-662H/HW-D Series User ’s Guide Appendix C Wa ll-mounting Instru ctions 371 A PPENDIX C W all-mounting Instructions Do the following to hang your ZyXEL Devic e on a wall. Note: See the product specifications appe ndix for the size of screws to use and how far apart to place them. 1 Locate a high posit ion on wall that is free of ob structions. U[...]

P-662H/HW-D Series User’s Guide 372 Appendix C Wall-mountin g Instructions[...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 373 A PPENDIX D Setting up Y our Computer ’ s IP Address All computers must have a 10M or 100M Et hernet adapter card and TCP/IP installed. W indows 95/98/Me/NT/2000/XP , Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the softw[...]

P-662H/HW-D Series User’s Guide 374 Appendix D Setting up Your Computer’s IP Address Figure 215 WIndows 95/98 /Me: Network: Co nfiguration Inst alling Components The Network window Configuration tab displays a list of installed components. Y ou need a network adapter , the TCP/IP protocol and Client for Microso ft Networks. If you need the adap[...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 375 3 Select Microsoft from the list of manufacturers. 4 Select Client for Microsoft Networks from the list of network clients and then click OK . 5 Restart your computer so the changes you made take ef fect. Configuring 1 In the Network window Configuration tab, [...]

P-662H/HW-D Series User’s Guide 376 Appendix D Setting up Your Computer’s IP Address Figure 217 Windows 95/98/Me : TCP/IP Pr operties: DNS Configuration 4 Click the Gateway tab. • If you do not know your gateway’ s IP address, remove previously installed gateways. • If you have a gateway IP address, type it in the New gateway field and cl[...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 377 Figure 218 Windows XP: S tart Menu 2 In the Control Panel , double-click Network Connections ( Network and Dial-up Connections in W indows 2000/NT). Figure 219 Windows XP: Control Panel 3 Right-click Local Area Connection and then click Pr oper ties .[...]

P-662H/HW-D Series User’s Guide 378 Appendix D Setting up Your Computer’s IP Address Figure 220 Windows XP: Control Panel: Network Connections: Pro perties 4 Select Internet Protocol (TCP/IP) (under the Genera l tab in W in XP) and then click Properties . Figure 221 Windows XP: Local Area Conne ction Properties 5 The Internet Pr otocol TCP/IP P[...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 379 • If you have a static IP address click Use the following IP Address and fill in the IP addr ess , Subnet mask , and Default gateway fields. • Click Advanced . Figure 222 Windows XP: Internet Protocol (TCP/IP) Propert ies 6 If you do not know your gateway&[...]

P-662H/HW-D Series User’s Guide 380 Appendix D Setting up Your Computer’s IP Address Figure 223 Windows XP: Advanced TCP/IP Properties 7 In the Internet Protocol TCP/IP Pr operties window (the General tab in W indows XP): • Click Obtain DNS server address automatically if you do not know your DNS server IP addre ss(es). • If you know your D[...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 381 Figure 224 Windows XP: Internet Protocol (TCP/IP) Propert ies 8 Click OK to close the Internet Protocol (TCP/IP) Pr operties window . 9 Click Close ( OK in W indows 2000/NT) to close the Local Area Connection Properties window . 10 Close the Network Connection[...]

P-662H/HW-D Series User’s Guide 382 Appendix D Setting up Your Computer’s IP Address Figure 225 Macintosh OS 8/9: Apple Menu 2 Select Ethernet built-in from the Connect via list. Figure 226 Macintosh O S 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configur e: list.[...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 383 4 For statically assigned settings, do the following: •F r o m t h e Configure box, select Manually . • T ype your IP address in the IP Address box. • T ype your subnet mask in the Subnet mask box. • T ype the IP address of your ZyXEL Device in the Rou[...]

P-662H/HW-D Series User’s Guide 384 Appendix D Setting up Your Computer’s IP Address Figure 228 Macintosh O S X: Network 4 For statically assigned settings, do the following: •F r o m t h e Configure box, select Manually . • T ype your IP address in the IP Address box. • T ype your subnet mask in the Subnet mask box. • T ype the IP addr[...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 385 Note: Make sure you are logged in as the ro ot administrator . Using the K Desktop Environment (KDE) Follow the steps below to configure your computer IP address using the KDE. 1 Click the Red Hat button (located on the bottom left corner), select System Setti[...]

P-662H/HW-D Series User’s Guide 386 Appendix D Setting up Your Computer’s IP Address • If you have a dynamic IP address click Automatically obtain IP address settings with and select dhcp from the drop down list. • If you have a static IP address click S tatically set IP Addresses and fill in the Address , Subnet mask , and Default Gateway [...]

P-662H/HW-D Series User ’s Guide Appendix D Setting up Your Computer’s IP Address 387 1 Assuming that you have only one network card on the computer , locate the ifconfig- eth0 configuration file (where eth0 is the name of the Ethernet card). Open the configuration file with any plain text editor . • If you have a dynamic IP ad dress, enter d[...]

P-662H/HW-D Series User’s Guide 388 Appendix D Setting up Your Computer’s IP Address Figure 236 Red Hat 9.0: Restart Eth ernet Card V erifying Settings Enter ifconfig in a terminal screen to ch eck your TCP/IP properties. Figure 237 Red Hat 9.0: Checking TCP/IP Properties [root@localhost init.d]# network res tart Shutting down interface eth0: [[...]

P-662H/HW-D Series User ’s Guide Appendix E IP Addresses an d Subnetting 389 A PPENDIX E IP Addresses and Subnetting This appendix introduces IP addresses, IP address classes and subnet masks. Y ou use subnet masks to subdivid e a network in to smaller logical networks. Introduction to IP Addresses An IP address has two parts: the network numb er[...]

P-662H/HW-D Series User’s Guide 390 Appendix E IP Addresses and Su bnetting The following table shows the network number and host ID arrangement for classes A, B and C. An IP address with host IDs of all zeros is the IP address of the n etwork (192.168. 1.0 for example). An IP address with host IDs of all ones is the broadcast address for that ne[...]

P-662H/HW-D Series User ’s Guide Appendix E IP Addresses an d Subnetting 391 Subnet Masks A subnet mask is used to dete rmine which bits are part of th e network number , and which bits are part of the host ID (using a logical AND operation). A subnet mask has 32 bits. If a b it in the subnet mask is a “1” then the corresponding bit in the IP[...]

P-662H/HW-D Series User’s Guide 392 Appendix E IP Addresses and Su bnetting The first mask shown is the class “C” natural m ask. Normally if no mask is specified it is understood that the natura l mask is being used. Example: T wo Subnet s As an example, you have a class “C” address 1 92.168.1.0 wi th subnet mask o f 255.255.255 .0. The f[...]

P-662H/HW-D Series User ’s Guide Appendix E IP Addresses an d Subnetting 393 Host IDs of all zeros represent the subnet itsel f and host IDs of all ones are the broadcast address for that subnet, so the actual number of hosts available on each subnet in the example above is 2 7 – 2 or 126 h osts for each subnet. 192.168.1.0 with mask 255.255 .2[...]

P-662H/HW-D Series User’s Guide 394 Appendix E IP Addresses and Su bnetting Example Eight Subnet s Similarly use a 27-bit mask to create eight subnets (000, 001, 010 , 01 1, 100, 101, 1 10 and 111 ) . Subnet Address: 192.1 68.1.0 Lowest Host ID: 192 .168.1.1 Broadcast Address: 192.168.1.63 Highest Host ID: 192.168.1.62 Table 157 Subnet 2 IP/SUBNE[...]

P-662H/HW-D Series User ’s Guide Appendix E IP Addresses an d Subnetting 395 The following table shows class C IP ad dress last octet values for each subnet. The following table is a summary for class “C” subnet planning. Subnetting With Class A and Class B Networks. For class “A” and class “B” addresses the subnet ma sk also determin[...]

P-662H/HW-D Series User’s Guide 396 Appendix E IP Addresses and Su bnetting The following table is a summary for class “B” subnet planning. Table 162 Class B Subnet Planning NO. “BORROWED” HOST BIT S SUBNET MASK NO. SUBNETS NO. HOSTS PER SUBNET 1 255.255.128.0 (/17) 2 32766 2 255.255.192.0 (/18) 4 16382 3 255.255.224.0 (/19) 8 8190 4 255.[...]

P-662H/HW-D Series User ’s Guide Appendix F Wireless LANs 397 A PPENDIX F Wireless LANs Wireless LAN T opologies This section discusses ad-hoc and in frastructure w ireless LAN topologies. Ad-hoc Wireless LAN Configuration The simplest WLAN configuration is an inde pendent (Ad-hoc) WLAN that connects a set of computers with wireless stations (A, [...]

P-662H/HW-D Series User’s Guide 398 Appendix F Wireless LA Ns Figure 239 Basic Service Set ESS An Extended Service Set (ESS) consists of a series of overlappi ng BSSs, each containing an access point, with each access point connected together by a wired network. This wired connection between APs is called a Distribution System (DS). This type of [...]

P-662H/HW-D Series User ’s Guide Appendix F Wireless LANs 399 Figure 240 Infrastructure WLAN Channel A channel is the radio frequency(ies) used by IEEE 802.1 1a/b/g wireless devices. Channels available depend on your ge ographical area. Y ou may have a choice o f channels (for your region) so you should use a dif ferent channel th an an adjacent [...]

P-662H/HW-D Series User’s Guide 400 Appendix F Wireless LA Ns Figure 241 RTS/ CTS When station A sends data to the AP , it might no t know that the station B is already using the channel. If these two stations se nd data at the same time, collis ions may occur when both sets of data arrive at the AP at the same time, r esulting in a loss of me ss[...]

P-662H/HW-D Series User ’s Guide Appendix F Wireless LANs 401 A large Fragmentation Thr eshold is recommended for networks not prone to interference while you should set a smaller thresh old for busy networks or networks tha t are prone to interference. If the Fragmentation Threshold value is smaller than the RT S /C T S value (see previously) yo[...]

P-662H/HW-D Series User’s Guide 402 Appendix F Wireless LA Ns IEEE 802.1x In June 2001, the IEEE 802.1x st andard was designed to extend th e features of IEEE 802.1 1 to support extended authentication as well as providing additional accounting and control features. It is supported by W indows XP and a number of network devices. Some advantages o[...]

P-662H/HW-D Series User ’s Guide Appendix F Wireless LANs 403 • Access-Challenge Sent by a RADIUS server requesting more information in order to allow access. The access point sends a proper response from the user and then sends another Access- Request message. The following types of RADIUS messages are exchanged between the acces s point and t[...]

P-662H/HW-D Series User’s Guide 404 Appendix F Wireless LA Ns EAP-TLS (T ransport Layer Security) W ith EAP-TLS, digital certifications are needed by both the server and the wireless st ations for mutual authentication. The server presents a certificate to the client. After validating the identity of the server , the client sends a differ ent cer[...]

P-662H/HW-D Series User ’s Guide Appendix F Wireless LANs 405 For added security , certificate-based authen tications (EAP-TLS, EAP-TTLS and PEAP) use dynamic keys for data encryption. They are ofte n deployed in corp orate environments, but for public deployment, a simp le user name and p assword pair is more practical. The following table is a [...]

P-662H/HW-D Series User’s Guide 406 Appendix F Wireless LA Ns TKIP uses 128-bit keys that are dyna mically generated and distribu ted by the authentication server . AES (Advanced Encryption S tandard) is a block cipher that uses a 256-bit mathematical algorithm called Rijndael. They bo th include a p er-p acket key mixing function, a Message Inte[...]

P-662H/HW-D Series User ’s Guide Appendix F Wireless LANs 407 Security Parameters Summary Refer to this table to see what other secur ity parameters you should co nfigure for each Authentication Method/ key management prot ocol type. MAC address filters are not dependent on how you config ure these security features. Table 165 Wireless Security R[...]

P-662H/HW-D Series User’s Guide 408 Appendix F Wireless LA Ns[...]

P-662H/HW-D Series User ’s Guide Appendix G Importing Certificates 409 A PPENDIX G Importing Certificates This appendix shows importing certificat es examples using In ternet Ex plorer 5. Import ZyXEL Device Certificates into Net scape Navigator In Netscape Navigator , you can permanently tr ust the ZyXEL Device’ s server certificate by importi[...]

P-662H/HW-D Series User’s Guide 410 Appendix G Im porting Certificates 1 In Internet Explorer , double click th e lock shown in the following screen. Figure 243 Login Screen 2 Click Install Certificate to open the Install Certificate wizard. Figure 244 Certificate General Information befor e Import 3 Click Next to begin the Install Certificate wi[...]

P-662H/HW-D Series User ’s Guide Appendix G Importing Certificates 411 Figure 245 Certificate Import Wizard 1 4 Select where you would like to store the certificate and then click Next . Figure 246 Certificate Import Wizard 2 5 Click Finish to complete the Import Certificate wizard.[...]

P-662H/HW-D Series User’s Guide 412 Appendix G Im porting Certificates Figure 247 Certificate Import Wizard 3 6 Click Ye s to add the ZyXEL Device certificate to the root store. Figure 248 Root Certificate S tore[...]

P-662H/HW-D Series User ’s Guide Appendix G Importing Certificates 413 Figure 249 Certificate General Information af ter Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the ZyXEL Device. Y ou must have imported at least one trusted CA to the ZyXEL Device [...]

P-662H/HW-D Series User’s Guide 414 Appendix G Im porting Certificates Figure 250 ZyXEL Device Trusted CA Screen The CA sends you a package containing the CA ’ s trusted certificate(s), your persona l certificate(s) and a password to inst all the personal certificate(s). Inst alling the CA ’ s Certificate 1 Double click the CA ’ s trusted c[...]

P-662H/HW-D Series User ’s Guide Appendix G Importing Certificates 415 Inst alling Y our Personal Certificate(s) Y ou need a password in a dvance. The CA may is sue the password or you may have to specify it during the enrollment. Double-click the person al certificate given to you by the CA to produce a screen simi lar to the one shown next 1 Cl[...]

P-662H/HW-D Series User’s Guide 416 Appendix G Im porting Certificates Figure 254 Personal Certificate Import Wizard 3 4 Have the wizard determine where the certificat e should be saved on your computer or select Place all certificates in the following stor e and choose a dif fe rent location. Figure 255 Personal Certificate Import Wizard 4 5 Cli[...]

P-662H/HW-D Series User ’s Guide Appendix G Importing Certificates 417 Figure 256 Personal Certificate Import Wizard 5 6 Y ou should see the following screen when the ce rtificate is correctly installed on your computer . Figure 257 Personal Certificate Import Wizard 6 Using a Certificate When Accessing the ZyXEL Device Example Use the following [...]

P-662H/HW-D Series User’s Guide 418 Appendix G Im porting Certificates Figure 259 SSL Client Authentication 3 Y ou next see the ZyXEL Device login screen. Figure 260 ZyXEL Device Se cure Logi n Screen[...]

P-662H/HW-D Series User ’s Guide Appendix H Com mand Interpreter 419 A PPENDIX H Command Interpreter The following describes how to use the command interpreter . Note: Use of undocumented comma nds or misconfiguration can damage the unit and possibly render it unusable. Command Synt ax • The command keywords are in courier new font. • Enter t[...]

P-662H/HW-D Series User’s Guide 420 Appendix H Command Interpreter[...]

P-662H/HW-D Series User ’s Guide Appendix I Certificate s Commands 421 A PPENDIX I Certificates Commands The following describes the certificate commands. See Appendix H o n page 419 for information on the command structure. All of these commands start with certificates. Table 166 Certificates Commands COMMAND DESCRIPTION my_cert create create se[...]

P-662H/HW-D Series User’s Guide 422 Appendix I Certificates Commands create cmp_enroll <name> <CA addr> <CA cert> <auth key> <subject> [key size] Create a certificate request and enroll for a certificate immediately online using CMP protocol. <name> specifies a descriptive name for the enrolled certificate. <[...]

P-662H/HW-D Series User ’s Guide Appendix I Certificate s Commands 423 replace_fact ory Create a certificate using your device MAC address that will be specific to this device. The factory default certificate is a common default certificate for al l ZyWALL models. ca_trusted import <name> Import the PEM-encoded certificate from stdin. <n[...]

P-662H/HW-D Series User’s Guide 424 Appendix I Certificates Commands delete <name> Delete the specified trusted remote host certificate. <name> sp ecifies the name of the certificate to be dele ted. list List all trusted remote host certificate names and basic info rmation. rename <old name> <new name> Rename the specified[...]

P-662H/HW-D Series User ’s Guide Appendix J Boot Commands 425 A PPENDIX J Boot Commands The BootModule A T comman ds execute from wi thin the router ’ s bootup software, when debug mode is selected before the main router firmware is start ed. When you start up your ZyXEL Device, you are given a choice to go into debug mode by pressing a key at [...]

P-662H/HW-D Series User’s Guide 426 Appendix J Boot Commands Figure 262 Boot Module Commands AT just answer OK ATHE print help ATBAx change baud rate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debu g Flag (y=password) ATSE show the seed of passw ord generator ATTI(h,m,s) change system time to hour:min:sec or show curre[...]

P-662H/HW-D Series User ’s Guide Appendix K Firewall Commands 427 A PPENDIX K Firewall Commands The following describes the firewall commands. Table 167 Firewall Commands FUNCTION COMMAND DESCRIPTION Firewall Se tUp config edit firewall active <yes | no> This command turns the firewall on or off. config retrieve firewall This co mmand retur[...]

P-662H/HW-D Series User’s Guide 428 Appendix K Firewall Commands E-mail config edit firewall e-mail mail-server <ip address of mail server> This command sets the IP address to which the e-mail messages are sent. config edit firewall e-mail return-addr <e-mail address> This command sets the source e-mail add ress of the firewall e-mail[...]

P-662H/HW-D Series User ’s Guide Appendix K Firewall Commands 429 config edit firewall attack minute-high <0-255> This command sets the threshold rate of new half-open sessions per minute where the ZyXEL Device starts deleting old half-opened sessions until it gets t hem down to the minute- low threshold. config edit firewall attack minute-[...]

P-662H/HW-D Series User’s Guide 430 Appendix K Firewall Commands Config edit firewall set <set #> tcp-idle-timeout <seconds> This command sets how long ZyXEL Device lets an inactive TCP connection re main open before considering it closed. Config edit firewall set <set #> log <yes | no> This command sets whether or not the[...]

P-662H/HW-D Series User ’s Guide Appendix K Firewall Commands 431 config edit firewall set <set #> rule <rule #> destaddr- single <ip address> This command sets the rule to have the ZyXEL Device check fo r traffic with this individual destination ad dress. config edit firewall set <set #> rule <rule #> destaddr- subn[...]

P-662H/HW-D Series User’s Guide 432 Appendix K Firewall Commands config delete firewall set <set #> rule<rule #> This command removes the specified rul e in a firewall configuration set. Table 167 Firewall Commands ( continued) FUNCTION COMMAND DESCRIPTION[...]

P-662H/HW-D Series User ’s Guide Appendix L NetBIOS Filter Commands 433 A PPENDIX L NetBIOS Filter Commands The following describes the Ne tBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output System ) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up servic[...]

P-662H/HW-D Series User’s Guide 434 Appendix L NetBIOS Filter Commands The filter types and their defa ult settings are as follows. NetBIOS Filter Configuration Syntax:sys filter netbios config <ty pe> <on|off> where Table 168 NetBIOS Filter Default Settings NAME DESCRIPTION EXAMPLE Between LAN and WAN This field displays whether NetB[...]

P-662H/HW-D Series User ’s Guide Appendix L NetBIOS Filter Commands 435 sys filter netbios config 3 on This command blocks IPSec NetBIOS packets. sys filter netbios config 4 off This command stops NetBIOS commands from initiating calls.[...]

P-662H/HW-D Series User’s Guide 436 Appendix L NetBIOS Filter Commands[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 437 A PPENDIX M Internal SPTGEN Internal SPTGEN Overview Internal SP TGEN (System Parame ter T able Generator) is a configuration text file useful for efficient configuration of multiple ZyXEL Device. Internal SP TGEN lets you configure, save and upload multiple menus at the same time us[...]

P-662H/HW-D Series User’s Guide 438 Appendix M Internal SPTGEN Some parameters are dependent on othe rs. For example, if you disable the Configur ed field in menu 1 (see Figure 263 on page 437 ), then you disable every field in this menu . If you enter a parameter that is invalid in the In put column, the ZyXEL Device will not save the configurat[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 439 Figure 266 Internal SP TGEN FTP Downl oad Example Note: Y ou can rename your “ rom-t ” file wh en you save it to your computer but it must be named “ rom-t ” when you uplo ad it to your ZyXEL De vice. Internal SPTGEN FTP Upload Example 1 Launch your FTP application. 2 Enter &[...]

P-662H/HW-D Series User’s Guide 440 Appendix M Internal SPTGEN The following are Internal SP TGEN sc reens asso ciated with the SMT screens of your ZyXEL Device. PV A Parameter V alues Allo wed INPUT An example of what you may enter * Applies to the Z yXEL Device. Table 169 Abbreviations Used in the Example Interna l SPTGEN Screens Tabl e (contin[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 441 / Menu 3.2 TCP/IP and DHCP Ethernet Setup (SMT Menu 3.2) FIN FN PVA INPUT 30200001 = DHCP <0(None) | 1(Server) | 2(Relay)> = 0 30200002 = Client IP Pool Starting Address = 192.168.1.33 30200003 = Size of Client IP Pool = 32 30200004 = Primary DNS Server = 0.0.0.0 30200005 = Sec[...]

P-662H/HW-D Series User’s Guide 442 Appendix M Internal SPTGEN 30201008 = IP Alias #1 Incoming protocol filters Set 3 = 256 30201009 = IP Alias #1 Incoming protocol filters Set 4 = 256 30201010 = IP Alias #1 Outgoing protocol filters Set 1 = 256 30201011 = IP Alias #1 Outgoing protocol filters Set 2 = 256 30201012 = IP Alias #1 Outgoing protocol [...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 443 30500004 = RTS Threshold <0 ~ 2432> = 2432 30500005 = FRAG. Threshold <256 ~ 2432> = 2432 30500006 = WEP <0(DISABLE) | 1(64-bit WEP) | 2(128-bit WEP)> = 0 30500007 = Default Key <1|2|3|4> = 0 30500008 = WEP Key1 = 30500009 = WEP Key2 = 30500010 = WEP Key3 = 30[...]

P-662H/HW-D Series User’s Guide 444 Appendix M Internal SPTGEN 40000002 = Active <0(No) | 1(Yes)> = 1 40000003 = ISP's Name = ChangeMe 40000004 = Encapsulation <2(PPPOE) | 3(RFC 1483)| 4(PPPoA )| 5(ENET ENCAP)> = 2 40000005 = Multiplexing <1(LLC-based) | 2(VC-based) = 1 40000006 = VPI # = 0 40000007 = VCI # = 35 40000008 = Ser[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 445 40000032= RIP Version <0(Rip-1) | 1(Rip-2B) |2(Rip-2M)> = 0 40000033= Nailed-up Connection <0(No) |1(Yes)> = 0 Table 172 Menu 4 Internet Access Setup ( SMT Menu 4) (continued) Table 173 Menu 12 (SMT Menu 1 2) / Menu 12.1.1 IP Static Route Setup (SMT Menu 12.1.1) FIN FN P [...]

P-662H/HW-D Series User’s Guide 446 Appendix M Internal SPTGEN / Menu 12.1.4 IP Static Route Setup (SMT Menu 12.1.4) FIN FN PVA INPUT 120104001 = IP Static Route set #4, Name <Str> = 120104002 = IP Static Route set #4, Active <0(No) |1(Yes)> = 0 120104003 = IP Static Route set #4, Destination IP address = 0.0.0.0 120104004 = IP Static[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 447 120107006 = IP Static Route set #7, Metric = 0 120107007 = IP Static Route set #7, Private <0(No) |1(Yes)> = 0 / Menu 12.1.8 IP Static Route Setup (SMT Menu 12.1.8) FIN FN PVA INPUT 120108001 = IP Static Route set #8, Name <Str> = 120108002 = IP Static Route set #8, Activ[...]

P-662H/HW-D Series User’s Guide 448 Appendix M Internal SPTGEN 120111004 = IP Static Route set #11, Destination IP subnetmask = 0 120111005 = IP Static Route set #11, Gateway = 0.0.0.0 120111006 = IP Static Route set #11, Metric = 0 120111007 = IP Static Route set #11, Private <0(No) |1(Yes)> = 0 */ Menu 12.1.12 IP Static Route Set up (SMT [...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 449 120115002 = IP Static Route set #15, Active <0(No) |1(Yes)> = 0 120115003 = IP Static Route set # 15, Destination IP address = 0.0.0.0 120115004 = IP Static Route set # 15, Destination IP subnetmask = 0 120115005 = IP Static Route set #15, Gateway = 0.0.0.0 120115006 = IP Stati[...]

P-662H/HW-D Series User’s Guide 450 Appendix M Internal SPTGEN 150000014 = SUA Server #4 Port Start = 0 150000015 = SUA Server #4 Port End = 0 150000016 = SUA Server #4 Local IP address = 0.0.0.0 150000017 = SUA Server #5 Active <0(No) | 1(Yes)> = 0 150000018 = SUA Server #5 Protocol <0(All)|6(TCP)|17(U DP)> = 0 150000019 = SUA Server[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 451 150000048 = SUA Server #11 Protocol <0(All)|6(TCP)|17(U DP)> = 0 150000049 = SUA Server #11 Port Start = 0 150000050 = SUA Server #11 Port End = 0 150000051 = SUA Server #11 Local IP addr ess = 0.0.0.0 150000052 = SUA Server #12 Active <0(No) | 1(Yes)> = 0 150000053 = SUA[...]

P-662H/HW-D Series User’s Guide 452 Appendix M Internal SPTGEN / Menu 21.1.1.2 set #1, rule #2 (SMT Menu 21.1.1.2) FIN FN PVA INPUT 210102001 = IP Filter Set 1,Rule 2 Type <2(TCP/IP)> = 2 210102002 = IP Filter Set 1,Rule 2 Active <0(No)|1(Yes)> = 1 210102003 = IP Filter Set 1,Rule 2 Protocol = 6 210102004 = IP Filter Set 1,Rule 2 Dest[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 453 210103013 = IP Filter Set 1,Rule 3 Act Match <1(check next)|2(forward)| 3(drop) = 3 210103014 = IP Filter Set 1,Rule 3 Act Not Match <1(check next)|2(forward)| 3(drop) = 1 / Menu 21.1.1.4 set #1, rule #4 (SMT Menu 21.1.1.4) FIN FN PVA INPUT 210104001 = IP Filter Set 1,Rule 4 Ty[...]

P-662H/HW-D Series User’s Guide 454 Appendix M Internal SPTGEN 210105009 = IP Filter Set 1,Rule 5 Src Subnet Mask = 0 210105010 = IP Filter Set 1,Rule 5 Src Port = 0 210105011 = IP Filter Set 1,Rule 5 Src Port Comp <0(none)|1(equal) |2(not equal)|3(less)|4( greater)> = 0 210105013 = IP Filter Set 1,Rule 5 Act Match <1(check next)|2(forwa[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 455 / Menu 21.1.2.1 Filter set #2, rule #1 (SMT Menu 21.1.2.1) FIN FN PVA INPUT 210201001 = IP Filter Set 2, Rule 1 Type <0(none)|2(T CP/IP)> = 2 210201002 = IP Filter Set 2, Rule 1 Active <0(No)|1(Yes)> = 1 210201003 = IP Filter Set 2, Rule 1 Protocol = 6 210201004 = IP Filt[...]

P-662H/HW-D Series User’s Guide 456 Appendix M Internal SPTGEN 210202009 = IP Filter Se t 2, Rule 2 Src Subne t Mask = 0 210202010 = IP Filter Set 2,Rule 2 Src Port = 0 210202011 = IP Filter Set 2, Rule 2 Src Port Comp <0(none)|1(equal)|2 (not equal)|3(less)|4(gr eater)> = 0 210202013 = IP Filter Set 2, Rule 2 Act Match <1(check next)|2([...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 457 210204002 = IP Filter Set 2, Rule 4 Active <0(No)|1(Yes )> = 1 210204003 = IP Filter Set 2, Rule 4 Protocol = 17 210204004 = IP Filter Set 2, Rule 4 Dest IP address = 0.0.0.0 210204005 = IP Filter Set 2, Rule 4 Dest Subnet Mask = 0 210204006 = IP Filter Set 2, Rule 4 Dest Port [...]

P-662H/HW-D Series User’s Guide 458 Appendix M Internal SPTGEN 210205011 = IP Filter Set 2, Rule 5 Src Port Comp <0(none)|1(equal)|2 (not equal)|3(less)|4(gr eater)> = 0 210205013 = IP Filter Set 2, Rule 5 Act Match <1(check next)|2(forward)|3( drop)> = 3 210205014 = IP Filter Set 2, Rule 5 Act Not Match <1(check next)|2(forward)|3[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 459 Table 177 Menu 23 System Menus (SMT Me nu 23) */ Menu 23.1 System Password Setup ( SMT Menu 23.1) FIN FN PVA INPUT 230000000 = System Password = 1234 */ Menu 23.2 System security: radius server (SMT Menu 23.2) FIN FN PVA INPUT 230200001 = Authentication Server Configured <0(No) | [...]

P-662H/HW-D Series User’s Guide 460 Appendix M Internal SPTGEN Command Examples The following are example Internal SP TGEN screens associated with the ZyXEL Device’ s command interpreter commands. 230400008 = WPA Mixed Mode <0(Disable) |1(Enable)> = 0 230400009 = Data Privacy for Broadcast/ Multicast packets <0(TKIP) |1(WEP)> = 0 23[...]

P-662H/HW-D Series User ’s Guide Appendix M Internal SPTGEN 461 FIN FN PVA INPUT 990000001 = ADSL OPMD <0(etsi)|1(normal) |2(gdmt)|3(multimo de)> = 3 Table 179 Command Examples (continued) FIN FN PV A INPUT[...]

P-662H/HW-D Series User’s Guide 462 Appendix M Internal SPTGEN[...]

P-662H/HW-D Series User ’s Guide Appendix N Sp litters and Microf ilters 463 A PPENDIX N S plitters and Microfilters This appendix tells you how to install a POTS splitter or a telephone microfilter . Connecting a POTS S plitter When you use the Full Rate (G .dmt) ADSL standard, you can use a POTS (Plain Old T elephone Service) splitter to separa[...]

P-662H/HW-D Series User’s Guide 464 App endix N Splitters and Microfilters 1 Connect a phone cable from the wall jack to the single jack end of the Y - Connector . 2 Connect a cable from the double jack end of the Y -Connector to th e “wall side” of the microfilter . 3 Connect another cable from the double jack end of the Y -Conn ector to the[...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 465 A PPENDIX O Log Descriptions This appendix provides descrip tions of example log messages. Table 180 System Maintenance Logs LOG MESSAGE DESCRIPTION Time calibration is successful The router has adjusted its time based on information from the time server . Time calibration failed Th[...]

P-662H/HW-D Series User’s Guide 466 Appendix O Log Descriptions Successful HTTPS login Someone has logged on to the router's web configu rator interface using HTTPS protocol. HTTPS login failed Someo ne has failed to log on to the router's web configurator interface using HTTPS protocol. Table 181 System Error Logs LOG MESSAGE DESCRIPTI[...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 467 Table 183 TCP Reset Lo gs LOG MESSAGE DESCRIPTION Under SYN flood attack, sent TCP RST The router sent a TCP reset packet when a host was u nder a SYN flood attack (the TCP incomplete count is per destination h ost.) Exceed TCP MAX incomplete, sent TCP RST The router sent a TCP rese[...]

P-662H/HW-D Series User’s Guide 468 Appendix O Log Descriptions Table 185 ICMP Logs LOG MESSAGE DESCRIPTION Firewall default policy: ICMP <Packet Direction>, <type:%d>, <code:%d> ICMP access matched the default policy and was blocked or forwarded according to the user's setting. For type an d code details, see T able 197 on[...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 469 ppp:LCP Closing Th e PPP connection’s Link Control Protocol stage is closing. ppp:IPCP Closing The PPP connection’s Internet Protocol Control Protocol stage is closing. Table 188 UPnP Logs LOG MESSAGE DESCRIPTION UPnP pass through Firewall UPnP packets can pass through the firew[...]

P-662H/HW-D Series User’s Guide 470 Appendix O Log Descriptions Connecting to content filter server fail The connection to the external content fi ltering server failed. License key is invalid The external content filter in g license key is invalid. Table 190 Attack Logs LOG MESSAGE DESCRIPTION attack [TCP | UDP | IGMP | ESP | GRE | OSPF] The fir[...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 471 Table 191 IPSec Logs LOG MESSAGE DESCRIPTION Discard REPLAY packet The router re ceived and discarded a packet with an incorrect sequence number . Inbound packet authentication failed The router received a packet that has been altered. A third party may have altered or tampered with[...]

P-662H/HW-D Series User’s Guide 472 Appendix O Log Descriptions Cannot resolve Secure Gateway Addr for rule <%d> The router couldn’t resolve t he IP address from the domain name that was used for the secure gateway address. Peer ID: <peer id> <My remote type> -<My local type> The displayed ID information did not match be[...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 473 XAUTH fail! Username: <Username> The router was not able to use extended authentication to authenticate the listed username. Rule[%d] Phase 1 negotiation mode mismatch The listed rule’s IKE phase 1 negotiation mode did not ma tch between the router and the peer . Rule [%d] P[...]

P-662H/HW-D Series User’s Guide 474 Appendix O Log Descriptions Rule [%d] phase 2 mismatch The l isted rule’s IKE phase 2 di d not match betwe e n the router and the peer . Rule [%d] Phase 2 key length mismatch The listed rule’s IKE phase 2 key lengths (with the AES encryption algorithm) di d not match between the router and the peer . Table [...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 475 Rcvd data <size> too large! Max size allowed: <max size> The router received dire ctory data that was too large (the size is listed) from the LDAP server whose address and port are recorded in the Source field. The maximu m size of di recto ry data that the router allows[...]

P-662H/HW-D Series User’s Guide 476 Appendix O Log Descriptions 26 Database method failed. 27 Path was not verified. 28 Maximum path length reached. Table 195 802.1X Logs LOG MESSAGE DESCRIPTION Local User Database accepts user. A user was authenticated by the local user database. Local User Database reports us er credential error. A user was not[...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 477 Table 196 ACL Setting Notes P ACKET DIRECTION DIRECTION DESCRIPTION (L to W) LAN to W AN ACL set for packets traveling from the LAN to the W AN. (W to L) W AN to LAN ACL set for packets traveling from the W AN to the LAN. (D to L) DMZ to LAN ACL set for packets traveling from the DM[...]

P-662H/HW-D Series User’s Guide 478 Appendix O Log Descriptions The following table shows RFC-2408 ISAKMP payload types that the log displays. Please refer to the RFC for detailed information on each type. 11 T ime Exceeded 0 T ime to live exceeded in transit 1 Fragment reassembly time exceeded 12 Parameter Problem 0 Pointer indicates the error 1[...]

P-662H/HW-D Series User ’s Guide Appendix O Log Descriptions 479 Log Commands Go to the command in terpreter interface. Configuring What Y ou W ant the ZyXEL Device to Log 1 Use the sys logs load command to load the log setting buffer that allows you to configure which logs the ZyXEL Device is to record. 2 Use sys logs category to view a list of [...]

P-662H/HW-D Series User’s Guide 480 Appendix O Log Descriptions Use 0 to not record logs for that category , 1 to record only logs fo r that category , 2 to record only alerts for that category , and 3 to record both logs and alerts for that category . Not every parameter is ava ilable with every category . 5 Use the sys logs save command to stor[...]

P-662H/HW-D Series User ’s Guide Appendix P Triangle Route 481 A PPENDIX P T riangle Route The Ideal Setup When the firewall is on, your ZyXEL Device acts as a secure gateway between your LAN and the Internet. In an ideal network topology , a ll incoming and outgoing network traf fic passes through the ZyXEL Device to pr otect your LAN against at[...]

P-662H/HW-D Series User’s Guide 482 Appendix P Triangle Route Figure 274 “T riangle Route” Problem The “T riangle Route” Solutions This section presents you two solutions to the “triangle route” problem. IP Aliasing IP alias allows you to partition your network into logical sections over the same Ethernet interface. Y our ZyXEL Device[...]

P-662H/HW-D Series User ’s Guide Appendix P Triangle Route 483 Figure 275 IP Alias Gateways on the W AN Side A second solution to the “triangle route” problem is to put all of your network gateways on the W AN side as the following figure shows. This en sures that all incoming network traffic passes through your ZyXEL Device to your LAN. Ther[...]

P-662H/HW-D Series User’s Guide 484 Appendix P Triangle Route[...]

P-662H/HW-D Series User ’s Guide Index 485 Index A Address Assignment 111 Address Resolution Protocol (ARP) 11 4 ADSL standards 42 Advanced Encryption S tandard 405 AH 235 AH Protoc ol 239 alternative subnet mask notation 391 antenna gain 134 Anti-virus Online upda te 207 Registrat ion 207 Anti-virus packet scan Configuration 205 Anti-virus scan [...]

P-662H/HW-D Series User’s Guide 486 Index BSS 397 BW Budget 299 C CA 404 CAC 215 CBR (Continuous Bit Rate) 93 , 98 certificate 251 Certificate Authority 404 change p asswor d at login 50 Channel 399 Interference 399 Channel ID 128 compact 44 compact guide 49 Computer vi rus 203 Computer virus infection and prevention 204 Computer vi rus types 203[...]

P-662H/HW-D Series User ’s Guide Index 487 Content filtering 21 1 content filtering 42 , 222 CTS (Clear to Send) 400 Custom Ports Creating/Editing 191 Customized Services 190 Customized services 190 D Data Confidentiality 234 Data Integrity 234 Data Origin Authentication 234 Default 349 default LAN IP address 49 Denial of Service 170 , 171 , 199 [...]

P-662H/HW-D Series User’s Guide 488 Index E EAP Authentication 403 ECHO 162 E-mail virus 203 embedded help 53 Encapsulated Routing Link Protocol (ENET ENCAP) 85 Encapsulation 85 , 235 ENET ENCAP 85 PPP over Ethernet 85 PPPoA 86 RFC 1483 86 Encapsulation Security Payload 239 Encryption 233 , 405 ESP 235 ESP Protocol 239 ESS 398 Ethernet 366 Extend[...]

P-662H/HW-D Series User ’s Guide Index 489 upload 345 upload error 346 Fragmentation Threshold 400 Fragmentation threshold 400 Frame Rel ay 46 FTP 162 , 309 , 312 FTP Restrictio ns 309 Full Rate 463 G General Setup 333 General wireless LAN screen 127 H Half-Open Sessions 199 Hidden node 399 Host 63 , 334 , 335 How ZyXEL Device virus scan works 20[...]

P-662H/HW-D Series User’s Guide 490 Index Internet Access 42 , 46 Internet access 65 Internet Access Setup 354 Internet access wizard setup 65 Internet Assigned Nu mb ers AuthoritySee IANA 11 2 Internet Control Mess age Protocol (ICMP) 173 , 197 Internet Key Exchange 252 Internet Protoco l Security 233 IP Address 111 , 162 , 163 , 164 IP Address [...]

P-662H/HW-D Series User ’s Guide Index 491 MAC Address Filtering 139 MAC Filter 139 Macro virus 203 Management Information Base (MIB) 314 Manually Update Virus Information 208 Maximize Bandwidth Usage 295 Maximum Burst Size (MBS) 89 , 94 , 98 Max-incomplete High 199 Max-incomplete Low 199 Media Bandwidth Manageme nt 43 Message Integrity Check (MI[...]

P-662H/HW-D Series User’s Guide 492 Index P Packet Filtering 180 Packet filtering When to use 180 Packet Filtering Firewall s 169 Pairwise Master Key (PMK) 406 Parental Control 215 Pattern file 203 Peak Cell Rate (PCR) 88 , 94 , 98 Perfect Forward Secrecy 254 PFS 254 Ping of Death 172 Point to Point Protocol over A TM Adaptation La yer 5 (AAL5) 8[...]

P-662H/HW-D Series User ’s Guide Index 493 RF (Radio Freque ncy) 45 RFC 1483 86 RFC 1631 157 RFC2516 43 RIPSee Rou ting Informa tion Proto col 11 2 Routing Informatio n Protocol 11 2 Direction 11 2 Ve r s i o n 11 2 RTS (Request T o Send) 400 RTS Threshold 399 , 400 Rules 184 Checklist 182 Key Fields 183 LAN to W AN 184 Logic 182 Predefined Servi[...]

P-662H/HW-D Series User’s Guide 494 Index S tatic Route 289 SUA 160 SUA (Single User Account) 160 SUA vs NA T 160 subnet 389 Subnet Mask 111 , 189 subnet mask 391 subnetting 391 Supporting Disk 39 Sustain Cell Rate (SCR) 94 , 98 Sustained Cell Rate (SCR) 88 SYN Flood 172 , 173 SYN-ACK 173 Syntax Conventions 39 Syslog 194 System Name 334 System Pa[...]

P-662H/HW-D Series User ’s Guide Index 495 Universal Plug and Pl ay (UPnP) 43 Update Schedule 208 Update the virus scan 209 UPnP 321 Forum 322 security issues 322 Upper Layer Prot ocols 177 , 178 URL keywor d blocking 222 User Authentication 406 User Name 306 V VBR (V ariable Bit Rate) 93 , 98 Viewing Certifications 5 Virtual Channel Identifier ([...]

P-662H/HW-D Series User’s Guide 496 Index WP A2-PSK 405 WP A-PSK 405 Z Zero Configuration Internet Access 42 Zero configuration Internet access 90 ZyXEL Device anti-virus packet s can 204 ZyXEL_s Firewall Introduction 170[...]